Configuration VLANs and Spanning Tree Avaya Ethernet Routing Switch 8300

Transcription

1 Configuration VLANs and Spanning Tree Avaya Ethernet Routing Switch NN , May 2011

2 2011 Avaya Inc. All Rights Reserved. Notice While reasonable efforts have been made to ensure that the information in this document is complete and accurate at the time of printing, Avaya assumes no liability for any errors. Avaya reserves the right to make changes and corrections to the information in this document without the obligation to notify any person or organization of such changes. Documentation disclaimer Avaya shall not be responsible for any modifications, additions, or deletions to the original published version of this documentation unless such modifications, additions, or deletions were performed by Avaya. End User agree to indemnify and hold harmless Avaya, Avaya's agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with, subsequent modifications, additions or deletions to this documentation, to the extent made by End User. Link disclaimer Avaya is not responsible for the contents or reliability of any linked Web sites referenced within this site or documentation(s) provided by Avaya. Avaya is not responsible for the accuracy of any information, statement or content provided on these sites and does not necessarily endorse the products, services, or information described or offered within them. Avaya does not guarantee that these links will work all the time and has no control over the availability of the linked pages. Warranty Avaya provides a limited warranty on this product. Refer to your sales agreement to establish the terms of the limited warranty. In addition, Avaya s standard warranty language, as well as information regarding support for this product, while under warranty, is available to Avaya customers and other parties through the Avaya Support Web site: Please note that if you acquired the product from an authorized Avaya reseller outside of the United States and Canada, the warranty is provided to you by said Avaya reseller and not by Avaya. Licenses THE SOFTWARE LICENSE TERMS AVAILABLE ON THE AVAYA WEBSITE, ARE APPLICABLE TO ANYONE WHO DOWNLOADS, USES AND/OR INSTALLS AVAYA SOFTWARE, PURCHASED FROM AVAYA INC., ANY AVAYA AFFILIATE, OR AN AUTHORIZED AVAYA RESELLER (AS APPLICABLE) UNDER A COMMERCIAL AGREEMENT WITH AVAYA OR AN AUTHORIZED AVAYA RESELLER. UNLESS OTHERWISE AGREED TO BY AVAYA IN WRITING, AVAYA DOES NOT EXTEND THIS LICENSE IF THE SOFTWARE WAS OBTAINED FROM ANYONE OTHER THAN AVAYA, AN AVAYA AFFILIATE OR AN AVAYA AUTHORIZED RESELLER, AND AVAYA RESERVES THE RIGHT TO TAKE LEGAL ACTION AGAINST YOU AND ANYONE ELSE USING OR SELLING THE SOFTWARE WITHOUT A LICENSE. BY INSTALLING, DOWNLOADING OR USING THE SOFTWARE, OR AUTHORIZING OTHERS TO DO SO, YOU, ON BEHALF OF YOURSELF AND THE ENTITY FOR WHOM YOU ARE INSTALLING, DOWNLOADING OR USING THE SOFTWARE (HEREINAFTER REFERRED TO INTERCHANGEABLY AS YOU AND END USER ), AGREE TO THESE TERMS AND CONDITIONS AND CREATE A BINDING CONTRACT BETWEEN YOU AND AVAYA INC. OR THE APPLICABLE AVAYA AFFILIATE ( AVAYA ). protected by copyright and other intellectual property laws including the sui generis rights relating to the protection of databases. You may not modify, copy, reproduce, republish, upload, post, transmit or distribute in any way any content, in whole or in part, including any code and software. Unauthorized reproduction, transmission, dissemination, storage, and or use without the express written consent of Avaya can be a criminal, as well as a civil, offense under the applicable law. Third-party components Certain software programs or portions thereof included in the Product may contain software distributed under third party agreements ( Third Party Components ), which may contain terms that expand or limit rights to use certain portions of the Product ( Third Party Terms ). Information regarding distributed Linux OS source code (for those Products that have distributed the Linux OS source code), and identifying the copyright holders of the Third Party Components and the Third Party Terms that apply to them is available on the Avaya Support Web site: Trademarks The trademarks, logos and service marks ( Marks ) displayed in this site, the documentation(s) and product(s) provided by Avaya are the registered or unregistered Marks of Avaya, its affiliates, or other third parties. Users are not permitted to use such Marks without prior written consent from Avaya or such third party which may own the Mark. Nothing contained in this site, the documentation(s) and product(s) should be construed as granting, by implication, estoppel, or otherwise, any license or right in and to the Marks without the express written permission of Avaya or the applicable third party. Avaya is a registered trademark of Avaya Inc. All other trademarks are the property of their respective owners. Downloading documents For the most current versions of documentation, see the Avaya Support Web site: Contact Avaya Support Avaya provides a telephone number for you to use to report problems or to ask questions about your product. The support telephone number is in the United States. For additional support telephone numbers, see the Avaya Web site: support Copyright Except where expressly stated otherwise, no use should be made of materials on this site, the Documentation(s) and Product(s) provided by Avaya. All content on this site, the documentation(s) and the product(s) provided by Avaya including the selection, arrangement and design of the content is owned either by Avaya or its licensors and is 2 Configuration VLANs and Spanning Tree May 2011

3 Contents Chapter 1: New in this release...9 Features...9 IP spoof detection...9 STP BPDU filtering...9 Other changes...10 Customer service...10 Chapter 2: Introduction...11 Chapter 3: VLAN and spanning tree fundamentals...13 VLAN overview...13 Policy-based VLANs...15 Independent VLAN Learning...18 VLAN tagging and port types...18 VLAN virtual router interfaces...20 VLAN implementation on the Ethernet Routing Switch VLAN configuration rules...22 VLAN feature support and scaling...22 Network Load Balancing Support...23 VLAN MAC-layer bridging and filtering...25 IP spoofing prevention within a VLAN...25 Spanning tree overview...26 Spanning Tree Protocol...26 RSTP and MSTP...30 Chapter 4: VLAN configuration using Device Manager...37 Viewing defined VLANs using Device Manager...37 Port-based VLANs configuration using Device Manager...39 Creating a port-based VLAN using Device Manager...39 Configuring an IP address for a VLAN using Device Manager...41 Configuring port-based VLANs using Device Manager...41 Viewing IP spoof detection information using Device Manager...43 Configuring policy-based VLANs using Device Manager...44 Creating user-defined, protocol-based VLANs using Device Manager...45 Configuring advanced VLAN operations using Device Manager...46 Configuring advanced VLAN features using Device Manager...47 Configuring VLAN forwarding filters using Device Manager...49 Changing VLAN port membership using Device Manager...50 Configuring MAC address autolearning on a VLAN using Device Manager...51 Modifying autolearned MAC addresses using Device Manager...52 Managing VLAN bridging using Device Manager...52 Configuring the forwarding database timeout using Device Manager...53 Viewing the forwarding database using Device Manager...54 Clearing learned MAC addresses by VLAN using Device Manager...55 Clearing learned MAC addresses for all VLANs by port using Device Manager...55 Configuring static forwarding using Device Manager...56 Configuring a MAC-layer bridge filter using Device Manager...57 Configuring Layer 2 multicast MAC filtering using Device Manager...59 Configuration VLANs and Spanning Tree May

4 Chapter 5: VLAN configuration using the CLI...61 VLAN configuration and management using the CLI...64 Creating a port-based VLAN using the CLI...65 Creating a protocol-based VLAN using the CLI...66 Assigning an IP address to a VLAN using the CLI...68 Deleting an IP address from a VLAN using the CLI...69 Viewing basic VLAN configuration using the CLI...69 Performing a general VLAN action using the CLI...70 Viewing general VLAN information using the CLI...71 Adding a multilink trunk to a VLAN using the CLI...71 Configuring VLAN forwarding database entries using the CLI...72 Configuring VLAN forwarding database filters using the CLI...73 Adding VLAN static forwarding database members using the CLI...74 Viewing VLAN forwarding database information using the CLI...75 Viewing forwarding database filters using the CLI...76 Adding ports to a VLAN using the CLI...76 Removing ports from a VLAN using the CLI...77 Configuring NLB using the CLI...78 Viewing VLAN port member status using the CLI...80 Configuring a VLAN name using the CLI...80 Deleting a VLAN using the CLI...81 Enabling VLAN tagging on a port using the CLI...81 Assigning untagged frames to the default VLAN using the CLI...82 Viewing advanced VLAN information using the CLI...82 IP spoof detection configuration using the CLI...83 Configuring IP spoof detection using the CLI...83 Viewing IP spoof detection information using the CLI...84 Configuring static multicast MAC entries using the CLI...85 Viewing VLAN static MAC information using the CLI...87 Viewing VLAN manual edit MAC information using the CLI...87 Viewing VLAN autolearn information using the CLI...87 Viewing VLAN ARP information using the CLI...88 Viewing VLAN IGMP information using the CLI...88 Viewing VLAN static multicast information using the CLI...89 Viewing the PID range for a user-defined, protocol-based VLAN using the CLI...89 Chapter 6: VLAN configuration using the ACLI...91 VLAN configuration and management using the ACLI...94 Creating a port-based VLAN using the ACLI...95 Creating a protocol-based VLAN using the ACLI...96 Creating a user-defined, protocol-based VLAN using the ACLI...97 Assigning an IP address to a VLAN using the ACLI...98 Deleting an IP address from a VLAN using the CLI...99 Performing a general VLAN action using the ACLI Adding a multilink trunk to a VLAN using the ACLI Viewing general VLAN information using the ACLI Configuring VLAN forwarding database entries using the ACLI Deleting VLAN forwarding database entries using the ACLI Configuring VLAN forwarding database filters using the ACLI Deleting VLAN forwarding database filters using the ACLI Adding VLAN static forwarding database members using the ACLI Configuration VLANs and Spanning Tree May 2011

5 Removing VLAN static forwarding database members using the ACLI Viewing VLAN forwarding database information using the ACLI Viewing VLAN forwarding database filters using the ACLI Adding ports to a VLAN using the ACLI Removing ports from a VLAN using the ACLI Configuring NLB using the ACLI Viewing VLAN port information using the ACLI Configuring a VLAN name using the ACLI Deleting a VLAN using the ACLI Configuring VLAN tagging using the ACLI Viewing specific VLAN information using the ACLI Viewing advanced VLAN information using the ACLI IP spoof detection configuration using the ACLI Enabling IP spoof detection using the ACLI Disabling IP spoof detection using the ACLI Viewing IP spoof detection information using the ACLI Configuring static multicast MAC entries using the ACLI Removing VLAN static multicast MAC entries using the ACLI Viewing VLAN static multicast information using the ACLI Viewing VLAN IP information using the ACLI Viewing VLAN static MAC information using the ACLI Viewing VLAN manual edit MAC information using the ACLI Viewing VLAN IGMP information using the ACLI Viewing VLAN autolearn information using the ACLI Viewing the PID range for a user-defined VLAN using the ACLI Chapter 7: Spanning Tree configuration using Device Manager Configuring the STP mode using Device Manager Configuring STP BPDU Filtering using Device Manager Configuring Spanning Tree Groups using Device Manager Viewing STG status using Device Manager Enabling or disabling STG on a port using Device Manager Viewing STG ports using Device Manager Configuring topology change detection using Device Manager RSTP Configuration using Device Manager Configuring global RSTP using Device Manager Configuring port RSTP parameters using Device Manager Viewing port RSTP status using Device Manager MSTP configuration using Device Manager Configuring global MSTP parameters using Device Manager Configuring port CIST for MSTP using Device Manager Configuring MSTI bridges for MSTP using Device Manager Configuring MSTI ports for MSTP using Device Manager Chapter 8: Spanning Tree configuration using the CLI Configuring the STP mode using the CLI STP BPDU Filtering configuration using the CLI Configuring STP BPDU Filtering using the CLI Viewing STP BPDU Filtering status using the CLI STG configuration using the CLI Configuring STG global settings using the CLI Creating an STG using the CLI Configuration VLANs and Spanning Tree May

6 Configuring STG parameters using the CLI Viewing STG configuration using the CLI Viewing STG status using the CLI Configuring STG port parameters using the CLI Viewing general port STG information using the CLI Viewing extended port STG information using the CLI Configuring topology change detection using the CLI RSTP configuration using the CLI Configuring RSTP using the CLI Viewing global RSTP configuration using the CLI Viewing global RSTP status using the CLI Configuring Ethernet RSTP parameters using the CLI Viewing port RSTP configuration using the CLI Viewing port RSTP status using the CLI Viewing port RSTP role using the CLI MSTP configuration using the CLI Configuring global MSTP parameters using the CLI Configuring an MSTP region using the CLI Viewing MSTP configuration using the CLI Configuring MSTP CIST using the CLI Configuring MSTP MSTI using the CLI Viewing MSTP instance information using the CLI Configuring Ethernet MSTP CIST using the CLI Configuring Ethernet MSTP MSTI using the CLI Viewing MSTP port information using the CLI Viewing MSTP status using the CLI Chapter 9: Spanning Tree configuration using the ACLI Configuring the STP mode using the ACLI Disabling STP mode using the ACLI STP BPDU Filtering configuration using the ACLI Enabling STP BPDU Filtering using the ACLI Disabling STP BPDU Filtering using the ACLI Configuring the STP BPDU Filtering port timer using the ACLI Configuring STP BPDU Filtering default values using the ACLI Viewing STP BPDU Filtering status using the ACLI STG configuration using the ACLI Configuring STG global settings using the ACLI Configuring STP using the ACLI Deleting an STG using the ACLI Viewing STG configuration using the ACLI Configuring STG port parameters using the ACLI Viewing port STG information using the ACLI RSTP configuration using the ACLI Configuring global RSTP using the ACLI Disabling group STP using the ACLI Viewing global RSTP configuration using the ACLI Viewing global RSTP status using the ACLI Configuring port RSTP parameters using the ACLI Disabling port RSTP using the ACLI Viewing port RSTP information using the ACLI Configuration VLANs and Spanning Tree May 2011

7 MSTP configuration using the ACLI Configuring MSTP using the ACLI Viewing MSTP configuration using the ACLI Configuring MSTP MSTI using the ACLI Viewing MSPT MSTI configuration information using the ACLI Configuring Ethernet MSTP CIST using the ACLI Disabling Ethernet MSTP CIST force-port-state using the ACLI Configuring Ethernet MSTP MSTI using the ACLI Viewing MSTP port information using the ACLI Viewing MSTP status using the ACLI Chapter 10: RSTP and MSTP CLI Configuration examples Configuring RSTP using the CLI Configuring MSTP using the CLI Chapter 11: Customer Service Getting technical documentation Getting product training Getting help from a distributor or reseller Getting technical support from the Avaya Web site Index Configuration VLANs and Spanning Tree May

8 8 Configuration VLANs and Spanning Tree May 2011

9 Chapter 1: New in this release The following sections detail what's new in Avaya Ethernet Routing Switch 8300 Configuration VLANs and Spanning Tree, NN for Release 4.2: Features on page 9 Other changes on page 10 Features See the following sections for information about feature changes: IP spoof detection IP spoof detection is a new feature for Release 4.2. With IP spoof detection, you can block the external use of the switch IP address. For more information see: IP spoofing prevention within a VLAN on page 25 Configuring port-based VLANs using Device Manager on page 41 Viewing IP spoof detection information using Device Manager on page 43 IP spoof detection configuration using the CLI on page 83 IP spoof detection configuration using the ACLI on page 115 STP BPDU filtering Spanning Tree Protocol (STP) Bridge Protocol Data Unit (BPDU) filtering is a new feature for Release 4.2. With STP BPDU filtering, a network administrator can prevent unknown devices from influencing an existing spanning tree topology and from flooding the network with BPDUs. For more information see: Spanning Tree BPDU Filtering on page 29 Configuring STP BPDU Filtering using Device Manager on page 126 STP BPDU Filtering configuration using the CLI on page 159 STP BPDU Filtering configuration using the ACLI on page 194 Configuration VLANs and Spanning Tree May

10 New in this release Other changes For information about changes that are not feature-related, see the following section: Customer service on page 10 Customer service Customer service chapter is added to this document. This chapter describes the complete range of services and support that Avaya provides to customers. For more information about Avaya support, see Customer Service on page Configuration VLANs and Spanning Tree May 2011

11 Chapter 2: Introduction The Avaya Ethernet Routing Switch 8300 is a flexible and multifunctional switch that supports a diverse range of network architectures and protocols. This guide contains conceptual and procedural information to support the administration of the Avaya Ethernet Routing Switch For more information about the available user interfaces and how to use edit commands and special terminal characters, see Avaya Ethernet Routing Switch 8300 User Interface Fundamentals, NN Navigation VLAN and spanning tree fundamentals on page 13 VLAN configuration using Device Manager on page 37 VLAN configuration using the CLI on page 61 VLAN configuration using the ACLI on page 91 Spanning Tree configuration using Device Manager on page 125 Spanning Tree configuration using the CLI on page 155 Spanning Tree configuration using the ACLI on page 189 RSTP and MSTP CLI Configuration examples on page 225 Configuration VLANs and Spanning Tree May

12 Introduction 12 Configuration VLANs and Spanning Tree May 2011

13 Chapter 3: VLAN and spanning tree fundamentals This chapter describes virtual local area network (VLAN) and spanning tree concepts and features supported on the Avaya Ethernet Routing Switch Navigation VLAN overview on page 13 Spanning tree overview on page 26 VLAN overview A virtual local area network (VLAN) is a switched network logically segmented by functions, project teams, or applications without regard to the physical location of users. Use a VLAN to divide the LAN into smaller groups without interfering with the physical network. With VLAN practical applications, you can perform the following tasks: create VLANs, workgroups, or common interest groups create VLANs, workgroups, or workgroups for specific types of network traffic add, move, or delete members from workgroups without making physical changes to the network By dividing the network into separate VLANs, you can create separate broadcast domains. This arrangement conserves bandwidth, especially in networks that support broadcast and multicast applications that flood the network with traffic. A VLAN workgroup can include members from several dispersed physical segments on the network, which improves traffic flow between them. The Ethernet Routing Switch 8300 performs the Layer 2 switching functions necessary to transmit information within VLANs and the Layer 3 routing functions necessary for VLANs to communicate with one another. You can define a VLAN for a single switch or it can span multiple switches. A VLAN consists of a group of ports that define a logical broadcast domain. These ports can belong to a single VLAN or they can be spread across multiple VLANs. In a VLAN-aware switch, every frame received on a port is classified as belonging to only one VLAN. When a broadcast, multicast, or unknown destination frame requires flooding by a VLAN-aware switch, Configuration VLANs and Spanning Tree May

14 VLAN and spanning tree fundamentals the system sends the frame through only the other active ports that belong to the same VLAN. The default switch configuration groups all ports into the port-based default VLAN 1. You cannot delete this VLAN from the system, and it is statically bound to the default Spanning Tree Group (STG). The Ethernet Routing Switch 8300 supports port-based VLANs and policy-based VLANs. VLAN overview navigation Port-based VLANs on page 14 Policy-based VLANs on page 15 Independent VLAN Learning on page 18 VLAN tagging and port types on page 18 VLAN virtual router interfaces on page 20 VLAN implementation on the Ethernet Routing Switch 8300 on page 21 VLAN configuration rules on page 22 VLAN feature support and scaling on page 22 Network Load Balancing Support on page 23 VLAN MAC-layer bridging and filtering on page 25 IP spoofing prevention within a VLAN on page 25 Port-based VLANs Port-based VLAN consist of ports explicitly configured as members of the VLAN. When you create a port-based VLAN, you assign a VLAN identification number (VID) and specify which ports belong to the VLAN. Use the VID to coordinate VLANs across multiple switches. The default switch configuration groups all ports into the port-based default VLAN 1. You cannot delete this VLAN from the system, and it is statically bound to the default STG. The example in the following figure shows two port-based VLANs: one for the marketing department and one for the sales department. Ports are assigned to each port-based VLAN. A change in the sales area requires the sales representative at port 3/1 (the first port in the I/ O module in chassis slot 3) to move to the marketing department. You can perform the move without physically moving cables. With a port-based VLAN, you can indicate in Device Manager or the CLI that port 3/1 in the sales VLAN now belongs to the marketing VLAN. 14 Configuration VLANs and Spanning Tree May 2011

15 VLAN overview Figure 1: Port-based VLAN A port can belong to one port-based VLAN and many policy-based VLANs. Policy-based VLANs A policy-based VLAN consists of ports that the system dynamically adds to the VLAN on the basis of the traffic that comes into the port. The Ethernet Routing Switch 8300 supports a total of 500 unique policy-based VLANS. However, some restrictions exist on the number of policy-based VLAN types. Policy-based VLANs navigation Port membership types on page 15 Protocol-based VLANs on page 16 User-defined, protocol-based VLANs on page 17 Port membership types In a policy-based VLAN, you can designate a port to always or never be a member of the VLAN that describes the port membership types. Configuration VLANs and Spanning Tree May

16 VLAN and spanning tree fundamentals The traffic that comes into the port determines the port membership in a VLAN. Avaya recommends that you designate some ports as always a member of the VLAN. If a server or router connects to a port, designate that port as always a member of a VLAN. The following table describes port membership types for policy-based VLANs. Table 1: Port membership types for policy-based VLANs Membership type Static (Always a member) Not allowed to join (Never a member) Description Static members remain active members of the VLAN when configured as belonging to that VLAN. Use this membership type in policy-based and port-based VLANs. In policy-based VLANs, the tagged ports are usually configured as static members. In port-based VLANs, all ports are always static members. Ports of this type are cannot join the VLAN. Protocol-based VLANs Use protocol-based VLANs to segment your network into broadcast domains according to the network protocols in use. You can automatically confine traffic generated by a network protocol IPX and Appletalk to its own VLAN. All ports within a protocol-based VLAN must belong to the same port-based VLAN. However, the same port within a port-based VLAN can belong to multiple protocol-based VLANs. Port tagging is not required for a port to belong to multiple protocol-based VLANs. The Ethernet Routing Switch 8300 supports the following protocol-based VLANs: IP version 4 (protocol-ipether2) Novell IPX on Ethernet frames (protocol-ipx802.3) Novell IPX on IEEE frames (protocol-ipx802.2) Novell IPX on Ethernet SNAP frames (protocol-ipxsnap) Novell IPX on Ethernet Type 2 frames (ipxether2) AppleTalk on Ethernet Type 2 and Ethernet SNAP frames (protocol-apltkether2snap) DEC LAT Protocol (protocol-decether2) Other DEC protocols (protocol-decotherether2) IBM SNA on IEEE frames (protocol-sna802.2) IBM SNA on Ethernet Type 2 frames (protocol-snaether2) NetBIOS Protocol (protocol-netbios) 16 Configuration VLANs and Spanning Tree May 2011

17 VLAN overview Xerox XNS (protocol-xnsether2) Banyan VINES (protocol-vinesether2) IP version 6 (protocol-ipv6ether2) Reverse Address Resolution Protocol (protocol-rarpether2) User-defined protocols (protocol-userdef) Example: IPX protocol-based VLAN You can create a VLAN for the IPX protocol and place ports that carry substantial IPX traffic into this new VLAN. In the following figure, the network manager placed ports 7/1, 3/1, and 3/2 in an IPX VLAN. These ports still belong to their respective marketing and sales VLANs, but they are also new members of the IPX VLAN. This arrangement localizes traffic and ensures that only three ports flood with IPX broadcast packets. Figure 2: Dynamic protocol-based VLAN User-defined, protocol-based VLANs You can create user-defined, protocol-based VLANs to support networks with nonstandard protocols. For user-defined, protocol-based VLANs, you can specify the Protocol Identifier (PID) for the VLAN. Frames that match the specified PID for the following items are assigned to that user-defined VLAN: the ethertype for Ethernet type 2 frames the PID in Ethernet Sub-Network Access Protocol (SNAP) frames the Destination Service Access Point (DSAP) or Source Service Access Point (SSAP) value in Ethernet frames The following table lists the predefined policy PIDs, which you cannot use as user-defined PIDs. Configuration VLANs and Spanning Tree May

18 VLAN and spanning tree fundamentals Table 2: PIDs not available for user-defined, protocol-based VLANs PID (hex) Description 04xx, xx04 sna802dot2 F0xx, xxf0 netbios DC Overlaps with frame length 0600, 0807 xns 0BAD VINES 4242 IEEE 802.1D BPDUs 0800 IP 0806 ARP 8035 RARP 809B, 80F3 AppleTalk 8100 Reserved by IEEE 802.1Q for tagged frames 8137, 8138 ipxethernet2 and ipxsnap 80D5 snaethernet2 86DD ipv IEEE 802.3x pause frames 9000 Used by diagnostic loopback frames Independent VLAN Learning You can use the independent VLAN learning (IVL) mode to learn MAC addresses in the context of the VLAN to which they belong. In the Ethernet Routing Switch 8300, each VLAN contains an independent, forwarding database. Different VLANs can learn the same MAC address and, based on the VLAN that receives traffic for this address, the switch can forward to this MAC address without confusion. Before a switch can look up the source or destination MAC address in a received frame, or before it can decide whether to bridge or route a frame, it must determine which VLAN the frame belongs to. VLAN tagging and port types The Ethernet Routing Switch 8300 supports the IEEE 802.1Q specification for tagging frames and coordinating VLANs across multiple switches. 18 Configuration VLANs and Spanning Tree May 2011

19 VLAN overview Figure 3: VLAN tag insertion on page 19 shows the additional 4-octet (tag) header inserted into a frame after the source address and before the frame type. The tag contains the VLAN ID associated with the frame. Figure 3: VLAN tag insertion VLAN tagging and port types navigation 802.1Q tagged ports on page 19 Treatment of tagged and untagged frames on page Q tagged ports Tagging a frame adds four octets, making the frame bigger than the traditional maximum frame size. These frames are sometimes called baby giant frames. If a device does not support IEEE 802.1Q tagging, it can experience problems interpreting tagged frames and receiving baby giant frames. On the Ethernet Routing Switch 8300, your port level configuration determines whether the system sends or receives tagged frames. Configured tagging as true or false for the port, which applies to all VLANs on that port. After you enable tagging on a nontagged port, you lose the previous configuration of VLANs, STGs, and Multilink Trunking (MLT) for the port. The port resets and runs Spanning Tree Protocol, which breaks connectivity while the protocol goes through the normal listening and learning states before the forwarding state. An Ethernet Routing Switch 8300 port with tagging enabled sends frames explicitly tagged with a VLAN ID. Use tagged ports to multiplex traffic that belongs to multiple VLANs to other IEEE-802.1Q-compliant devices. If you disable tagging on a port, it does not send tagged frames. A nontagged port connects the Ethernet Routing Switch 8300 to devices that do not support IEEE 802.1Q tagging. If a tagged frame forwards out a port on which tagging is configured as false, the switch removes the tag from the frame before it sends it out the port. Configuration VLANs and Spanning Tree May

20 VLAN and spanning tree fundamentals Treatment of tagged and untagged frames AnEthernet Routing Switch 8300 associates a frame with a VLAN basedon the data content of the frame and the configuration of the ingressport. Whether the frame is tagged or untagged dictates how that frameis treated. If a tagged port receives a tagged frame with a VLAN ID specified in the tag, the Ethernet Routing Switch 8300 directs it to that VLAN if the VLAN is present. If that VLAN is not configured on the ingress port the frame is dropped. For tagged frames received on an untagged port, you can configure that port to either discard the frame or accept it. Discarding tagged frames on an untagged port does not apply to the port-based VLANs. If you choose not to discard tagged frames, the Ethernet Routing Switch 8300 sends the frame to the default VLAN assigned to the ingress port. For untagged frames, content of the frame itself implies VLAN membership. For untagged frames received on a tagged port, you can configure the port to either discard or accept the frame. If you configure a tagged port to accept untagged frames, the port must be assigned to the default port-based VLAN in spanning tree group 1 (STG1). On the Ethernet Routing Switch 8300 you can configure tagged ports to send untagged frames on the default VLAN of the port. MLT ports do not support this feature and it becomes disabled when you add a port to an MLT. You cannot apply VLAN port tagging on access ports. Ports are disabled by default. Where the system forwards the frame is based on the VLAN that receives the frame and the forwarding options available for that VLAN. The Ethernet Routing Switch 8300 tries to associate untagged frames received on untagged ports with a VLAN in the following order: 1. Does the frame belong to a protocol-based VLAN? 2. What is the port-based VLAN of the receiving port? If the frame meets none of the preceding criteria, the switch discards the frame. A nontagged port can belong to multiple VLANs of the same type, but cannot belong to the same Spanning Tree Group (STG). VLAN virtual router interfaces Virtual router interfaces correspond to routing on a virtual port associated with a VLAN. This type of routing routes IP traffic to and from a VLAN. Because a port can belong to multiple VLANs (configured for routing on the switch or not), no one-to-one correspondence exists between the physical port and the router interface. For VLAN routing, the router interface for the VLAN is called a virtual router interface because the IP address is assigned to an interface on the routing entity in the switch. This initial interface has a one-to-one correspondence with a VLAN on a switch. 20 Configuration VLANs and Spanning Tree May 2011

21 VLAN overview VLAN implementation on the Ethernet Routing Switch 8300 This section describes how to implement VLANs on an Ethernet Routing Switch VLAN implementation on the Ethernet Routing Switch 8300 navigation Default VLAN on page 21 Unassigned VLAN on page 21 Default VLAN Ethernet Routing Switch 8300 devices arrive factory-configured with all ports in a port-based default VLAN and default Spanning Tree Group (STG) 1. With all ports in this default VLAN, the switch behaves as a Layer 2 switch. The default VLAN always includes a VLAN ID of 1 and is port-based. You cannot delete the default VLAN. Unassigned VLAN The unassigned port-based VLAN acts as a placeholder for ports removed from other portbased VLANs. Ports can belong to policy-based VLANs and to the unassigned VLAN. If a frame does not meet policy criteria and no underlying port-based VLAN exists, the port belongs to the unassigned VLAN and the system drops the frame. Only ports in the unassigned VLAN have no STG association, so they do not participate in Spanning Tree Protocol negotiation; that is, ports in the unassigned VLAN do not send out Bridge Protocol Data Units (BPDU). You cannot delete or view the unassigned VLAN. If you delete an STG, the ports move to the unassigned VLAN, and you can later assign them to another STG. Moving the ports to the unassigned VLAN avoids creating unwanted loops and duplicate connections. If you disable routing in these ports, the ports are completely isolated and no Layer 2 or Layer 3 functionality is provided. You can use the unassigned VLAN for security concerns or when you use a port to monitor a mirrored port. Configuration VLANs and Spanning Tree May

22 VLAN and spanning tree fundamentals VLAN configuration rules The following VLAN rules exist for the EthernetRouting Switch In addition to the default VLAN, the Ethernet Routing Switch 8300 supports 4000 VLANs. VLAN IDs range in value from 1 to If you enable tagging on a port in a VLAN, you lose the STG configuration for that port. To preserve VLAN assignment of ports, enable tagging on the ports before you assign the ports to VLANs. A tagged port can belong to multiple VLANs and multiple STGs. When a tagged port belongs to multiple spanning tree groups, the BPDUs are tagged for all spanning tree groups except for STG 1. The default is STG 1. An untagged port can belong to only one port-based VLAN. A port in a port-based VLAN can belong to other policy-based VLANs. An untagged port can belong to only one policy-based VLAN for a protocol. For example, a port can belong to only one policy-based VLAN where the policy is IPX802dot2 protocol. A VLAN cannot span multiple spanning tree groups; that is, one STG must contain all the ports in the VLAN. STG IDs can range in value from 1 to 64. The following order of precedence determines the VLAN membership of a frame: - VLAN ID in the VLAN tag of the frame - protocol-based VLAN - port-based VLAN VLAN feature support and scaling The following table summarizes features supported on the Ethernet Routing Switch 8300 modules. Important: This table changes frequently. For more information about the latest scalability information, see the release notes that came with your switch. Table 3: VLAN support in the Ethernet Routing Switch 8300 Feature Number of VLANs 4096 Port-based VLANs Supported 22 Configuration VLANs and Spanning Tree May 2011

23 VLAN overview Feature Policy-based VLANs Protocol-based Source MAC-based IEEE 802.1Q tagging IP routing and VLANs IPX routing IPX VLANs Special VLANs Default VLAN Unassigned VLAN Brouter ports Supported Not supported Supported Supported Not supported Supported Supported Supported Not supported Network Load Balancing Support Network Load Balancing (NLB) support is a clustering technology that Microsoft includes in the Windows 2000 Advanced Server and Datacenter Server operating systems. NLB increases the scalability and availability of TCP- and IP-based services such as Web, Terminal Services, Virtual Private Networking, and streaming media servers. To scale the performance of a server-based program, NLB distributes client requests among multiple servers within a cluster of hosts. Figure 4: Two-host cluster on page 24 shows an example of a cluster of hosts. With NLB, all hosts receive each incoming IP packet, but only the intended recipients accept the packet. The cluster hosts can respond concurrently to requests from different clients or to multiple requests from the same client. Configuration VLANs and Spanning Tree May

24 VLAN and spanning tree fundamentals Figure 4: Two-host cluster Network Load Balancing Support modes of operation NLB supports three modes of operation: unicast mode of operation multicast mode of operation Internet Group Management Protocol (IGMP) multicast mode of operation Unicast mode of operation In unicast mode, NLB replaces the MAC address of the network adapter with a virtual cluster MAC address. By masking the cluster MAC address, NLB creates a bogus MAC address on each host adapter. Therefore, all NLB host adapters in a cluster share a common cluster MAC address, and all the hosts in the cluster receive all the frames forwarded to the cluster MAC address. After you enable NLB, the bogus MAC address appears in the Ethernet frame header, and the Ethernet Routing Switch 8300 learns this bogus address rather than the cluster MAC address. This process ensures that the Ethernet switch does not learn the cluster MAC addresses on multiple ports. After a client or switch sends an ARP request for the MAC address of the virtual IP address of the cluster, the ARP response from the cluster hosts contains the virtual cluster MAC address in the payload rather than the bogus MAC addresses. Multicast mode of operation In this mode, NLB assigns a multicast MAC address to all hosts in the cluster but retains the built-in address of the network adapter. This mode does not need a bogus MAC address. 24 Configuration VLANs and Spanning Tree May 2011

25 VLAN overview After you enable NLB, the adapter MAC address appears in the Ethernet frame header. The Ethernet switch learns this adapter MAC address rather than the cluster MAC address. This process ensures that the Ethernet switch does not learn the cluster MAC addresses on multiple ports. NLB uses the multicast MAC address for client-to-cluster traffic and the adapter MAC address for network traffic specific to the host computer. After a client or switch sends an ARP request for the MAC address of the virtual IP address of the cluster, the ARP response from the cluster hosts contains the cluster MAC virtual Multicast address in the payload rather than the hardware MAC addresses. IGMP multicast mode of operation In this mode, NLB assigns an IP multicast MAC address to all hosts in the cluster but retains the built-in address of the network adapter. This mode does not need a false MAC address. NLB supports multicast flood suppression by implementing IGMP. The cluster hosts send the join message for a predefined group, and the multicast MAC is the virtual MAC address of the cluster hosts. After a client or switch sends an ARP request for the MAC address of the virtual IP address of the cluster, the ARP response from the cluster hosts contains the cluster MAC virtual multicast address in the payload rather than the hardware MAC addresses. VLAN MAC-layer bridging and filtering To perform MAC-layer bridging, the switch must know the destination MAC-layer address of each device on each attached network, so it can forward packets to the appropriate destination. The bridging table stores MAC-layer addresses, and you can filter packet traffic based on the destination MAC-layer address information. The Ethernet Routing Switch 8300 supports Bridge MIB filtering (RFC 1493) with a limit of 100 MAC filters. Create a filter entry by entering a MAC address and the port it resides on (similar to a static MAC entry). In the MAC filter record, you also specify the ports, for which to discard source or destination packets for the MAC address on a port. IP spoofing prevention within a VLAN You can prevent VLAN logical IP spoofing by blocking the external use of the switch IP address. You can configure IP spoof detection on a port by port basis. This configuration detects a duplicate IP address (that is, an address that is the same as the VLAN IP address) and blocks all packets with a source or destination MAC address equal to the VLAN IP address. If an ARP packet is received that has the same source IP address as the logical VLAN IP address, the hardware discards all traffic coming to a port of the switch in that VLAN (with this MAC address as source or destination address). After detecting a duplicate IP address, the switch sends a gratuitous ARP packet to inform devices on the VLAN about the correct MAC address for that IP address. You can specify a time on a configurable global timer after which Configuration VLANs and Spanning Tree May

26 VLAN and spanning tree fundamentals the MAC discard record is deleted, and the switch resumes accepting packets from that MAC address. This covers virtual and physical IP addresses such as those associated with VRRP. IP spoof prevention can detect spoofing of VRRP virtual IP addresses as well as physical IP addresses assigned to a VLAN. If you use Split MultiLink Trunking (SMLT), configure this option on both SMLT aggregation switches to avoid connectivity issues. For more information about configuring IP spoof detection, see Configuring port-based VLANs using Device Manager on page 41, Viewing IP spoof detection information using Device Manager on page 43, IP spoof detection configuration using the CLI on page 83, or IP spoof detection configuration using the ACLI on page 115. Spanning tree overview The Ethernet Routing Switch 8300 can use one of three spanning tree protocols, including Spanning Tree Protocol (STP), Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). Spanning Tree Protocol The IEEE Std 802.1D standard defines the operation of the Spanning Tree Protocol (STP). STP detects and eliminates logical loops in a bridged or switched network. When multiple paths exist, the spanning tree algorithm configures the network, so that a bridge or switch uses only the most efficient path. If that path fails, the protocol automatically reconfigures the network to make another path become active and sustain network operations. You can control path redundancy for VLANs by implementing the STP. A network can include multiple instances of STP. The collection of ports in one spanning tree instance is called a spanning tree group (STG). Important: If you disable the Spanning Tree Protocol, it can reduce Central Processing Unit (CPU) overhead slightly. However, unless you use the switch in a simple network with little possibility of loops, Avaya recommends that you leave the Spanning Tree Protocol enabled. Spanning Tree Protocol navigation Spanning Tree Groups on page 27 Spanning Tree Protocol controls on page Configuration VLANs and Spanning Tree May 2011

27 Spanning tree overview Spanning Tree Group modes on page 28 Spanning tree FastStart on page 28 STGs and VLANs on page 29 Spanning Tree Protocol topology change detection on page 29 Spanning Tree Groups Each Spanning Tree Group (STG) consists of a collection of ports that belong to the same instance of the STP. These STP instances are completely independent from each other. For example, they each send their own BPDUs and have their own timers. With the Ethernet Routing Switch 8300, you can include multiple spanning tree groups (STG) within the same switch. The routing switch can participate in the negotiation for multiple spanning trees. The following figure shows multiple spanning tree groups. Figure 5: Multiple STGs Spanning Tree Protocol controls Both the ports associated with a VLAN and VLANs themselves must be contained within a single STG to prevents problems with spanning tree blockage of ports and loss of connectivity within the VLAN. Each untagged port can belong to only one STG, while tagged ports can belong to more than one STG. When a tagged port belongs to more than one STG, the system tags the spanning tree BPDUs to distinguish those of one STG from those of another STG. The system does not tag the BPDUs from STG 1. The tagged BPDUs transmit using a multicast MAC address as tagged frames with a VLAN ID. Because tagged BPDUs are not part of the IEEE 802.1D standard, not all devices can interpret tagged BPDUs. Configuration VLANs and Spanning Tree May

28 VLAN and spanning tree fundamentals You can enable or disable the Spanning Tree Protocol at the port or STG level. If you disable the protocol at the group level, received BPDUs are handled like a MAC-level multicast and flooded out the other ports of the STG, and an STG can contain one or more VLANs. Remember that MAC broadcasts are flooded out on all ports of a VLAN; a BPDU is a MAClevel message, but the BPDU is flooded out all ports on the STG, which can encompass many VLANs. When you globally enable STP on the STG, BPDU handling depends on the STP setting of the port. When you enable STP on the port, it processes received BPDUs in accordance with STP. When you disable STP on the port, the port stays in a forwarding state and drops and does not process received BPDUs. Spanning Tree Group modes The Ethernet Routing Switch 8300 supports a Cisco compatible Spanning Tree Group (STG) mode. By default, the Avayal STG (ASTG) is enabled, and all BPDUs sent on every MLT link. To use the Cisco compatible spanning tree mode, disable ASTG, and the system sends BPDUs on only one link of the aggregation group. Spanning tree FastStart When enabled on a port with no other bridges, Spanning Tree FastStart starts the port quickly following switch initialization or a spanning tree change. The port goes through the normal blocking and learning states before the forwarding state, but the bridge hello timer (2 seconds by default) determines the hold time for these states instead of the bridge forward delay timer (15 seconds by default). If you enable FastStart on a port that uses the defaults of 2 seconds for Hello time and 15 seconds for Forward Delay time, it goes into the forwarding state in 4 seconds instead of the usual 30 seconds. If the port sees a BPDU, it reverts to regular behavior. Instead of disabling Spanning Tree protocol on a port, Avaya recommends that you enable FastStart on the port as an alternative. FastStart is intended for access ports where only one device connects to the switch (for example, workstations with no other spanning tree devices) and it prevents the 30 to 35 second wait period for spanning tree initialization and bridge learning. Important: Use Spanning Tree FastStart with caution. This feature does not adhere to the specifications in the IEEE 802.1D standard for Spanning Tree Protocol (STP), in which a port enters the blocking state following the initialization of the bridging device or from the disabled state when you enable the port through configuration. 28 Configuration VLANs and Spanning Tree May 2011

29 Spanning tree overview STGs and VLANs A VLAN can include all the ports in a STG, and an STG can include multiple VLANS, but a VLAN never includes more ports than exist in the STG. Avaya recommends that you plan the STGs, and then create the VLANs. In the Avaya Ethernet Routing Switch 8300 default configuration, a single STG encompasses all the ports in the switch. For most applications, this configuration is sufficient. The default STG is assigned ID 1 (STG1). If a VLAN spans multiple switches, it must belong to the same STG across all switches. Spanning Tree Protocol topology change detection With change detection, you can detect topology changes and send a topology change notification (TCN) to the root on an individual port basis. Change detection is enabled by default. When and a topology change occurs, change detection sends a trap that contains the following information, so you can identify the device: the MAC address of the STG sending the TCN the port number the STG ID You can disable change detection on ports connected to a single end station where powering that end station on and off can trigger the TCN. The IEEE STD 802.1D standard references change detection. Topology change detection configuration rules When you work with change detection settings You can configure change detection on access ports only. This also applies to link aggregation ports. If you disable change detection and change the port from access to tagging-enabled, the switch automatically configures change detection to enabled for the port. This also applies to link aggregation ports. In a link aggregation group with access ports, modifications to change detection for a member port automatically apply to the remaining member ports. Spanning Tree BPDU Filtering The Ethernet Routing Switch 8300 supports Bridge Protocol Data Unit (BPDU) Filtering for a Spanning Tree Group (STPG), Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). The Spanning Tree Protocol detects and eliminates logical loops in a bridged or switched network. A bridge that participates in the spanning tree exchanges information with other Configuration VLANs and Spanning Tree May