1. Smart III Switch Functions and Features WebUI Config Guide 1 1 ©Copyright 2007. By D-Link HQ TSD James Chu

2. Smart Wizard Before entering the Web-based Management Utility, you can see the Smart Wizard first, it will guide you to quick configure some functions as below. If you don’t plan to change anything, click Exit to exit the Wizard and enter the Web Interface: - Password Setting - SNMP Setting - System Setting

3. Function Tree Overview System System Settings Trap Settings Port Settings SNMP Settings Password Access Control System Log Settings Configuration Jumbo Frame 802.1Q VLAN 802.1Q Management VLAN Voice VLAN Link Aggregation IGMP Snooping Port Mirroring Power Saving Loopback Detection SNTP Settings Spanning Tree QoS Storm Control Bandwidth Control 802.1P/DSCP Priority Settings Security Trusted Host Safeguard Engine Port Security 802.1x MAC Address Table ACL ●ACL Configuration Wizard ●Access Profile List ●ACL Finder Monitoring ●Statistics ●Cable Diagnostics ●System Log

4. System Contents System System Settings Trap Settings Port Settings SNMP Settings Password Access Control System Log Settings System >> Contents

5. System Settings IP Information Static: When using static mode, the IP Address, Subnet Mask and Gateway can be manually configured DHCP: When using DHCP mode, the Switch will first look for a DHCP server to provide it with an IP address, network mask, and default gateway before using the default or previously entered settings System Information System Name: For easier recognized when manage. System Location: For easier recognized when manage. Login Timeout (3-30 minutes): For controls the idle time-out for security purposes. Group Internal (120-1225 seconds): For routinely send report packets to the SmartConsole Utility in order to maintain the correct data shown. Setting zero (0) means disable Group Interval. System >> System Settings

6. Trap Settings Trap is a message which is initiated by switch, when some abnormal conditions happen (Ex: link change, device bootup), switch will send out the announcement to notify the managed stations. Trap Settings for Smart Console Utility: It allows Smart Console Utility to monitor specified events on Smart Switch, the default is disabled. The Destination IP for the managed station that will receive trap information. After enabled, when the specified events happen (ex: Link change), Smart switch will send out the UDP packets which contain the events information to Smart Console Utility for the log. System >> Trap Settings

7. Port Settings Port Settings: By selecting a range of ports, setting the Speed to be “Auto mode, forced mode, or Disabled”, the Flow Control to be enabled or disabled, and lastly MDI/MDIX to “Auto, MDI or MDIX”. System >> Port Settings

8. SNMP Settings SNMP Setting: SNMP, Simple Network Management Protocol, developing to manage the devices, by using the OID and SNMP commands to read or modify it. Community Setting: Community Strings are like passwords between switch and managed PC. Trap Setting: Traps are messages that alert some events occur on the Switch, and send SNMP Trap Packets to the managed PC for the notify. System >> SNMP Settings

9. SNMP Settings Test Topology: After configure the SNMP Setting as last slide, we can use the following 2 method for getting the information from smart switch (DGS-1210 in this example): SNMP: (use “commTrapIpAddress” for the example: the IP Address of this SNMP Trap Community Entry) #snmpwalk -v2c -c private 192.168.0.1 1.3.6.1.4.1.171.10.76.5.1.3.1.3 Trap: >> SNMP Settings Test DGS-1210 Managed PC 192.168.0.5 System Test Client for link up/down

10. Password Access Control >> Password Access Control System

11. System Logs Settings System Log Configuration –System Logs record and manage events, as well as report errors and informational messages. Message severity determines a set of event messages that will be sent. Click Enable so you can start to configure the related settings of the remote system log server, then press Apply for the changes to take effect. >> System Logs Settings System

12. Configuration Contents Configuration Jumbo Frame 802.1Q VLAN 802.1Q Management VLAN Voice VLAN Voice VLAN Settings Voice VLAN OUI Settings Link Aggregation Port Trunkings LACP Port Settings IGMP Snooping Port Mirroring Power Saving Loopback Detection SNTP Settings Time Settings TimeZone Settings Spanning Tree STP Global Settings STP Port Settings Configuration >> Contents

13. Jumbo Frame (only for DGS series) Jumbo Frame Configuration Jumbo frames mean larger than the Ethernet frame size of 1500 bytes, and D-Link Gigabit Smart Switches support jumbo frame up to 10000 bytes (around 10KB). Default is disabled. Configuration >> Jumbo Frame

14. 802.1Q VLAN Example for edit a VLAN: Configuration >> 802.1Q VLAN

15. 802.1Q VLAN Example for create an new VLAN: Configuration >> 802.1Q VLAN

16. 802.1Q VLAN Example for the Asymmetric VLAN: Asymmetric VLAN allows devices in different VLANs to communicate with the servers, firewalls or other shared resources in the shared VLAN. As the diagram below, VLAN 2 and VLAN 3 cannot communicate each other, but both of them can access to VLAN 1 by Asymmetric VLAN. VLAN 1 (Shared VLAN) VLAN 2 (Access VLAN) VLAN 3 (Access VLAN) Configuration >> 802.1Q VLAN

17. 802.1Q VLAN Asymmetric VLAN Test Topology: Settings: Configuration >> 802.1Q VLAN PC1 (VID 2) PC2 (VID 3) PC3 (VID 4) Servers (VID 1) Firewall (VID 1) 56715-1820

18. 802.1Q Management VLAN By default, all VLANs are the Management VLAN in smart switch. So 802.1Q Management VLAN setting allows you to transfer the authority to one specific VLAN. Default is disabled. For example, we can set the VLAN 2 to be the only one Management VLAN in smart switch, so the client who connected to VLAN 2 can access to DGS-1224T: First, there are 3 VLANs in DGS-1224T: Change the “VID 2” to be Management VLAN only: >> 802.1Q Management VLAN Configuration

19. Voice VLAN Voice VLAN Settings –Voice VLAN is a feature that allows you to automatically place the voice traffic from IP phone to an assigned VLAN to enhance the VoIP service. With a higher priority and individual VLAN, the quality and the security of VoIP traffic are guaranteed. Switch will add ports to the voice VLAN automatically if it detects the device OUI matches the Telephony OUI configured in the Voice VLAN OUI Setting page. >>Voice VLAN Configuration

20. Voice VLAN Voice VLAN OUI Settings –This window allows the user to configure the user-defined voice traffic’s OUI. An Organizationally Unique Identifier (OUI) is the first three bytes of the MAC address. This identifier uniquely identifies a vendor, manufacturer, or other organization. >>Voice VLAN Configuration

21. Link Aggregation Port Trunking The Trunking function enables the cascading of two or more ports for a combined larger bandwidth. Up to eight Trunk groups may be created, each supporting up to 8 ports. Configuration >> Trunk

22. Link Aggregation LACP port settings –The LACP Port Settings is used to create port trunking groups on the Switch. The user may set which ports will be active and passive in processing and sending LACP control frames and Port priority. In order to utilize the ability to change an aggregated port group, that is, to add or subtract ports from the group, at least one of the participating devices must designate LACP ports as active. Lastly the administrative LACP timeout. >>Link Aggregation Configuration

23. IGMP Snooping IGMP Snooping Configuration: With IGMP Snooping, the Smart Switch can make intelligent multicast forwarding decisions by examining the contents of each frame’s Layer 2 MAC header. IGMP Global Settings. VLAN Setting of IGMP Snooping: After enable IGMP Snooping, you can edit each VLAN Settings of IGMP Snooping. Configuration >> IGMP Snooping

24. Port Mirroring Port Mirroring is a method of monitoring network traffic that forwards a copy of each incoming and/or outgoing packet from one port of the Switch to another port where the packet can be studied. Target Port: Select a target port which will monitor. Source Port: Select a source port which will be monitored, and the sniffer mode as TX, RX, or Both. Configuration >> Port Mirroring

25. Power Saving (only for DGS series) Power Saving: The Power Saving mode feature reduces power consumption automatically when the port link down or the connected devices are turned off. By default, the Power Saving mode is enabled. For example, the following is the Power Consumption Table in 110V AC (Unit: W) on DGS-1210: Test ItemsEnable PSDisable PSOld revision All port Link Down Test8.4 W10.8 W13.4 W 1/2 port Link Up w/o traffic18.0 W18.7 W26.8 W 1/2 port Link Up w 100% traffic18.5 W19.0 W27.7 W All port Link Up w/o traffic29.8 W 44.1 W All port Link Up w 100% traffic30.4 W 45.2 W Configuration >> Power Saving

26. Loopback Detection Loopback Detection Settings The Loopback Detection function is used to detect the loop created by a specific port while Spanning Tree Protocol (STP) is not enabled in the network. The Switch will automatically shutdown the port and sends a log to the administrator. Loopback Detection Global Settings: Set the Loop detection interval and the Loopback Detection port will be unlocked when the Loopback Detection Recover Time times out and. >>Loopback Detection Configuration

27. SNTP Settings Time Settings Simple Network Time Protocol is used by the Switch to synchronize the clock of the computer. SNTP Server Configuration: Specify the IP address of the primary and Secondary SNTP server from which the system time is retrieved or Set time from a PC. >>SNTP Settings Configuration

28. SNTP Settings TimeZone Settings The TimeZone Setting Page is used to configure time zones and Daylight Savings time settings for SNTP DST Annual Settings: Using annual mode will enable DST seasonal time adjustment >>SNTP Settings Configuration

29. Spanning Tree STP Global Settings Enabled, the Switch will listen for BPDU packets and its accompanying Hello packet. BPDU packets are sent even if a BPDU packet was not received. Therefore, each link between bridges is sensitive to the status of the link results in faster detection of failed links, and thus faster topology adjustment. >>Spanning Tree Configuration

30. Spanning Tree STP Port Settings STP can be set up on a port per port basis. In addition to setting Spanning Tree parameters for use on the switch level, the Switch allows for the configuration of the groups of ports, each port- group of which will have its own spanning tree, and will require some of its own configuration settings. Setting for External Cost define a metric that indicates the relative cost of forwarding packets, Migrate parameter as “Yes” will set the ports to send out BPDU packets to other bridges, requesting information on their STP setting and Edge selected the port as an edge port that cannot create loops. >>Spanning Tree Configuration

31. PoE Contents PoE: PoE Port Settings PoE System Settings

32. PoE (Power Over Ethernet) PoE, means Power Over Ethernet, is a technology that allows to supply electricity over standard Ethernet cables, as well as providing the data, which is defined by the IEEE 802.3af specification. PoE consists of 2 components : PSE: means Power Sourcing Equipment, the devices which provide the power to PD. PD: means Powered Device, the devices which receive the power from PSE, it could be IP telephones, wireless AP, network cameras, and other appliances. IEEE 802.3af defined that the PSE provides power according to the following classification: ClassUsageMax power used by PD 0Default15.4W 1Optional4.0W 2Optional7.0W 3Optional15.4W 4Reserved15.4W PoE >> PoE

33. PoE (Power Over Ethernet) DGS-1210-10P supports PoE: Supply power to PD device up to 15.4W per port. The Power Budget of all switch is 180W. When port current is over 350mA, switch will auto disable the ports. PoE System settings: Power Threshold: When the ratio of the system power supply is larger than or smaller than the System Power Threshold Setting, the Switch will send trap events to the Management Station. >> PoE PoE

34. PoE (Power Over Ethernet) PoE Port Settings: Power Limit: This function allows you to manually set the port power current limitation to be given to the PD. Select from "Class 1 (4.0W )", "Class 2 (7.0W ) ", "Class 3 (15.4.W ) " and "Auto" for the power limit. PoE Port Status: we also provide the auto discovery feature, automatically recognize the connection of PD device. 5 diagnostics status in this section: “Normal”, “Power management cause fail”, “Over current”, “Short circuit”, and “Power ON”. >> PoE PoE

35. PoE (Power Over Ethernet) Test Topology: Setting: Enable PoE function on port 1-5, and select power limit to “Auto”. Connected DWL-8200AP to DGS-1210-10P, then AP start working by the power provided from PoE switch. Check the Table, after Auto check, the PD is class 3 with 4.41W / 49.53V / 89.06mA, and status is “Power ON”, means work well. >> PoE Test PoE DGS-1210-10P PSE: DGS-1210-10P 3 PD: DWL-8200AP LAN1 (PoE)....

36. QoS Contents QoS Storm Control Bandwidth Control 802.1P/DSCP Priority Settings QoS >> Contents

37. Storm Control QoS >> Storm Control Storm Control – The Storm Control feature provides the ability to control the receive rate of broadcast, multicast, and unknown unicast packets.

38. Bandwidth Control QoS >>Bandwidth Control Bandwidth Control –The Bandwidth Control page allows network managers to define the bandwidth settings for a specified port’s transmitting and receiving data rates. – By setting Disabled in No Limit, the selected port will have no bandwidth limit. If enable, the Rate field allows you to enter the data rate, in Kbits per second, will be the limit for the selected port.

39. 802.1p/DSCP Priority Settings QoS: QoS can provide different priority to different users or data flows, or guarantee a certain level of performance to a data flow in accordance with requests from the application program or the internet service provider policy. Qos mode: 802.1p DSCP Queue Mechanism: Strict Priority WRR (Weighted Round-Robin) QoS >> 802.1p/DSCP Priority Settings

40. 802.1p/DSCP Priority- Qos mode 802.1p: 802.1p priority in the VLAN tag, for layer 2 packets. For ingress tagged packets, D-Link Smart Switches will refer to their 802.1p information and prioritize them with 4 different priority queues (Highest, High, Medium, Low). For ingress untagged packets, the per port "Default Priority" settings will be applied to packets of each port to provide port-based traffic prioritization. For our smart switch, 802.1p support 4 queues of the priority: Switch Priority Queues802.1p PriorityClass of Traffic Highest6, 73 High4, 52 Medium0, 31 Low1, 20 Tagged frame Untagged frame Tagged frame VIDPri.VIDPri.PVIDPri. Ingress Rule QoS >> 802.1p/DSCP Priority-QoS Mode

41. 802.1p/DSCP Priority- Qos mode DSCP: Differentiated Services Code Point (DSCP), is a field in the IP header of layer 3 that enables different levels of service to be assigned to network traffic. This is achieved by marking each packet on the network with a DSCP code and appropriating to it the corresponding level of service. For our smart switch, we’ll check the DSCP value from the incoming packets, and decide the priority of handling by mapping the value to our DSCP Priority Table in switch. Also we have 4 queues for mapping DSCP Value into different level of priority: Highest, High, Medium, and Low. QoS >> 802.1p/DSCP Priority-QoS Mode 76543210 DSCP OffsetFCSProtoTTLIDLENToS Version SA_IPDA_IPData L3 IPV4 Unused Bits

42. 802.1p/DSCP Priority- Queue Mechanism Strict Priority: to process the packets with the highest priority. Highest Priority Queue 45 1 4 2 5 6 3 High Priority Queue Medium Priority Queue Low Priority Queue 1 3 2 6 QoS >> 802.1p/DSCP Priority-Queue Mechanism

43. 802.1p/DSCP Priority- Queue Mechanism WRR (Weighted Round-Robin): to process packets according to the weight of each priority within our smart switch. x x x x x x x x x x x x 1718 25 17 18 25 9101112 1920 262827 QoS >> 802.1p/DSCP Priority-Queue Mechanism 9 10 11 12 1234 5678 13141516 21222324 29303231 1 2 3 4 5 6 7 8 Medium Priority Queue (20%) High Priority Queue (40%) Highest Priority Queue (80%) Low Priority Queue (10%)

44. Security Contents Security Trusted Host Safeguard Engine Port Security 802.1x 802.1x Setting MAC Address Table Static MAC Dynamic Forwarding Table Security >> Contents

45. Trusted Host Use Trusted Host function to manage the switch from a remote station, you can create 3 designated management stations by defining the IP address/Mask. Security >> Trusted Host 1 2 3

46. Safeguard Engine If there are malicious hosts attacking the Switch, the CPU receiving high packet rate and CPU utilization may be very high. During this period, normal management services will be impacted. (i.e. ARP packet storm) So the solution is Safeguard Engine. This function is designed to reduce the CPU utilization, and protects D-Link Switches from malicious viruses or worm attacks. Safeguard Engine is enabled by default in Smart Switches and disabled by default in Managed Switches. Security >> Safeguard Engine * This feature are supported in both D-Link Smart and Managed Switches.

47. 47 Safeguard Engine Page is Animated The CPU of switch is designed to handle the control information like STP, SNMP, Web access..etc. Also some specific network packets will be forwarded to CPU for processing like ARP broadcast, unknown DST unicast, IP broadcast.. etc. But nowadays networks are with blended threats like virus / worm. Usually they will generate unexpected bulk “CPU interested” traffic [ like ARP broadcast ] during infection. It turns out CPU is overloaded and not able to respond to those important tasks like management access, STP, SNMP polling Spanning Tree BPDU packets IGMP snooping Web Mgm Access SNMP Polling ARP broadcast Unknown DST unicast IP broadcast Security >> Safeguard Engine

48. 48 Safeguard Engine Page is Animated But nowadays networks are with blended threats like virus / worm. Usually they will generate unexpected bulk “CPU interested” traffic [ like ARP broadcast ] during infection. It turns out CPU is overloaded and not able to respond to those important tasks like management access, STP, SNMP polling Spanning Tree BPDU packets IGMP snooping Web Mgm Access SNMP Polling With D-Link Safeguard Engine, it will further identify & prioritize those ‘CPU interested’ traffic, to throttle those unwanted interruption and to protect the switch operation. ARP broadcast Unknown DST unicast IP broadcast Thus with Safeguard Engine, D-Link Switch will show its robustness especially under virus infection or worm scanning. Security >> Safeguard Engine

49. Port Security Port Security is a security feature that prevents unauthorized computers (with source MAC addresses) unknown to the Switch prior to stopping auto-learning processing from gaining access to the network by stopping such that the current source MAC addresses entered into the MAC address forwarding table can not be changed once the port lock is enabled. Security >> Port Security

50. 802.1x 802.1x define a client/server-based access control and authentication protocol that restricts unauthorized devices from connecting to a LAN through publicly accessible ports. The Authentication Server authenticates each client connecting to a switch port before making any services offered by the switch or LAN available. 802.1X Authentication Mechanism consists of three components Authentication Server (RADIUS Server) : The Authentication Server validates the identity of the client and notifies the Authenticator. Authenticator (Switch) : The Authenticator requests information from the client, verifies that information with the Authentication Server and relays a response to the client. Client : The client requests access to the LAN and switch services and responds to the requests from the switch. The Workstation must run 802.1X-Compliant Client Software (eg. Windows XP has embedded 802.1X suppliant). Security >> 802.1x RADIUS Server (Authentication Server) Switch (Authenticator) Client Authentication Server 802.1x Client Unauthorized Device

51. 802.1x 802.1x setting interface on smart switch: Radius Server IP: assign the IP Address of Radius Server. Authentication Port: sets primary port for security monitoring. Default is 1812. Key: Masked password matching the Radius Server Key. ReAuthEnabled: This enables or disables the periodic ReAuthentication control. When the 802.1X function is enabled, the ReAuthEnabled function is by default also enabled. ReAuthPeriod: This command affects the behavior of the switch only if periodic re-authentication is enabled. Default is 3600. 1 2 3 Security >> 802.1x

52. 802.1x Test Topology: Test Result: Authentication Username/passwordtest/test DGS-1210 802.1x enabled port1-8 Radius Server Secret keydlink DGS-1210 Radius Server 192.168.0.10 802.1x Client 192.168.0.5 315 DGS-1210 192.168.0.1

53. MAC Address Table Static MAC Disable Auto Learning Excluding Uplink Port: When turn on it (means disable auto learning), switch will not learn any MAC address to MAC Address Table except for the uplink port you check in the port list, and switch should follow the static MAC table for the security. For example, after turn on this feature and select the port 1 to be uplink port, then only the devices under port 1 can be learned by switch. Static MAC Address Lists: displays the static Mac address list, as well as the VID. Security >> MAC Address Table 1 2 3

54. MAC Address Table Dynamic Forwarding Table: For each port, this table displays the Mac address of each packet passing through the Switch, and you can add the Mac address into static Mac Address list by the following steps: Security >> MAC Address Table 1 2 3

55. ACL Contents ACL ACL Configuration Wizard Access Profile List ACL Finder ACL >> Contents

56. ACL Configuration Wizard Access Control List (ACL) allows you to establish criteria to determine whether or not the Switch will forward packets based on the information contained in each packet's header. This criteria can be specified on a basis of the MAC address, or IP address and on which ports to allow or deny the packets. ACL >>ACL Configuration Wizard

57. Access Profile List The ACL Profile List provides information for configuring ACL Profiles manually. ACL profiles are attached to interfaces, and define how packets are forwarded if they match the ACL criteria. ACL >>Access Profile List

58. Access Profile List –To manually add a profile, click Add ACL Profile: ACL >>Access Profile List

59. ACL Finder –This page is used to help find a previously configured ACL entry. To search for an entry, enter the profile ID from the drop-down menu, select a port that you wish to view, define the state and click Find. The table on the lower half of the screen will display the entries. To delete an entry click the corresponding Delete button or edit the profile by selecting the Access ID. ACL >>ACL Finder

60. Monitoring Contents Monitoring Statistics Cable Diagnostics System Log Monitoring >> Contents

61. Statistics Statistics: Displays the status of each port packet count. Monitoring >> Statistics

62. Cable Diagnostics Cable Diagnostics: The Cable Diagnostics for examine the cable healthy status, and can rapidly determines the type of cable errors occurred in the cable, and detect the cable length. For D-Link Smart Switch, this function: only applied for Gigabit copper port when the link speed is 1000M. For detect the cable length and the Cable errors of Open or Short. Monitoring >> Cable Diagnostics

63. System Log Switch History Log The System Log page provides information about system logs, including information when the device was booted, how the ports are operating, when users logged in, when sessions timed out, as well as other system information. Monitoring >> System Log

64. Q&A