왏Priority: Priority here means Port Priority. Port Priority and Port Num-
ber are mixed to form the Port ID. Port IDs are often compared in
order to determine which port of a bridge would become the Root
Port. The range is 0 – 240.
Default is 128.
왏Admin Edge Port: If user selects “Yes”, this port will be an edge port.
An Edge Port is a port connected to a device that knows nothing
about STP or RSTP. Usually, the connected device is an end station.
Edge Ports will immediately transit to forwarding state and skip the
listening and learning state because the edge ports cannot create
bridging loops in the network. This will expedite the convergence.
When the link on the edge port toggles, the STP topology keeps
unchanged. Unlike the designate port or root port though, an edge
port will transit to a normal spanning-tree port immediately if it recei-
ves a BPDU.
Default: No
왏Admin Point To Point: say a port is a point-to-point link, from RSTP’s
view, if it is in full-duplex mode but is shared link if it is in half-duplex
mode. RSTP fast convergence can only happen on point-to-point links
and on edge ports. This can expedite the convergence because this
will have the port fast transited to forwarding state.
There are three parameters, Auto, True and False, used to configure
the type of the point-to-point link. If configure this parameter to be
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
92
EN
Auto, it means RSTP will use the duplex mode resulted from the auto-
negotiation. In today’s switched networks, most links are running in
full-duplex mode. For sure, the result may be half-duplex, in this case,
the port will not fast transit to Forwarding state. If it is set as True, the
port is treated as point-to-point link by RSTP and unconditionally
transited to Forwarding state. If it is set as False, fast transition to For-
warding state will not happen on this port.
Default: Auto
M Check:
Migration Check. It forces the port sending out an RSTP BPDU instead of
a legacy STP BPDU at the next transmission. The only benefit of this ope-
ration is to make the port quickly get back to act as an RSTP port. Click
<M Check> button to send a RSTP BPDU from the port you specified.
4.11Trunk
The Port Trunking Configuration is used to configure the settings of Link
Aggregation. You can bundle more than one port with the same speed, full
duplex and the same MAC to be a single logical port, thus the logical port
aggregates the bandwidth of these ports. This means you can apply your cur-
rent Ethernet equipments to build the bandwidth aggregation. For example,
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
93
EN
if there are three Fast Ethernet ports aggregated in a logical port, then this
logical port has bandwidth three times as high as a single Fast Ethernet port
has.
The switch supports two kinds of port trunking methods:
쐃LACP:
Ports using Link Aggregation Control Protocol (according to IEEE 802.3ad
specification) as their trunking method can choose their unique LACP
GroupID (1~3) to form a logic “trunked port”. The benefit of using LACP
is that a port makes an agreement with its peer port before it becomes a
ready member of a “trunk group” (also called aggregator). LACP is safer
than the other trunking method - static trunk.
The switch LACP does not support the followings:
Link Aggregation across switches
Aggregation with non-IEEE 802.3 MAC link
Operating in half-duplex mode
Aggregate the ports with different data rates
쐇Static Trunk:
Ports using Static Trunk as their trunk method can choose their unique
Static GroupID (also 1~3, this Static groupID can be the same with
another LACP groupID) to form a logic “trunked port”. The benefit of using
Static Trunk method is that a port can immediately become a member of
a trunk group without any handshaking with its peer port. This is also a
disadvantage because the peer ports of your static trunk group may not
know that they should be aggregate together to form a “logic trunked
port”. Using Static Trunk on both end of a link is strongly recommended.
Please also note that low speed links will stay in “not ready” state when
using static trunk to aggregate with high speed links.
As to system restrictions about the port aggregation function on the
switch, in the management point of view, the switch supports maximum
3 trunk groups for LACP and additional 3 trunk groups for Static Trunk. But
in the system capability view, only 3 “real trunked” groups are supported.
An LACP trunk group with more than one ready member-ports is a “real
trunked” group. An LACP trunk group with only one or less than one ready
member-ports is not a “real trunked” group. Any Static trunk group is a
“real trunked” group.
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
94
EN
Per Trunking Group supports a maximum of 4 ready member-ports. Please
note that some decisions will automatically be made by the system while
you are configuring your trunking ports. Trunk Setting Rules are listed
below:
Rule1:Maximum 3 groups are allowed
Rule 2: The members of each group cannot exceed more than 4 ports
Rule 3: Group 1 and 2 cannot exist member 25 and 26 port
Rule 4: Group 3 cannot exist member from 1 to 24 port
4.11.1Port Setting/Status
Port setting/status is used to configure the trunk property of each and every
port in the switch system.
쮿Parameter Description:
왏Method: This determines the method a port uses to aggregate with
other ports.
None: A port does not want to aggregate with any other port
should choose this default setting.
LACP: A port use LACP as its trunk method to get aggregated with
other ports also using LACP.
Static: A port use Static Trunk as its trunk method to get aggrega-
ted with other ports also using Static Trunk.
왏Group: Ports choosing the same trunking method other than “None”
must be assigned a unique Group number (i.e. Group ID, valid value
is from 1 to 8) in order to declare that they wish to aggregate with
each other.
왏Active LACP:
This field is only referenced when a port’s trunking method is LACP.
Active:
An Active LACP port begins to send LACPDU to its link partner
right after the LACP protocol entity started to take control of this
port.
Passive:
A Passive LACP port will not actively send LACPDU out before it
receives an LACPDU from its link partner.
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
95
EN
왏Aggtr: Aggtr is an abbreviation of “aggregator”. Every port is also an
aggregator, and its own aggregator ID is the same as its own Port No.
We can regard an aggregator as a representative of a trunking group.
Ports with same Group ID and using same trunking method will have
the opportunity to aggregate to a particular aggregator port. This
aggregator port is usually the port with the smallest Port No. within
the trunking group.
왏Status: This field represents the trunking status of a port which uses a
trunking method other than “None”. It also represents the manage-
ment link status of a port which uses the “None” trunking method. “-
--“ means “not ready”
4.11.2Aggregator View
To display the current port trunking information from the aggregator point of
view.
쮿Parameter Description:
왏Aggregator: It shows the aggregator ID (from 1 to 26) of every port.
In fact, every port is also an aggregator, and its own aggregator ID is
the same as its own Port No..
왏Method: Show the method a port uses to aggregate with other ports.
왏Member Ports: Show all member ports of an aggregator (port).
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
96
EN
왏Ready Ports: Show only the ready member ports within an aggregator
(port).
4.11.3LACP System Configuration
Show the detailed information of the LACP trunking group.
쮿Parameter Description:
왏Actor:
The switch you are watching on.
왏Partner: The peer system from this aggregator’s view.
왏System Priority: Show the System Priority part of a system ID.
왏MAC Address: Show the MAC Address part of a system ID.
왏Port:
Show the port number part of an LACP port ID.
왏Key: Show the key value of the aggregator. The key value is determi-
ned by the LACP protocol entity and can’t be set through manage-
ment.
왏Trunk Status: Show the trunk status of a single member port.”---“
means “not ready”.
Zeigt ihnen den Trunk-Status eines einzelnden Portes an. Dabei bedeutet “---” das der Port nicht bereit bzw. nicht aktiv ist.### Bild von einem Aggrega tor fehlt.
쮿Function name: LACP System Configuration
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
97
EN
쮿Function Description: It is used to set the priority part of the LACP system
ID. LACP will only aggregate together the ports whose peer link partners
are all on a single system. Each system supports LACP will be assigned a
globally unique System Identifier for this purpose. A system ID is a 64-bit
field comprising a 48-bit MAC Address and 16-bit priority value.
쮿Parameter Description:
왏System Priority: The System Priority can be set by the user. Its range is
from 1 to 65535. Default: 32768.
왏Hash Method: DA+SA, DA and SA are three Hash methods offered for
the Link Aggregation of the switch. Packets will decide the path to
transmit according to the mode of Hash you choose.
Default: DA and SA.
4.12802.1x Configuration
802.1x port-based network access control provides a method to restrict users
to access network resources via authenticating user’s information. This rest-
ricts users from gaining access to the network resources through a 802.1x-
enabled port without authentication. If a user wishes to touch the network
through a port under 802.1x control, he (she) must firstly input his (her)
account name for authentication and waits for gaining authorization before
sending or receiving any packets from a 802.1x-enabled port.
Before the devices or end stations can access the network resources through
the ports under 802.1x control, the devices or end stations connected to a
controlled port send the authentication request to the authenticator, the
authenticator pass the request to the authentication server to authenticate
and verify, and the server tell the authenticator if the request get the grant of
authorization for the ports.
According to IEEE802.1x, there are three components implemented. They are
Authenticator, Supplicant and Authentication server.
Supplicant:
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
98
EN
It is an entity being authenticated by an authenticator. It is used to com-
municate with the Authenticator PAE (Port Access Entity) by exchanging
the authentication message when the Authenticator PAE request to it.
Authenticator:
An entity facilitates the authentication of the supplicant entity. It controls
the state of the port, authorized or unauthorized, according to the result
of authentication message exchanged between it and a supplicant PAE.
The authenticator may request the supplicant to re-authenticate itself at
a configured time period. Once start re-authenticating the supplicant, the
controlled port keeps in the authorized state until re-authentication fails.
A port acting as an authenticator is thought to be two logical ports, a con-
trolled port and an uncontrolled port. A controlled port can only pass the
packets when the authenticator PAE is authorized, and otherwise, an
uncontrolled port will unconditionally pass the packets with PAE group
MAC address, which has the value of 01-80-c2-00-00-03 and will not be
forwarded by MAC bridge, at any time.
Authentication server:
A device provides authentication service, through EAP, to an authentica-
tor by using authentication credentials supplied by the supplicant to
determine if the supplicant is authorized to access the network resource.
The overview of operation flow for the following figure is quite simple. When
Supplicant PAE issues a request to Authenticator PAE, Authenticator and Sup-
plicant exchanges authentication message. Then, Authenticator passes the
request to RADIUS server to verify. Finally, RADIUS server replies if the request
is granted or denied.
While in the authentication process, the message packets, encapsulated by
Extensible Authentication Protocol over LAN (EAPOL), are exchanged between
an authenticator PAE and a supplicant PAE. The Authenticator exchanges the
message to authentication server using EAP encapsulation. Before success-
fully authenticating, the supplicant can only touch the authenticator to per-
form authentication message exchange or access the network from the
uncontrolled port.
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
99
EN
In this figure is the typical configuration, a single supplicant, an authenticator
and an authentication server. B and C is in the internal network, D is Authen-
tication server running RADIUS, switch at the central location acts Authenti-
cator connecting to PC A and A is a PC outside the controlled port, running
Supplicant PAE. In this case, PC A wants to access the services on device B and
C, first, it must exchange the authentication message with the authenticator
on the port it connected via EAPOL packet. The authenticator transfers the
supplicant’s credentials to Authentication server for verification. If success,
the authentication server will notice the authenticator the grant. PC A, then,
is allowed to access B and C via the switch. If there are two switches directly
connected together instead of single one, for the link connecting two swit-
ches, it may have to act two port roles at the end of the link: authenticator
and supplicant, because the traffic is bi-directional.
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
100
EN
The figure shows the procedure of 802.1x authentication. There are steps for
the login based on 802.1x port access control management. The protocol
used in the right side is EAPOL and the left side is EAP.
쐃At the initial stage, the supplicant A is unauthenticated and a port on
switch acting as an authenticator is in unauthorized state. So the access
is blocked in this stage.
쐇Initiating a session. Either authenticator or supplicant can initiate the
message exchange. If supplicant initiates the process, it sends EAPOL-
start packet to the authenticator PAE and authenticator will immediately
respond EAP-Request/Identity packet.
쐋The authenticator always periodically sends EAP-Request/Identity to the
supplicant for requesting the identity it wants to be authenticated.
쐏If the authenticator doesn’t send EAP-Request/Identity, the supplicant will
initiate EAPOL-Start the process by sending to the authenticator.
쐄And next, the Supplicant replies an EAP-Response/Identity to the authen-
ticator. The authenticator will embed the user ID into Radius-Access-
Request command and send it to the authentication server for confirming
its identity.
쐂After receiving the Radius-Access-Request, the authentication server
sends Radius-Access-Challenge to the supplicant for asking for inputting
user password via the authenticator PAE.
쐆The supplicant will convert user password into the credential information,
perhaps, in MD5 format and replies an EAP-Response with this credential
information as well as the specified authentication algorithm (MD5 or
OTP) to Authentication server via the authenticator PAE. As per the value
of the type field in message PDU, the authentication server knows which
algorithm should be applied to authenticate the credential information,
EAP-MD5 (Message Digest 5) or EAP-OTP (One Time Password) or other
else algorithm.
쐊If user ID and password is correct, the authentication server will send a
Radius-Access-Accept to the authenticator. If not correct, the authentica-
tion server will send a Radius-Access-Reject.
쐎When the authenticator PAE receives a Radius-Access-Accept, it will send
an EAP-Success to the supplicant. At this time, the supplicant is authori-
zed and the port connected to the supplicant and under 802.1x control is
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
101
EN
in the authorized state. The supplicant and other devices connected to this
port can access the network. If the authenticator receives a Radius-
Access-Reject, it will send an EAP-Failure to the supplicant. This means
the supplicant is failed to authenticate. The port it connected is in the
unauthorized state, the supplicant and the devices connected to this port
won’t be allowed to access the network.
쐅When the supplicant issue an EAP-Logoff message to Authentication ser-
ver, the port you are using is set to be unauthorized.
Only MultiHost 802.1X is the type of authentication supported in the switch.
In this mode, for the devices connected to this port, once a supplicant is
authorized, the devices connected to this port can access the network
resource through this port.
802.1x Port-based Network Access Control function supported by the switch
is little bit complex, for it just support basic Multihost mode, which can dis-
tinguish the device’s MAC address and its VID. The following table is the sum-
mary of the combination of the authentication status and the port status
versus the status of port mode, set in 802.1x Port mode, port control state, set
in 802.1x port setting. Here Entry Authorized means MAC entry is authorized.
LANCOM ES-2126+ and LANCOM ES-2126P+
쮿 Chapter 4: Operation of Web-based Management
102
EN
Table 3-3
802.1x State Setting
This function is used to configure the global parameters for RADIUS authen-
tication in 802.1x port security application.
쮿Parameter Description:
왏Radius Server: RADIUS server IP address for authentication.
Default: 192.168.1.1
왏Port Number: The port number to communicate with RADIUS server
for the authentication service. The valid value ranges 1-65535.
Default port number is 1812.
왏Secret Key: The secret key between authentication server and authen-
ticator. It is a string with the length 1 – 31 characters. The character
string may contain upper case, lower case and 0-9. It is character
sense. It is not allowed for putting a blank between any two charac-
Gebruikershandleiding.com neemt misbruik van zijn services uitermate serieus. U kunt hieronder aangeven waarom deze vraag ongepast is. Wij controleren de vraag en zonodig wordt deze verwijderd.
Product:
Spelregels forum
Om tot zinvolle vragen te komen hanteren wij de volgende spelregels:
lees eerst de handleiding door;
controleer of uw vraag al eerder door iemand anders is gesteld;
probeer uw vraag zo duidelijk mogelijk te stellen;
heeft u een probleem en al geprobeerd om dit op te lossen, vermeld dit erbij aub;
heeft u een oplossing gekregen van een bezoeker dan horen wij dat graag in dit forum;
wilt u een reactie geven op een vraag of antwoord, gebruik dan niet dit formulier maar klik op de knop 'reageer op deze vraag';
uw vraag wordt direct op de website gezet; vermijd daarom persoonlijke gegevens in te vullen;
Belangrijk! Als er een antwoord wordt gegeven op uw vraag, dan is het voor de gever van het antwoord nuttig om te weten als u er wel (of niet) mee geholpen bent! Wij vragen u dus ook te reageren op een antwoord.
Belangrijk! Antwoorden worden ook per e-mail naar abonnees gestuurd. Laat uw emailadres achter op deze site, zodat u op de hoogte blijft. U krijgt dan ook andere vragen en antwoorden te zien.
Abonneren
Abonneer u voor het ontvangen van emails voor uw Lancom ES-2126 plus bij:
nieuwe vragen en antwoorden
nieuwe handleidingen
U ontvangt een email met instructies om u voor één of beide opties in te schrijven.
Ontvang uw handleiding per email
Vul uw emailadres in en ontvang de handleiding van Lancom ES-2126 plus in de taal/talen: Engels als bijlage per email.
De handleiding is 2,46 mb groot.
U ontvangt de handleiding per email binnen enkele minuten. Als u geen email heeft ontvangen, dan heeft u waarschijnlijk een verkeerd emailadres ingevuld of is uw mailbox te vol. Daarnaast kan het zijn dat uw internetprovider een maximum heeft aan de grootte per email. Omdat hier een handleiding wordt meegestuurd, kan het voorkomen dat de email groter is dan toegestaan bij uw provider.
Uw handleiding is per email verstuurd. Controleer uw email
Als u niet binnen een kwartier uw email met handleiding ontvangen heeft, kan het zijn dat u een verkeerd emailadres heeft ingevuld of dat uw emailprovider een maximum grootte per email heeft ingesteld die kleiner is dan de grootte van de handleiding.
Er is een email naar u verstuurd om uw inschrijving definitief te maken.
Controleer uw email en volg de aanwijzingen op om uw inschrijving definitief te maken
U heeft geen emailadres opgegeven
Als u de handleiding per email wilt ontvangen, vul dan een geldig emailadres in.
Uw vraag is op deze pagina toegevoegd
Wilt u een email ontvangen bij een antwoord en/of nieuwe vragen? Vul dan hier uw emailadres in.
