System Description Quidway S5000 Series Ethernet Switches. Table of Contents

Transcription

1 Table of Contents Table of Contents Chapter 1 Product Overview Preface System Features Service Features Chapter 2 Hardware Description S5012G and S5012G-DC Ethernet Switches Switch Appearance Power System Cooling System S5012T-12/10GBC and S5012T-12/10GBC-DC Ethernet Switches Switch Appearance Power System Cooling System S5024G-24/20TP and S5024G-24/20TP-DC Ethernet Switch Switch Appearance Power System Cooling System Console Attributes GBIC Port Attributes of S5000 Series Attributes of GE Port with a RJ-45 Connector of S5000 Series Chapter 3 Software Description Basic Features Link Aggregation Broadcast Storm Suppression VLAN VLAN Trunk GARP/GVRP STP/RSTP/MSTP Network Protocol Features ARP Multicast Features GMRP IGMP Snooping QoS Traffic Classification Port Flow Control Port Mirroring i

2 Table of Contents Queue Scheduling Priority Mark Centralized Management Feature HGMP Security and Authentication Features Terminal Access User Security Mechanism Packet Filtering X Authentication AAA and RADIUS Chapter 4 Management and Maintenance System Simple and Flexible Maintenance System System Configuration System Maintenance System Test and Diagnosis Software Upgrade Quidview Network Management Topology Management Configuration Management Fault Management Performance Management Security Management WEB Network Management Chapter 5 Networking Application Typical Networking of Enterprise Networks Typical Networking in Large-scale Enterprise Networks and Campus Networks Chapter 6 Guide to Purchase Purchase Host ii

3 Chapter 1 Product Overview Chapter 1 Product Overview 1.1 Preface With the flying development of the Internet, people s demand for communication has gradually been extending from such traditional narrowband services as telephone, facsimile and telegram to high-speed broadband services, including Internet access, videophone and Video on Demand (VoD), etc. Users require increasingly higher online speed. Ethernet access, by virtue of its low cost, easy application and high speed, especially engages attention in the industry. Facing the booming demand for the construction of broadband network, Huawei Technologies Co., Ltd. (hereinafter referred to as Huawei) launches Quidway Series Ethernet Switches to accommodate to diversified clients. (hereinafter referred to as S5000 Series) belong to Layer 2 (L2) wire speed Gigabit Ethernet (GE) switching products which are independently developed by Huawei. The intelligent switch series, which can be managed over the network, are designed specially for such applications as high-speed interconnection between enterprise networks and providing gigabit bandwidth to desktop PCs (Personal Computers) and workstations. For Wide Area Network (WAN) application, S5000 Series provide multi-channel GigabitEthernet optical interfaces, which support WAN convergence and can address the problem of scarce GE ports on high-end devices. Besides, S5000 Series also provide redundant backup protection of power supply on devices. S5000 Series currently include the following models: S5012G: Adopt AC power supply. Provide 12 10/100/1000BASE-T auto-negotiation Ethernet ports (RJ-45 connector) and 4 Combo GBIC (Gigabit Interface Converter) ports. S5012G-DC: Adopt DC power supply. Provide 12 10/100/1000BASE-T Ethernet ports (RJ-45 connector) and 4 Combo GBIC ports. S5012T-12/10GBC: Adopt AC power supply. Provide 10 GBIC ports, 2 10/100/1000BASE-T Ethernet ports and 2 Combo RJ45 ports. S5012T-12/10GBC-DC: Adopt DC power supply. Provide 10 GBIC ports, 2 10/100/1000BASE-T Ethernet ports and 2 Combo RJ45 ports. S5024G-24/20TP: Adopt AC power supply. Provide 20 10/100/1000BASE-T Ethernet ports (RJ-45 connector) and 4 GBIC ports. S5024G-24/20TP-DC: Adopt DC power supply. Provide 20 10/100/1000BASE-T Ethernet ports (RJ-45 connector) and 4 GBIC ports. 1-1

4 Chapter 1 Product Overview Note: Gigabit Interface Converter (GBIC) is a hot-swappable connector used for data telecommunication. Note: The following describes the meaning of a Combo port: Take S5012G Ethernet Switch as an example, Combo GBIC port (numbered 9+) and its corresponding 10/100/1000BASE-T Ethernet port (numbered 9) are optional in optical or electronic type. The user can select one from them according to real networking environment. But these two ports cannot work simultaneously. S5000 Series can be used in the following applications: Internet broadband access High-speed enterprise network internetworking Multimedia application, big file transmission, broadband community application, etc. Note: Because S5012G Switch and S5012G-DC have similar structures except for the power sockets, the following introduction only concerns S5012G Switch, unless otherwise specified. For the same reason, S5012T-12/10GBC is introduced as a representative for both S5012T-12/10GBC and S5012T-12/10GBC-DC switches. S5024G-24/20TP is introduced as a representative for both S5024G-24/20TP Switch and S5024G-24/20TP-DC Switch. 1-2

5 Chapter 1 Product Overview 1.2 System Features Table 1-1 System features of S5000 Series Item S5012G S5012T-12/10GBC S5024G-24/20TP Dimensions (W H D) 436mm 42mm 245mm Weight 4kg 6kg fixed port Twelve 10/100/1000Mbit/s Two 10/100/1000Mbit/s Twenty 10/100/1000Mbit/s Ethernet ports Ethernet ports Ethernet ports Four 1000Mbit/s Combo Two Combo RJ45 ports Four 1000Mbit/sGBIC ports GBIC ports Mbit/sGBIC ports Management port One Console port 10Base-T: Category 3/4/5 unshielded twisted pair (100m supported) Category 5 unshielded twisted pair (100m supported) 100Base-TX: Category 3/4/5 unshielded twisted pair (100m supported) 1000Base-T: Category 5 unshielded twisted pair (100m supported) Type of interface cable and transmission distance 1000Base-LX: Single mode optical fiber (10km supported) 1000Base-LH: Single mode optical fiber (30km supported) 1000Base-SX: 62.5/125µm multimode optical fiber (275m supported) 50/125µm multimode optical fiber (550m supported) 1000BASE-ZX-VR: Single mode optical fiber, with a transmission distance of 70km 1000BASE-ZX-LR: Single mode optical fiber, with a transmission distance of 40km AC: 100V to 240V 50/60Hz Input voltage DC: -48V to -60V Support redundant power input Power (full load) 30W 50W Operation temperature 0 to 45 o C Operation humidity 10% to 90% 1.3 Service Features The software of S5000 Series is designed on the basis of the proprietary Versatile Routing Platform (VRP) of Huawei and has the following service features. 1-3

6 Chapter 1 Product Overview Table 1-2 Service features of S5000 Series Feature Wire speed L2 switching Switching mode VLAN Multicast STP (Spanning Tree Protocol)/RSTP (Rapid Spanning Tree Protocol)/MSTP (Multiple Spanning Tree Protocol) Port Aggregation Broadcast storm suppression Mirroring MAC address table Flow control Load and upgrade Management Maintenance QoS (Quality of Service)/ACL (Access Control List) Security feature Implementation All the ports support wire speed forwarding Switching capacity is 24Gbit/s (S5012G and S5012T-12/10GBC) or 48Gbit/s (S5024G-24/20TP) Packet forward speed is 17.8Mpps (S5012G and S5012T-12/10GBC) or 35.6Mpps (S5024G-24/20TP) Store and forwarding Supports up to 4094 VLANs (Virtual Local Area Networks) based on IEEE 802.1Q Supports port-based VLAN Supports GVRP (GARP VLAN Registration Protocol) Supports GMRP (GARP Multicast Registration Protocol) Supports IGMP Snooping (Internet Group Management Protocol Snooping) Supports STP/RSTP/MSTP and observe standards including IEEE 802.1D, IEEE 802.1w and IEEE 802.1s Supports up to 6 (S5012G and S5012T-12/10GBC) or 12 (S5024G-24/20TP) port aggregation groups, with each aggregation group supporting 8 ports at most All the ports support broadcast storm suppression based on bandwidth ratio. Supports port mirroring Address learning Supports IEEE 802.1D Supports 16k MAC addresses at most Supports IEEE 802.3x flow control (full duplex) Supports back-pressure based flow control (half duplex) Supports XModem protocol to implement load and upgrade Supports load and upgrade of FTP (File Transfer Protocol) and TFTP (Trivial File Transfer Protocol) Supports the Command Line Interface (CLI) configuration Supports remote configuration through Telnet Supports configuration via the Console port Supports SNMP (Simple Network Management Protocol) Supports RMON (Remote Monitoring) Supports Huawei Quidview NM system and WEB network management Supports system log Supports hierarchical alarm Supports HGMP (Huawei Group Management Protocol) v2 Supports remote dialing Supports debugging information output Supports PING (Packet Internet Groper) and Tracert Supports remote maintenance through Telnet Supports HGMP v2 Provides ACL function of layer2 to layer7 policy to filter traffic satisfying specified rules. The user can flexibly configure policies according to such information as source IP address, destination IP address, source port number, destination port number, inbound/outbound physical port and protocol type. Supports traffic-based bandwidth control, with a granularity of 1Mbit/s Supports 802.1p priority and DSCP (Differentiated Services Code Point) priority Each port includes 8 priority queues Supports SP (Strict Priority) and WFQ (Weighted Fair Queuing) Hierarchical management over the users and password protection Supports 802.1X authentication Supports RADIUS (Remote Authentication Dial-In User Service) 1-4

7 Chapter 2 Hardware Description Chapter 2 Hardware Description 2.1 S5012G and S5012G-DC Ethernet Switches Switch Appearance Note: The front panels of S5012G Switch and S5012G-DC Switch are totally the same. Here take the appearance of S5012G Switch as an example. The following shows the appearance of S5012G Switch. Figure 2-1 S5012G Switch On the front panel of S5012G Switch, from left to right, there are system state indicators (RUN, MPS, RPS), one indicator mode switching button (MODE), port state mode indicators (L/A, D/S, SPD), 12 fixed GE electrical interfaces (RJ-45 connectors, the port indicators are below the ports. As for the two-level-rj-45-connector of S5012G Switch, the left indicators are for the ports on the upper level, and the right indicators are for the lower level), 4 GBIC ports (the port indicators are below the ports) and 1 Console port, as shown in the following figure: Figure 2-2 Front panel of S5012G Switch 2-1

8 Chapter 2 Hardware Description Note: S5012G Switch provides 4 GBIC interfaces. The user can select gigabit optical modules as needed. All optical modules are hot-swappable Power System I. Power input of S5012G Switch Rated voltage: V a.c.; 50/60Hz Maximum tolerance: V a.c.; 50/60Hz II. Power input of S5012G-DC Switch Rated voltage: V d.c. Maximum tolerance: V d.c. III. Redundancy power supply Caution: The redundancy power cable is not hot-swappable. To ensure higher reliability, S5012G Switch provides a redundant power input interface, which is a DC interface and is connected with Huawei Redundant Power System (RPS). Each RPS can provide redundancy power supply for 4 switches simultaneously. According to different input power supplies, RPS is divided into AC RPS and DC RPS. The user can choose appropriate RPS as needed Cooling System S5012G Ethernet Switch provides 2 temperature control fans for cooling the whole system, and each fan has two levels of speed. 2-2

9 Chapter 2 Hardware Description 2.2 S5012T-12/10GBC and S5012T-12/10GBC-DC Ethernet Switches Switch Appearance Note: The front panels of S5012T-12/10GBC Switch and S5012T-12/10GBC-DC Switch are totally the same. Here take the appearance of S5012T-12/10GBC Switch as an example. The following shows the appearance of S5012T-12/10GBC Switch. Figure 2-3 S5012T-12/10GBCSwitch On the front panel of S5012T Switch, from left to right, there are system state indicators (RUN, MPS, RPS), one indicator mode switching button (MODE), port state mode indicators (L/A, D/S, SPD), 10 GBIC ports (the corresponding port indicators are at the right of the ports), 4 fixed GE electrical interfaces (RJ-45 connectors, the port indicators are below the ports), and 1 Console port, as shown in the following figure: Figure 2-4 Front panel of S5012T-12/10GBC Switch 2-3

10 Chapter 2 Hardware Description Power System I. Input power supply of S5012T-12/10GBC Switch Rated voltage: V a.c.; 50/60Hz Maximum tolerance: V a.c.; 50/60Hz II. Input power supply of S5012T-12/10GBC-DC Switch Rated voltage: V d.c. Maximum tolerance: V d.c. III. Redundancy Power supply Refer to the contents in section Power System Cooling System S5012T-12/10GBC Ethernet Switch provides 2 temperature control fans for cooling the whole system. 2.3 S5024G-24/20TP and S5024G-24/20TP-DC Ethernet Switch Switch Appearance Note: The front panels of S5024G-24/20TP Switch and S5024G-24/20TP-DC Switch are totally the same. Here take the appearance of S5024G-24/20TP Switch as an example. The following shows the appearance of S5024G Switch. Figure 2-5 S5024G-24/20TP Switch 2-4

11 Chapter 2 Hardware Description On the front panel of S5024G Switch, from left to right, there are system state indicators (RUN, MPS, RPS), one indicator mode switching button (MODE), port state mode indicators (L/A, D/S, SPD), 20 fixed GE electrical interfaces (RJ-45 connectors, the port indicators are below the ports. As for the two-level-rj-45-connector of S5024G Switch, the left indicators are for the ports on the upper level, and the right indicators are for the lower level), 4 GBIC ports (the corresponding port indicators are at the right of the ports), and 1 Console port, as shown in the following figure: Figure 2-6 Front panel of S5024G-24/20TP Switch Power System I. Power input of S5024G-24/20TP Rated voltage: V a.c.; 50/60Hz Maximum tolerance: V a.c.; 50/60Hz II. Power input of S5024G-24/20TP-DC Rated voltage: V d.c. Maximum tolerance: V d.c. III. Redundancy Power supply Refer to the contents in section2.1.2 Power System Cooling System S5024G-24/20TP Ethernet Switch provides 2 temperature control fans for cooling the whole system. 2-5

12 Chapter 2 Hardware Description 2.4 Console Attributes S5000 Series provide Console port, complying with the EIA/TIA-232 asynchronous serial standard, on its front panel. You can configure the switch via this interface locally or remotely. The attributes of the Console port are shown in Table 2-1. Table 2-1 Attributes of Console port Attribute Connector type Interface standard Baud rate Service supported Description RJ-45 Asynchronous EIA/TIA bit/s (by default) Connect with the character terminal Connect with the serial port of the local terminal (e.g., a PC) or remote terminal (via a pair of Modems) and run the terminal emulation program on the terminal. 2.5 GBIC Port Attributes of S5000 Series For S5000 Series, the user can choose from the following GBIC modules as needed. Table 2-2 Optional GBIC modules for S5000 Series Name of a GBIC module 1000BASE-SX-GBIC 1000BASE-LX-GBIC 1000BASE-LH-GBIC 1000BASE-ZX-LR-GB IC 1000BASE-ZX-VR-G BIC 1000BASE-CX-HSSD C-GBIC Central wavelength 850nm 1310nm 1550nm SC Type of user interface connector provided by a GBIC module Interface optical fiber specification 50/125µm multimode optical fiber 62.5/125µm multimode optical fiber single mode optical fiber Maximum transmission distance of optical fiber 550m 275m 10km 30km 40km 70km - HSSDC - 30m Note: The gigabit GBIC modules may be updated with time. If you need accurate information about module types, consult marketing personnel or technical support personnel of Huawei. 2-6

13 Chapter 2 Hardware Description 2.6 Attributes of GE Port with a RJ-45 Connector of S5000 Series The attributes of GE port with a RJ-45 connector of S5000 Series are shown in Table 2-3. Table 2-3 Attributes of GE port with a RJ-45 connector of S5000 Series Attribute Description Connector type RJ-45 S5012G Switch provides 12 interfaces Interface number S5012T Switch provides 4 interfaces S5024G Switch provides 20 interfaces 10M half duplex/full duplex 100Mhalf duplex/full duplex Interface attribute 1000M full duplex MDI/MDI-X auto-sensing Regulatory compliance IEEE 802.3u Medium and transmission Adopt Category5 twisted pair and support a transmission distance of 100m distance 2-7

14 Chapter 3 Software Description Chapter 3 Software Description 3.1 Basic Features Link Aggregation The link aggregation is used for the connection between switches or between the switch and high-speed server. It balances the traffic among the aggregated ports, which is a simple and cost-effective way to expand the bandwidth on the port. It also improves the reliability of the connection. The link aggregation is to aggregate several Ethernet ports together. The aggregated ports in one group are considered as a single logic port inside the switch. The switch can automatically balance the traffic load among several aggregated ports. The aggregated ports support load sharing which can ensure service packets in right order. When one of the aggregated ports is faulty, the traffic on the faulty port will be distributed among other ports, so the service will not be interrupted. After the faulty connection recovers, the traffic will be automatically balanced again, so that the aggregated ports can continue to share the load Broadcast Storm Suppression The broadcast storm suppression is to suppress the spread of broadcast packets on the network, thereby reducing the affect of broadcast packets upon the network efficiency. The broadcast storm suppression is configured on the port of an Ethernet switch. The received broadcast traffic can be monitored on the port on which broadcast storm suppression is enabled. If the bandwidth for broadcast traffic exceeds the configured limit, the switch will drop the exceeding broadcast traffic on the port, so as to lower the traffic ratio of broadcast to a reasonable range and ensure the normal operation of the network service VLAN Virtual Local Area Network (VLAN) technology is used to logically, rather than physically, divide devices inside LAN into various network segments and thus to realize the virtual workgroup. It is based on IEEE 802.1Q. 3-1

15 Chapter 3 Software Description VLAN allows the network manager to logically divide a physical LAN into several different broadcast domains, each of which consists of a group of devices (such as PCs) with the same demand. As it is divided logically, not physically, the devices in the same VLAN are unnecessarily located in the same physical area, that is, they may belong to different physical LAN network segments. In addition, the broadcast and unicast traffic inside a VLAN will not be forwarded to other VLANs. VLAN technology is significant for achieving low control, simplifying network management and ensuring higher network security VLAN Trunk VLAN Trunk, used for the connection between two switches, is a point-to-point link between them. The two switches involved are called trunk port, where multiple VLANs are permitted to pass. The implementation fundamental is: Trunk port differentiates packets in different VLANs by identifying different 802.1Q flags so that the VLAN interconnection over the whole network is achieved. Note: The VLAN entity set to be permitted to pass on the Trunk port should be created beforehand on the switch. Otherwise, the switch cannot identify the VLAN frame and will discard it GARP/GVRP I. GARP Generic Attribute Registration Protocol (GARP) provides a way to forward, transmit and register a kind of information (for example, VLAN and multicast group address) among the switching members inside the same switching network. 3-2

16 Chapter 3 Software Description GARP member can be either a terminal workstation or a switch. Information switching between GARP members is based on messages. Through message interaction, all attribute information to be registered is transmitted to all the switches on the same switching network. With GARP mechanism, configuration information on one GARP member will be rapidly transmitted throughout the switching network. GARP member tells other GARP members through declaration or declaration withdrawal, expecting them to register or deregister its attribute information. And it registers or deregisters attribute information about other GARP members according to declaration or declaration withdrawal of them. GARP itself does not exist in the switch as an entity. The application entity in compliance with GARP is called GARP application. Currently GVRP and GMRP are the main GARP applications. The protocol data packets of different GARP applications (GVRP or GMRP) have specific MAC addresses. When the GARP-supported switch receives the GARP application packets, it differentiates them according to their MAC addresses and processes them with different applications (GVRP or GMRP). II. GVRP GARP VLAN Registration Protocol (GVRP), an application of GARP, is based on the GARP mechanism. It maintains VLAN dynamic registration information in a switch and transmits the information to other switches. All the GVRP-supported switches can receive VLAN registration information from other switches and dynamically update the local VLAN registration information, such as current VLAN members and ports connected to them. Moreover, all GVRP-supported switches can transmit the local VLAN registration information to other switches, so that VLAN information will be consistent in all the GVRP-supported devices on the same switching network. VLAN registration information transmitted by GVRP includes both the local static registration information configured manually and the dynamic registration information learned from other switches STP/RSTP/MSTP I. STP/RSTP Spanning Tree Protocol (STP) / Rapid Spanning Tree Protocol (RSTP) are used for pruning a Layer 2 switching network with loops into a loop-free tree-topology network (all the data on the Layer 2 switching network must be forwarded along the spanning tree), thereby eliminating the network broadcast storm caused by network loop and providing the redundant links for data forwarding. 3-3

17 Chapter 3 Software Description The basic philosophy of STP/RSTP is to generate a tree rooted at a switch called root bridge. Any switch can be possibly selected as the root bridge based on their settings (such as switch priority and MAC address), but there should be only one root bridge at any time. From the root bridge, a tree is formed level by level. The non-root bridge switch forwards data to the root bridge via its root port, and to the connected network via its designated port. The root bridge transmits configuration packets regularly and the non-root bridge switch receives and then forwards the configuration packets. If a switch can receive configuration packets from more than one port, the network must have loop(s). In this case, the switch selects one port as the root port and blocks the other port(s) to eliminate the loop(s). When a port has not received any configuration packets for a long time, the switch will consider the configuration of this port as timed out and the network topology may have changed. Then the switch will recalculate the network topology and generate a new tree. RSTP is an optimized version of STP, which greatly shortens the period before the network topology become stable. II. MSTP Multiple Spanning Tree Protocol (MSTP) is compatible to both STP and RSTP. By associating VLAN with STP, it divides a switching network into multiple domains, with each domain containing multiple mutually independent spanning trees. MSTP prunes a looped network into a tree-topology network without any loops so as to avoid packet increase and infinite circulation in a looped network. Moreover, it also provides multiple redundancy paths for data forwarding and thereby achieves load balancing of VLAN data during data forwarding. 3.2 Network Protocol Features ARP As a dynamic address resolution protocol, Address Resolution Protocol (ARP) is mainly used to resolve an IP address into a physical address of a device connected with the network, making it unnecessary to notify application program about the physical address of the device. The ARP resolution is automatically implemented, without user s involvement. 3-4

18 Chapter 3 Software Description 3.3 Multicast Features GMRP GARP Multicast Registration Protocol (GMRP) is based on GARP and used for maintaining the dynamic multicast registration information in the switch. All switches supporting the GMRP feature can receive the multicast registration information from other switches and dynamically update the local multicast registration information. They can also transmit the local multicast registration information to other switches, so that multicast information could be consistent for all equipment supporting GMRP feature on the same switching network. To join a multicast group, a host sends GMRP Join message. The switch adds the port where the GMRP Join message is received into the multicast group and broadcasts the GMRP Join message throughout the VLAN. When the multicast source forwards multicast packets to the multicast group, the switch forwards them to the port connected to the multicast group member only, thereby implementing L2 multicast inside a VLAN IGMP Snooping 3.4 QoS Internet Group Management Protocol Snooping (IGMP Snooping) is a multicast restraint mechanism running on Layer 2 Ethernet switches, for multicast group management and control. IGMP Snooping runs on the link layer. When a Layer 2 Ethernet Switch receives an IGMP packet transmitted between a host and a router, IGMP Snooping analyzes the information carried in the IGMP packet. When monitoring a host is sending an IGMP host report message, the switch will add the host to the corresponding multicast table. When monitoring a host sending an IGMP leave message, the switch will remove the multicast table entry corresponding to the host from the multicast table. By means of continuous IGMP packet snooping, a switch can create and maintain MAC multicast address table at Layer 2. Then it can forward the multicast packets sent from the routers according to MAC multicast address table. Quality of Service (QoS) refers to providing network services with different quality according to different demands. 3-5

19 Chapter 3 Software Description Traffic Classification The traffic classification facilitates subsequent processing in the switch. Traffic classification recognizes packets with different characteristics according to certain rules. The classification rule can be simple. For example, traffic with different priorities is identified according to the ToS (Type of Service) field in the IP message header. It can also be complex. For example, packets are classified according to relevant information of integrated data link layer, network layer and transport layer, such as MAC address, IP protocol type, source (host or network segment) address, destination (host or network segment) address, and port number of application program Port Flow Control The port flow control is used for congestion management. Congestion occurs when the network cannot satisfy the committed or negotiated performance specifications (such as speed). When congestion occurs, the switch will send a pause frame to the corresponding connection and notify the peer to pause for a period of time before transmitting data again, so as to reduce the incoming traffic on the network. The port control takes effect on all types of traffic Port Mirroring Port mirroring is used to monitor packets on a specified port. This function copies packets on a specified port onto the monitoring port so as to perform network detection and troubleshooting Queue Scheduling When the switch forwards several packets, they may simultaneously compete for the resources. Queue scheduling is used for solving this problem. Queue scheduling algorithm supported in S5000 Series includes: Strict Priority (SP), Round Robin (RR) and Weighted Round Robin (WRR). These types of algorithm forward the packets in the egress queues on ports according to their own principle. 1) SP 3-6

20 Chapter 3 Software Description Packer to be sent v ia the interfac e Classify Queue High Medium Normal Low Packets left the interfac e Queue departure sc heduling Figure 3-1 SP SP queue scheduling is specially designed for key service applications. Key services have an important feature, that is, they require prior services to reduce the response delay during congestion. The SP classifies all packets into 4 types at most, including high-priority queue, medium-priority queue, normal-priority queue, and low-priority queue (specified as Queue 3, 2, 1, and 0 respectively) with descending priority levels. In queue scheduling, SP transmits the packets in a strict descending priority order. The packets in the higher priority queues go first. When these queues are empty, the packets in the lower priority queues will be transmitted. In this way, the key service packets can be put in the higher-priority queue, while non-key service packets can be put in the lower-priority queue so that packets of key services could be transmitted first, while packets of non-key services transmitted during the idle intervals of key service data processing. However, SP has some disadvantage. If congestion occurs and the higher-priority queue has packets for a long time, packets in the lower-priority queue will be starved for being unable to obtaining services. 2) RR&WRR RR queue scheduling divides each port into 4 or 8 egress queues. The packets in different queues are processed in turn, so that each queue can get some service time. RR is initiated, aiming at fairly sharing network resources and achieving optimum delay and delay jitter of all flows. Compared with RR, WRR additionally considers priority during calculating packet scheduling order. WRR configures each queue with a weight (specified as w3, w2, w1, and w0 respectively). The weight value indicates the proportion of resources obtained. For example, you can configure the weight value of the WRR algorithm for a 100M port as 50, 30, 10, and 10 (corresponding to the w3, w2, w1 and w0 respectively). Thus the lowest-priority queue can be guaranteed to get at least a bandwidth of 10Mbps, thereby avoiding the case that the messages in the lower-priority queue cannot obtain service for a long time, as is the case in SP scheduling. WRR queue scheduling has another advantage. Although the scheduling of multiple queues is performed in circulation, the service time slices are assigned flexibly for each queue. 3-7

21 Chapter 3 Software Description When a queue is empty, the next one will be processed immediately. So it makes good use of the bandwidth resources Priority Mark Priority mark feature is used to reconfigure the priority of a packet. An Ethernet switch can provide priority mark service for a specified packet. The flag contents include ToS priority, Differentiated Services Codepoint Priority (DSCP), 802.1p priority, etc. 3.5 Centralized Management Feature HGMP Huawei Group Management Protocol (HGMP) implements centralized management over devices. In other words, with HGMP, one device can manage several devices. S5000 Series support HGMP v2. HGMP v2 classifies the switches in an administrative domain into a command switch and multiple member switches. The command switch is used for managing other switches; while member switches are switches being managed. After enabling HGMP v2, the network administrator can manage multiple member switches through one command switch. The member switches are unnecessary to have public network IP addresses. They are managed and maintained by the command switch. 3.6 Security and Authentication Features As the network application becomes more and more popular, the network security gradually engages the main concern of people, especially for the application in some sensitive occasions (such as e-commerce). S5000 Series provide the following network security features: Terminal access user security mechanism Packet filtering 802.1X authentication AAA (Authentication, Authorization and Accounting) RADIUS (Remote Authentication Dial in User Service ) Terminal Access User Security Mechanism A hierarchical protection method is adopted by the system in ascending order, in which the command lines of the system are divided into four levels, namely visit level, 3-8

22 Chapter 3 Software Description monitoring level, configuration level and management level. At the same time, registered users are accordingly classified into four levels that correspond to the above four command levels respectively. A user can only use the commands at the levels that are equal to or lower than his/her level after login Packet Filtering Packet filtering is to filter the illegal data packets or those the user is not interested in. The Ethernet switch filters each data packet according to the user-defined entries, such as whether the source or destination address of a data packet complies with the rule. Packet filtering does not care about session state, nor does it analyze data. With the packet filtering function, the user can decide which data packet can pass X Authentication IEEE 802.1X Protocol (hereinafter referred to as 802.1X) is basically a port-based network access control protocol. As the name indicates, the port-based network access control protocol refers to the authentication and control performed over the accessed device on the port of the LAN access control device. If a user device connected to the port passes the authentication, the user is allowed to access the LAN resources. Otherwise, he will be rejected. In 802.1X implementation, the Ethernet switch not only supports the port-based access authentication defined by the protocol, but also extends and optimizes it. Support connecting several downstream terminals to the same physical port The access control (namely the authentication over the user) can be based on either port or MAC address In this way, the system security, operability, and manageability are greatly improved. Note: Although 802.1X provides a solution for user authentication, the protocol itself is not enough to implement the solution. The manager of the access device should also configure AAA and select RADIUS or local authentication to complete the user authentication along with 802.1X AAA and RADIUS I. AAA AAA provides a uniform framework to configure the three security functions including authentication, authorization, and accounting. Actually, it offers a way to manage the network security, which can be implemented with RADIUS. AAA performs the following services: 3-9

23 Chapter 3 Software Description Authentication: Authenticate if the user can obtain access authority. Authorization: Authorize the user with specified services. Accounting: Record network resources used by the user. II. RADIUS As a kind of distributed Client/Server system, RADIUS (Remote Authentication Dial-In User Service) can prevent the network from interruption of unauthorized access. It is often used in the network environments requiring both high security and remote access maintenance (e.g. used to manage 802.1X access users). RADIUS protocol is based on the Client/Server model. The authentication of RADIUS Server over the user generally adopts the authentication proxy of NAS (Network Access Server) devices (such as Ethernet switch). The information interacted between RADIUS Client and RADIUS Server is authenticated with the sharing key. The user password is transmitted over the network in encrypted mode, which ensures higher security. S5000 Series support RADIUS client. 3-10

24 Chapter 4 Management and Maintenance System Chapter 4 Management and Maintenance System 4.1 Simple and Flexible Maintenance System System Configuration The configuration modes supported by S5000 Series include: command line configuration and network management (NM) configuration. In command line configuration mode, users can configure locally via Console port or configure remotely via Telnet terminal. Telnet Server and Telnet Client services are also supported in this mode. In NM configuration mode, SNMP-based NM system can configure S5000 Series. HGMP configuration mode adopts the Layer 2 proprietary protocol developed by Huawei, to implement centralized management over the Ethernet switch by a management device and transmit the configuration information and configuration response information System Maintenance A variety of management and maintenance functions are available in S5000 Series. On both the host and extended interface module of S5000 Series, there are indicators to show the card operation status. Telnet remote maintenance. Provide hierarchical user authority management, operation log management, and online help. Provide such functions as alarm level management and alarm filtering. Provide system status query, version query, debugging and tracing functions, to monitor the system operation status System Test and Diagnosis S5000 Series support software and hardware fault detection and diagnosis functions. They also provide the networking connection test tools such as ping and tracert to check network connectivity and to trace online the data packet transmission path which can be used as a reference for fault location. 4-1

25 Chapter 4 Management and Maintenance System Software Upgrade S5000 Series provide multiple approaches to upgrade the software and supports remote upgrade and rollback of software version. S5000 Series provide the following upgrade methods: Software upgrade via Console port using XModem protocol. Software upgrade via Ethernet port using TFTP or FTP. 4.2 Quidview Network Management S5000 Series adopt the Huawei Quidview NM system as their central NM system, which applies multi-lingual GUIs (graphic user interfaces) with direct and convenient operation. The Quidview NM system also provides such functions as topology management, configuration management, fault management, security management, performance management etc Topology Management It provides the unified topology view for equipment of the whole network and helps users to understand their networks in the most direct and convenient way. The Huawei NM products provide powerful topology management function. They support physical topology view, logical topology view and customized view, offering a unified view for equipment of overall network. It also provides friendly network and equipment operation and maintenance entry. The system supports automatic topology detection, reflecting the change of network topology structure and equipment status in real time Configuration Management It completes the configurations on S5000 Series, including port query, port enabling and disabling, board query, reset and loading, port parameters & VLAN configuration query, and so on Fault Management Fault management is the most important and common management means during user network running maintenance. Through the GUIs, the user can implement the query of equipment operation and fault status, real-time monitoring, fault filtering, fault locating, fault confirmation, and fault analysis. Faults are audible and visible and tone prompt is available. Alarm panels, displayed graphically, can be connected to the alarm box system, facilitating routine maintenance of the user. 4-2

26 Chapter 4 Management and Maintenance System Performance Management It supports such functions according to performance data collection, performance monitoring and performance data analysis, providing diversified performance report forms and graphic displays. It implements statistics of device loads and user access data streams, helping users learn QoS of the network, evaluate and adjust the network resources configuration in time Security Management It provides multiple security measures to strictly authenticate user operation and ensure the system security. In addition, it provides detailed logs of user operations and allows of query and analysis functions. 4.3 WEB Network Management WEB network management means that the user can manage and maintain the switch in the form of Web. The philosophy of WEB network management is: The LAN Switch provides a built-in WEB server. A PC connected to the Ethernet port of the switch accesses the switch via a browser to manage the homepage at the IP address of the VLAN. WEB network management program runs in the homepage and the PC user can manage the switch via the program. The operation environment of Web network management is illustrated in Figure 4-1: Switch HTTP Connection PC Figure 4-1 WEB NM operation environment 4-3

27 Chapter 5 Networking Application Chapter 5 Networking Application S5000 Series mainly orient to such applications as high-speed interconnection between enterprise networks and providing gigabit bandwidth to desktop PCs and workstations. For MAN application, S5000 Series provide multi-channel gigabit optical interfaces to perform MAN convergence. 5.1 Typical Networking of Enterprise Networks In enterprise networks, S5000 Series can provide gigabit bandwidth to desktop PCs and workstations. It can be also installed in the center of the community, connecting downstream with users via an S3500 Switch Series, and connecting upstream with the router through a gigabit port. Internet/Enterprise network Router S5000 S3500 S5000 S2000 Gigabit to desktop PC Figure 5-1 Typical networking of enterprise network with S5000 Series 5.2 Typical Networking in Large-scale Enterprise Networks and Campus Networks S5000 Series can serve as desktop devices in large-scale enterprise networks, directly connecting upstream with L3 switches at backbone layer via gigabit ports and connecting downstream with users through S3500 and S3000 Series. In this way, an overall enterprise networking solution from gigabit to backbone layer is created. 5-1

28 Chapter 5 Networking Application Enterprise network backbone server Server L3 S5000 S5000 server Server Section server S3500 Server cluster server Server server Server S3000 S2000 Desktop PC PC PC PC PC Figure 5-2 Enterprise network or campus networking with S5000 Series 5-2

29 Chapter 6 Guide to Purchase Chapter 6 Guide to Purchase S5000 Series are delivered upon your orders, and you can purchase the modules according to your actual demands. 6.1 Purchase Host When you purchase a host, please take the following factors into consideration: I. Networking requirements Location of the switch in networking. Required processing capability of the switch in upstream and downstream. Required network scalability of this switch. Reliability requirement of the switch. Required transmission distance of the switch in networking. II. Power Supply Whether DC or AC power supply is required. Table 6-1 Host purchasing list of S5000 Series Description Quantity Remarks S5012G host (AC power supply, with an input voltage of 220V) 1 Optional S5012G-DC host (DC power supply, with an input voltage of -48V) 1 Optional S5012T-12/10GBC host (AC power supply, with an input voltage of 220V) 1 Optional S5012T-12/10GBC-DC host (DC power supply, with an input voltage of -48V) 1 Optional S5024G-24/20TP host (AC power supply, with an input voltage of 220V) 1 Optional S5024G-24/20TP-DC host (DC power supply, with an input voltage of -48V) 1 Optional 6-1