GS-4012F 12-port Managed Layer 3+ Gigabit Ethernet Switch
GS-4024 24-port Managed Layer 3+ Gigabit Ethernet Switch
Intelligent Pro Gigabit Switching & Routing Solution for Business
L3+ IP Routing RIP & OSPF Support Multicast DVMRP & IGMP Support High Redundancy and Resilient Architecture with RSTP, VRRP & Port Trunking Backup Power System Optional Multilayer (L2/L3/L4) Enterprise Access Control List Port Security and Static MAC filtering & Limited MAC number per port VLAN Stacking (QinQ) for Networkbased VPN or Campus VPN 802.1x Authentication ZyXEL iStackingTM Technology, Clustering Network Management SNMP & RMON Support

Benefits

Intelligent Multilayer Gigabit Ethernet Switch
ZyXEL GS-4000 series is an intelligent Gigabit multilayer (L2/L3/L4) Ethernet switch that provides enterprise-class availability, resilient and redundant architecture with OSPF, VRRP, RSTP and port trunking. The GS-4000 series offers many advanced features to make it the preferred choice for real-routing network in the enterprise. Advanced functionalities like QoS, rate-limiting, rule-based access control lists, multicasting support, wire-speed, high-performance IP routing and simplified management software (iStacking) highly improve network operation.
High-Performance Wire-speed Switching and IP Routing
The GS-4000 series consists of two switches: the GS-4024 with 20-port 100/1000BASE-T RJ-45 and four dualpersonality GbE interface (RJ-45 or SFP), the GS-4012F with 8-port SFP open slots and four dual-personality GbE interface (RJ-45 or SFP). Base on non-blocking switching architecture, the GS-4000 series can be deployed as both an intelligent access layer switch for enterprise wiring closets and as a Layer 3 backbone switch for SMB networks. The GS-4000 series delivers wire-speed full-dynamic IP routing, like OSPF and RIP using a hardware-based IP routing engine and sophisticated multilayer operating software. In addition to dynamic IP multicast, the GS4000 series supports Distance Vector Multicast Routing Protocol (DVMRP) and Internet Group Management Protocol (IGMP) snooping to perfectly handle a variety of datagrams making the ZyXEL GS-4000 series ideal for todays multi-service network environment.
iFlow - Advanced QoS for Significant Service
The GS-4000 series works with ZyXEL exclusive iFlow technology, a set of advanced QoS mechanisms, to insure noteworthy service, and smooth operation via a series of QoS processes to prevent customers networks being negatively impacted by network congestion. With intelligent multilayer capability, the GS4000 series offers wire-speed flow control which can classify, police, and prioritize the incoming packets
12/24-port Managed L3+ Gigabit Ethernet Switch gs-4000 series
according to predefined QoS policies. In classification, Differentiated Services Code Point field (DSCP) and the 802.1p class of service (CoS) field are identified to assess the priority of incoming packets. Classification and reclassification can be based on criteria as specific as rule-based on IP, MAC addresses, VLAN ID,TCP/UDP port number, on the other hand, for bandwidth management, the GS-4000 series is loaded with powerful traffic management tools. For instance, the GS-4000 series provides eight priority queues per port for different types of traffics, allowing administrators to set rule-based rate limiting which takes full advantage of limited network resources and guarantees the best performance.

iSafe - High-Security for Business-Critical Applications
The GS-4000 series works with iSafe intelligent 3-tiers security which offers complete data security in the data and management plane via a wide range of security features to protect users data and administrative traffic, and secure the network from unauthorized users. 802.1x authentication and Port security provide the ability to deny unauthorized users from accessing the network. Limited MAC Number by Port limits the total number of devices connected to a switch port, therefore highly reducing the risk of unknown access from mass deployed wireless networks or Hubs. Cooperating with RADIUS, 802.1x is useful to prevent unauthorized access based on username and password (or other credentials) and acts as powerful access control for convergent networks with mixed wired and wireless access. The GS-4000 series multilayer (L2/L3/L4) ACLs suite of sophisticated rule-based control mechanisms is easily deployed, based on realistic network environments via a Web GUI or command line to prevent abnormal and illegal access. The rules can be defined to deny packets based on source and destination MAC addresses, IP addresses, or TCP/UDP ports.
iManage - Enterprise-class Network Management
The GS-4000 series works with iManage intelligent network management tool kits. Compared with conventional bounded network management, ZyXEL GS-4000 Series demonstrates its power with advanced management capabilities; such as ZyXEL-exclusive iStacking clustering management technology that can cross different
floors and routing domains to locate other iStacking-capable switches in the same management cluster, thus allowing administrators to manage 24 switches with one single IP. This greatly reduces operating costs and offers more flexible maintenance of ZyXEL Switches. IT staff can opt for the Web or command line interface to suit their needs, and even encrypt their instructions with SSHv1/v2 and SSL/TLS. With these sophisticated functionalities, the IT staff is empowered to build a highly secure and efficient corporate network with minimum effort.

Specifications

Standard Compliance
IEEE 802.3 10BASE-T Ethernet IEEE 802.3u 100BASE-Tx Ethernet IEEE 802.3ab 1000BASE-T Ethernet IEEE 802.3z IEEE 802.3x Flow control IEEE 802.1d Spanning tree protocol IEEE 802.1w Rapid Spanning tree protocol IEEE 802.1p Class of service, priority protocols IEEE 802.1Q VLAN tagging IEEE 802.1x Port Authentication IEEE 802.3ad LACP aggregation
Traffic Management and QoS
Jumbo frame support (9K Bytes) for high performance data backup or recovery services IEEE 802.1p with 8 priority queues per port for different types of traffic WRR (Weighted Round Robin) scheduling for different prioritization of packets Support GVRP, automatic VLAN member registration Supports IGMP snooping Congestion control on all ports Rate Limiting: Rule-based bandwidth control Port-based egress traffic shaping Rule-based flow control Any to any port mirroring

Performance

48/24Gbps non-blocking switching fabric (GS-4024/GS-4012F) Flexible design for both Gigabit copper and Gigabit fiber connectivity 1488000pps forwarding rate for 1000BASET/1000BASE-X connectivity, 148800pps forwarding rate for 100BASE-TX connectivity Wire-speed performance
IP Routing and Service Features
IPV4 support 64 IP routing domains 8K IP address table 8K routing path Wire-speed IP routing RIPV1/V2 OSPF V2 Static routing protocol IGMP V1/V2 DVMRP Support DHCP Server/Relay

16K MAC entries

Link Aggregation
IEEE 802.3ad compliant Support LACP, static and dynamic link aggregation Link aggregation: up to 6 aggregation groups, per group support up to 8 ports. (manually or dynamically selected) VLAN Trunking
Intelligent ACL (L2/L3/L4 Access List Control)
Based on MAC address Based on VLAN ID Based on IP address or subnet Based on Protocol type or TCP/UDP port number Based on DSCP
Redundancy for Fault Backup
VRRP (Virtual Router Redundancy Protocol) BPS (Backup Power System) support, one power connector with ZyXEL BPS-120 IEEE 802.1w Rapid Spanning Tree Protocol (RSTP) provides rapid convergence of spanning tree independent of spanning-tree timer

Hardware Specifications

GS-4024 - Ports: 20 10/100/1000BASE-T RJ-45 ports and 4 dual-personality GbE interface (RJ-45 or SFP open slots) - Console: D-Sub 9 pin Female (DCE) - Management: 1 out-of-band management RJ-45 port GS-4012F - Ports: 8 SFP open slots and 4 dual-personality GbE interface (RJ-45 or SFP open slots) - Console: D-Sub 9 pin Female (DCE) - Management: 1 out-of-band management RJ-45 port
User Security and Authentication
MAC filtering per port secures access to each port Specific MAC forwarding per port: only specified MAC addresses can access the network (port lock) Limited maximum MAC number per port IP Filtering TCP/UDP Socket Filtering 802.1x port-based security, prevent unauthorized client access to the network IEEE 802.1Q tag-based 256 static VLAN, up to 4K dynamic VLAN Port-based VLAN Support VLAN Stacking (QinQ) Private VLAN provides security and isolation between ports on a switch, ensures that users can not snoop on each other's traffic

Physical Specifications

GS-4024 - Dimension: 438 (L) x 300 (D) x 44.45 (H) mm - Weight: 4 Kg GS-4012F - Dimension: 438 (L) x 225 (D) x 44.45 (H) mm - Weight: 3.4 Kg
Power Requirement Network Administration Security
User name/password required for web/telnet/local console administrators Two level security by specific SNMP read/write community Input voltage of AC: 100-240VAC, 50/60Hz Max power rating of AC: 50 Watts Backup power supply into 12V DC

Operation Environment

Operating temperature: 0C ~ 45C Storage temperature: -25C ~ 70C Operating humidity: 10% ~ 90%, non-condensing

Network Management

Supports ZyXEL iStacking, up to 24 switches can be managed by one IP address Web-based management Support out-of-band management RJ-45 port for management VLAN Telnet CLI Text-based configuration file for scripting SNMP v2c RS-232c Local console IP management: static IP or DHCP client RMON four RMON groups 1, 2, 3, 9 (history, statistics, alarms, and events) for enhanced traffic management, monitoring, and analysis Port mirroring: supports Source/Destination/Both port mirroring

Feature Matrix

Dimension Managed Switch

Feature/Model

General Specs Layer 3 IP Switching Height No. of 100Base-TX No. of 100Base-FX No. of 1000Base-T Dual Personality GbE Interface(RJ-45 or SFP) Switching fabric Routing Protocol RIP OSPF V2 DVMRP Availability 802.1D STP 802.1w RSTP 802.1s MSTP VRRP BPS Support 802.3ad Link Aggregation QoS 802.1p No. of CoS Per Port Port based Rate Limiting Policy based Rate Limiting Port based traffic shaping Broadcast Storm Control IGMP Snooping DiffServ(DSCP) Security 802.1x Port Security Static MAC Filtering Limited MAC number per Port IP Filtering TCP/UDP Socket Filtering SSH v1/v2 SSL/TLS Port-Based VLAN 802.1Q VLAN 802.1ad VLAN Stacking Management SNMP RMON 1.2.3.9 Web Management Telnet CLI iStacking Out-of-band MGMT Port Console Port DHCP Server DHCP Relay DHCP Client NTP Port Mirroring ACL Based on MAC address Based on VLAN Based on IP address Based on protocol type Based on TCP/UDP port Based on DSCP X X X X X X X X X X X X X X X X * X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X 256 X 2k * X X X X * X X X X X X X X X 4k X X 4k X 4k X X X X X X X X X X X X X X X * * X 4k X X X X X X X X X 4k X X X X X X 2 X 2 X X 8 X X X X X X X X 4 X X X X X X X X X 4 X X 8 X X X X X * X 8 X X X X X X X X X X X X X X X * X X X X X X X X X X X X * X X * X X X X X X X X X 3.6Gbps 8.8Gbps 12.8Gbps 12.8Gbps 48Gbps 24Gbps 24Gbps/48Gbps 1U 8 (All Series) 1 x MM (ES-2008-SC) 1 x SM (ES-2008-SC30) 2 1(ES-2008-GTP) x stacking optinoal Module 2 4/8 x SFP 4/8 x SFP 8/4 20/4 1U 24 1U 24 X 1U 24 1U 1U X 1U

ES-2008 Series

ES-2024

ES-3124

ES-4024A

GS-2024

GS-3012 GS-3012F

GS-4024 GS-4012F

* Firmware upgradeable for future enhancement

Application Diagram

GS-4024 Deployment for SMB Core Network
3rd Floor High Bandwidth Demand Workgroup

~150 Users

2nd Floor High Security Demand Workgroup

BPS-120

Back-up Power System
1st Floor High Performance Server Farm

GS-3012

L2+ GbE Switch
o Et Gb eD th op kt es o Et Gb eD th op kt es o Et Gb eD th op kt es

NetAltas Enterprise NMS

Se er rv r Fa m

1000Mbps

L2 GbE Switch

GbE Trunk IP Cam

ES-3124/ES-3124PWR

L2+ Fast Ethernet Switch

IP Phone

GbE Trunk

GS-4024
L3+ GbE Switch GbE Trunk VRRP OSPF

100/1000Mbps

L3+ GbE Switch

ZyWALL

Internet Security Gateway

Internet

GS-4012F Deployment for Campus Fiber Aggregation

GbE to the Desktop

Access Switch

ES-3124PWR

Building A

GbE Core Switch

GS-4012F ESESGbE to the Server

MIS Center

Fiber Trunk

Building B

Fiber Uplink

Student Dormitories

Library

Operational Information

Transceiver (Optional) Model Name
Optical Receiver Sensitivity Wavelength Connector Transmission Distance vs. Fiber Cable Specification

Building C

Operational Ranges

62.5um Multi-Mode Fiber

50um Multi-Mode Fiber 550 m 550 m -
9/10um Single-Mode Fiber 10 km 40 km 80 km
Supply Voltage 3.15 ~ 3.45 V 3.15 ~ 3.45 V 3.15 ~ 3.45 V 3.15 ~ 3.45 V
Max Current 300 mA 300 mA 300 mA 300 mA
SFP-SX SFP-LX-10 SFP-LHX1310-40 SFP-ZX-80
-17 dBm -20 dBm -23 dBm -24 dBm
850nm 1310nm 1310nm 1550nm

LC LC LC LC

220m 550m -

For more product

Corporate Headquarters ZyXEL Communications Corp.
Tel: +886-3-578-3942 Fax: +886-3-578-2439 Email: sales@zyxel.com.tw http://www.zyxel.com http://www.zyxel.com.tw
information, visit us on the web www.ZyXEL.com

ZyXEL France SARL

Tel: +33 (0) 97 Fax: +33 (0) 20 Email: info@zyxel.fr http://www.zyxel.fr

ZyXEL Denmark A/S

Tel: +00 Fax: +07 Email: sales@zyxel.dk http://www.zyxel.dk

ZyXEL Hungary

Tel: +36-1-336-1643 Fax: +36-1-325-9100 http://www.zyxel.hu

ZyXEL North America

Tel: +1-714-632-0882 Fax: +1-714-632-0858 Email: sales@zyxel.com http://www.us.zyxel.com

ZyXEL Russia

Tel: +7-095 542-8920 Fax: +7-095 542-8925 Email: contact@zyxel.ru http://www.zyxel.ru

ZyXEL Sweden A/S

Tel: +Fax: +Email: sales@zyxel.se http://www.zyxel.se

ZyXEL Ukraine

Tel: +31 Fax: +32 http://ua.zyxel.com

ZyXEL Czech s.r.o.

Tel: +Fax: +Email: info@cz.zyxel.com http://cz.zyxel.com

ZyXEL Finland Oy

Tel: +358-9-Fax: +358-9-Email: sales@zyxel.fi http://www.zyxel.fi

ZyXEL Germany GmbH.

Tel: +Fax: +Email: sales@zyxel.de http://www.zyxel.de

ZyXEL Kazakhstan

Tel: +7 (3272) 590699 Fax: +7 (3272) 590689 Email: tyulyukin@zyxel.kz

ZyXEL Norway A/S

Tel: +80 Fax: +81 Email: sales@zyxel.no http://www.zyxel.no

ZyXEL Spain

Tel: +Fax: +Email: sales@zyxel.es http://www.zyxel.es

ZyXEL UK Ltd.

Tel: +44 (0) Fax: +44 (0) Email: sales@zyxel.co.uk http://www.zyxel.co.uk
Copyright 2005 ZyXEL Communications Corp. All rights reserved. ZyXEL, ZyXEL logo and ZyNOS are registered trademarks of ZyXEL Communications Corp. All other brands, product names, or trademarks mentioned are the property of their respective owners. All specifications are subject to change without notice.

65-100-402402

Contents Overview

Introduction and Hardware.... 35
Getting to Know Your Switch.... 37 Hardware Installation and Connection.... 41 Hardware Overview.... 45
Basic Configuration.... 53
The Web Configurator.... 55 Initial Setup Example..... 65 System Status and Port Statistics.... 71 Basic Setting..... 77

Advanced..... 89

VLAN..... 91 Static MAC Forward Setup.... 105 Filtering.... 107 Spanning Tree Protocol.... 109 Bandwidth Control.... 127 Broadcast Storm Control.... 129 Mirroring..... 131 Link Aggregation..... 133 Port Authentication.... 141 Port Security.... 147 Classifier..... 151 Policy Rule.... 157 Queuing Method..... 163 VLAN Stacking.... 165 Multicast..... 171 Authentication & Accounting.... 185 IP Source Guard..... 199 Loop Guard.... 219

IP Application.... 223

Static Route..... 225 RIP..... 227 OSPF..... 229 IGMP..... 241 DVMRP.... 245
Contents Overview IP Multicast.... 249 Differentiated Services.... 251 DHCP.... 259 VRRP..... 267
Management, CLI, Troubleshooting.... 277
Maintenance.... 279 Access Control.... 285 Diagnostic..... 303 Syslog.... 305 Cluster Management.... 309 MAC Table.... 315 IP Table.... 317 ARP Table..... 319 Routing Table..... 321 Configure Clone.... 323 Introducing Commands.... 325 User and Enable Mode Commands... 377 Configuration Mode Commands.... 383 Interface Commands.... 395 IEEE 802.1Q Tagged VLAN Commands... 403 Multicast VLAN Registration Commands...411 Routing Domain Command Examples... 413 Troubleshooting.... 415
Appendices and Index.... 423

Table of Contents

About This User's Guide.... 3 Document Conventions... 4 Safety Warnings.... 6 Contents Overview.... 9 Table of Contents.... 11 List of Figures.... 25 List of Tables..... 31
Part I: Introduction and Hardware... 35
Chapter 1 Getting to Know Your Switch.... 37
1.1 Introduction.... 37 1.1.1 Backbone Application.... 37 1.1.2 Bridging Example... 38 1.1.3 High Performance Switching Example... 38 1.1.4 IEEE 802.1Q VLAN Application Examples... 39
Chapter 2 Hardware Installation and Connection... 41
2.1 Freestanding Installation.... 41 2.2 Mounting the Switch on a Rack... 42 2.2.1 Rack-mounted Installation Requirements... 42 2.2.2 Attaching the Mounting Brackets to the Switch... 42 2.2.3 Mounting the Switch on a Rack.... 43
Chapter 3 Hardware Overview..... 45
3.1 Front Panel Connection.... 45 3.1.1 Console Port.... 46 3.1.2 Gigabit Ethernet Ports.... 46 3.1.3 SFP Slots.... 47 3.2 Rear Panel.... 48
Table of Contents 3.2.1 Power Connector... 49 3.2.2 External Backup Power Supply Connector... 49 3.3 LEDs..... 50

Chapter 34 VRRP.... 267

34.1 VRRP Overview.... 267 34.2 VRRP Status.... 268
Table of Contents 34.3 VRRP Configuration... 269 34.3.1 IP Interface Setup.... 269 34.3.2 VRRP Parameters.... 270 34.3.3 Configuring VRRP Parameters... 271 34.4 VRRP Configuration Summary... 272 34.5 VRRP Configuration Examples... 272 34.5.1 One Subnet Network Example... 272 34.5.2 Two Subnets Example... 274
Part V: Management, CLI, Troubleshooting.. 277
Chapter 35 Maintenance.... 279
35.1 The Maintenance Screen.... 279 35.2 Load Factory Default.... 280 35.3 Save Configuration.... 280 35.4 Reboot System.... 281 35.5 Firmware Upgrade.... 281.... 282.... 282 35.6 Restore a Configuration File 35.7 Backup a Configuration File
35.8 FTP Command Line.... 283 35.8.1 Filename Conventions... 283 35.8.2 FTP Command Line Procedure... 283 35.8.3 GUI-based FTP Clients... 284 35.8.4 FTP Restrictions.... 284
Chapter 36 Access Control..... 285
36.1 Access Control Overview.... 285 36.2 The Access Control Main Screen... 285 36.3 About SNMP.... 286 36.3.1 SNMP v3 and Security... 287 36.3.2 Supported MIBs.... 287 36.3.3 SNMP Traps.... 287 36.3.4 Configuring SNMP... 291 36.3.5 Configuring SNMP Trap Group 36.3.6 Setting Up Login Accounts... 293... 294
36.4 SSH Overview..... 296 36.5 How SSH works.... 296 36.6 SSH Implementation on the Switch... 297 36.6.1 Requirements for Using SSH... 297
Table of Contents 36.7 Introduction to HTTPS.... 297 36.8 HTTPS Example.... 298 36.8.1 Internet Explorer Warning Messages... 298 36.8.2 Netscape Navigator Warning Messages... 299 36.8.3 The Main Screen.... 299 36.9 Service Port Access Control 36.10 Remote Management.... 300.... 301
Chapter 37 Diagnostic.... 303

37.1 Diagnostic.... 303

Chapter 38 Syslog.... 305
38.1 Syslog Overview.... 305 38.2 Syslog Setup.... 305 38.3 Syslog Server Setup... 306
Chapter 39 Cluster Management.... 309
39.1 Cluster Management Status Overview... 309 39.2 Cluster Management Status... 310 39.2.1 Cluster Member Switch Management...311 39.3 Clustering Management Configuration... 312
Chapter 40 MAC Table.... 315
40.1 MAC Table Overview.... 315 40.2 Viewing the MAC Table.... 316
Chapter 41 IP Table..... 317
41.1 IP Table Overview.... 317 41.2 Viewing the IP Table.... 318
Chapter 42 ARP Table.... 319
42.1 ARP Table Overview... 319 42.1.1 How ARP Works.... 319 42.2 Viewing the ARP Table.... 319
Chapter 43 Routing Table.... 321
Table of Contents 43.1 Overview.... 321 43.2 Viewing the Routing Table.... 321
Chapter 44 Configure Clone.... 323
44.1 Configure Clone.... 323
Chapter 45 Introducing Commands... 325
45.1 Overview.... 325 45.2 Accessing the CLI... 325 45.2.1 The Console Port.... 325 45.3 The Login Screen.... 326 45.4 Command Syntax Conventions.... 326 45.5 Changing the Password... 327 45.6 Creating a New IP Interface.... 327 45.7 Privilege Levels.... 328 45.8 Command Modes... 328 45.9 Getting Help.... 329 45.9.1 List of Available Commands... 330 45.10 Using Command History... 331 45.11 Saving Your Configuration... 331 45.11.1 Switch Configuration File... 332 45.11.2 Logging Out.... 332 45.12 Command Summary.... 332 45.12.1 User Mode... 333 45.12.2 Enable Mode.... 334 45.12.3 General Configuration Mode... 343 45.12.4 interface port-channel Commands... 368 45.12.5 interface route-domain Commands... 373 45.12.6 config-vlan Commands... 375 45.13 mvr Commands.... 376

List of Tables Table 82 RIP..... 228 Table 83 OSPF vs. RIP.... 229 Table 84 OSPF: Router Types.... 229 Table 85 OSPF Status.... 232 Table 86 OSPF Status: Common Output Fields.... 232 Table 87 OSPF Configuration: Activating and General Settings.. 234 Table 88 OSPF Configuration: Area Setup... 235 Table 89 OSPF Configuration: Summary Table... 236 Table 90 OSPF Interface.... 237 Table 91 OSPF Virtual-Link..... 239 Table 92 IP Application > IGMP.... 244 Table 93 DVMRP.... 246 Table 94 DVMRP: Default Timer Values.... 248 Table 95 IP Multicast..... 250 Table 96 IP Application > DiffServ... 254 Table 97 IP Application > DiffServ > 2-rate 3 Color Marker... 255 Table 98 Default DSCP-IEEE 802.1p Mapping... 256 Table 99 IP Application > DiffServ > DSCP Setting.... 257 Table 100 IP Application > DHCP Status... 260 Table 101 IP Application > DHCP Server Status Detail... 261 Table 102 Relay Agent Information.... 262 Table 103 IP Application > DHCP > Global.... 262 Table 104 IP Application > DHCP > VLAN... 265 Table 105 VRRP Status.... 268 Table 106 VRRP Configuration: IP Interface.... 270 Table 107 VRRP Configuration: VRRP Parameters... 271 Table 108 VRRP Configuring: VRRP Parameters... 272 Table 109 Maintenance.... 279 Table 110 Filename Conventions.... 283 Table 111 Access Control Overview.... 285 Table 112 SNMP Commands.... 286 Table 113 SNMP System Traps.... 287 Table 114 SNMP InterfaceTraps.... 289 Table 115 AAA Traps..... 289 Table 116 SNMP IP Traps.... 290 Table 117 SNMP Switch Traps... 291 Table 118 Access Control: SNMP.... 292 Table 119 Access Control: SNMP: Trap Group... 294 Table 120 Access Control: Logins... 295 Table 121 Access Control: Service Access Control.... 301 Table 122 Access Control: Remote Management... 301 Table 123 Diagnostic..... 303 Table 124 Syslog Severity Levels.... 305
List of Tables Table 125 Syslog.... 306 Table 126 Syslog: Server Setup.... 307 Table 127 ZyXEL Clustering Management Specifications.. 309 Table 128 Cluster Management: Status...311 Table 129 FTP Upload to Cluster Member Example... 312 Table 130 Clustering Management Configuration... 313 Table 131 MAC Table.... 316 Table 132 IP Table.... 318 Table 133 ARP Table..... 320 Table 134 Routing Table Status.... 321 Table 135 Configure Clone.... 324 Table 136 Command Interpreter Mode Summary... 329 Table 137 Command Summary: User Mode... 333 Table 138 Command Summary: Enable Mode... 334 Table 139 Command Summary: Configuration Mode... 343 Table 140 interface port-channel Commands... 368 Table 141 interface route-domain Commands... 373 Table 142 Command Summary: config-vlan Commands... 375 Table 143 Command Summary: mvr Commands... 376 Table 144 Troubleshooting the Start-Up of Your Switch... 415 Table 145 Troubleshooting Accessing the Switch... 415 Table 146 Troubleshooting the Password.... 421 Table 147 Hardware Specifications.... 425 Table 148 Firmware Specifications.... 426 Table 149 Feature Specifications.... 428 Table 150 Standards Supported.... 429 Table 151 IP Address Network Number and Host ID Example... 432 Table 152 Subnet Masks.... 433 Table 153 Maximum Host Numbers.... 433 Table 154 Alternative Subnet Mask Notation.... 433 Table 155 Subnet 1.... 435 Table 156 Subnet 2.... 436 Table 157 Subnet 3.... 436 Table 158 Subnet 4.... 436 Table 159 Eight Subnets..... 436 Table 160 24-bit Network Number Subnet Planning... 437 Table 161 16-bit Network Number Subnet Planning... 437 Table 162 Commonly Used Services.... 441

21.1.1 VLAN Stacking Example
In the following example figure, both A and B are Service Providers Network (SPN) customers with VPN tunnels between their head offices and branch offices respectively. Both have an identical VLAN tag for their VLAN group. The service provider can separate these two VLANs within its network by adding tag 37 to distinguish customer A and tag 48 to distinguish customer B at edge device 1 and then stripping those tags at edge device 2 as the data frames leave the network.
Chapter 21 VLAN Stacking Figure 79 VLAN Stacking Example
21.2 VLAN Stacking Port Roles
Each port can have three VLAN stacking roles, Normal, Access Port and Tunnel (the latter is for Gigabit ports only). Select Normal for regular (non-VLAN stacking) IEEE 802.1Q frame switching. Select Access Port for ingress ports on the service provider's edge devices (1 and 2 in the VLAN stacking example figure). The incoming frame is treated as "untagged", so a second VLAN tag (outer VLAN tag) can be added.
Static VLAN Tx Tagging MUST be disabled on a port where you choose Normal or Access Port.
Select Tunnel Port (available for Gigabit ports only) for egress ports at the edge of the service provider's network. All VLANs belonging to a customer can be aggregated into a single service provider's VLAN (using the outer VLAN tag defined by SP VID).
Static VLAN Tx Tagging MUST be enabled on a port where you choose Tunnel Port.

Chapter 21 VLAN Stacking

21.3 VLAN Tag Format
A VLAN tag (service provider VLAN stacking or customer IEEE 802.1Q) consists of the following three fields.

Table 49 VLAN Tag Format

Type Priority VID
Type is a standard Ethernet type code identifying the frame and indicates that whether the frame carries IEEE 802.1Q tag information. SP TPID (Service Provider Tag Protocol Identifier) is the service provider VLAN stacking tag type. Many vendors use 0x8100 or 0x9100. TPID (Tag Protocol Identifier) is the customer IEEE 802.1Q tag. If the VLAN stacking port role is Access Port, then the Switch adds the SP TPID tag to all incoming frames on the service provider's edge devices (1 and 2 in the VLAN stacking example figure). If the VLAN stacking port role is Tunnel Port, then the Switch only adds the SP TPID tag to all incoming frames on the service provider's edge devices (1 and 2 in the VLAN stacking example figure) that have an SP TPID different to the one configured on the Switch. (If an incoming frames SP TPID is the same as the one configured on the Switch, then the Switch will not add the tag.) Priority refers to the IEEE 802.1p standard that allows the service provider to prioritize traffic based on the class of service (CoS) the customer has paid for. On the Switch, configure priority level of inner IEEE 802.1Q tag in the Port Setup screen. "0" is the lowest priority level and "7" is the highest. VID is the VLAN ID. SP VID is the VID for the second (service providers) VLAN tag.

Priority Apply

This chapter shows you how to configure various multicast features.

Multicast

22.1 Multicast Overview
Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender to 1 recipient) or Broadcast (1 sender to everybody on the network). Multicast delivers IP packets to just a group of hosts on the network. IGMP (Internet Group Management Protocol) is a network-layer protocol used to establish membership in a multicast group - it is not used to carry user data. Refer to RFC 1112, RFC 2236 and RFC 3376 for information on IGMP versions 1, 2 and 3 respectively.
22.1.1 IP Multicast Addresses
In IPv4, a multicast address allows a device to send packets to a specific group of hosts (multicast group) in a different subnetwork. A multicast IP address represents a traffic receiving group, not individual receiving devices. IP addresses in the Class D range (224.0.0.0 to 239.255.255.255) are used for IP multicasting. Certain IP multicast numbers are reserved by IANA for special purposes (see the IANA web site for more information).

22.1.2 IGMP Filtering

With the IGMP filtering feature, you can control which IGMP groups a subscriber on a port can join. This allows you to control the distribution of multicast services (such as content information distribution) based on service plans and types of subscription. You can set the Switch to filter the multicast group join reports on a per-port basis by configuring an IGMP filtering profile and associating the profile to a port.

22.1.3 IGMP Snooping

A Switch can passively snoop on IGMP packets transferred between IP multicast routers/ switches and IP multicast hosts to learn the IP multicast group membership. It checks IGMP packets passing through it, picks out the group registration information, and configures multicasting accordingly. IGMP snooping allows the Switch to learn multicast groups without you having to manually configure them.

Chapter 22 Multicast

The Switch forwards multicast traffic destined for multicast groups (that it has learned from IGMP snooping or that you have manually configured) to ports that are members of that group. IGMP snooping generates no additional network traffic, allowing you to significantly reduce multicast traffic passing through your Switch.
22.1.4 IGMP Snooping and VLANs
The Switch can perform IGMP snooping on up to 16 VLANs. You can configure the Switch to automatically learn multicast group membership of any VLANs. The Switch then performs IGMP snooping on the first 16 VLANs that send IGMP packets. This is referred to as auto mode. Alternatively, you can specify the VLANs that IGMP snooping should be performed on. This is referred to as fixed mode. In fixed mode the Switch does not learn multicast group membership of any VLANs other than those explicitly added as an IGMP snooping VLAN.

Accounting Update Period

Active Broadcast

Method

Privilege
23.2.4 Vendor Specific Attribute
RFC 2865 standard specifies a method for sending vendor-specific information between a RADIUS server and a network access device (for example, the Switch). A company can create Vendor Specific Attributes (VSAs) to expand the functionality of a RADIUS server. The Switch supports VSAs that allow you to perform the following actions based on user authentication: Limit bandwidth on incoming or outgoing traffic for the port the user connects to. Assign account privilege levels (See Section 45.7 on page 328 for more information on account privilege levels) for the authenticated user. The VSAs are composed of the following: Vendor-ID: An identification number assigned to the company by the IANA (Internet Assigned Numbers Authority). ZyXELs vendor ID is 890. Vendor-Type: A vendor specified attribute, identifying the setting you want to modify. Vendor-data: A value you want to assign to the setting.
Refer to the documentation that comes with your RADIUS server on how to configure VSAs for users authenticating via the RADIUS server.
The following table describes the VSAs supported on the Switch.

Table 63 Supported VSAs

FUNCTION Ingress Bandwidth Assignment ATTRIBUTE Vendor-Id = 890 Vendor-Type = 1 Vendor-data = ingress rate (Kbps in decimal format)
Chapter 23 Authentication & Accounting Table 63 Supported VSAs
FUNCTION Egress Bandwidth Assignment Privilege Assignment ATTRIBUTE Vendor-Id = 890 Vendor-Type = 2 Vendor-data = egress rate (Kbps in decimal format) Vendor-ID = 890 Vendor-Type = 3 Vendor-Data = "shell:priv-lvl=N" or Vendor-ID = 9 (CISCO) Vendor-Type = 1 (CISCO-AVPAIR) Vendor-Data = "shell:priv-lvl=N" where N is a privilege level (from 0 to 14).
Note: If you set the privilege level of a login account differently on the RADIUS server(s) and the Switch, the user is assigned a privilege level from the database (RADIUS or local) the Switch uses first for user authentication. 23.2.4.1 Tunnel Protocol Attribute You can configure tunnel protocol attributes on the RADIUS server (refer to your RADIUS server documentation) to assign a port on the Switch to a VLAN based on IEEE 802.1x authentication. The port VLAN settings are fixed and untagged. This will also set the ports VID. The following table describes the values you need to configure. Note that the bolded values in the table are fixed values as defined in RFC 3580.

24.1.1 DHCP Snooping Overview
Use DHCP snooping to filter unauthorized DHCP packets on the network and to build the binding table dynamically. This can prevent clients from getting IP addresses from unauthorized DHCP servers. 24.1.1.1 Trusted vs. Untrusted Ports Every port is either a trusted port or an untrusted port for DHCP snooping. This setting is independent of the trusted/untrusted setting for ARP inspection. You can also specify the maximum number for DHCP packets that each port (trusted or untrusted) can receive each second.
Chapter 24 IP Source Guard
Trusted ports are connected to DHCP servers or other switches. The Switch discards DHCP packets from trusted ports only if the rate at which DHCP packets arrive is too high. The Switch learns dynamic bindings from trusted ports.
The Switch will drop all DHCP requests if you enable DHCP snooping and there are no trusted ports.
Untrusted ports are connected to subscribers. The Switch discards DHCP packets from untrusted ports in the following situations: The packet is a DHCP server packet (for example, OFFER, ACK, or NACK). The source MAC address and source IP address in the packet do not match any of the current bindings. The packet is a RELEASE or DECLINE packet, and the source MAC address and source port do not match any of the current bindings. The rate at which DHCP packets arrive is too high. 24.1.1.2 DHCP Snooping Database The Switch stores the binding table in volatile memory. If the Switch restarts, it loads static bindings from permanent memory but loses the dynamic bindings, in which case the devices in the network have to send DHCP requests again. As a result, it is recommended you configure the DHCP snooping database. The DHCP snooping database maintains the dynamic bindings for DHCP snooping and ARP inspection in a file on an external TFTP server. If you set up the DHCP snooping database, the Switch can reload the dynamic bindings from the DHCP snooping database after the Switch restarts. You can configure the name and location of the file on the external TFTP server. The file has the following format:

Key Apply

34.3.2 VRRP Parameters
This section describes the VRRP parameters. 34.3.2.1 Advertisement Interval The master router sends out Hello messages to let the other backup routers know that it is still up and running. The time interval between sending the Hello messages is the advertisement interval. By default, a Hello message is sent out every second. If the backup routers do not receive a Hello message from the master router after this interval expires, it is assumed that the master router is down. Then the backup router with the highest priority becomes the master router.
All routers participating in the virtual router must use the same advertisement interval.
34.3.2.2 Priority Configure the priority level (1 to 254) to set which backup router to take over in case the master router goes down. The backup router with the highest priority will take over. The priority of the VRRP router that owns the IP address(es) associated with the virtual router is 255. 34.3.2.3 Preempt Mode If the master router is unavailable, a backup router assumes the role of the master router. However, when another backup router with a higher priority joins the network, it will preempt the lower priority backup router that is the master. Disable preempt mode to prevent this from happening. By default, a layer 3 device with the same IP address as the virtual router will become the master router regardless of the preempt mode.
34.3.3 Configuring VRRP Parameters
After you set up an IP interface, configure the VRRP parameters in the VRRP Configuration screen.
Figure 155 VRRP Configuration: VRRP Parameters
Table 107 VRRP Configuration: VRRP Parameters
LABEL Active Name Network Virtual Router ID Advertisement Interval Preempt Mode Priority Uplink Gateway Primary Virtual IP Secondary Virtual IP Add DESCRIPTION Select this option to enable this VRRP entry. Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes. Select an IP domain to which this VRRP entry applies. Select a virtual router number (1 to 7) for which this VRRP entry is created. You can configure up to seven virtual routers for one network. Specify the number of seconds between Hello message transmissions. Select this option to activate preempt mode. Enter a number (between 1 and 254) to set the priority level. The bigger the number, the higher the priority. Enter the IP address of the uplink gateway in dotted decimal notation. The Switch checks the link to the uplink gateway. Enter the IP address of the primary virtual router in dotted decimal notation. This field is optional. Enter the IP address of a secondary virtual router in dotted decimal notation. This field is ignored when you enter 0.0.0.0. Click Add to save your changes to the Switchs run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click Cancel to discard all changes made in this table. Click Clear to set the above fields back to the factory defaults.

Restore a previously saved configuration from your computer to the Switch using the Restore Configuration screen.
Figure 171 Restore Configuration
Type the path and file name of the configuration file you wish to restore in the File Path text box or click Browse to display the Choose File screen (below) from which you can locate it. After you have specified the file, click Restore. "config" is the name of the configuration file on the Switch, so your backup configuration file is automatically renamed when you restore using this screen.
35.7 Backup a Configuration File
Backing up your Switch configurations allows you to create various snap shots of your device from which you may restore at a later date. Back up your current Switch configuration to a computer using the Backup Configuration screen.
Figure 172 Backup Configuration
Follow the steps below to back up the current Switch configuration to your computer in this screen. 1 Click Backup. 2 Click Save to display the Save As screen. 3 Choose a location to save the file on your computer from the Save in drop-down list box and type a descriptive name for it in the File name list box. Click Save to save the configuration file to your computer.

35.8 FTP Command Line

This section shows some examples of uploading to or downloading files from the Switch using FTP commands. First, understand the filename conventions.
35.8.1 Filename Conventions
The configuration file (also known as the romfile or ROM) contains the factory default settings in the screens such as password, Switch setup, IP Setup, and so on. Once you have customized the Switchs settings, they can be saved back to your computer under a filename of your choosing. ZyNOS (ZyXEL Network Operating System sometimes referred to as the ras file) is the system firmware and has a bin filename extension.
Table 110 Filename Conventions
FILE TYPE Configuration File INTERNAL NAME config EXTERNAL NAME DESCRIPTION This is the configuration filename on the Switch. Uploading the config file replaces the specified configuration file system, including your Switch configurations, system-related data (including the default password), the error log and the trace log. *.bin This is the generic name for the ZyNOS firmware on the Switch.

Firmware

35.8.1.1 Example FTP Commands
ftp> put firmware.bin ras
This is a sample FTP session showing the transfer of the computer file "firmware.bin" to the Switch.
ftp> get config config.cfg
This is a sample FTP session saving the current configuration to a file called config.cfg on your computer. If your (T)FTP client does not allow you to have a destination filename different than the source, you will need to rename them as the Switch only recognizes config and ras. Be sure you keep unaltered copies of both files for later use.

Figure 185 Access Control: Service Access Control
The following table describes the fields in this screen.
Table 121 Access Control: Service Access Control
LABEL Services Active Service Port DESCRIPTION Services you may use to access the Switch are listed here. Select this option for the corresponding services that you want to allow to access the Switch. For Telnet, SSH, FTP, HTTP or HTTPS services, you may change the default service port by typing the new port number in the Server Port field. If you change the default port number then you will have to let people (who wish to use the service) know the new port number for that service. Type how many minutes a management session (via the web configurator) can be left idle before the session times out. After it times out you have to log in with your password again. Very long idle timeouts may have security risks. Click Apply to save your changes to the Switchs run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click Cancel to begin configuring this screen afresh.

36.10 Remote Management

From the Access Control screen, display the Remote Management screen as shown next. You can specify a group of one or more trusted computers from which an administrator may use a service to manage the Switch. Click Access Control to return to the Access Control screen.
Figure 186 Access Control: Remote Management
Table 122 Access Control: Remote Management
LABEL Entry Active Start Address End Address DESCRIPTION This is the client set index number. A client set is a group of one or more trusted computers from which an administrator may use a service to manage the Switch. Select this check box to activate this secured client set. Clear the check box if you wish to temporarily disable the set without deleting it. Configure the IP address range of trusted computers from which you can manage this Switch. The Switch checks if the client IP address of a computer requesting a service or protocol matches the range set here. The Switch immediately disconnects the session if it does not match.
Chapter 36 Access Control Table 122 Access Control: Remote Management (continued)
LABEL Telnet/FTP/ HTTP/ICMP/ SNMP/SSH/ HTTPS Apply DESCRIPTION Select services that may be used for managing the Switch from the specified trusted computers.

start-address

end-address
An example is shown next. Enable IGMP filtering on the Switch. Create an IGMP filtering profile filter1 and specify the multicast IP addresses in the range 224.255.255.0 to 225.255.255.255 to belong to this profile.
sysname(config)# igmp-filtering sysname(config)# igmp-filtering profile filter1 start-address 224.255.255.0 end-address 225.255.255.255

47.4 Enabling STP

Use the spanning-tree or the mrstp commands to enable and configure STP on the Switch. The difference between the commands is that spanning-tree only allows you to set up one spanning tree configuration and the mrstp command allows you to set up multiple ones. Syntax:
spanning-tree spanning-tree spanning-tree spanning-tree spanning-tree priority <0-61440> hello-time <1-10> maximum-age <6-40> forward-delay <4-30> <port-list> path-cost <1-65535> <port-list> priority <0-255>
mrstp <treeIndex> <cr> mrstp <treeIndex> priority <0-61440> mrstp <treeIndex> hello-time <1-10> maximum-age <6-40> forward-delay -> <4-30> mrstp interface <port-list> <cr> mrstp interface <port-list> path-cost <1-65535> mrstp interface <port-list> priority <0-255> mrstp interface <port-list> treeIndex <1-4>
spanning-tree mrstp <treeIndex> priority <0-61440>
Enables STP on the Switch. Enables a specific tree configuration. Specifies the bridge priority for the Switch. The lower the numeric value you assign, the higher the priority for this bridge. Bridge priority is used in determining the root switch, root port and designated port. The Switch with the highest priority (lowest numeric value) becomes the STP root switch. If all switches have the same priority, the switch with the lowest MAC address will then become the root switch. Bridge Priority determines the root bridge, which in turn determines Hello Time, Max Age and Forwarding Delay.

47.5.2 Resetting Commands
Use the no command to reset Switch settings to their default values. Syntax:

no https timeout

Resets the https session timeout to default. An example is shown next. The session timeout is reset to 300 seconds.
sysname(config)# no https timeout Cache timeout 300
47.5.3 Re-enable commands
The no command can also be used to re-enable features which have been disabled. Syntax:
no ip route <ip> <mask> inactive
<ip> <mask> inactive
Re-enables an ip route with the specified IP address and subnet mask.
An example is shown next. Enable the IP route with the IP address of 192.168.11.1 and subnet mask of 255.255.255.0. This ip route must have already been created and made inactive prior to reenable command being applied.
sysname(config)# no ip route 192.168.11.1 255.255.255.0 inactive
47.5.4 Other Examples of no Commands
In some cases the no command can disable a feature, disable an option of a feature or disable a feature on a port by port basis. 47.5.4.1 no trunk Syntax:
no trunk <T1|T2|T3|T4|T5|T6> no trunk <T1|T2|T3|T4|T5|T6> lacp no trunk <T1|T2|T3|T4|T5|T6> interface <port-list>
<T1|T2|T3|T4|T5|T6> <T1|T2|T3|T4|T5|T6> lacp <T1|T2|T3|T4|T5|T6> interface <port-list>
Disables the trunk group. Disables LACP in the trunk group. Removes ports from the trunk group.
An example is shown next. Disable trunk one (T1). Disable LAPC on trunk three (T3). Remove ports one, three, four and five from trunk two (T2).
sysname(config)# no trunk T1 sysname(config)# no trunk T3 lacp sysname(config)# no trunk T2 interface 1,3-5
47.5.4.2 no port-access-authenticator Syntax:
no port-access-authenticator no port-access-authenticator <port-list> reauthenticate no port-access-authenticator <port-list>

where =

<port-list> reauthenticate <port-list>
Disables port authentication on the Switch. Disables the re-authentication mechanism on the listed port(s). Disables authentication on the listed ports.
An example is shown next. Disable authentication on the Switch. Disable re-authentication on ports one, three, four and five. Disable authentication on ports one, six and seven.

Operating Environment Storage Environment Ground Wire Gauge
Appendix A Product Specifications Table 147 Hardware Specifications
Power Wire Gauge Fuse Specification 18 AWG or larger 250 VAC, T2A
Table 148 Firmware Specifications
FEATURE Default IP Address Default Subnet Mask Administrator User Name Default Password Number of Login Accounts Configurable on the Switch IP Routing Domain DESCRIPTION In band: 192.168.1.1 Out of band (Management port): 192.168.0.1 255.255.255.0 (24 bits) admin management accounts configured on the Switch. Authentication via RADIUS and TACACS+ also available. An IP interface (also known as an IP routing domain) is not bound to a physical port. Configure an IP routing domain to allow the Switch to route traffic between different networks. A VLAN (Virtual Local Area Network) allows a physical network to be partitioned into multiple logical networks. Devices on a logical network belong to one group. A device can belong to more than one group. With VLAN, a device cannot directly talk to or hear from devices that are not in the same group(s); the traffic must first go through a router. Use VLAN stacking to add an outer VLAN tag to the inner IEEE 802.1Q tagged frames that enter the network. By tagging the tagged frames (double-tagged frames), the service provider can manage up to 4,094 VLAN groups with each group containing up to 4,094 customer VLANs. This allows a service provider to provide different service, based on specific VLANs, for many different customers. Filter traffic based on the source and/or destination MAC address and VLAN group (ID). Use this feature to have the Switch assign IP addresses, an IP default gateway and DNS servers to computers on your network. The Switch supports IGMP snooping, enabling group multicast traffic to be only forwarded to ports that are members of that group; thus allowing you to significantly reduce multicast traffic passing through your Switch. With DiffServ, the Switch marks packets so that they receive specific per-hop treatment at DiffServ-compliant network devices along the route based on the application types and traffic flow. You can create a policy to define actions to be performed on a traffic flow grouped by a classifier according to specific criteria such as the IP address, port number or protocol type, etc. Queuing is used to help solve performance degradation when there is network congestion. Three scheduling services are supported: Strict Priority Queuing (SPQ) and Weighted Round Robin (WRR). This allows the Switch to maintain separate queues for packets from each individual source or flow and prevent a source from monopolizing the bandwidth. Port mirroring allows you to copy traffic going from one or all ports to another or all ports in order that you can examine the traffic from the mirror port (the port you copy the traffic to) without interference. Static routes tell the Switch how to forward IP traffic when you configure the TCP/IP parameters manually.