w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

PowerConnect 3448

The PowerConnect 3448 provides 48 10/100Mbps ports plus two SFP ports, and two Copper ports which can be used to forward traffic in a stand-alone device, or as stacking ports when the device is stacked. The device also provides one RS-232 console port. The PowerConnect 3448 is a stackable device, but also functions as a stand-alone device.

PowerConnect 3448P

The PowerConnect 3448P provides 48 10/100Mbps ports, two SFP ports, and two copper ports that can be used to forward traffic when the device is in stand-alone mode, or as stacking ports when the device is part of a stack. The device also provides one RS-232 console port. In addition, PowerConnect 3448P provides PoE.

Figure 1-2. PowerConnect 3448 and PowerConnect 3448P

Stacking Overview

PowerConnect 3424/P and PowerConnect 3448/P stacking provides multiple switch management through a single point as if all stack members are a single unit. All stack members are accessed through a single IP address through which the stack is managed. The stack is managed from a:

???Web-based interface

???SNMP Management Station

???Command Line Interface (CLI)

PowerConnect 3424/P and PowerConnect 3448/P devices support stacking up to six units per stack, or can operate as stand-alone units.

During the Stacking setup, one switch is selected as the Stack Master and another stacking member can be selected as the Backup Master. All other devices are selected as stack members, and assigned a unique Unit ID.

Switch software is downloaded separately for each stack members. However, all units in the stack must be running the same software version.

Switch stacking and configuration is maintained by the Stack Master. The Stack Master detects and reconfigures the ports with minimal operational impact in the event of:

???Unit Failure

???Inter-unit Stacking Link Failure

???Unit Insertion

???Removal of a Stacking Unit

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Once the user selects a different Unit ID, it is not erased, and remains valid, even if the unit is reset.

Unit ID 1 and Unit ID 2 are reserved for Master enabled units. Unit IDs 3 to 6 can be defined for stack members.

When the Master unit boots or when inserting or removing a stack member, the Master unit initiates a stacking discovering process.

NOTE: If two members are discovered with the same Unit ID the stack continues to function, however only the unit with the older join time joins the stack. A message is sent to the user, notifying that a unit failed to join the stack.

Removing and Replacing Stacking Members

Unit 1 and Unit 2 are Master enabled units. Unit 1 and Unit 2 are either designated as Master Unit or Backup Master Unit. The stack Master assignment is performed during the configuration process. One Master enabled stack member is elected as Master, and the other Master enabled stack member is elected as Backup Master, according to the following decision process:

???If only one Stack Master enabled unit is present, it is elected as the Master.

???If two Master enabled stacking members are present, and one has been manually configured as the Stack Master, the manually configured member is elected as Stack Master.

???If two Master enabled units are present and neither has been manually configured as the Master, the one with the longer up-time is elected as the Stack Master.

???If two Master enabled units are present and both have been manually configured as the Master, the one with the longer up-time is elected as the Stack Master.

???If the two Master enabled stacking members are the same age, Unit 1 is elected as the Stack Master.

NOTE: Two stacking member are considered the same age if they were inserted within a ten minute interval.

For example, Unit 2 is inserted in the first minute of a ten-minute cycle, and Unit 1 is inserted in fifth minute of the same cycle, the units are considered to be the same age. If there are two Master enabled stack members that are the same age, then Unit 1 is elected master.

The Stack Master and the Backup Master maintain a Warm Standby. The Warm Standby ensures that the Backup Master takes over for the Stack Master if a failover occurs. This guarantees that the stack continues to operate normally.

During the Warm Standby, the Master and the Backup Master are synchronized with the static configuration only. When the Stacking Master is configured, the Stack Master must synchronize the Stacking Backup Master. The Dynamic configuration is not saved, for example, dynamically learned MAC addresses are not saved.

Each port in the stack has a specific Unit ID, port type, and port number, which are part of both the configuration commands and the configuration files. Configuration files are managed only from the device Stack Master, including:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 1-4. PowerConnect 3448/P replaces PowerConnect 3448/P

???If a PowerConnect 3448/P replaces PowerConnect 3424/P, the first 3448/P 24 FE ports receive the 3424/P 24 FE port configuration. The GE port configurations remain the same. The remaining ports receive the default port configuration.

Figure 1-5. PowerConect 3424/P port replaces PowerConnect 3448/P port

Default

Configuration

???If a PowerConnect 3424/P replaces PowerConnect 3448/P, the PowerConnect 3424/P 24 FE ports receives the first 24 FE PowerConnect 3448/P port configuration. The GE port configurations remain the same.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Features Overview

This section describes the device features. For a complete list of all updated device features, see the latest software version Release Notes.

Power over Ethernet

Power over Ethernet (PoE) provides power to devices over existing LAN cabling, without updating or modifying the network infrastructure. PoE removes the need for placing network devices next to power sources. PoE can be used in the following applications:

???IP Phones

???Wireless Access Points

???IP Gateways

???PDAs

???Audio and video remote monitoring

For more information about Power over Ethernet, see "Managing Power over Ethernet".

Head of Line Blocking

Head of Line (HOL) blocking results in traffic delays and frame loss caused by traffic competing for the same egress port resources. HOL blocking queues packets, and the packets at the head of the queue are forwarded before packets at the end of the queue.

Flow Control Support (IEEE 802.3X)

Flow control enables lower speed devices to communicate with higher speed devices, by requesting that the higher speed device refrains from sending packets. Transmissions are temporarily halted to prevent buffer overflows.

For information on configuring Flow Control for ports or LAGs, see "Defining Port Configuration" or "Defining LAG Parameters."

Back Pressure Support

On half-duplex links, the receiving port prevents buffer overflows by occupying the link so that it is unavailable for additional traffic.

For information on configuring Flow Control for ports or LAGs, see "Defining Port Configuration" or "Defining LAG Parameters."

Virtual Cable Testing (VCT)

VCT detects and reports copper link cabling occurrences such as open cables and cable shorts. For more information on testing cables, see "Running Cable Diagnostics".

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

VLAN-aware MAC-based Switching

The device always performs VLAN-aware bridging. Classic bridging(IEEE802.1D) is not performed, where frames are forwarded based only on their destination MAC address. However, a similar functionality can be configured for untagged frames. Frames addressed to a destination MAC address that is not associated with any port are flooded to all ports of the relevant VLAN.

MAC Multicast Support

Multicast service is a limited broadcast service, which allows one-to-many and many-to-many connections for information distribution. Layer 2 Multicast service is where a single frame is addressed to a specific Multicast address, from where copies of the frame are transmitted to the relevant ports.

For more information, see "Assigning Multicast Forward All Parameters."

Layer 2 Features

IGMP Snooping

IGMP Snooping examines IGMP frame contents, when they are forwarded by the device from work stations to an upstream Multicast router. From the frame, the device identifies work stations configured for Multicast sessions, and which Multicast routers are sending Multicast frames.

For more information, see "IGMP Snooping."

Port Mirroring

Port mirroring monitors and mirrors network traffic by forwarding copies of incoming and outgoing packets from a monitored port to a monitoring port. Users specify which target port receives copies of all traffic passing through a specified source port.

For more information, see "Defining Port Mirroring Sessions."

Broadcast Storm Control

Storm Control enables limiting the amount of Multicast and Broadcast frames accepted and forwarded by the device.

When Layer 2 frames are forwarded, Broadcast and Multicast frames are flooded to all ports on the relevant VLAN. This occupies bandwidth, and loads all nodes connected on all ports.

For more information, see "Enabling Storm Control."

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Fast Link

STP can take up to 30-60 seconds to converge. During this time, STP detects possible loops, allowing time for status changes to propagate and for relevant devices to respond. 30-60 seconds is considered too long of a response time for many applications. The Fast Link option bypasses this delay, and can be used in network topologies where forwarding loops do not occur.

For more information enabling Fast Link for ports and LAGs, see "Defining STP Port Settings" or "Defining Static Addresses."

IEEE 802.1w Rapid Spanning Tree

Spanning Tree can take 30-60 seconds for each host to decide whether its ports are actively forwarding traffic. Rapid Spanning Tree (RSTP) detects uses of network topologies to enable faster convergence, without creating forwarding loops.

For more information, see "Defining Rapid Spanning Tree."

IEEE 802.1s Multiple Spanning Tree

Multiple Spanning Tree (MSTP) operation maps VLANs into STP instances. MSTP provides differing load balancing scenario. Packets assigned to various VLANs are transmitted along different paths within MSTP Regions (MST Regions). Regions are one or more MSTP bridges by which frames can be transmitted. The standard lets administrators assign VLAN traffic to unique paths.

For more information, see "Configuring the Spanning Tree Protocol".

Link Aggregation

Link Aggregation

Up to eight Aggregated Links may be defined, each with up to eight member ports, to form a single Link Aggregated Group (LAG). This enables:

???Fault tolerance protection from physical link disruption

???Higher bandwidth connections

???Improved bandwidth granularity

???High bandwidth server connectivity

LAG is composed of ports with the same speed, set to full-duplex operation.

For more information, see "Defining LAG Parameters."

Link Aggregation and LACP

LACP uses peer exchanges across links to determine, on an ongoing basis, the aggregation capability of various links, and continuously provides the maximum level of aggregation capability achievable between a given pair of devices. LACP automatically determines, configures, binds, and monitors the port binding within the system.

For more information, see "Aggregating Ports."

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

TFTP Trivial File Transfer Protocol

The device supports boot image, software, and configuration upload/download via TFTP.

Remote Monitoring

Remote Monitoring (RMON) is an extension to SNMP, which provides comprehensive network traffic monitoring capabilities (as opposed to SNMP which allows network device management and monitoring). RMON is a standard MIB that defines current and historical MAC-layer statistics and control objects, allowing real-time information to be captured across the entire network.

For more information, see "Viewing Statistics."

Command Line Interface

Command Line Interface (CLI) syntax and semantics conform as much as possible to common industry practice. CLI is composed of mandatory and optional elements. The CLI interpreter provides command and keyword completion to assist user and shorten typing.

Syslog

Syslog is a protocol that enables event notifications to be sent to a set of remote servers, where they can be stored, examined and acted upon. The system sends notifications of significant events in real time, and keeps a record of these events for after-the-fact usage.

For more information on Syslog, see "Managing Logs."

SNTP

The Simple Network Time Protocol (SNTP) assures accurate network Ethernet Switch clock time synchronization up to the millisecond. Time synchronization is performed by a network SNTP server. Time sources are established by Stratums. Stratums define the distance from the reference clock. The higher the stratum (where zero is the highest), the more accurate the clock.

For more information, see "Configuring SNTP Settings."

Domain Name System

Domain Name System (DNS) converts user-defined domain names into IP addresses. Each time a domain name is assigned the DNS service translates the name into a numeric IP address. For example, www.ipexample.com is translated to 192.87.56.2. DNS servers maintain domain name databases and their corresponding IP addresses.

For more information, see "Configuring Domain Name Systems".

Traceroute

Traceroute discovers IP routes that packets were forwarded along during the forwarding process. The CLI Traceroute utility can be executed from either the user-exec or privileged modes.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Password Management

Password management provides increased network security and improved password control. Passwords for SSH, Telnet, HTTP, HTTPS, and SNMP access are assigned security features. For more information on Password Management, see "Managing Passwords".

Additional CLI Documentation

The CLI Reference Guide, which is available on the Documentation CD, provides information about the CLI commands used to configure the device. The document provides information about the command description, syntax, default values, guidelines, and examples.

Figure 2-1. PowerConnect 3424 Front Panel

10/100 Base-T Ports 1, 3, 5, 7, ...23

10/100 Base-T Ports 2, 4, 6, 8, ...24

System LEDs

Reset Button

Stacking Button

Stacking LEDs

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

There are two buttons on the front panel. The Stack ID button is used to select the unit number. The second button is the Reset Button which is used to manually reset the device. The Reset button does not extend beyond the unit???s front panel surface, so reset by pressing it accidentally is prevented. On the front panel are all the device LEDs.

The following figure illustrates the PowerConnect 3424 back:

Figure 2-2. PowerConnect 3424 Back Panel

The back panel contains an RPS connector, console port, and power connector.

PowerConnect 3448 Port Description

The PowerConnect 3448 device is configured with the following ports:

???48 FE ports ??? RJ-45 ports designated as 10/100Base-T ports

???2 Fiber ports ??? Designated as 1000Base-X SFP ports

???2 Gigabit ports ??? Designated as 1000Base-T ports

???Console port ??? RS-232 Console based port

The following figure illustrates the PowerConnect 3448 front panel.

The front panel contains 48 RJ-45 ports number 1-48. The upper row of ports is marked by odd numbers 1-47, and the lower row of ports is marked with even numbers 2-48. In addition, the front panel also contains ports G1 - G2 which are fiber ports and ports G3- G4 which are copper ports. Ports G3- G4 can either be used as stacking ports, or used to forward network traffic in a stand- alone device.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Physical Dimensions

The PowerConnect 3424/P and PowerConnect 3448/P devices have the following physical dimensions:

PoE Model:

???Width ??? 440 mm (17.32 inch)

???Depth ??? 387 mm (15.236 inch)

???Height ??? 43.2 mm (1.7 inch) Non-PoE Device:

???Width ??? 440 mm (17.32 inch)

???Depth ??? 257 mm (10.118 inch)

???Height ??? 43.2 mm (1.7 inch)

LED Definitions

The front panel contains light emitting diodes (LED) that indicate the status of links, power supplies, fans, and system diagnostics.

Port LEDs

Each 10/100/1000 Base-T port and 10/100 Base-T port has two LEDs. The speed LED is located on the left side of the port, while the link/duplex/activity LED is located on the right side.

The following figure illustrates the 10/100 Base-T port LEDs on The PowerConnect 3424 /P and PowerConnect 3448/P switches:

Figure 2-6. RJ-45 Copper Based 10/100 BaseT LEDs

Speed/LNK/ACT

FDX

The RJ-45 100 Base-T port on the PowerConnect 3424 /P and PowerConnect 3448/P has two LEDs marked as LNK/ACT.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The RJ-45 LED indications for PowerConnect 3424P and PowerConnect 3448P are described in the following table:

Table 2-2. PowerConnect 3424P and PowerConnect 3448P RJ-45 Copper based 100BaseT LED Indications

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

System LEDs

The system LEDs of The PowerConnect 3424 /P and PowerConnect 3448/P devices provide information about the power supplies, fans, thermal conditions, and diagnostics. The following figure illustrates the system LEDS.

Figure 2-9. System LEDs

The following table describes the system LED indications.

Table 2-5. System LED Indicators

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

DC Power Supply Unit

The PowerConnect 3424 and PowerConnect 3448 switches connect to an external RPS-600 unit to provide a redundant power option. No configuration is required. The front panel "RPS" LED indicates whether the external RPS-600 is connected. See Table 2-5 for RPS LED definition.

The PowerConnect 3424/P and PowerConnect 3448/P switches connect to an external EPS-470 unit to provide a redundant power option. No configuration is required. The front panel "RPS" LED indicates whether the external EPS-470 is connected. See Table 2-5 for RPS LED definition.

Figure 2-11. Power Connection

When the device is connected to a different power source, the probability of failure in the event of a power outage decreases.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Unpacking the Device

NOTE: Before unpacking the device, inspect the package and immediately report any evidence of damage.

1Place the box on a clean flat surface.

2Open the box or remove the box top.

3Carefully remove the device from the box and place it on a secure and clean surface.

4Remove all packing material.

5Inspect the device and accessories for damage. Report any damage immediately.

Mounting the Device

The following mounting instructions apply to The PowerConnect 3424/P and PowerConnect 3448/P devices. The Console port is on the back panel. The power connectors are positioned on the back panel. Connecting a Redundant Power Supply (RPS) is optional, but is recommended.

The RPS connector is on the back panel of the devices.

Installing in a Rack

CAUTION: Read the Safety Information included in the Product Information Guide for safety information on devices connected to or that support the SWI.

CAUTION: Disconnect all cables from the unit before mounting the device in a rack or cabinet.

CAUTION: When mounting multiple devices into a rack, mount the devices from the bottom up.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Installing the Device on a Wall

1Place the supplied wall-mounting bracket on one side of the device, ensuring that the mounting holes on the device line up to the mounting holes on the rack-mounting bracket. The following figure illustrates where to mount the brackets.

Figure 3-2. Bracket Installation for Mounting on a Wall

2Insert the supplied screws into the rack-mounting holes and tighten with a screwdriver.

3Repeat the process for the wall-mounting bracket on the other side of the device.

4Place the device on the wall in the location where the device is being installed.

5On the wall mark the locations where the screws to hold the device must be prepared.

6Drill holes and place all plugs (not provided) in the holes, in the marked location.

7Secure the unit to the wall with screws (not provided). Ensure that the ventilation holes are not obstructed.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Connecting a Device to a Power Supply

Connect the supplied AC power cable to the AC power connector on the back panel.

NOTE: Do not connect the power cable to a grounded AC outlet at this time. Connect the device to a power source in the steps detailed in "Starting and Configuring the Device".

Figure 3-4. Back-Panel Power Connector

PowerConnect 3424P/3448P Rear View

After connecting the device to a power source, confirm that the device is connected and operating correctly by examining the LEDs on the front panel.

Installing a Stack

Overview

Each device can operate as a stand-alone device or can be a member in a stack. Up to six devices or up to 192 ports are supported per stack.

All stacks must have a Master unit, and may have a Master Backup unit, with any other devices connected to the stack as Members.

Stacking PowerConnect 3400 Series Switches

Each PowerConnect 3400 series stack contains a single Master unit, and may have a Master Backup unit, while the remaining units are considered stacking Members.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 3-6. Stacking Configuration and Identification Panel

Each stack device has a unique identifying unit ID that defines the unit???s position and function in the stack. If the device is a stand-alone unit, the Stack LED is not illuminated. The default setting is stand-alone.

The unit ID is manually configured by using the Stack ID button. The unit ID is indicated by the Stack ID LEDs. Unit ID 1 and 2 are reserved for the Master and Backup Master unit, and

unit ID 3 to 6 are for Member units.

Unit ID Selection Process

The unit ID selection process is as follows:

1Ensure that the stand-alone/Master device Console port is connected to a VT100 terminal device or VT100 terminal emulator via the RS-232 crossover cable.

2Locate an AC power receptacle.

3Deactivate the AC power receptacle.

4Connect the device to the AC receptacle.

5Activate the AC power receptacle.

When powering up, the configured LED number (corresponding to the previously saved unit ID) begins to flash. The LED flashes for 15 seconds. During this period, select a specific Stack ID by pressing the Stack ID button until the appropriate Stack ID LED is illuminated.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

3Set the data rate to 9600 baud.

4Set the data format to 8 data bits, 1 stop bit, and no parity.

5Set flow control to none.

6Under Properties, select VT100 for Emulation mode.

7Select Terminal keys for Function, Arrow, and Ctrl keys. Ensure that the setting is for Terminal keys (not Windows keys).

NOTICE: When using HyperTerminal with Microsoft?? Windows?? 2000,ensure that you have Windows 2000 Service Pack 2 or later installed. With Windows 2000 Service Pack 2, the arrow keys function properly in HyperTerminal???s VT100 emulation. Go to www.microsoft.com for information on Windows 2000 service packs.

8Connect the female connector of the RS-232 crossover cable directly to the device Console port on the Master unit/stand-alone device, and tighten the captive retaining screws.

The PowerConnect 3400 Series Console port is on the rear panel.

Figure 3-7. Connecting to PowerConnect 3400 Series Console Port

Back Panel

To VT100

Terminal

NOTE: A console can be connected to the Console port on any unit in the stack, but stack management is performed only from the stack master (unit ID 1 or 2).

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 4-1. Installation and Configuration Flow

Connect Device and

Console

Hardware

Setup

Standard

Device

Installation

Advanced

Device

Installation

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The system will prompt you with a default answer; by pressing enter, you accept the default.

You must respond to the next question to run the setup wizard within 60 seconds, otherwise the system will continue with normal operation using the default system configuration.

Would you like to enter the Setup Wizard (you must answer this question within 60 seconds? (Y/N)[Y]Y

You can exit the Setup Wizard at any time by entering [ctrl+Z].

If you enter [N], the Setup Wizard exits. If there is no response within 60 seconds, the Setup Wizard automatically exits and the CLI console prompt appears.

If you enter [Y], the Setup Wizard provides interactive guidance through the initial device configuration.

NOTE: If there is no response within 60 seconds, and there is a BootP server on the network, an address is retrieved from the BootP server.

NOTE: You can exit the Setup Wizard at any time by entering [ctrl+z].

Wizard Step 1

The following is displayed:

The system is not setup for SNMP management by default.

To manage the switch using SNMP (required for Dell Network Manager) you can

???Setup the initial SNMP version 2 account now.

???Return later and setup additional SNMP v1/v3 accounts.

For more information on setting up SNMP accounts, please see the user documentation.

Would you like to setup the SNMP management interface now? (Y/N)[Y]Y

Enter [N] to skip to Step 2.

Enter [Y] to continue the Setup Wizard. The following is displayed:

To setup the SNMP management account you must specify the management system IP address and the "community string" or password that the particular management system uses to access the switch. The wizard automatically assigns the highest access level [Privilege Level 15] to this account.

You can use Dell Network Manager or CLI to change this setting, and to add additional management systems. For more information on adding management systems, see the user documentation.

To add a management station:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Please enter the IP address of the device (A.B.C.D):[1.1.1.1] Please enter the IP subnet mask (A.B.C.D or nn): [255.255.255.0]

Enter the IP address and IP subnet mask, for example 1.1.1.1 as the IP address and 255.255.255.0 as the IP subnet mask.

Press Enter.

Wizard Step 4

The following is displayed:

Finally, setup the default gateway.

Please enter the IP address of the gateway from which this network is reachable (e.g. 192.168.1.1).Default gateway (A.B.C.D):[0.0.0.0]

Enter the default gateway.

Press Enter. The following is displayed (as per the example parameters described):

This is the configuration information that has been collected:

==============================================================

SNMP Interface = Dell_Network_Manager@0.0.0.0

User Account setup = admin

Password = *

Management IP address = 1.1.1.1 255.255.255.0

Default Gateway = 1.1.1.2

==============================================================

Wizard Step 5

The following is displayed:

If the information is correct, please select (Y) to save the configuration, and copy to the start-up configuration file. If the information is incorrect, select (N) to discard configuration and restart the wizard: (Y/N)[Y]Y

Enter [N] to skip to restart the Setup Wizard.

Enter [Y] to complete the Setup Wizard. The following is displayed:

Configuring SNMP management interface

Configuring user account......

Configuring IP and subnet......

Thank you for using Dell Easy Setup Wizard. You will now enter CLI mode.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The interface receives the IP address automatically.

3To verify the IP address, enter the show ip interface command at the system prompt as shown in the following example.

console# show ip interface

NOTE: It is not necessary to delete the device configuration to retrieve an IP address for the DHCP server.

NOTE: When copying configuration files, avoid using a configuration file that contains an instruction to enable DHCP on an interface that connects to the same DHCP server, or to one with an identical configuration. In this instance, the device retrieves the new configuration file and boots from it. The device then enables DHCP as instructed in the new configuration file, and the DHCP instructs it to reload the same file again.

NOTE: If you configure a DHCP IP address, this address is dynamically retrieved, and the ip address dhcp command is saved in the configuration file. In the event of master failure, the backup will again attempt to retrieve a DHCP address. This could result in one of the following:

???The same IP address may be assigned.

???A different IP address may be assigned, which could result in loss of connectivity to the management station.

???The DHCP server may be down, which would result in IP address retrieval failure, and possible loss of connectivity to the management station.

Receiving an IP Address From a BOOTP Server

The standard BOOTP protocol is supported and enables the device to automatically download its IP host configuration from any standard BOOTP server in the network. In this case, the device acts as a BOOTP client.

To retrieve an IP address from a BOOTP server:

1Select and connect any port to a BOOTP server or subnet containing such a server, to retrieve the IP address.

2At the system prompt, enter the delete startup configuration command to delete the Startup Configuration from flash.

The device reboots with no configuration and in 60 seconds starts sending BOOTP requests. The device receives the IP address automatically.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

NOTE: When creating a user name, the default priority is 1, which allows access but not configuration rights. A priority of 15 must be set to enable access and configuration rights to the device. Although user names can be assigned privilege level 15 without a password, it is recommended to always assign a password. If there is no specified password, privileged users can access the Web interface with

any password.

NOTE: Passwords can be secured by using password management commands to force aging-out of passwords, or expiration of passwords. For more information, see "Security Management and Password Configuration".

Configuring an Initial Terminal Password

To configure an initial terminal password, enter the following commands:

console(config)# aaa authentication login default line console(config)# aaa authentication enable default line console(config)# line console

console(config-line)# login authentication default console(config-line)# enable authentication default console(config-line)# password george

???When initially logging on to a device through a terminal session, enter george at the password prompt.

???When changing a device???s mode to enable, enter george at the password prompt.

Configuring an Initial Telnet Password

To configure an initial Telnet password, enter the following commands:

console(config)# aaa authentication login default line console(config)# aaa authentication enable default line console(config)# line telnet

console(config-line)# login authentication default console(config-line)# enable authentication default console(config-line)# password bob

???When initially logging onto a device through a Telnet session, enter bob at the password prompt.

???When changing a device mode to enable, enter bob.

68 Configuring PowerConnect 3424/P and 3448/P

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Startup Procedures

Startup Menu Procedures

The procedures called from the Startup menu cover software download, flash handling and password recovery. The diagnostics procedures are for use by technical support personnel only and are not disclosed in the document.

You can enter the Startup menu when booting the device. The user input is to be entered immediately after the POST test.

128 MByte SDRAM. I-Cache 16 KB. D-Cache 16 KB. Cache Enabled. Autoboot in 2 seconds - press RETURN or Esc. to abort and enter prom.

2When the auto-boot message appears, press <Enter> to get the Startup menu. The Startup menu procedures can be done using the ASCII terminal or Windows HyperTerminal.

[1]Download Software

[2]Erase Flash File

[3]Password Recovery Procedure

[4]Enter Diagnostic Mode

[5]Set Terminal Baud-Rate

[6]Back

The following sections describe the available Startup menu options.

NOTE: When selecting an option from the Startup menu, take time-out into account: if no selection is made within 35 seconds (default), the device times out. This default value can be changed through CLI.

NOTE: Technical support personnel only can operate the Diagnostics Mode (option[4]). For this reason, Enter Diagnostics Mode is not described in this guide.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

01-Jan-2000 01:01:19 %Entity-I-SEND-ENT-CONF-CHANGE-TRAP: entity configuration change trap.

01-Jan-2000 01:01:19 %Box-I-FAN-STAT-CHNG: FAN# 2 status changed - operational.

01-Jan-2000 01:01:19 %Box-I-PS-STAT-CHNG: PS# 1 status changed - operational.

2When using the HyperTerminal, click Transfer on the HyperTerminal Menu Bar.

3In the Filename field, enter the file path for the file to be downloaded.

4Ensure that the Xmodem protocol is selected in the Protocol field.

5Press Send. The software is downloaded.

NOTE: After software download, the device reboots automatically.

Erase FLASH File - option[2]

In some cases, the device configuration must be erased. If the configuration is erased, all parameters configured via CLI, EWS or SNMP must be reconfigured.

To erase the device configuration:

1From the Startup menu, press [2] within two seconds to erase flash file. The following message is displayed:

Warning! About to erase a Flash file.

Are you sure (Y/N)? y

2 Press Y. The following message is displayed.

Write Flash file name (Up to 8 characters, Enter for none.):config

File config (if present) will be erased after system initialization

======== Press Enter To Continue ========

3Enter config as the name of the flash file. The configuration is erased and the device reboots.

4Repeat the device initial configuration.

Password Recovery - option[3]

If a password is lost, the Password Recovery procedure can be called from the Startup menu. The procedure enables entry to the device once without password.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

4Enter the show bootvar command to verify which system image is currently active. The following is an example of the information that appears:

console# show bootvar

Images currently available on the Flash

Image-1 active (selected for next boot)

Image-2 not active

console#

5 Enter the copy tftp://{tftp address}/{file name} image command to copy a new system image to the device. When the new image is downloaded, it is saved in the area allocated for the other copy of system image (image-2, as given in the example). The following is an example of the information that appears:

console# copy tftp://176.215.31.3/file1.ros image

Accessing file ???file1??? on 176.215.31.3??

Loading file1 from 176.215.31.3:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Copy took 00:01:11 [hh:mm:ss]

Exclamation symbols indicate that a copying process is in progress. Each symbol (!) corresponds to 512 bytes transferred successfully. A period indicates that the copying process is timed out. Many periods in a row indicate that the copying process failed.

6Select the image for the next boot by entering the boot system command. After this command, enter the show bootvar command to verify that the copy indicated as a parameter in the boot system command is selected for the next boot.

The following is an example of the information that appears:

console# boot system image-2

console# show bootvar

Images currently available on the Flash

Image-1 active

Image-2 not active (selected for next boot)

If the image for the next boot is not selected by entering the boot system command, the system boots from the currently active image.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Port Default Settings

The general information for configuring the device ports includes the short description of the auto-negotiation mechanism and the default settings for switching ports.

Auto-Negotiation

Auto-negotiation enables automatic detection of speed, duplex mode and flow control on all switching 10/100/1000BaseT ports. Auto-negotiation is enabled per port by default.

Auto-negotiation is a mechanism established between two link partners to enable a port to advertise its transmission rate, duplex mode and flow control (the flow control default is disabled) abilities to its partner. The ports then both operate at the highest common denominator between them.

If connecting a NIC that does not support auto-negotiation or is not set to auto-negotiation, both the device switching port and the NIC must be manually set to the same speed and duplex mode.

If the station on the other side of the link attempts to auto-negotiate with a device 100BaseT port that is configured to full duplex, the auto-negotiation results in the station attempting to operate in half duplex.

MDI/MDIX

The device supports auto-detection of straight through and crossed cables on all switching 10/100/1000BaseT ports. The feature is part of the Auto-negotiation and is enabled when Auto-negotiation is enabled.

When the MDI/MDIX (Media Dependent Interface with Crossover) is enabled, the automatic correction of errors in cable selection is possible, thus making the distinction between a straight through cable and a crossover cable irrelevant. (The standard wiring for end stations is known as MDI (Media Dependent Interface), and the standard wiring for hubs and switches is known as MDIX.

Flow Control

The device supports 802.3x Flow Control for ports configured with the Full Duplex mode. By default, this feature is disabled. It can be enabled per port. The flow control mechanism allows the receiving side to signal to the transmitting side that transmission must temporarily be halted to prevent buffer overflow.

Back Pressure

The device supports back pressure for ports configured with the half duplex mode. By default, this feature is disabled. It can be enabled per port. The back-pressure mechanism prevents the sender from transmitting additional traffic temporarily. The receiver may occupy a link so it becomes unavailable for additional traffic.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 5-1. Switch Administrator Components

4

1

2

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Using the Switch Administrator Buttons

This section describes the buttons found on the OpenManage Switch Administrator interface. Interface buttons are divided into the following categories:

Information Buttons

Information buttons provide access to online support and online help, as well as information about the OpenManage Switch Administrator interfaces.

Table 5-10. Information Buttons

Device Management Buttons

Device Management buttons provide an easy method of configuring device information, and include the following:

Table 5-11. Device Management Buttons

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Telnet Connection

Telnet is a terminal emulation TCP/IP protocol. RS-232 terminals can be virtually connected to the local device through a TCP/IP protocol network. Telnet is an alternative to a local login terminal where a remote login is required.

The device supports up to four simultaneous Telnet sessions to manage the device. All CLI commands can be used over a telnet session.

To start a Telnet session:

1Select Start > Run. The Run window opens.

2 In the Run window, type Telnet <IP address> in the Open field.

3Click OK.

The Telnet session begins.

Using the CLI

This section provides information for using the CLI.

Command Mode Overview

The CLI is divided into command modes. Each command mode has a specific command set. Entering a question mark at the terminal prompt displays a list of commands available for that particular command mode.

In each mode, a specific command is used to navigate from one command mode to another.

During the CLI session initialization, the CLI mode is the User EXEC mode. Only a limited subset of commands are available in the User EXEC mode. This level is reserved for tasks that do not change the terminal configuration and is used to access configuration sub-systems such as the CLI. To enter the next level, the Privileged EXEC mode, a password is required (if configured).

The Privileged EXEC mode provides access to the device global configuration. For specific global configurations within the device, enter the next level, Global Configuration mode. A password is not required.

The Global Configuration mode manages the device configuration on a global level.

The Interface Configuration mode configures the device at the physical interface level. Interface commands which require subcommands have another level called the Subinterface Configuration mode. A password is not required.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Global Configuration Mode

Global Configuration commands apply to system features, rather than a specific protocol or interface.

To access Global Configuration mode, at the Privileged EXEC Mode prompt, type the configure command and press <Enter>. The Global Configuration mode displays as the device host name followed by (config) and the pound sign #.

console(config)#

To list the Global Configuration commands, enter a question mark at the command prompt.

To return from Global Configuration mode to Privileged EXEC mode, type the exit command or use the <Ctrl>+<Z> key combination.

The following example illustrates how to access Global Configuration mode and return back to the Privileged EXEC mode:

console#

console# configure

console(config)# exit

console#

For a complete list of the CLI modes, see the Dell??? PowerConnect???3424/P and PowerConnect 3448/P CLI Guide.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining General Switch Information

The General page contains links to pages that allow network managers to configure switch parameters.

Viewing Switch Asset Information

The Asset page contains parameters for configuring and viewing general device information, including the system name, location, and contact, the system MAC Address, System Object ID, date, time, and System Up Time. To open the Asset page, click System ???General ???Asset in the tree view.

Figure 6-2. Asset

The Asset page contains the following fields:

System Name (0-159 Characters) ??? Defines the user-defined device name.

System Contact (0-159 Characters) ??? Indicates the name of the contact person.

System Location (0-159 Characters) ??? The location where the system is currently running.

MAC Address ??? Indicates the device MAC address.

Sys Object ID ??? The vendor's authoritative identification of the network management subsystem contained in the entity.

Date (DD/MMM//YY) ??? The current date. The format is day, month, year, for example, 10/OCT/03 is October 10, 2003.

Time (HH:MM:SS) ??? Indicates the time. The format is hour, minute, second, for example, 20:12:21 is eight twelve and twenty-one seconds in the evening.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following is an example of defining the device host name, system contact and device location as well as setting the time and date of the system clock using the CLI commands:

console(config)# hostname dell

dell (config)# snmp-server contact Dell_Tech_Supp dell (config)# snmp-server location New_York

dell (config)# exit

Console(config)# snmp-server host 10.1.1.1 management 2 Console# clock set 13:32:00 7 Mar 2002

Console# show clock

15:29:03 Jun 17 2002

The following is an example of displaying system information for a stand-alone device using the CLI commands:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

1OK

2OK

3OK

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Daylight Savings ??? Enables the Daylight Savings Time (DST) on the device based on the device???s location. The possible field values are:

USA ??? The device switches to DST at 2 a.m. on the first Sunday of April, and reverts to standard time at 2 a.m. on the last Sunday of October.

European ??? The device switches to DST at 1:00 am on the last Sunday in March, and reverts to standard time at 1:00 am on the last Sunday in October. The European option applies to EU members, and other European countries using the EU standard.

Other ??? The DST definitions are user-defined based on the device locality. If Other is selected, the From and To fields must be defined.

Time Set Offset (1-1440) ??? For non USA and European countries, the amount of time for DST can be set in minutes. The default time is 60 minutes.

From ??? Defines the time that DST begins in countries other than USA or Europe, in the format DD/MMM/YY in one field and time in another. For example, if DST begins on the 25th October 2007 5:00 am, the two fields are defined as 25/Oct/07 and 05:00. The possible field values are:

Date ??? The date at which DST begins. The possible field range is 1-31.

Month ??? The month of the year in which DST begins. The possible field range is Jan-Dec.

Year ??? The year in which the configured DST begins.

Time ??? The time at which DST begins. The field format is Hour: Minute, for example, 05:30.

To ??? Defines the time that DST ends in countries other than USA or Europe in the format DD/MMM/YY in one field and time in another. For example, DST ends on the 23rd March 2008 12:00 am, the two fields are defined as 23/Mar/08 and 12:00. The possible field values are:

Date ??? The date at which DST ends. The possible field range is 1-31.

Month ??? The month of the year in which DST ends. The possible field range is Jan-Dec.

Year??? The year in which the configured DST ends.

Time ??? The time at which DST starts. The field format is Hour:Minute, for example, 05:30.

Recurring ??? Defines the time that DST starts in countries other than USA or European where the DST is constant year to year. The possible field values are:

From ??? Defines the time that DST begins each year. For example, DST begins locally every second Sunday in April at 5:00 am. The possible field values are:

Day ??? The day of the week from which DST begins every year. The possible field range is Sunday-Saturday.

Week ??? The week within the month from which DST begins every year. The possible field range is 1-5.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

For example:

console(config)# clock summer-time recurring usa console(config)# clock time zone 2 zone TMZ2 console(config)# clock set 10:00:00 apr 15 2004

Table 6-13. Clock Setting CLI Commands

clock time zone hours-offset Sets the time zone for display purposes. [minutes minutes-offset][zone

acronym]

clock summer-time recurring

{usa | eu | week day month hh:mm week day month hh:mm} [offset offset] [zone acronym]

clock summer-time date date month year hh:mm date month year hh:mm [offset offset] [zone acronym]

Configures the system to automatically switch to summer time (according to the USA and European standards).

Configures the system to automatically switch to summer time (Daylight Savings Time) for a specific period - date/month/year format.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Table 6-14. Celsius to Fahrenheit Conversion Table

Viewing System Health Information Using the CLI Commands

The following table summarizes the equivalent CLI commands for viewing fields displayed on the

System Health page.

Table 6-15. System Health CLI Command

The following is an example of the system health CLI command.

Console> show system

System Description: Ethernet switch

System Up Time (days,hour:min:sec): 1,22:38:21

System Contact:

System Name: RS1

System location:

System MAC Address: 00.10.B5.F4.00.01

Sys Object ID: 1.3.6.1.4.1.674.10895.3004

Type: PowerConnect 3424

Temperature Sensors:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 6-5. Power Over Ethernet

The Power Over Ethernet page contains the following sections:

???Global

???Port Settings

Global

The Power over Ethernet Global Settings section contains the following fields:

Power Status ??? Indicates the inline power source status.

On ??? Indicates that the power supply unit is functioning.

Off ??? Indicates that the power supply unit is not functioning.

Faulty ??? Indicates that the power supply unit is functioning, but an error has occurred. For example, a power overload or a short circuit.

Nominal Power ??? Indicates the actual amount of power the device can supply. The field value is displayed in Watts.

Consumed Power ??? Indicates the amount of the power used by the device. The field value is displayed in Watts.

System Usage Threshold (1-99 Percent) ??? Indicates the percentage of power consumed before an alarm is generated. The field value is 1-99 percent. The default is 95 percent.

Traps ??? Enables or Disables receiving PoE device traps. The default is disabled.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

3.84 ??? 6.49 ??? Indicates that the port is assigned a power consumption level of 3.84 to 6.49 Watts.

6.49 ??? 12.95 ??? Indicates that the port is assigned a power consumption level of 6.49 to 12.95 Watts.

Power Device (0-24 characters) ??? Provides a user-defined powered device description. The field can contain up to 24 characters.

Overload Counter ??? Indicates the total power overload occurrences.

Short Counter ??? Indicates the total power shortage occurrences.

Denied Counter ??? Indicates times the powered device was denied power.

Absent Counter ??? Indicates the times the power supply was stopped to the powered device because the powered device was no longer detected.

Invalid Signature Counter ??? Indicate the times an invalid signature was received. Signatures are the means by which the powered device identifies itself to the PSE. Signatures are generated during powered device detection, classification, or maintenance.

Defining PoE Settings

1Open the Power Over Ethernet page.

2Define the fields.

3Click Apply Changes.

PoE settings are defined, and the device is updated.

Managing PoE Using the CLI Commands

The following table summarizes the equivalent CLI commands for viewing fields displayed on the

Power Over Ethernet page.

Table 6-16. System Health CLI Commands

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Viewing Version Information

The Versions page contains information about the hardware and software versions currently running. To open the Versions page, click System???General???Versions in the tree view.

Figure 6-6. Versions

The Versions page contains the following fields:

Unit No. ??? Indicates the unit number for which the device versions are displayed.

Software Version ??? The current software version running on the device.

Boot Version ??? The current Boot version running on the device.

Hardware Version ??? The current device hardware version.

Displaying Device Versions Using the CLI

The following table summarizes the equivalent CLI commands for viewing fields displayed in the

Versions page.

Table 6-17. Versions CLI Commands

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Switching Between Stack Masters

1Open the Stack Management page.

2Check the Switch Stack Control from Unit 1 to Unit 2 check box.

3Click Apply Changes.

A confirmation message displays.

4Click OK.

The device is reset. After the device is reset, a prompt for a user name and password displays.

Configuring Stack Display Order

1Open the Stack Management page.

2Define the stack topology by defining the top and bottom units. These units should be neighbors.

3Click Apply Changes.

The display order is reconfigured on the System page.

Managing Stacks Using the CLI Commands

The following table summarizes the equivalent CLI commands for viewing fields displayed in the

Stack Management page.

Table 6-18. Stack Management CLI Commands

The following is an example of the CLI commands:

console# reload

Are you sure you want to erase running configuration (y/n) [n]

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Configuring SNTP Settings

The switch supports the Simple Network Time Protocol (SNTP). SNTP assures accurate network switch clock time synchronization up to the millisecond. Time synchronization is performed by a network SNTP server. SNTP operates only as a client, and cannot provide time services to other systems.

The switch can poll the following server types for the server time:

???Unicast

???Anycast

???Broadcast

Time sources are established by Stratums. Stratums define the accuracy of the reference clock. The higher the stratum (where zero is the highest), the more accurate the clock. The switch receives time from stratum 1 and above. The following is an example of stratums:

???Stratum 0 ??? Indicates a real time clock is used as the time source, for example, a GPS system.

???Stratum 1 ??? Indicates that a server that is directly linked to a Stratum 0 time source is used. Stratum 1 time servers provide primary network time standards.

???Stratum 2 ??? Indicates that the time source is distanced from the Stratum 1 server over a network path. For example, a Stratum 2 server receives the time over a network link, via NTP, from a Stratum 1 server.

Information received from SNTP servers is evaluated based on the Time level and server type. SNTP time definitions are assessed and determined by the following time levels:

???T1 ??? The time at which the original request was sent by the client.

???T2 ??? The time at which the original request was received by the server.

???T3 ??? The time at which the server sent the client a reply.

???T4 ??? The time at which the client received the server's reply.

The device can poll the following server types for the server time: Unicast, Anycast and Broadcast.

Polling for Unicast information is used for polling a server for which the IP address is known. SNTP servers that are configured on the device are the only ones that are polled for synchronization information. T1-T4 are used to determine server time. This is the preferred method for synchronizing device time as it is most secure. If this method is selected, SNTP information is accepted only from SNTP servers defined on the device using the SNTP Servers page.

Polling for Anycast information is used when the server IP address is unknown. If this method is selected, all SNTP servers on the network can send synchronization information . The device is synchronized when it proactively requests synchronization information. The best response (lowest stratum) from the first 3 SNTP servers to respond to a request for synchronization information is used to set the time value. Time levels T3 and T4 are used to determine the server time.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining SNTP Global Parameters

The SNTP Global Settings page provides information for defining SNTP parameters globally. To open the SNTP Global Settings page, click System ???SNTP???Global Settings in the tree view.

Figure 6-8. SNTP Global Settings

The SNTP Global Settings page contains the following fields:

Poll Interval (60-86400) ??? Defines the interval (in seconds) at which the SNTP server is polled for Unicast information. By default, the poll interval is 1024 seconds.

Receive Broadcast Servers Updates ??? Listens to the SNTP servers for Broadcast server time information on the selected interfaces, when enabled.

Receive Anycast Servers Updates ??? Polls the SNTP server for Anycast server time information, when enabled. If both the Receive Anycast Servers Update, and the Receive Broadcast Servers Update fields are enabled, the system time is set according the Anycast server time information.

Receive Unicast Servers Updates ??? Polls the SNTP server for Unicast server time information, when enabled. If the Receive Broadcast Servers Updates, Receive Anycast Servers Updates, and the Receive Unicast Servers Updates fields are all enabled, the system time is set according the Unicast server time information.

Send Unicast Requests ??? Sends SNTP Unicast server time information requests to the SNTP server, when enabled.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining SNTP Authentication Methods

The SNTP Authentication page enables SNTP authentication between the device and an SNTP server. The means by which the SNTP server is authenticated is also selected in the SNTP Authentication page. Click System ???SNTP???Authentication in the tree view to open the SNTP Authentication page.

Figure 6-9. SNTP Authentication

The SNTP Authentication page contains the following:

SNTP Authentication ??? Enables authenticating an SNTP session between the device and an SNTP server, when enabled.

Encryption Key ID ??? Defines the Key Identification used to authenticate the SNTP server and device. The field value is up to 4294967295.

Authentication Key (1-8 Characters) ??? The key used for authentication.

Trusted Key ??? Indicates the encryption key used (Unicast) to authenticate the SNTP server.

Remove ??? Removes selected authentication keys, when checked.

Adding an SNTP Authentication Key

1Open the SNTP Authentication page.

2Click Add.

The Add Authentication Key page opens:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining SNTP Authentication Settings Using CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

SNTP Authentication page.

Table 6-21. SNTP Authentication CLI Commands

The following is an example of the CLI commands:

console(config)# sntp authentication-key 8 md5 Calked

console(config)# sntp trusted-key 8

Console(config)# sntp authenticate

Defining SNTP Servers

You can enable SNTP servers, as well as add new SNTP servers, from the SNTP Servers page. To open the SNTP Servers page, click System ???SNTP ???Servers in the tree view.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Offset ??? Timestamp difference between the device local clock and the acquired time from the SNTP server.

Delay ??? The amount of time it takes to reach the SNTP server.

Remove ??? Removes a specific SNTP server from the SNTP Servers list, when selected.

Adding an SNTP Server

1Open the SNTP Servers page.

2Click Add.

The Add SNTP Server page opens:

Figure 6-13. Add SNTP Server

3Define the fields.

4Click Apply Changes.

The SNTP Server is added, and the device is updated.

Displaying the SNTP Server Table

1Open the SNTP Servers page.

2Click Show All.

The SNTP Servers Table opens:

Figure 6-14. SNTP Servers Table

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining SNTP Interfaces

The SNTP Interface Settings page contains SNTP interface information. To open the SNTP Interface Settings page, click System???SNTP???Interface Settings.

Figure 6-15. SNTP Interface Settings

The SNTP Interface Settings page contains the following fields:

Unit No. ??? Indicates the stacking member on which the SNTP interface is enabled.

Interface ??? Contains an interface list on which SNTP can be enabled.

Receive Servers Updates ??? Enables or disables SNTP on the specific interface.

Remove ??? Removes SNTP from a specific interface, when selected.

Adding an SNTP Interface

1Open the SNTP Interface Settings page.

2Click Add.

The Add SNTP Interface page opens.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The Logs page contains links to various log pages. To open the Logs page, click System ???Logs in the tree view.

Defining Global Log Parameters

The System Logs enable viewing device events in real time, and recording the events for later usage. System Logs record and manage events and report errors or informational messages.

Event messages have a unique format, as per the System Logs protocol recommended message format for all error reporting. For example, Syslog and local device reporting messages are assigned a severity code, and include a message mnemonic, which identifies the source application generating the message. It allows messages to be filtered based on their urgency or relevancy. The distribution of logging messages to the various destinations, such as the logging buffer, logging file or Syslog server, is controlled by the Syslog configuration parameters. Users can define up-to eight Syslog servers.

The following table contains the Log Severity Levels:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The Global Log Parameters page contains the following parameters:

Logging ??? Enables device global logs for Cache, File, and Server Logs. Console logs are enabled by default.

Log Authentication Events ??? Enables generating logs when users are authenticated.

Log Copy Files Events ??? Enables generating logs when files are copied.

Log Rename and Delete Files Events ??? Enables generating logs when backup configuration files are renamed or deleted.

Log Management Access Events ??? Enables generating logs when the device is accessed using a management method. For example, each time the device is accessed using SSH, a device log is generated.

Severity ??? The following are the available severity logs:

Emergency ??? The highest warning level. If the device is down or not functioning properly, an emergency log message is saved to the specified logging location.

Alert ??? The second highest warning level. An alert log is saved if there is a serious device malfunction, for example, an attempt was made to download a non-existing configuration file.

Critical ??? The third highest warning level. A critical log is saved if a critical device malfunction occurs, for example, two device ports are not functioning, while the rest of the device ports remain functional.

Error ??? A device error has occurred, for example, a copy operation has failed.

Warning ??? The lowest level of a device warning. For example, the device is functioning, but a port link is currently down.

Notice ??? Provides important device information.

Informational ??? Provides device information. For example, a port is currently up.

Debug ??? Provides debugging messages.

NOTE: When a severity level is selected, all severity level choices above the selection are selected automatically.

The Global Log Parameters page also contains check boxes which correspond to a distinct logging system:

Console ??? The minimum severity level from which logs are sent to the console.

RAM Logs ??? The minimum severity level from which logs are sent to the Log File kept in RAM (Cache).

Log File ??? The minimum severity level from which logs are sent to the Log File kept in FLASH memory.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Viewing the RAM Log Table

The RAM Log Table contains information about log entries kept in RAM, including the time the log was entered, the log severity, and a description of the log. To open the RAM Log Table, click

System???Logs???RAM Table in the tree view.

Figure 6-18. RAM Log Table

The RAM Log Table contains the following fields:

Log Index ??? The log number in the RAM Log Table.

Log Time ??? Indicates the time at which the log was entered into the RAM Log Table.

Severity ??? Indicates the log severity.

Description ??? Description of the log entry.

Removing Log Information:

1Open the RAM Log Table.

2Click Clear Log.

The log information is removed from the RAM Log Table, and the device is updated.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Viewing the Log File Table

The Log File Table contains information about log entries saved to the Log File in FLASH, including the time the log was entered, the log severity, and a description of the log message. To open the Log File Table, click System???Logs???File Table in the tree view.

Figure 6-19. Log File Table

The Log File Table contains the following fields:

Log Index ??? The log number in the Log File Table.

Log Time ??? Indicates the time at which the log was entered in the Log File Table.

Severity ??? Indicates the log severity.

Description ??? The log message text.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Viewing the Device Login History

The Login History page contains information for viewing and monitoring device utilization, including the time the user logged in and the protocol used to log on to the device.

To open the Login History page, click System???Logs???Login History in the tree view.

Figure 6-20. Login History

The Login History page contains the following fields:

User Name ??? Contains a user-defined device user name list.

Login History Status ??? Indicates if password history logs are enabled on the device.

Login Time ??? Indicates the time the selected user logged on to the device.

User Name ??? Indicates the user that logged on to the device.

Protocol ??? Indicates the means by which the user logged on to the device.

Location ??? Indicates the IP address of the station from which the device was accessed.

Viewing Login History

1Open the Login History page.

2Select a user in the User Name field.

3Click Apply Changes.

The login information for the selected user is displayed.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Modifying Remote Log Server Definitions

The Remote Log Server Settings page contains fields for viewing and configuring the available Log Servers. In addition, new log servers can be defined, and the log severity sent to each server. To open the Remote Log Server Settings page, click System???Logs???Remote Server Settings in the tree view.

Figure 6-21. Remote Log Server Settings

The Remote Log Server Settings page contains the following fields:

Available Servers ??? Contains a list of servers to which logs can be sent.

UDP Port (1-65535) ??? The UDP port to which the logs are sent for the selected server. The possible range is 1 - 65535. The default value is 514.

Facility ??? Defines a user-defined application from which system logs are sent to the remote server. Only one facility can be assigned to a single server. If a second facility level is assigned, the first facility level is overridden. All applications defined for a device utilize the same facility on a server. The field default is Local 7. The possible field values are:

Local 0 - Local 7.

Description (0-64 Characters) ??? The user-defined server description.

Delete Server ??? Deletes the currently selected server from the Available Servers list, when selected.

The Remote Log Server Settings page also contains a severity list. The severity definitions are the same as the severity definitions in the Global Log Parameters page.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 6-23. Log Servers Table

Removing a Log Server from the Log Servers Table Page:

1Open the Remote Log Server Settings page.

2Click Show All.

The Log Servers Table page opens.

3Select a Log Servers Table entry.

4Select the Remove check box to remove the server(s).

5Click Apply Changes.

The Log Servers Table entry is removed, and the device is updated.

Working with Remote Server Logs Using the CLI Commands

The following table summarizes the equivalent CLI command for working with remote log servers.

Table 6-29. Remote Log Server CLI Commands

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The Default Gateway page contains the following fields:

User Defined ??? The device???s Gateway IP address.

Active ??? Indicates if the Gateway is active.

Remove User Defined ??? Removes the device???s Gateway from the Default Gateway drop-down list, when selected.

Selecting a Device???s Gateway:

1Open the Default Gateway page.

2Select an IP address in the Default Gateway drop-down list.

3Select the Active check box.

4Click Apply Changes.

The device???s Default Gateway is selected and the device is updated.

Removing a Device???s Default Gateway Device:

1Open the Default Gateway page.

2Select the Remove check box to remove default gateways.

3Click Apply Changes.

The default gateway entry is removed, and the device is updated.

Defining a Device???s Gateway Using the CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

Default Gateway page

.

Table 6-30. Default Gateway CLI Commands

The following is an example of the CLI commands:

console(config)# ip default-gateway 196.210.10.1

console(config)# no ip default-gateway

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 6-25. Add a Static IP Interface

Network Mask ??? Indicates the subnetwork mask of the source IP address.

3Complete the fields on the page.

4Click Apply Changes.

The new IP address is added to the interface, and the device is updated.

Modifying IP Address Parameters

1Open the IP Interfaces Parameters page.

2Select an IP address in the IP Address drop-down menu.

3Modify the interface type.

4Click Apply Changes.

The parameters are modified, and the device is updated.

Deleting IP Addresses

1Open the IP Interfaces Parameters page.

2Click Show All.

The IP Interface Parameters Table page opens:

Figure 6-26. IP Interface Parameter Table

3Select an IP address and select the Remove check box.

4Click Apply Changes.

The selected IP address is deleted, and the device is updated.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining DHCP IP Interface Parameters

The DHCP IP Interface page contains parameters for defining DHCP clients connected to the device. To open the DHCP IP Interface page, click System???IP Addressing???DHCP IP Interface in the tree view.

Figure 6-27. DHCP IP Interface

The DHCP IP Interface page contains the following fields:

Interface ??? The specific interface connected to the device. Click the option button next to Port, LAG, or VLAN and select the interface connected to the device.

Host Name ??? The host name.

Remove ??? When selected, removes DHCP clients.

Adding DHCP Clients

1Open the DHCP IP Interface page.

2Click Add.

The Add DHCP IP Interface page opens.

3Complete the information on the page.

4Click Apply Changes.

The DHCP Interface is added, and the device is updated.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Configuring Domain Name Systems

Domain Name System (DNS) converts user-defined domain names into IP addresses. Each time a domain name is assigned the DNS service translates the name into a numeric IP address. For example, www.ipexample.com is translated into 192.87.56.2. DNS servers maintain domain name databases and their corresponding IP addresses.

The Domain Naming System (DNS) page contains fields for enabling and activating specific DNS servers. To open the Domain Naming System (DNS) page, click System???IP Addressing??? Domain Naming System (DNS) in the tree view.

Figure 6-28. Domain Naming System (DNS)

The Domain Naming System (DNS) page contains the following fields:

DNS Status ??? Enables or disables translating DNS names into IP addresses.

DNS Server ??? Contains a list of DNS servers. DNS servers are added to the Add DNS Server page.

DNS Server Currently Active ??? The DNS server that is currently active.

Set DNS Server Active ??? Activates the selected DNS server.

Remove DNS Server ??? When selected, removes the selected DNS server.

Adding a DNS Server

1Open the Domain Naming System (DNS) page.

2Click Add.

The Add DNS Server page opens:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Configuring DNS Servers Using the CLI Commands

The following table summarizes the CLI commands for configuring device system information.

Table 6-33. DNS Server CLI Commands

The following is an example of the CLI commands:

console(config)# ip name-server 176.16.1.18

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining DNS Domain Names Using the CLI Commands

The following table summarizes the CLI commands for configuring DNS domain names:

Table 6-34. DNS Domain Name CLI Commands

The following is an example of the CLI commands:

console(config)# ip domain-name dell.com

Mapping Domain Host

The Host Name Mapping page provides parameters for assigning IP addresses to static host names. On this page, one IP address per host can be assigned. To open the Host Name Mapping page, click System???IP Addressing???Host Name Mapping in the tree view.

Figure 6-32. Host Name Mapping

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 6-34. Hosts Name Mapping Table

Removing Host Name from IP Address Mapping

1Open the Host Name Mapping page.

2Click Show All.

3The Host Mapping Table page opens.

4Select a Host Name Mapping Table entry.

5Check the Remove checkbox.

6Click Apply Changes.

The Host Mapping Table entry is deleted, and the device is updated.

Mapping IP addresses to Domain Host Names Using the CLI Commands

The following table summarizes the equivalent CLI commands for mapping Domain Host names to IP addresses.

Table 6-35. Domain Host Name CLI Commands

The following is an example of the CLI commands:

console(config)# ip host accounting.abc.com 176.10.23.1

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

IP Address ??? The station IP address, which is associated with the MAC address filled in below.

MAC Address ??? The station MAC address, which is associated in the ARP table with the IP address.

Status ??? The ARP Table entry status. Possible field values are:

Dynamic ??? The ARP entry is learned dynamically.

Static ??? The ARP entry is a static entry.

Remove ARP Entry ??? When selected, removes an ARP entry.

Adding a Static ARP Table Entry:

1Open the ARP Settings page.

2Click Add.

The Add ARP Entry page opens.

3Select an interface.

4Define the fields.

5Click Apply Changes.

The ARP Table entry is added, and the device is updated.

Displaying the ARP Table

1Open the ARP Settings page.

2Click Show All.

The ARP Table page opens.

Deleting ARP Table Entry

1Open the ARP Settings page

2Click Show All.

The ARP Table page opens.

3Select a table entry.

4Select the Remove check box.

5Click Apply Changes.

The selected ARP Table entry is deleted, and the device is updated.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Running Cable Diagnostics

The Diagnostics page contains links to pages for performing virtual cable tests on copper cables. To open the Diagnostics page, click System???Diagnostics in the tree view.

Viewing Copper Cable Diagnostics

The Copper Cables page contains fields for performing tests on copper cables. Cable testing provides information about where errors occurred in the cable, the last time a cable test was performed, and the type of cable error which occurred. The tests use Time Domain Reflectometry (TDR) technology to test the quality and characteristics of a copper cable attached to a port. Cables up to 120 meters long can be tested. Cables are tested when the ports are in the down state, with the exception of the Approximated Cable Length test.

To open the Copper Cables page, click System???Diagnostics???Copper Cable in the tree view.

Figure 6-36. Copper Cables

The Copper Cables page contains the following fields:

Port ??? The port to which the cable is connected.

Test Result ??? The cable test results. The possible field values are:

No Cable ??? There is no cable connected to the port.

Open Cable ??? The cable is connected on only one side.

Short Cable ??? A short has occurred in the cable.

OK ??? The cable passed the test.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following is an example of the CLI commands:

-------------------

NOTE: The cable length returned by the Integrated Cable Tester (ICT) is an approximation in the ranges of up to 50 meters, 50m-80m, 80m-110m, 110m-120m, or more than 120m. The deviation may be up to

20 meters, and cable length measurement does not operate for 10 Mbps links.

Viewing Optical Transceiver Diagnostics

Use the Optical Transceiver page to perform tests on Fiber Optic cables. To open the Optical Transceiver page, click System???Diagnostics???Optical Transceiver in the tree view.

. NOTE: Optical transceiver diagnostics can be performed only when the link is present.

Figure 6-37. Optical Transceiver

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following is an example of the CLI command:

Console# show fiber-ports optical-transceiver detailed

Managing Switch Security

The Management Security page provides access to security pages that contain fields for setting security parameters for ports, device management methods, user, and server security. To open the

Management Security page, click System???Management Security in the tree view.

Defining Access Profiles

The Access Profiles page contains fields for defining profiles and rules for accessing the device. Access to management functions can be limited to user groups, which are defined by ingress interfaces and source IP address or source IP subnets.

Management access can be separately defined for each type of management access method, including Web (HTTP), Secure Web (HTTPS), Telnet, and Secure Telnet.

Access to different management methods may differ between user groups. For example, User Group 1 can access the device only via an HTTPS session, while User Group 2 can access the device via both HTTPS and Telnet sessions.

Management Access Lists contain up to 256 rules that determine which users can manage the device, and by which methods. Users can also be blocked from accessing the device.

The Access Profiles page contains fields for configuring Management Lists and applying them to specific interfaces. To open the Access Profiles page, click System???Management Security???Access Profiles in the tree view.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining Rules for an Access Profile:

1Open the Access Profiles page.

2Click Add Profile.

The Add an Access Profile page opens:

Figure 6-39. Add an Access Profile

The Add an Access Profile page contains the following additional fields:

Access Profile Name (1-32 Characters) ??? User-defined name for the access profile. The Access Profile name can contain up to 32 characters.

Rule Priority (1-65535) ??? The rule priority. When the packet is matched to a rule, user groups are either granted access or denied access to device management. The rule order is set by defining a rule priority using this field. The rule number is essential to matching packets to rules, as packets are matched on a first-fit basis. The rule priorities can be viewed in the Profile Rules Table.

Management Method ??? The management method for which the access profile is defined. Users with this access profile are denied or permitted access to the device from the selected management method (line).

Interface ??? The interface type to which the rule applies. This is an optional field. This rule can be applied to a selected port, LAG, or VLAN by selecting the check box, then selecting the appropriate option button and interface.

NOTE: Assigning an access profile to an interface denies access via other interfaces. If an access profile is not assigned to any interface, the device can be accessed by all interfaces.

Source IP Address (X.X.X.X) ??? The interface source IP address for which the rule applies. This is an optional field and indicates that the rule is valid for a subnetwork.

Network Mask (X.X.X.X) ??? The IP subnetwork mask.

Prefix Length (/XX) ??? The number of bits that comprise the source IP address prefix, or the network mask of the source IP address.

Action ??? Defines whether to permit or deny management access to the defined interface.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 6-41. Profile Rules Table

Removing a Rule

1Open the Access Profiles page.

2Click Show All.

The Profile Rules Table page opens.

3Select a rule.

4Select the Remove check box.

5Click Apply Changes.

The selected rule is deleted, and the device is updated.

Defining Access Profiles Using CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

Access Profiles page.

Table 6-39. Access Profiles CLI Commands

management access-list name Defines an access-list for management, and enters the access-list context for configuration.

permit [ethernet interface- Sets port permitting conditions for the management number | vlan vlan-id | port- access list.

channel number] [service

service]

permit ip-source ip-address Sets port permitting conditions for the management [mask mask | prefix-length] access list, and the selected management method. [ethernet interface-number |

vlan vlan-id | port-channel number] [service service]

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following is an example of the CLI commands:

console(config)# management access-list mlist console(config-macl)# permit ethernet 1/e1 console(config-macl)# permit ethernet 1/e2 console(config-macl)# deny ethernet 1/e3 console(config-macl)# deny ethernet 1/e4 console(config-macl)# exit

console(config)# management access-class mlist console(config)# exit

console# show management access-list mlist

-----

permit ethernet 1/e1 permit ethernet 1/e2 deny ethernet 1/e3 deny ethernet 1/e4

! (Note: all other access implicitly denied) Console# show management access-class

Management access-class is enabled, using access list mlist

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Optional Methods ??? User authentication methods. The possible options are:

None ??? No user authentication occurs.

Local ??? User authentication occurs at the device level. The device checks the user name and password for authentication.

RADIUS ??? User authentication occurs at the RADIUS server. For more information, see Configuring RADIUS Settings.

Line ??? The line password is used for user authentication.

Enable ??? The enable password is used for authentication.

TACACS+ ??? The user authentication occurs at the TACACS+ server.

Restore Default??? Restores the default user authentication method on the device. Available for default profile only.

Remove ??? Removes the selected profile, when selected. Active profiles can not be deleted. Available for user-defined profiles only.

Selecting an Authentication Profile:

1Open the Authentication Profiles page.

2Select a profile in the Authentication Profile Name field.

3Select the authentication method using the navigation arrows. The authentication occurs in the order the authentication methods are listed.

4Click Apply Changes.

The user authentication profile is updated to the device.

Adding an Authentication Profile:

1Open the Authentication Profiles page.

2Click Add.

The Add Authentication Profile page opens:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Configuring an Authentication Profile Using CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

Authentication Profiles page.

Table 6-40. Authentication Profile CLI Commands

aaa authentication login Configures login authentication.

{default | list-name} method1 [method2.]

no aaa authentication login Removes a login authentication profile. {default | list-name}

The following is an example of the CLI commands:

console(config)# aaa authentication login default radius local enable none

console(config)# no aaa authentication login default

Selecting Authentication Profiles

After Authentication Profiles are defined, the Authentication Profiles can be applied to Management Access methods. For example, console users can be authenticated by Authentication Method List 1, while Telnet users are authenticated by Authentication Method List 2. To open the

Select Authentication page, click System???Management Security???Select Authentication in the tree view.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Applying an Authentication List to Console Sessions

1Open the Select Authentication page.

2Select an Authentication Profile in the Console field.

3Click Apply Changes.

Console sessions are assigned an Authentication List.

Applying an Authentication Profile to Telnet Sessions

1Open the Select Authentication page.

2Select an Authentication Profile in the Telnet field.

3Click Apply Changes.

Telnet sessions are assigned an Authentication List.

Applying an Authentication Profile to Secure Telnet (SSH) Sessions

1Open the Select Authentication page.

2Select an Authentication Profile in the Secure Telnet (SSH) field.

3Click Apply Changes.

Secure Telnet (SSH) sessions are assigned an Authentication Profile.

Assigning HTTP Sessions an Authentication Sequence

1Open the Select Authentication page.

2Select an authentication sequence in the HTTP field.

3Click Apply Changes.

HTTP sessions are assigned an authentication sequence.

Assigning Secure HTTP Sessions an Authentication Sequence

1Open the Select Authentication page.

2Select an authentication sequence in the Secure HTTP field.

3Click Apply Changes.

Secure HTTP sessions are assigned an authentication sequence.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Managing Passwords

Password management provides increased network security and improved password control. Passwords for SSH, Telnet, HTTP, HTTPS, and SNMP access are assigned security features, which include:

???Defining minimum password lengths

???Password expiration

???Prevents frequent password reuse

???Locks users out after failed login attempts

Password aging starts immediately, when password management is enabled. Passwords expire based on the user-defined time/day definition expiration. Ten days prior to password expiration, the device displays a password expiration warning message.

After the password has expired, users can login three additional times. During the three remaining logins an additional warning message displays informing the user that the password must be changed immediately. If the password is not changed,users are locked out of the system, and can only log in using the console. Password warnings are logged in the Syslog file.

If a privilege level is redefined, the user must also be re-defined. However, the password age time expires from the initial user definition.

To open the Password Management page, click System???Management Security???Password Management in the tree view.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Password Management Using CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

Password Management page.

Table 6-42. Password Management Using CLI Commands

password min-length length Defines the minimum password length.

password history number Defines the amount of times a password is changed, before the password can be reused.

password lock-out number Defines the number of times a faulty password is entered before the user is locked out of the device.

show password configuration Displays password management information.

The following is an example of the CLI commands:

console # show passwords configuration

Minimal length: 0

History: Disabled

History hold time: no limit

Lockout control: disabled

Enable Passwords

Line Passwords

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The Local User Database page contains the following fields:

User Name ??? List of users.

Access Level ??? User access level. The lowest user access level is 1 and 15 is the highest user access level. Users with access level 15 are Privileged Users, and only they can access and use the OpenManage Switch Administrator.

Password (0-159 Characters) ??? User-defined password.

Confirm Password ??? Confirms the user-defined password.

Enable Password Aging (1-365) ??? Indicates the amount of time in days that elapses before a password is aged out, when selected.

Expiry Date ??? Indicates the expiration date of the user-defined password.

Lockout Status ??? Specifies the number of failed authentication attempts since the user last logged in successfully, when the Enable Login Attempts checkbox is selected in the Password Management page. Specifies LOCKOUT, when the user account is locked.

Reactivate Suspended User ??? Reactivate the specified user???s access rights, when selected. Access rights can be suspended after unsuccessfully attempting to login.

Remove ??? Removes users from the User Name list, when selected.

Assigning Access Rights to a User:

1Open the Local User Database page.

2Select a user in the User Name field.

3Define the fields.

4Click Apply Changes.

The user access rights and passwords are defined, and the device is updated.

Defining a New User:

1Open the Local User Database page.

2Click Add.

The Add User page opens:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Deleting Users:

1Open the Local User Database page.

2Click Show All.

The Local User Table opens.

3Select a User Name.

4Select the Remove check box.

5Click Apply Changes.

The selected user is deleted, and the device is updated.

Assigning Users Using CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

Local User Database page.

Table 6-43. Local User Database CLI Commands

username name [password Establishes a username-based authentication system. password] [level level]

[encrypted]

set username name active Reactivates a suspended user???s access rights.

The following is an example of the CLI commands:

console(config)# username bob password lee level 15

console# set username bob active

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining Line Passwords for Console Sessions

1Open the Line Password page

2Define the Console Line Password field.

3Click Apply Changes.

The line password for console sessions is defined, and the device is updated.

Defining Line Passwords for Telnet Sessions

1Open the Line Password page.

2Define the Telnet Line Password field.

3Click Apply Changes.

The line password for the Telnet sessions is defined, and the device is updated.

Defining Line Passwords for Secure Telnet Sessions

1Open the Line Password page.

2Define the Secure Telnet Line Password field.

3Click Apply Changes.

The line password for Secure Telnet sessions is defined, and the device is updated.

Assigning Line Passwords Using CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

Line Password page.

Table 6-44. Line Password CLI Commands

The following is an example of the CLI commands:

console(config-line)# password dell

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining a New Enable Password:

1Open the Enable Password page.

2Define the fields.

3Click Apply Changes.

The new Enable password is defined, and the device is updated.

Assigning Enable Passwords Using CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

Enable Password page.

Table 6-45. Modify Enable Password CLI Commands

The following is an example of the CLI commands:

console(config)# enable password level 15 secret

Defining TACACS+ Settings

The devices provide Terminal Access Controller Access Control System (TACACS+) client support. TACACS+ provides centralized security for validation of users accessing the device.

TACACS+ provides a centralized user-management system, while still retaining consistency with RADIUS and other authentication processes. TACACS+ provides the following services:

???Authentication ??? Provides authentication during login and via user names and user-defined passwords.

???Authorization ??? Performed at login. Once the authentication session is completed, an authorization session starts using the authenticated user name. The TACACS+ server checks the user privileges.

The TACACS+ protocol ensures network integrity through encrypted protocol exchanges between the device and TACACS+ server. To open the TACACS+ Settings page, click System??? Management Security???TACACS+ in the tree view.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The TACACS+ default parameters are user-defined defaults. The default settings are applied to newly defined TACACS+ servers. If default values are not defined, the system defaults are applied to the new TACACS+ servers.

The following are the TACACS+ defaults:

Source IP Address ??? The default device source IP address used for the TACACS+ session between the device and the TACACS+ server. The default source IP address is 0.0.0.0.

Key String (0-128 Characters) ??? The default key string used for authenticating and encrypting all communications between the device and the TACACS+ server. This key is encrypted.

Timeout for Reply (1-30) ??? The default time that passes before the device and the TACACS+ server connection times out. The default is 5 seconds.

Adding a TACACS+ Server

1Open the TACACS+ Settings page.

2Click Add.

The Add TACACS+ Host page opens:

Figure 6-52. Add TACACS+ Host

3Define the fields.

4Click Apply Changes.

The TACACS+ server is added, and the device is updated.

Displaying the TACACS+ Table

1Open the TACACS+ Settings page.

2Click Show All.

The TACACS+ Table opens:

tacacs-server timeout timeout tacacs-server source-ip source show tacacs [ip-address]

Indicates the timeout value in seconds. (Range: 1 - 30.)

Indicates the source IP address. (Range: Valid IP Address.)

Displays configuration and statistics for a TACACS+ server.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following is an example of the CLI commands:

console# show tacacs

Device Configuration

Connected

Global values

-----------------

TimeOut : 5

Device Configuration

--------------------

Source IP : 0.0.0.0 console#

Configuring RADIUS Settings

Remote Authorization Dial-In User Service (RADIUS) servers provide additional security for networks. Up to four RADIUS servers can be defined. RADIUS servers provide a centralized authentication method for:

???Telnet Access

???Secure Shell Access

???Web Access

???Console Access

To open the RADIUS Settings page, click System ???Management Security ???RADIUS in the tree view.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following fields set the RADIUS default values:

NOTE: If host-specific Timeouts, Retries, or Dead time values are not specified, the Global values (Defaults) are applied to each host.

Default Retries (1-10) ??? Indicates the default number of transmitted requests sent to RADIUS server before a failure occurs.

Default Timeout for Reply (1-30) ??? Indicates the default amount of the time (in seconds) the device waits for an answer from the RADIUS server before timing out. The default is 5 seconds.

Default Dead time (0-2000) ??? Indicates the default amount of time (in minutes) that a RADIUS server is bypassed for service requests. The range is 0-2000.

Default Key String (1-128 Characters) ??? The Default Key string used for authenticating and encrypting all RADIUS communications between the device and the RADIUS server. This key is encrypted.

Source IP Address ??? Indicates the default source IP address that is used for communication with RADIUS servers. The default source IP address is 0.0.0.0.

Defining RADIUS Parameters:

1Open the RADIUS Settings page.

2Define the fields.

3Click Apply Changes.

The RADIUS setting are updated to the device.

Adding a RADIUS Server:

1Open the RADIUS Settings page.

2Click Add.

The Add RADIUS Server page opens:

Figure 6-55. Add RADIUS Server

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Table 6-47. RADIUS Server CLI Commands (continued)

The following is an example of CLI commands:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining SNMP Global Parameters

The SNMP Global Parameters page permits enabling both SNMP and Authentication notifications. To open the SNMP Global Parameters page, click System ???SNMP ???Global Parameters in the tree view.

Figure 6-57. SNMP Global Parameters

The SNMP Global Parameters page contains the following fields:

Local Engine ID ??? Indicates the local device engine ID. The field value is a hexadecimal string. Each byte in hexadecimal character strings is two hexadecimal digits. Each byte can be separated by a period or a colon. The Engine ID must be defined before SNMPv3 is enabled.

For stand-alone devices select a default Engine ID that is comprised of Enterprise number and the default MAC address.

For a stackable system configure the Engine ID, and verify that the Engine ID is unique for the administrative domain. This prevents two devices in a network from having the same Engine ID.

Use Defaults ??? Uses the device generated Engine ID. The default Engine ID is based on the device MAC address and is defined per standard as:

First 4 octets ??? first bit = 1, the rest is IANA Enterprise number = 674.

Fifth octet ??? Set to 3 to indicate the MAC address that follows.

Last 6 octets ??? MAC address of the device.

SNMP Notifications ??? Enables or disables the router sending SNMP notifications.

Authentication Notifications ??? Enables or disables the router sending SNMP traps when authentication fails.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following is an example of the CLI commands:

Console(config)# snmp-server enable traps

Console(config)# snmp-server trap authentication

Console# show snmp

Traps are enabled.

Authentication-failure trap is enabled.

System Contact: Robert

System Location: Marketing

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Adding a View

1Open the SNMPv3 View Settings page.

2Click Add.

The Add A View page opens:

Figure 6-59. Add A View

3Define the field.

4Click Apply Changes.

The SNMP View is added, and the device is updated.

Displaying the View Table

1Open the SNMPv3 View Settings page.

2Click Show All.

The View Table page opens:

Figure 6-60. View Table

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining SNMP Access Control

The Access Control page provides information for creating SNMP groups, and assigning SNMP access control privileges to SNMP groups. Groups allow network managers to assign access rights to specific device features, or features aspects.

To open the Access Control Group page, click System ???SNMP ???Access Control in the tree view.

Figure 6-61. Access Control Group

The Access Control Group contains the following fields:

Group Name ??? The user-defined group to whom access control rules are applied. The field range is up to 30 characters.

SNMP Version ??? Defines the SNMP version attached to the group. The possible field values are:

SNMPv1 ??? SNMPv1 is defined for the group.

SNMPv2 ??? SNMPv2 is defined for the group.

SNMPv3 ??? SNMPv3 is defined for the group.

Security Level ??? The security level attached to the group. Security levels apply to SNMPv3 only. The possible field values are:

No Authentication ??? Neither the Authentication nor the Privacy security levels are assigned to the group.

Authentication ??? Authenticates SNMP messages, and ensures the SNMP messages origin is authenticated.

Privacy ??? Encrypts SNMP message.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Removing SNMP Groups

1Open the Access Control Group page.

2Click Show All.

The Access Table opens.

3Select a SNMP group.

4Check the Remove checkbox.

5Click Apply Changes.

The SNMP group is deleted, and the device is updated.

Defining SNMP Access Control Using CLI Commands

The following table summarizes the equivalent CLI commands for defining fields displayed in the

Access Control Group page.

Table 6-50. SNMP Access Control CLI Commands

The following is an example of the CLI commands:

console (config)# snmp-server group user-group v3 priv read user- view

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

MD5 Password ??? Indicates that HMAC-MD5-96 password is used for authentication. The user should enter a password.

SHA Password ??? Users are authenticated using the HMAC-SHA-96 authentication level. The user should enter a password.

None ??? No user authentication is used.

Password (0-32 Characters) ??? Modifies the user-defined password for a group. Passwords can contain a maximum of 32 alphanumeric characters.

Authentication Key (MD5-16; SHA-20 hexa chars) ??? Defines the HMAC-MD5-96 or HMAC- SHA-96 authentication level. The authentication and privacy keys are entered to define the authentication key. If only authentication is required, 16 bytes are defined for MD5. If both privacy and authentication are required, 32 bytes are defined for MD5. Each byte in hexadecimal character strings is two hexadecimal digits. Each byte can be separated by a period or a colon.

Privacy Key (16 hexa characters) ??? If only authentication is required, 20 bytes are defined. If both privacy and authentication are required, 16 bytes are defined. Each byte in hexadecimal character strings is two hexadecimal digits. Each byte can be separated by a period or colon.

Remove ??? When checked, removes users from a specified group.

Adding Users to a Group

1Open the SNMPv3 User Security Model (USM) page.

2Click Add.

The Add SNMPv3 User Name page opens:

Figure 6-65. Add SNMPv3 User Name

3Define the relevant fields.

4Click Apply Changes.

The user is added to the group, and the device is updated.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following is an example of the CLI commands:

console (config)# snmp-server user John user-group auth-md5 1234 console (config)# end

console# show snmp users

Defining SNMP Communities

Access rights are managed by defining communities on the SNMPv1,2 Community page. When the community names are changed, access rights are also changed. SNMP Communities are defined only for SNMP v1 and SNMP v2. To open the SNMPv1,2 Community page, click System??? SNMP???Communities in the tree view.

Figure 6-67. SNMPv1,2 Community

The SNMPv1,2 Community page contains the following fields:

SNMP Management Station ??? The management station IP address for which the SNMP community is defined.

Community String ??? Functions as a password and used to authenticate the management station to the device.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Deleting Communities

1Open the SNMPv1,2 Community page.

2Click Show All.

The Community Table page opens.

3Select a community and check the Remove check box.

4Click Apply Changes.

The community entry is deleted, and the device is updated.

Configuring Communities Using CLI Commands

The following table summarizes the equivalent CLI commands for viewing fields displayed in the

SNMPv1,2 Community.

Table 6-52. SNMP Community CLI Commands

The following is an example of the CLI commands:

Console (config)# snmp-server community dell ro 10.1.1.1

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 6-70. Add Filter

3Define the relevant fields.

4Click Apply Changes.

The new filter is added, and the device is updated.

Displaying the Filter Table

1Open the Notification Filter page.

2Click Show All.

The Filter Table opens:

Figure 6-71. Filter Table

Removing a Filter

1Open the Notification Filter page.

2Click Show All.

The Filter Table opens.

3Select a Filter Table entry.

4Check the Remove checkbox.

The filter entry is deleted, and the device is updated.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Defining SNMP Notification Recipients

The Notification Recipients page contains information for defining filters that determine whether traps are sent to specific users, and the trap type sent. SNMP notification filters provide the following services:

???Identifying Management Trap Targets

???Trap Filtering

???Selecting Trap Generation Parameters

???Providing Access Control Checks

To open the Notification Recipients page, click System???SNMP???Notification Recipient in the tree view.

Figure 6-72. Notification Recipients

The Notification Recipients page contains the following fields:

Recipient IP ??? Indicates the IP address to whom the traps are sent.

Notification Type ??? The notification sent. The possible field values are:

Trap ??? Traps are sent.

Inform ??? Informs are sent.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 6-73. Add Notification Recipients

3Define the relevant fields.

4Click Apply Changes.

The notification recipient is added, and the device is updated.

Displaying Notification Recipients Tables

1Open Notification Recipients page.

2Click Show All.

The Notification Recipients Tables page opens:

Figure 6-74. Notification Recipients Tables

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The following is an example of the CLI commands:

console(config)# snmp-server host 172.16.1.1 private console(config)# end

Managing Files

Use the File Management page to manage device software, the image file, and the configuration files. Files can be downloaded or uploaded via a TFTP server.

Management File Overview

The management file structure consists of the following files:

???Startup Configuration File ??? Contains the commands required to configure device at startup or after reboot. The startup configuration file is created by copying the configuration commands from the Running Configuration file or the Backup Configuration file to the Startup Configuration file.

???Running Configuration File ??? Contains all Startup Configuration file commands, as well as all commands entered during the current session. After the device is powered down or rebooted, all commands stored in the Running Configuration file are lost. During the startup process, all commands in the Startup Configuration file are copied to the Running Configuration file and applied to the device. During the session, all new commands are added to the commands existing in the Running Configuration file. To update the Startup Configuration file, before powering down the device, the Running Configuration file must be copied to the Startup Configuration file.

???Backup Configuration File ??? Contains a backup copy of the device configuration. Up to five backup configuration files can be saved on the device, with user configured names. These files are generated when the user copies the Running Configuration file or the Startup Configuration file to a user-named file. The contents of the backup configuration files can be copied to either the Running Configuration or the Startup Configuration files.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Destination File Name ??? The destination file type to which the file is downloaded. The possible field values are:

Software Image ??? Downloads the Image file.

Boot Code ??? Downloads the Boot file.

Configuration Download

TFTP Server IP Address ??? The TFTP Server IP Address from which the configuration files are downloaded.

Source File Name ??? Indicates the configuration files to be downloaded.

Destination File Name??? The destination file to which the configuration file is downloaded. The possible field values are:

Running Configuration ??? Downloads commands into the Running Configuration file.

Startup Configuration ??? Downloads the Startup Configuration file, and overwrites it.

User Defined Backup Configuration ??? Downloads the user-defined Backup Configuration file, and overwrites it.

New File Name ??? Downloads a new backup configuration file can be specified as the destination file.

NOTE: The image file overwrites the non-active image. It is recommended to designate that the non-active image will become the active image after reset, and then to reset the device following the download.

During the Image file download a dialog box opens which displays the download progress. The window closes automatically when the download is complete.

Downloading Files

1Open the File Download from Server page.

2Define the file type to download.

3Define the fields.

4Click Apply Changes.

The software is downloaded to the device.

NOTE: To activate the selected Image file, reset the device. For information on resetting the device, see Switching Between Stack Masters.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 6-76. File Upload to Server

The File Upload to Server page contains the following fields:

Firmware Upload ??? The Firmware file is uploaded. If Firmware Upload is selected, the Configuration Upload fields become unavailable.

Configuration Upload ??? The Configuration file is uploaded. If Configuration Upload is selected, the Active Image Upload fields become unavailable.

Active Image Upload

TFTP Server IP Address ??? The TFTP Server IP Address to which the Software Image is uploaded.

Destination File Name (1-159 Characters) ??? Indicates the Software Image file path to which the file is uploaded.

Configuration Upload

TFTP Server IP Address ??? The TFTP Server IP Address to which the Configuration file is uploaded.

Destination File Name (1-159 Characters) ??? Indicates the Configuration file path to which the file is uploaded.

Transfer File Name ??? The software file to which the configuration is uploaded. The possible field values are:

Running Configuration ??? Uploads the Running Configuration file.

Startup Configuration ??? Uploads the Startup Configuration file.

List of User Defined Configuration Files ??? Uploads a user-defined configuration file.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Activating Image Files

The Active Images page allows network managers to select and reset the Image files. The Active Image file for each unit in a stacking configuration can be individually selected. To open the Active Images page, click System ???File Management ???Active Images in the tree view.

Figure 6-77. Active Images

The Active Images page contains the following fields:

Unit No. ??? The unit number for which the Image file is selected.

Active Image ??? The Image file which is currently active on the unit.

After Reset ??? The Image file which is active on the unit after the device is reset. The possible field values are:

Image 1 ??? Activates Image file 1 after the device is reset.

Image 2 ??? Activates Image file 2 after the device is reset.

Selecting an Image File

1Open the Active Images page.

2Select an Image file for a specific unit in the After Reset field.

3Click Apply Changes.

The Image file is selected. The Image file reloads only after the next reset. The currently selected Image file continue to run until the next device reset.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Destination ??? Indicates the destination configuration file to which the source file is copied. Files cannot be copied to the Backup Master???s backup file. Backup files appear in the Destination Unit field only if backup files have been defined. Select the New File Name checkbox and indicate the name of the new file to copy the source file to a new backup configuration file.

New File Name ??? Indicates the name of the newly created backup configuration file.

Restore Configuration Factory Defaults ??? When selected, indicates that the current configuration settings should be replaced by the factory configuration default settings. When clear, indicates that the current configuration settings should be maintained.

Copying Files

1Open the Copy Files page.

2Define the Source and Destination fields.

3Click Apply Changes.

The file is copied, and the device is updated.

Restoring Company Factory Default Settings

1Open the Copy Files page.

2Click Restore Configuration Factory Defaults.

3Click Apply Changes.

The company factory default settings are restored, and the device is updated.

Copying and Deleting Files Using CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

Copy Files page.

Table 6-58. Copy Files CLI Commands

CLI CommandDescription

copy source-url destination-url Copies any file from a source to a destination.

delete startup-config Deletes the startup-config file.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Permission ??? Indicates the permission type assigned to the file. The possible field values are:

Read Only ??? Indicates a read-only file.

Read Write ??? Indicates a read-write file.

Remove ??? Deletes the file, when checked.

Rename ??? Permits renaming the file. The file name is renamed in the File Name field.

Total Bytes ??? Indicates the total amount of the space currently used.

Free Bytes ??? Indicates the remaining amount of the space currently free.

Managing Files Using CLI Commands

The following table summarizes the equivalent CLI commands for managing system files.

Table 6-59. Copy Files CLI Commands

The following is an example of the CLI commands:

console# dir

Directory of flash:

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The General Settings page contains the following information:

Attribute ??? The general setting attribute.

Current ??? The currently configured value.

After Reset ??? The future (after reset) value. By entering a value in the After Reset column, memory is allocated to the field table.

Max RAM Log Entries (20-400) ??? The maximum number of RAM Log entries. When the Log entries are full, the log is cleared and the Log file is restarted.

Viewing RAM Log Entries Counter Using the CLI Commands

The following table summarizes the equivalent CLI commands for setting fields displayed in the

General Settings page.

Table 6-60. General Settings CLI Commands

logging buffered size number Sets the number of syslog messages stored in the internal buffer (RAM).

The following is an example of the CLI commands:

console(config)# logging buffered size 300

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

???Enables user based authentication. Specific VLANs in the device are always available, even if specific ports attached to the VLAN are unauthorized.

???For example, Voice over IP does not require authentication, while data traffic requires authentication. VLANs for which authorization is not required can be defined. Unauthenticated VLANs are available to users, even if the ports attached to the VLAN are defined as authorized.

Advanced Port Based Authentication is implemented in the following modes:

???Single Host Mode ??? Only the authorized host can access the port.

???Multiple Host Mode ??? Multiple hosts can be attached to a single port. Only one host must be authorized for all hosts to access the network. If the host authentication fails, or an EAPOL-logoff message is received, all attached clients are denied access to the network.

???Guest VLANs ??? Provides limited network access authorized to ports. If a port is denied network access via port based authorization, but the Guest VLAN is enabled, the port receives limited network access. For example, a network administrator can use Guest VLANs to deny network access via port based authentication, but grant Internet access to unauthorized users.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Guest VLAN ??? Enables using a guest VLAN for unauthorized ports. If a Guest VLAN is enabled, the unauthorized port automatically joins the VLAN selected in VLAN List field. The field default is disabled.

Interface ??? Contains an interface list for which port based authentication is enabled.

User Name ??? Indicates the supplicant user-name.

Admin Interface Control ??? Defines the port authorization state. The possible field values are:

Auto ??? Enables port based authentication on the device. The interface moves between an authorized or unauthorized state based on the authentication exchange between the device and the client.

Authorized ??? Places the interface into an authorized state without being authenticated. The interface resends and receives normal traffic without client port based authentication.

Unauthorized ??? Denies the selected interface system access by moving the interface into unauthorized state. The device cannot provide authentication services to the client through the interface.

Current Interface Control ??? The current port authorization state.

Make Guest VLAN ??? If enabled, indicates that unauthorized users connected to this interface can access the Guest VLAN.

Periodic Reauthentication ??? Permits immediate port reauthentication.

Reauthentication Period (300-4294967295) ??? Indicate the time span in which the selected port is reauthenticated. The field value is seconds. The field default is 3600 seconds.

Reauthenticate Now ??? Permits immediate port reauthentication, when checked.

Authentication Server Timeout (1-65535) ??? Defines the amount of time that lapses before the device resends a request to the authentication server. The field value is specified in seconds. The field default is 30 seconds.

Resending EAP Identity Request (1-65535) ??? Defines the amount of time that lapses before EAP request are resent. The field default is 30 seconds.

Quiet Period (0-65535) ??? Indicates the number of seconds that the device remains in the quiet state following a failed authentication exchange. The possible field range is 0-65535. The field default is 60 seconds.

Supplicant Timeout (1-65535) ??? Indicates the amount of time that lapses before EAP requests are resent to the supplicant. The field value is in seconds. The field default is 30 seconds.

Max EAP Requests (1-10) ??? Indicates that total amount of EAP requests sent. If a response is not received after the defined period, the authentication process is restarted. The field default is 2 retries.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Enabling Port Based Authentication Using the CLI Commands

The following table summarizes the equivalent CLI commands for enabling the port based authentication as displayed in the Port Based Authentication table.

Table 7-61. Port Authentication CLI Commands

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

The Multiple Hosts page contains the following fields:

Port ??? The port number for which Advanced Port Based Authentication is enabled.

Multiple Hosts ??? Enables or disables a single host to authorize multiple hosts for system access. This setting must be enabled in order to either disable the ingress-filter, or to use port-lock security on the selected port.

Action on Single Host Violation ??? Defines the action to be applied to packets arriving in single-host mode, from a host whose MAC address is not the client (supplicant) MAC address. The possible field values are:

Forward ??? Forwards the packets from an unknown source, however, the MAC address is not learned.

Discard ??? Discards the packets from any unlearned source. This is the default value.

Shutdown ??? Discards the packet from any unlearned source and shuts down the port. Ports remain shut down until they are activated, or the switch is reset.

Traps ??? Enables or disables sending traps to the host if a violation occurs.

Trap Frequency (1-1000000) (Sec) ??? Defines the time period by which traps are sent to the host. The Trap Frequency (1-1000000) field can be defined only if the Multiple Hosts field is defined as Disable. The default is 10 seconds.

Status ??? The host status. The possible field values are:

Unauthorized ??? Indicates that the port control is Force Unauthorized, the port link is down or the port control is Auto, but a client has not been authenticated via the port.

Not in Auto Mode ??? Indicates that the port control is Forced Authorized, and clients have full port access.

Single-host Lock ??? Indicates that the port control is Auto and a single client has been authenticated via the port.

No Single Host ??? Indicates that Multiple Host is enabled.

Number of Violations ??? The number of packets that arrived on the interface in single-host mode, from a host whose MAC address is not the client (supplicant) MAC address.

Displaying the Multiple Hosts Table

1Open the Multiple Hosts page.

2Click Show All.

The Multiple Hosts Table opens.

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Enabling Multiple Hosts Using the CLI Commands

The following table summarizes the equivalent CLI commands for enabling the advanced port based authentication as displayed in the Multiple Hosts page.

Table 7-62. Multiple Hosts CLI Commands

dot1x single-host-violation Configures the action to be taken when a station, {forward |discard whose MAC address is not the client (supplicant) |discard-shutdown}[trap MAC address, attempts to access the interface. seconds]

The following is an example of the CLI Command.

Console(config)# interface ethernet 1/e1

Console(config-if)# dot1x multiple-hosts

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Displaying the Authenticated Users Table

1Open the Authenticated Users page.

2Click Show All.

The Authenticated Users Table opens:

Figure 7-6. Authenticated Users Table

Authenticating Users Using the CLI Commands

The following table summarizes the equivalent CLI commands for authenticating users as displayed in the Authenticated Users page.

Table 7-63. Add User Name CLI Commands

show dot1x users [username Displays 802.1X users for the device.

username]

The following is an example of the CLI commands:

console# show dot1x users

Port Username Session Time Auth Method MAC Address

-----------------------------------------------------------------

1/e11 gili 00:09:27 Remote 00:80:c8:b9:dc:1d

w w w . d e l l . c o m | s u p p o r t . d e l l . c o m

Figure 7-7. Port Security

The Port Security page contains the following fields:

Interface ??? The selected interface type on which Locked Port is enabled.

Port ??? The selected interface type is a port.

LAG ??? The selected interface type is a LAG.

Current Port Status ??? The currently configured Port status.

Set Port ??? The port is either locked or unlocked. The possible field values are:

Unlocked ??? Unlocks Port. This is the default value.

Locked ??? Locks Port.

Learning Mode ??? Defines the locked port type. The Learning Mode field is enabled only if Locked is selected in the Set Port field.The possible field values are:

Classic Lock ??? Locks the port using the classic lock mechanism. The port is immediately locked, regardless of the number of addresses that have already been learned.

Limited Dynamic Lock ??? Locks the port by deleting the current dynamic MAC addresses associated with the port. The port learns up to the maximum addresses allowed on the port. Both relearning and aging MAC addresses are enabled.

Max Entries ??? Specifies the number of MAC address that can be learned on the port. The Max Entries field is enabled only if Locked is selected in the Set Port field. In addition, the Limited Dynamic Lock mode is selected. The default is 1.