Internet 貼貼樂: 2008/12/28

Page 16-1

16 Managing Groups and Ports

In a traditional hub-based network, a broadcast domain is confined to a single network interface,

such as Ethernet or Token Ring, or even a specific physical location, such as a department

or building floor. In a switch-based network, such as one comprised on OmniAccess

512es, a broadcast domain—or Group — can span multiple physical switches and can include

ports using multiple network interfaces. For example, a single OmniAccess 512 Group could

span three different switches located in different buildings and include Ethernet, Token Ring,

ATM and WAN physical ports.

An unconfigured OmniAccess 512 contains one Group, or broadcast domain. It also contains

one default Virtual Network, or VLAN , referred to as "default VLAN #1". The default Group,

Group #1, and its default VLAN contain all physical ports in the switch. When a switching

module is added to the switch all of these additional physical ports are also assigned to

Group #1, VLAN #1.

You can create Groups in addition to this default Group. When you add a new Group, you

give it a name and number, optionally configure a virtual router port for its default

VLAN , and then add switch ports to it. The switch ports you add to a new Group are moved from the

default Group #1 to this new Group. (For more information on how ports are assigned to

Groups, see How Ports Are Assigned to Groups on page 16-2.)

Up to 500 Groups can be configured on each OmniAccess 512. An entire OmniAccess 512

network can contain up to 65,535 Groups. Each Group is treated as a separate entity.

There are three main types of Groups:

Mobile Groups. These groups allow ports to be dynamically assigned to the Group based

on AutoTracker polices. In contrast to non-mobile Groups, AutoTracker rules are assigned

directly to a mobile Group. No AutoTracker VLANs are contained within a mobile Group.

(However, mobile groups do contain a default VLAN 1 to which AutoTracker policies are

assigned; policies assigned to this default VLAN apply to the entire mobile group.) Any

AutoTracker policy may be used as criteria for membership in a mobile Group. Mobile

groups are described in more detail in

Mobile Groups

on page 16-5.

Mobile Groups based on authentication. Authenticated Groups are a special form of

mobile Group. These Groups include devices that are dynamically assigned based on an

authentication criteria. Typically the user will have to log in with a valid password before

being included in an authenticated mobile Group. Group membership is based on users

proving their identity rather than the physical location of user devices. Authenticated

Groups are described in more detail in the

Switch Network Services User Manual

Non-mobile Groups. These Groups are the original Group type used in previous releases.

They contain statically assigned ports and may contain AutoTracker or Multicast VLANs.

These VLANs within a non-mobile Group use AutoTracker policies to filter traffic.

AutoTracker rules are not assigned to non-mobile Groups, they are assigned to the VLANs

within the Group. Non-mobile groups are described in more detail in

Non-Mobile Groups

and AutoTracker VLANs

on page 16-15.

All three types of Groups may co-exist on the same switch. However, a switch port cannot

belong to a non-mobile group and a mobile group.

How Ports Are Assigned to Groups

Page 16-2

How Ports Are Assigned to Groups

There are two methods for assigning physical OmniAccess 512 ports to a Group. One method

is static and requires manual configuration by the network administrator; the other method is

dynamic and requires only the configuration of AutoTracker rules for port assignment to

occur. The two methods are described in this section.

Static Port Assignment

In the static method, the network administrator manually assigns a port to a Group through

the

crgp

and

addvp

commands. The static method can be restrictive because it limits the

mobility of users in a multi-Group network. Users can only move within their assigned

Group. In addition, customized access for individual users is limited by this method. You can

use the static method of port assignment with mobile and non-mobile groups. Static port

assignment can be combined with dynamic port assignment for mobile groups, while static

port assignment is the only method for assigning ports to non-mobile groups.

Dynamic Port Assignment (Group Mobility)

The dynamic method is available with the Group Mobility feature. Initially each port is part of

the default Group #1 (only ports in the default Group and ports in mobile Groups are candidates

for dynamic port assignment). Based on the nature of traffic and configured

AutoTracker policies, ports are dynamically assigned to the appropriate Group.

For example, if a device attached to a port transmits traffic from the 140.0.0.0 subnet,

AutoTracker will check to see if a policy exists for this IP address. If it does, then it will move

the port from the default Group to the first Group using this policy. If this device detaches

from the network the port will be re-assigned to a Group without intervention by the network

administrator.

A port can belong to multiple mobile groups (up to 16) as long as devices attached to that

port match policies of these mobile groups. However, an individual device, or MAC address,

can only belong to one mobile group per protocol.

The dynamic method of port-to-Group assignment still requires the creation of Groups

through the

crgp

command. The criteria for the dynamic assignment of ports to a Group are

determined by AutoTracker policies that you can configure during the

crgp

procedure.

Only Ethernet and Token Ring ports can be dynamically assigned to Groups.

If more than one Group has the same type of rule, then ports matching that policy will be

assigned to the first Group matching the policy. For example, if a device matched policies in

both Groups 2 and 5, the port would be assigned to Group 2. To make the most out of

Group Mobility it is best not to duplicate policies among Groups.

Configuring Dynamic Port Assignment

You can enable dynamic port assignment while creating a group through the

crgp

command.

During the

crgp

procedure, you will be prompted

Enable Group Mobility on the Group ? [y/n] (n):

Answer

Yes

to this question to give this Group the capability of having ports and devices

dynamically added to the Group. Port and devices will be dynamically assigned based on

AutoTracker rules you define.

Service Ports and Group Mobility

Dynamic port assignment (ports carrying Ethernet and Token Ring traffic only) to Groups can

also apply to LANE service ports configured for

ATM

access. These ports may be automatically

added to the mobile group during the

crgp

procedure or through the

cats

command.

How Ports Are Assigned to Groups

Page 16-3

How Dynamic Port Assignment Works

Initially each port is assigned to the default Group. In this example, all three ports have workstations

that belong to three different

subnets (130.0.0.0, 138.0.0.0, and 140.0.0.0). All three

ports start out in the default Group.

Group Mobility examines traffic coming from OmniAccess 512 ports. Three mobile groups are

defined on the switch and each uses a different IP policy. Traffic that matches IP policies for a

Group will trigger the movement of the port to the matching Group.

Initial Configuration: All Ports in Default Group

As soon as the workstations start transmitting traffic, Group Mobility checks the source subnet

of the frames and looks for a match with any configured IP policies. If a match is found—and

in this example all three ports can be matched with a corresponding Group—the port is

moved to the matching Group.

Devices matching a policy trigger the assignment of a port to a mobile group. Therefore, the

device is moved to the mobile group at the same time as the port to which it is attached. If

more than one device comes in on a port, then that port can belong to more than one mobile

group. Similarly, if a device transmits more than one protocol—such as IP and IPX—then the

port to which it is attached can belong to more than one mobile group.

OmniAccess 512

12345678

123456

Port 2

Group 2

Group 1

Group 4

IP Network 130.0.0.0

Default Group

IP Network 140.0.0.0

Port 1

130.0.0.1 138.0.0.5 140.0.0.3

Group 3

IP Network 138.0.0.0

Port 3

How Ports Are Assigned to Groups

Page 16-4

As the illustration below shows, the three ports are each moved from the default Group to a

Group with a policy that matches the subnet address of the workstation attached to the port.

AutoTracker IP address policies have been set up in Groups 2, 3, and 4. The ports are moved

to the Group with policies matching the subnet of the workstation.

Ports Move to Groups With Matching Policies

OmniAccess 512

12345678

123456

Port 2

Group 2

Group 1

Group 4

IP Network 130.0.0.0

Default Group

IP Network 140.0.0.0

138.0.0.1 140.0.0.1

Group 3

IP Network 138.0.0.0

Port 3

130.0.0.1

Port 1

Mobile Groups

Page 16-5

Mobile Groups

Switch ports can be dynamically assigned to mobile groups through AutoTracker policies.

Support for dynamic port assignment is one of the main differences between mobile groups

and non-mobile groups. AutoTracker rules are assigned

directly

to a mobile group. In

contrast, AutoTracker rules are assigned to the VLANs

within

a non-mobile group. No

AutoTracker VLANs are contained within a mobile Group, and each mobile group constitutes

a single spanning tree.

A switch port can belong to multiple mobile groups, whereas a switch port can belong to

only one non-mobile group. However, a port can

not

belong to a mobile and a non-mobile

group at the same time.

Ports can be assigned to mobile groups either statically or dynamically. A port is

statically

assigned to a mobile group when one of the following occurs:

• Port by default assigned to default group 1

• Port assigned to a group through

crgp

addvp

commands

Although switch ports can belong to multiple mobile groups, it is not possible to assign a port

to two different groups using the

addvp

command. However, a switch port could be assigned

to one mobile group via the

addvp

command and then gain membership to another mobile

group by matching the policy criteria for that group.

A switch port is

dynamically

assigned to a mobile group after one of its attached devices

matches an AutoTracker policy for that mobile group. An overview of how ports and devices

are dynamically assigned to mobile Groups can be found in

How Ports Are Assigned to Groups

on page 16-2.

Authenticated Groups

Mobile groups provide the added flexibility of user-authentication policies. Using Authentication

Management Console (

AMC

) software, you can configure mobile groups to use log-in

procedures as a means of assigning group membership. Mobile groups that use authentication

are a special group type called an Authenticated Group. Authenticated Groups are

described in more detail in the

Switch Network Services User Manual

Configuring Mobile Groups

You configure mobile Groups through the

crgp

command. During the

crgp

procedure you

will receive a prompt asking if you want to create a mobile Group

Enable Group Mobility on this Group ? [y/n] (n):

You must answer

Yes

to this prompt to set up a mobile group. After this question, you will be

asked to configure virtual ports and AutoTracker policies for the Group. Documentation for

the full

crgp

procedure can be found in

Creating a New Group

on page 16-18.

Mobile Groups

Page 16-6

Turning Group Mobility On or Off

The

gmstat

command turns group mobility on or off for a Group that you specify. Essentially,

you can change a non-mobile group into a mobile group and a mobile group back into a

non-mobile group through

gmstat

. The group you specify must previously have been created

through the

crgp

command.

Use the following syntax for the gmstat command:

gmstat <group number>

For example, if you wanted to change the group mobility status of group 2, you would enter:

gmstat 2

Mobile Group to Non-Mobile Group

If this group is already a mobile group, the following would display:

Group Mobility is ON for Group 2

Change Group Mobility Status for Group 2 to OFF ? [y/n] (y):

If you wanted to change this mobile group back to a non-mobile group, you would press

<enter>

and the group would lose its mobile status. All AutoTracker policies you set up for

the Group would no longer be valid.

If you decided not to turn off group mobility, enter

and the following prompt displays:

Group Mobility Status unchanged

Non-Mobile Group to Mobile Group

If this group is currently a non-mobile group, the following would display:

Group Mobility is OFF for Group 8

Change Group Mobility Status for Group 8 to ON ? [y/n] (y):

If you wanted to turn on Group Mobility, you would press

<enter>

and would then be asked

if you want to configure AutoTracker policies. If you answer yes, then the AutoTracker policies

menu would display as follows:

Select rule type:

1. Port Rule

2. MAC Address Rule

21) MAC Address Range Rule

3. Protocol Rule

4. Network Address Rule

5. User Defined Rule

6. Binding Rule

7. DHCP PORT Rule

8. DHCP MAC Rule

81) DHCP MAC Range Rule

Enter rule type (1):

You define policies for a mobile Group. Non-mobile groups do not require policies.

However, mobile Groups use policies to define membership. Instructions for specifying

AutoTracker policies may be found in Chapter 17.

Note

As of the current release, the MAC Address Range Rule

and DHCP MAC Range are not supported for

AutoTracker VLANs

Mobile Groups

Page 16-7

If you decided not to turn group mobility on, you would enter

at the group mobility prompt

and the following message would display:

Group Mobility Status unchanged

Understanding Port Membership in Mobile Groups

Switch ports can belong to multiple mobile groups. A port becomes a member of a mobile

group as long as one of its attached devices matches the policy criteria for that group.

However, the movement of ports between groups and the status of port membership in

groups can be affected by more than just whether or not devices match policy criteria.

Group mobility uses three variables that can affect a port's default group and whether or not

a port ages out of a group. These variables are as follows: def_group, move_from_def, and

move_to_def. The def_group and move_to_def variables can be configured through the

gmcfg

command, which is described on page 16-12. The move_from_def variable is enabled by

default, but can be disabled by entering a statement in the

oa512.cmd

file. The effects of these

three variables are described through diagrams on the following pages.

From the perspective of a device or switch port, there are three types of mobile group—

default, primary, and secondary. Keep in mind that definitions of these three types are relative

and can change for each port and device depending on the settings of the group mobility

variables and traffic patterns of devices.

Default Group

The default group is the group a port or device is statically assigned to by "default." Typically,

a port's default group will be Group 1. A port can also be statically assigned to its

default group through the crgp or addvp commands. A port or device does not have to match

a policy to gain membership into its default group.

The default group for a port or device is stored in memory; it can only be manually changed

through the addvp or crgp commands. Depending on the settings of other group mobility variables

a device or port can age out of other mobile groups but still remain a member of its

default group.

Primary Group

The primary group is the group upon which Spanning Tree operations converge. The primary

group is similar to the default group. There are two main differences between a primary and

a default group.

1. A primary group only contains devices that have matched one of its AutoTracker policies.

In contrast, switch ports may end up in a default group without matching any policy.

2. It is possible for the primary group of a port or device to change through learning or

aging. For example, if the move_from_def variable is enabled and a device matches the

policies of a mobile group other than its default group, then this new mobile group

becomes the primary group for the device and the port to which the device is attached

(see diagram on page 16-10). In this case the default group and primary group will be

different.

If the move_from_def is disabled, the port always remains int he default group (which can

now also be the primary group).

In addition a port can age out of its primary group if the move_to_def variable is enabled

(see diagram on page 16-11). A port cannot age out of its default group.

Mobile Groups

Page 16-8

Secondary Group

Switch ports and devices may become members of multiple mobile groups. A switch port

starts in its default group, which initially is also it's primary group. The primary group may

change if the move_from_def variable is enabled. Any subsequent mobile groups to which a

port gains membership beyond the primary group are "secondary" mobile groups. A port can

age out of these secondary groups if the move_to_def variable is enabled (see diagram on

page 16-11).

Mobile Groups

Page 16-9

How a Device Is Dropped from the Default Mobile Group (def_group)

If def_group is enabled....

The device that does not

match any policies becomes a

member of the default group.

Default Group 1

Group 3

Why enable def_group?

• Ensure that all network devices will be a

member of at least one mobile group.

If def_group is disabled....

Default

All traffic from the device that

does not match any policies

is dropped. The device is not

a member of any mobile

group, including the default

mobile group.

Mobile Group 1

Secondary

Mobile Group 3

• Reduces traffic to and from devices that

do not satisfy any network policies.

Device sends traffic that is forwarded to the MPM for processing.

If the traffic matches the policies of an existing

mobile group, then it will become a member of that group.

If the device does not match the policies of any mobile

group, then the def_group variable determines whether

that device becomes a member of the default group.

Default Group 1

Group 3

Why disable move_from_def?

Mobile Groups

Page 16-10

How a Port's Primary Mobile Group Changes (move_from_def)

Default/Primary

Port assigned to default

group 1 or another group

through crgp or addvp.

Mobile Group 1

If move_from_def is enabled....

Device on port matches policy

in another mobile group

(3). Group 3 becomes primary

group.

Default Group 1

Primary Group 3

Helpful Hints:

• Reduces broadcasts to the default group.

• Best used when only one device is

attached to each port.

If move_from_def is disabled....

Default/Pri

Device on port matches policy

in another mobile group

(3). Group 1 remains primary

group. Group 3 is now a

"secondary" group for this

port.

Mobile Group 1

Secondary

Mobile Group 3

Why disable move_from_def?

• When multiple devices are attached to

the switch port, the port must support

multiple traffic in the default group as

well as traffic in the secondary mobile

groups.

Mobile Groups

Page 16-11

How a Port Ages Out of a Mobile Group (move_to_def)

If the port is in "optimized mode," then the MAC does not age out and the port would stay in

the mobile group even if move_to_def is enabled.

Default

Port assigned to default group.

Mobile Group

If move_to_def is enabled....

Why enable move_to_def?

• Security. Mobile groups only contain

devices and ports that have recently

matched policy criteria.

If move_to_def is disabled....

Why disable move_to_def?

• Switch ports retain group membership

even when idle for some time. May be

appropriate for silent devices, such as

printers.

Default

Port becomes a member of

other mobile groups when it

matches their policies. These

groups may be primary or

secondary groups.

Mobile Group

Primary

Group 2

Secondary

Group 3

Default

Port will be removed from

other groups when attached

devices age out of filtering

database.

Mobile Group

Primary

Group 2

Secondary

Group 3

Default

Port remains a member of all

mobile groups with which it

has satisfied a policy criteria

even if its devices age out of

the filtering database.

Mobile Group

Primary

Group 2

Secondary

Group 3

Mobile Groups

Page 16-12

Configuring Switch-Wide Group Mobility Variables

There are several switch-wide group mobility variables that you can configure through the

gmcfg command. These variables control the status of group mobility on all groups in a

switch as well as the use of the default group. These variables are illustrated through

diagrams on pages 16-9 to 16-11.

Follow these steps to use the gmcfg command:

1. Enter gmcfg. You do not need to specify a group number as this command applies to all

mobile groups in this switch.

2. The following prompt displays:

Group Mobility is Enabled. Disable Group Mobility ? [yes/no] (no) :

This prompt controls the status of group mobility in this switch. If you disable group

mobility here then mobile groups will not be supported in this switch even if they are

configured through the crgp command.

Default Group 1. When group mobility is enabled, default group 1 in the switch will be

treated as a mobile group and you will not be able to create AutoTracker VLANs within

this group. When group mobility is disabled, default Group 1 in the switch will be treated

as a non-mobile group in which AutoTracker VLANs could be created.

The default is to turn Group Mobility off. If you want to enable group mobility, then you

need to indicate that choice at this prompt. The prompt will always show the current

status of Group Mobility and then ask if you want to change that status. If you want to

change the current status, then enter a y at this prompt and press <enter>. To keep the

current status, simply press <enter>.

3. The following prompt displays:

move_to_def is set to Disabled. Set to Enable ? [yes/no] (no) :

The move_to_def variable determines what happens to a port once the devices on that

port age out of the filtering database. By default this variable is Disabled, which means

that a port will remain a member of a mobile group as long as its attached device satisfied

the criteria for membership in that mobile group at one point. If devices on a port

stop transmitting, the port will still retain all its mobile group memberships.

If the move_to_def variable is Enabled, then a port will lose its membership in a mobile

group if its devices age out of the filtering database for that mobile group (i.e., they stop

transmitting traffic that satisfies the criteria for membership in the mobile group). Once a

port loses membership in all criteria-based mobile groups, it will return to its default

group. The effect of this variable is illustrated on page 16-11.

By default, the move_to_def variable is Disabled. If you want to enable it (ports lose

mobile group membership when they age out), then you need to indicate that choice at

this prompt. The prompt will always show the current status of move_to_def and then ask

if you want to change that status. If you want to change the current status, then enter a y

at this prompt and press <enter>. To keep the current status, simply press <enter>.

4. The following prompt displays:

def_group is set to Enable. Set to Disable ? [yes/no] (no) :

The def_group variable determines what happens to devices that do not match any

mobile group policies. If def_group is Enabled (the default), then devices that do not

match any mobile group policies will be part of the default group for that port. If the

def_group variable is Disabled, then devices that do not match any mobile group policies

will be dropped from their default group and will not be part of any mobile group.

Mobile Groups

Page 16-13

By default the def_group variable is Enabled. If you want to disable it (devices that do not

meet criteria for mobile group membership will not be part of any mobile group), then

you need to indicate that choice at this prompt. The prompt will always show the current

status of def_group and then ask if you want to change that status. If you want to change

the current status, then enter a y at this prompt and press <enter>. To keep the current

status, simply press <enter>.

The move_from_def Variable

The move_from_def variable controls whether or not a port's primary group can differ

from the port's default mobile group. This variable is enabled by default, but can be

changed to disabled in the oa512.cmd file.

The original default group for a port is group 1 or the group to which the port is assigned

through the crgp or addvp commands. The primary group at this point is the same as the

default group. However, if the move_from_def variable is enabled, the primary group can

change as soon as a device on the port matches the policy criteria for another mobile

group.

For example, Port 5 may start out in Group 1, it's default group. The primary group in this

case will also be Group 1. If the move_from_def variable is enabled and Port 5 matches

AutoTracker polices for mobile group 3, then the new primary group for Port 5 will be

Group 3. All further Spanning Tree operations for the port will converge on group 3

rather than group 1. The effects of the move_from_def variable are further illustrated

though diagrams on page 16-10.

If you disable the move_from_def variable, then the primary group for a port will always

match the default group regardless of the number of other mobile groups to which it

gains membership. To disable the move_from_def variable, enter the following statement

in the oa512.cmd file

move_from_def=0

For this new setting to take place you need to reboot the switch.

Mobile Groups

Page 16-14

Viewing Ports in a Mobile Group

The vpl command lists all the Groups in the switch currently configured as mobile Groups

and the ports currently assigned to those Groups. Since ports are assigned to mobile groups

dynamically, this display is helpful to find out which ports the switch already sees in each

group. Ports will only display in this screen for secondary groups (i.e., not default or primary

groups). Enter vpl and a screen similar to the following displays:

================================================

Group ID Physical Port Virtual Port

================================================

Group ID: 2 4/2 4/3 4/4 4/5 12 13 14 15

Group ID: 3 3/1 5/2 8 20

Group ID: 6 NULL Port List

Group ID: 8 4/1 5/1 11 19

Group ID. The group number assigned to this mobile group during the crgp procedure.

Physical Port. The physical switch ports that have been dynamically assigned to this group

because they matched an AutoTracker policy. (Primary groups do not display in this screen.

For a display of port-to-primary group mappings, use the vi command) If this column reads

NULL Port List, then no physical ports have been assigned to the group yet.

Virtual Port. The virtual ports that are part of this mobile group. For Ethernet and Token Ring

switch ports, there is a one-to-one relationship between physical and virtual ports. For ATM

ports, multiple virtual ports may be associated with one physical port.

Viewing a Port's Mobile Group Affiliations

The vigl command lists all the ports in the switch that have been assigned to mobile Groups.

It is similar to the vpl command, but it lists ports first and then Groups. Since ports are

assigned to mobile groups dynamically, this display is helpful to find out which ports the

switch already sees in each group. Ports will only display in this screen for secondary groups

(i.e., not default or primary groups). Enter vigl and a screen similar to the following displays:

================================================

Virtual Port Physical Port Group ID

================================================

12 13 14 15 4/2 4/3 4/4 4/5 Group ID: 2

8 20 3/1 5/2 Group ID: 3

NULL Port List Group ID: 6

11 19 Physical Port Group ID

Virtual Port. The virtual ports in this mobile group. For Ethernet and Token Ring switch ports,

there is a one-to-one relationship between physical and virtual ports. For ATM ports, multiple

virtual ports may be associated with one physical port.

Physical Port. The physical switch ports that have been dynamically assigned to this secondary

mobile group because they matched an AutoTracker policy. (Primary groups do not

display in this screen. For a display of port-to-primary group mappings, use the vi command)

If this column reads NULL Port List, then no physical ports have been assigned to the group

yet.

Group ID. The group number assigned to this mobile group during the crgp procedure.

Non-Mobile Groups and AutoTracker VLANs

Page 16-15

Non-Mobile Groups and AutoTracker VLANs

Non-mobile Groups are comprised of physical entities—switch ports. Groups can span multiple

switches, but they are still made up of physical ports that you can see and touch. But just

as physically-based broadcast domains are limited, entirely port-based Groups can also be

limiting. In a large, flat, switched network, broadcast traffic can overload the network. There

needs to be a method for subdividing traffic even further. That's where virtual networks, or

VLANs, come into play.

VLANs are created within a Group to subdivide network traffic based on specific criteria. The

criteria you use to define a VLAN are called AutoTracker™ policies. AutoTracker policies can

be defined by port, MAC address, protocol, network address, a user-defined policy, or a multicast

policy. VLANs are described in more detail in Chapter 19, "Managing AutoTracker VLANs"

and Chapter 20, "Multicast VLANs."

Routing in a Non-Mobile Group

Communication within a Group containing only the default VLAN is switched; the ports are in

the same broadcast domain and do not require routing to communicate. Communication

between VLANs in the same Group or to VLANs in other Groups requires routing. That's why

all VLANs—including the default VLAN within each Group—may contain their own virtual

router port. A virtual router port for each VLAN can be configured to support IP and/or IPX

routing. If you do not configure a virtual router port for a VLAN, the devices in that VLAN will

not be able to communicate with devices in other VLANs unless there is an external router

between the VLANs.

Each OmniAccess 512 supports up to 32 virtual router ports. A single router port, using one

MAC address, can support IP routing, IPX routing, or both types of routing. When you enable

a router port for a default VLAN, you are actually creating a static route to that VLAN. Routing

is covered in more detail in Chapters 22 and 24.

_ Note _

For mobile, non-mobile groups and AutoTracker

VLANs, the router port operational status is not active

unless an active switch port is a member of the group

or VLAN.

Non-Mobile Groups and AutoTracker VLANs

Page 16-16

Spanning Tree and Non-Mobile Groups

Each Group uses one Spanning Tree for bridging. The OmniAccess 512 supports both 802.1d

and IBM Spanning Tree protocols. The Spanning Tree state for the port is Forwarding. Ports

that are in Blocked state, or in another non-Forwarding state, will not receive frames from the

router port. The figure below illustrates this concept.

Spanning Tree State and Routed Frames

OmniAccess 512

12345678

123456

Group 2

Ports 1 and 2

Server

Port 1: Forwarding

State

VLAN 1

(default VLAN #1)

Virtual Router

Workstation

Port 2: Blocked

State

VLAN 2

Routed frames not

received because attached

port is in Blocking state.

Routed frames received

because attached port

is in Forwarding state.

Group and Port Software Commands

Page 16-17

Group and Port Software Commands

Group and Virtual Port commands are part of the VLAN menu within the User Interface. Entering

vlan at any prompt displays the following menu:

Command VLAN Management Menu

gp View the list of Groups currently defined

crgp Create a Group

modvl Modify a VLANs configuration/availability

rmgp Remove a Group

addqgp Add 802.1q group/s to a port

delqgp Delete 802.1q group/s from a port

viqgp Display 802.1q groups on port/s

via View ports assigned to the selected Group

vi View info on a specific virtual port

vs View statistics on a virtual port attachment

ve View errors on a virtual port attachment

addvp Add ports to a GROUP

modvp Modify existing VPORT configuration information

rmvp Remove ports from a Group

pmapcr Create a Port Map

pmapdel Delete a Port Map

pmapmod Modify a Port Map

pmapv View Port Mapping Configuration

br Enter the Bridge Configuration/Parameter sub-menu

prty_mod Modify the priority of a group

prty_disp Display the priority of a group

at Enter the AutoTracker sub-menu

Main File Summary VLAN Networking

Interface Security System Services Help

The VLAN menu commands are divided into four sets of commands. The first set, at the top of

the menu beginning with gp, contains commands that create, modify, delete, and view

Groups. The second set of commands, beginning with addqgp are obsolete and no longer

control 802.1Q implimentation. (See Chapter 13 for information on 802.1Q.) The third set,

beginning with addvp, contains commands for adding, modifying, and deleting virtual ports.

All of these commands are described in this chapter.

The final set of commands at the bottom of the menu, br and at, are actually entry points to

the Bridging and AutoTracker submenus, respectively. Commands for the Bridge Management

(br) sub-menu are documented in Chapter 14, "Configuring Bridging Parameters."

Commands for the AutoTracker (at) sub-menu are documented in this chapter and in Chapter

19, "Managing AutoTracker VLANs" and Chapter 20, "Multicast VLANs." Some commands in

the at sub-menu apply to mobile groups and authenticated groups; those commands are

described in this chapter.

The pmapcr, pmapdel, pmapmod, and pmapv commands allow you to create port mapping

configurations. The port mapping feature is documented in Port Mapping on page 16-64. The

prty_mod and prty_disp commands allow you to modify and view the priority of a selected

group. These commands are detailed in Priority VLANs on page 16-71.

Creating a New Group

Page 16-18

Creating a New Group

There are several steps involved in creating a new Group. Note that some steps apply only to

mobile groups. These steps are as follows:

1. Enter Basic Group Information, such as the Group number and type. This section starts on

page 16-19.

2. Configure the Virtual Router Port (Optional). This section starts on page 16-20.

3. Enable/disable Group Mobility and User Authentication. This section starts on page 16-26.

4. Configure Virtual Ports. This section starts on page 16-27.

5. Configure AutoTracker policies (for mobile groups only). This section starts on page 16-

33.

WAN Routing Groups follow a slightly different procedure for their creation. You will receive

prompts during the procedure asking whether you want to create one of these special

Groups.

Creating a New Group

Page 16-19

Step 1. Entering Basic Group Information

a. Type crgp at any prompt.

b. The following prompt displays:

GROUP Number (5):

By default the Group number you entered or the next available Group number is

displayed in parentheses. Enter the Group number or accept the number shown in parentheses.

Each Group must have a unique number, which may range from 2 to 65,535.

(Group 1 is the default switch Group. It does not need to be created and it cannot be

deleted.) Press <Enter> after entering the Group number.

c. The following prompt displays:

Description (no quotes) :

Enter a descriptive name for the new Group. Group names can consist of up to 30 alphanumeric

characters. Press <Enter> after entering the Group name.

d. The following prompt displays:

Enable WAN Routing? (n):

If you want to perform WAN Routing through this Group you must enter a y at this

prompt. If you do not need to support WAN Routing, then answer n at this prompt and

continue with Step e.

_ Note _

You do not need to create a special WAN Routing

Group to bridge or trunk traffic over a WAN connection.

A WAN Routing Group is different from other Groups; it must contain only WAN ports. In

addition, the virtual router and virtual ports are configured differently. Please skip ahead

to Creating a WAN Routing Group on page 16-34 to continue setting up this WAN Routing

Group.

Creating a New Group

Page 16-20

Step 2. Configuring the Virtual Router Port (Optional)

You can now optionally configure the virtual router port that the default VLAN in this Group

will use to communicate with other VLANs. When you define a virtual router, a virtual router

port for the default VLAN in the Group is created. If you do not define a virtual router, no

virtual router port is created and the default VLAN in the new Group will be "firewalled,"

unable to communicate with other VLANs.

_ Important Note _

Use caution when setting up routing on the default

VLAN for a Group. In some configurations enabling

routing on the default VLAN may not be necessary or

desirable. You can always enable routing on other,

non-default VLANs, within this Group. Refer to

AutoTracker Application Example 4 in Chapter 21 for

more information.

You will have the choice of configuring IP, IPX, or both IP and IPX routing. Continue with the

steps below:

a. The following prompt displays:

Enable IP (y):

Press <Enter> if you want to enable IP Routing on this virtual router port. If you do not

enable IP, then the default VLAN in this Group will not be able to route IP data. If you

don't want to set up an IP router, enter n, press <Enter> and skip to Step j.

_ Note _

You may enable routing of both IP and IPX traffic on

this router port. If you set up dual-protocol routing, you

must fill out information for both IP and IPX parameters.

b. The following prompt displays:

IP Address:

Enter the IP address for this virtual router port in dotted decimal notation (e.g.,

198.206.181.10). This IP address is assigned to the virtual router port of the default VLAN

within this Group. After you enter the address, press <Enter>.

c. The following prompt displays:

IP Subnet Mask (0xffffff00):

The default IP subnet mask (in parentheses) is automatically derived from the default

VLAN IP address class. Press <Enter> to select the default subnet mask or enter a new

subnet mask in dotted decimal notation or hexadecimal notation and press <Enter>.

d. The following prompt displays:

IP Broadcast Address (198.200.10.255):

The default IP broadcast address (in parentheses) is automatically derived from the default

VLAN IP address class. Press <Enter> to select the default address or enter a new address in

dotted decimal notation and press <Enter>.

Creating a New Group

Page 16-21

e. The following prompt displays:

Description (30 chars max):

Enter a useful description for this virtual IP router port using alphanumeric characters. The

description may be up to 30 characters long. Press <Enter>.

f. The following prompt displays:

Disable routing? (n) :

Indicate whether you want to disable routing in the group. You can enable routing later

through the modvl command.

g. The following prompt displays:

IP RIP Mode {Deaf (d),

Silent (s),

Active (a),

Inactive (i)} (s):

Define the RIP mode in which the virtual router port will operate. RIP (Router Information

Protocol) is a network-layer protocol that enables the default VLAN in this Group to learn

and advertise routes. The RIP mode can be set to one of the following:

Silent. The default setting shown in parentheses. RIP is active and receives routing information

from other VLANs, but does not send out RIP updates. Other VLANs will not receive

routing information concerning the default VLAN in this Group and will not include the

VLAN in their routing tables. Simply press <Enter> to select Silent mode.

Deaf. RIP is active and sends routing information to other VLANs, but does not receive RIP

updates from other VLANs. The default VLAN in this Group will not receive routing information

from other VLANs and will not include other VLANs in its routing table. Enter d and

press <Enter> to select Deaf mode.

Active. RIP is active and both sends and receives RIP updates. The default VLAN in this

Group will receive routing information from other VLANs and will be included in the routing

tables of other VLANs. Enter a and press <Enter> to select Active mode.

Inactive. RIP is inactive and neither sends nor receives RIP updates. The default VLAN in

this Group will neither send nor receive routing information to/from other VLANs. Enter i

and press <Enter> to select Inactive mode.

h. If routing domains are not configured on the switch, go to the next step. If routing

domains are configured on the switch, the following prompt displays:

Apply to Routing Domain ID (none) :

Enter a routing domain in which this group should be included, or press Enter. A routing

domain is a grouping of IP router interfaces that can forward packets only within the

domain. Routing domains are part of Advanced Routing software and are not part of the

base code. For more information about routing domains, see Chapter 14, "Routing

Domains," in the Advanced Routing User Manual.

i. After you enter the RIP mode, or after you enter a routing domain ID, the following

prompt displays:

Default framing type [Ethernet II(e),

fddi (f),

token ring (t),

Ethernet 802.3 SNAP (8),

source route token ring(s)} (e):

Creating a New Group

Page 16-22

Select the default framing type for the frames that will be generated by this router port

and propagated over the default VLAN to the outbound ports. Set the framing type to the

encapsulation type that is most prevalent in the default VLAN. If the default VLAN contains

devices using encapsulation types other than those defined here, the switching modules

must translate those frames, which slows throughput. The figure on the next page illustrates

the Default Framing Type and its relation to Virtual Router Port communications.

Default Framing Type and the Virtual Router Port

j. You can now configure IPX routing on this port. The following message displays:

Enable IPX? (y) :

Press <Enter> if you want to enable IPX Routing on this virtual router port. If you do not

enable IPX, then the default VLAN in this Group will not be able to route IPX data. You

can set up a virtual router port to route both IP and IPX traffic.

If you don't want to set up an IPX router for the default VLAN in this Group, enter n, press

<Enter>, and skip ahead to step p below. You can always set up IPX routing for other

VLANs within this Group.

OmniAccess 512

12345678

123456

Group

Virtual Router Port

VLAN 1

(default VLAN #1)

Virtual Router

The Default Router

Framing Type determines

the type of

frame transmitted

through the Virtual

Router Port to the

default VLAN.

SNMP AGENT RIP

Workstation A Workstation B

Creating a New Group

Page 16-23

k. After selecting to enable IPX, the following prompt displays:

IPX Network:

Enter the IPX network address. IPX addresses consist of eight hex digits and you can enter

a minimum of one hex digit in this field. If you enter less than eight hex digits, the system

prefixes your entry with zeros to create eight digits.

l. The following prompt displays:

Description (30 chars max):

Enter a useful description for this virtual IPX router port using alphanumeric characters.

The description may be up to 30 characters long. Press <Enter>.

m. The following prompt displays:

IPX Delay in ticks (0):

Enter the number of ticks you want for the IPX network. A tick is about 1/18th of a

second. The default is 0.

n. The following prompt displays:

IPX RIP and SAP mode {RIP and SAP active (a)

RIP only active (r)

RIP and SAP inactive (i)} (a):

Select how you want the IPX protocols, RIP (router information protocol) and SAP (service

access protocol), to be configured for the default VLAN in this Group. RIP is a networklayer

protocol that enables this VLAN to learn routes. SAP is also a network-layer protocol

that allows network services, such as print and files services, to advertise themselves. The

choices are:

RIP and SAP active. The default setting. The default VLAN to which this IPX router port is

attached participates in both RIP and SAP updates. RIP and SAP updates are sent and

received through this router port. Simply press <Enter> to select RIP and SAP active.

RIP only active. The default VLAN to which this IPX router port is attached participates in

RIP updates only. RIP updates are sent and received through this router port. Enter an r

and press <Enter> to select RIP only active.

RIP and SAP inactive. The IPX router port is active, but the default VLAN to which it is

attached does not participate in either RIP nor SAP updates. Enter an i and press <Enter> to

select RIP and SAP inactive.

Creating a New Group

Page 16-24

o. After selecting the RIP and SAP configuration, the following prompt displays the default

router framing type options:

Default router framing type for : {

Ethernet Media:

Ethernet II (0),

Ethernet 802.3 LLC (1),

Ethernet 802.3 SNAP (2),

Novell Ethernet 802.3 raw (3),

Select the default framing type for the frames that will be generated by this router port

and propagated over the default VLAN to the outbound ports. Set the framing type to the

encapsulation type that is most prevalent in the default VLAN. If the default VLAN contains

devices using encapsulation types other than those defined here, the switching modules

must translate those frames, which slows throughput. See the figure, Default Framing

Type and the Virtual Router Port on page 16-22 for an illustration of the Default Framing

Type and its relation to Virtual Router Port communications.

_ Note _

The .cmd file contains a command called hreXnative

that by default is set to 1. If physical ports in an end

station are using a different encapsulation than the

virtual router ports (for example, the modvl command

shows router ports set to Ethernet II IPX, but the swch

command shows that physical ports are using SNAP)

then the hreXnative command must be set to 0. See

Chapter 6, "Switch Wide Parameters," for more information

about the .cmd file.

p. If you chose a Source Routing frame format in the last step (options 5, 7, 9, or b), an additional

prompt displays:

Default source routing broadcast type : {

ARE broadcasts(a), STE broadcasts(s)} (a) :

Select how broadcasts will be handled for Source Routing. The choices are:

ARE broadcasts. All Routes Explorer, the default setting. Broadcasts are transmitted over

every possible path on inter-connected source-routed rings. This setting maximizes the

generality of the broadcast. Simply press <Enter> to select All Routes Explorer.

STE broadcasts. Spanning Tree Explorer. Broadcasts are transmitted only over Spanning

Tree paths on inter-connected source-routed rings. This setting maximizes the efficiency

of the broadcast. Enter an s and press <Enter> to select Spanning Tree Explorer.

Creating a New Group

Page 16-25

q. The following prompt displays:

Enter a priority level (0...7)(0):

Prioritizing VLANs allows to you set a value for traffic based on the destination VLAN of

packets. Traffic with the higher priority destination will be delivered first. VLAN priority

can be set from 0 to 7, with 7 being the level with the most priority.

Modifying and displaying a group's priority is described in Priority VLANs on page 16-71.

You have now completed the configuration of the virtual router port for this group. At

this point, you will be asked whether you want to enable group mobility. The following

prompt will display:

Enable Group Mobility on the Group ? [y/n] (n):

Mobile groups are discussed in detail in Mobile Groups on page 16-5. If you want to

enable group mobility answer Y to this prompt, press <enter>, and go on to Step 3. Set Up

Group Mobility and User Authentication on page 16-26.

If you do not want to configure group mobility answer N at the prompt, press <enter>,

and go on to Step 4. Configuring Virtual Ports on page 16-27 for further instructions.

Creating a New Group

Page 16-26

Step 3. Set Up Group Mobility and User Authentication

A mobile group offers more flexibility than a non-mobile group. With a mobile group, ports

are assigned dynamically to the group based on AutoTracker policies that you configure. In a

non-mobile group, ports are statically defined and AutoTracker policies are assigned to individual

VLANs within the Group. In most cases, you will want to set up a mobile group. The

following steps show you how.

a. After configuring the virtual router port, you will receive the following prompt:

Enable Group Mobility on the Group ? [y/n] (n):

To create a mobile group, enter a Y as this prompt, press <enter>, and continue with step

b. If you want to configure a non-mobile Group, enter N, press <enter>, and you will see

the following prompt:

This Group will not participate in Group Mobility

If you are not creating a mobile group, go on to Step 4. Configuring Virtual Ports on page

16-27.

b. The following prompt displays:

Enable User Authentication on the Group ? [y/n] (n):

An authenticated group is a special type of mobile group. It uses an authentication

process as it criteria for group membership. Typically, users will be prompted for an id

and password before gaining membership to an authenticated group. Authenticated

groups require additional Windows NT server software. More detailed information on

these groups can be found in the Switch Network Services User Manual. If you are not sure

whether this is an authenticated group, simply press <enter> at this prompt.

c. The following prompt displays:

Enable spanning tree for this group [y/n] (y):

Spanning Tree prevents broadcast storms by limiting logical loops in the network. For

more information on Spanning Tree, see Chapter 14, titled "Configuring Bridging Parameters."

If you wish to enable Spanning Tree, enter y and press <enter>. Otherwise, enter n.

d. The following prompt displays:

Do you wish to configure the interface group for this Virtual LAN at this time? (y)

You can assign physical ports to the new Group at this time. To begin assigning ports to

the new Group, press <Enter> and go to Step 4.

To assign ports to the Group later, type n and <Enter>. The new Group is configured but

does not yet contain any ports. You can use the addvp command later to assign ports to

the Group (see Adding Virtual Ports on page 16-43). A message similar to the following

displays confirming the creation of the new Group.

GROUP 6 has been added to the system.

You may add interfaces to this group using the addvp command at a later date.

For now, the GROUP is inactive until you add interfaces.

Creating a New Group

Page 16-27

Step 4. Configuring Virtual Ports

You can now enter configuration parameters for each switch port to be included in this

Group. These configuration parameters include the bridging mode, output format type, and

administrative state. In addition, if the port you are configuring is Ethernet (10/100 Mbps) or

Token Ring, you can also configure port mirroring.

Prompts for configuring virtual ports follow directly after Group Mobility prompts. You can

choose to add ports now or add them later through the addvp command. Follow these steps:

a. After you have stepped through the Routing and/or Group Mobility prompts, the following

message displays:

Do you wish to configure the interface group for this Virtual LAN at this time? (y)

You can assign physical ports to the new Group at this time. To begin assigning ports to

the new Group, press <Enter> and go to Step b.

To assign ports to the Group later, type n and <Enter>. The new Group is configured but

does not yet contain any ports. You can use the addvp command later to assign ports to

the Group (see Adding Virtual Ports on page 16-43). A message similar to the following

displays confirming the creation of the new Group.

GROUP 6 has been added to the system.

You may add interfaces to this group using the addvp command at a later date.

For now, the GROUP is inactive until you add interfaces.

b. After indicating that you want to set up ports, the following prompt displays:

Initial Vports (Slot/Phys Intf. Range) - For example, first I/O Module

(slot 2), second interface would be 2/2. Specify a range of interfaces

and/or a list as in: 2/1-3, 3/3, 3/5, 4/6-8

Enter the port or ports that you want to include in this new Group. The notation for

adding a port to a group is

<slot number of module>/<port number on the module>

Omni-9 slots are numbered 1-9, left to right. Port numbers are labelled on the front panel

of switching modules.

You may enter multiple ports from multiple switching modules. For example, to add ports

1 through 3 on the module in slot 2, specify 2/1-3. To additionally add the third and fifth

port on the module in the third slot, specify 3/3, 3/5. The complete slot port specification

would be:

2/1-3, 3/3, 3/5

c. If you enter a port that is already assigned to another Group, then you will be prompted

on whether or not you want to change its assignment. A message similar to the following

displays for each port that you enter:

Initial Slot/Interface Assignments: 2/8

2/8 - This interface has already been assigned to GROUP 1 -

(Default GROUP #1).

Do you wish to remove it from that GROUP and assign it (with

new configuration values) to this GROUP (n)?

Simply enter a y at each port prompt to change its Group assignment and begin setting

port parameters. You could also enter a c at this prompt to accept all default port parameters

and skip port configuration prompts. If you enter a c, all remaining ports are automatically

added to the Group with default settings, and your work is complete.

Creating a New Group

Page 16-28

d. The virtual port configuration menu displays:

Modify Ether/8 Vport 2/8 Configuration

1) Vport : 9

2) Description :

3) Bridge Mode : Auto-Switched

31) Switch Timer : 60

4) Flood Limit : 192000

5) Output Format Type : Default (IP-Eth II, IPX-802.3)

6) Ethernet 802.2 Pass Through : Yes

7) Admin, Operational Status : Enabled, inactive

8) Mirrored Port Status : Disabled, available

9) MAC address : 000000:000000

Command {Item=Value/?/Help/Quit/Redraw/Next/Previous/Save} (Redraw) :

Descriptions for each of the fields in this display follow. To change any default value,

enter the line number for item, an equal sign (=), and then the value for the parameter.

Enter save to save all configured settings and move onto the next step in the group

creation process.

1) Vport

The virtual port number for this port. The next virtual port number available in the switch

is shown by default in this field.

2) Description

Enter a useful description for this virtual port using alphanumeric characters. The description

may be up to 30 characters long.

3) Bridge Mode

Select the bridge mode used by this port. The choices are:

Spanning Tree Bridge. The default setting for all non-Ethernet ports. This mode is appropriate

for backbone and hub connections. The port acts as a standard 802.1d bridge port. It

forwards BPDU frames out the port. When frames are received, Spanning Tree BPDUs are

processed, and Spanning Tree dynamically controls the forwarding state. If flooding

occurs, all frames destined for unknown MAC addresses, broadcast addresses, or multicast

addresses will be sent to all ports in the same Group. Enter 3=b and press <Enter> to

select Spanning Tree Bridge mode.

Optimized Device Switching. This mode is appropriate for dedicated connections to a single

workstation or server. Spanning Tree is turned off. No Spanning Tree BPDUs will be sent

and the port will always be in the forwarding state. The port will stay in this mode even if

a Spanning Tree BPDU is detected. In addition, all MACs learned will not be aged out

(regardless of the Bridge Aging Timer setting) until the port is disconnected or configured

to be administratively down. No flooding of packets with an unknown destination address

is allowed after at least one MAC address has been learned. (An exception to this rule

occurs on newer Mammoth-generation Ethernet modules, such as the ESM-100C-12, ESM-

100F-8, and ESM-C-32. When these ports are in optimized mode, packets with unknown

destination addresses will be flooded.) Packets with a broadcast or multicast destination

will always be allowed. Enter 3=o and press <Enter> to select Optimized Device Switching

mode.

Creating a New Group

Page 16-29

Auto-Switch. The default setting for all Ethernet ports. This mode is appropriate for dedicated

connections requiring a switch-over to bridge mode when multiple devices are

detected. A port in Auto-Switch mode will start in Optimized Device Switching mode (see

description above). The port will remain in Optimized Device Switching mode until a

Spanning Tree BPDU is detected or more than one MAC address transmits data. Once

either of these conditions is met, the port will switch to Spanning Tree Bridge mode and

Spanning Tree will start (if configured in the switch).

An Auto-Switch port will remain in Spanning Tree Bridge mode as long as there are

BPDUs and multiple MACs. However, the port can revert back to Optimized Device

Switching Mode if the time specified in the next field (Switch Timer) transpires without

BPDUs and multiple MACs. Also, if the port is disconnected or configured to be administratively

down, then an Auto-Switch port will revert back to Optimized Device Switching

mode when it becomes operational again. Enter 3=a and press <Enter> to select Auto-

Switch mode.

How Auto-Switch Bridge Mode Works

31) Switch Timer

If you selected the Auto-Switch bridge mode, then you can configure this field. Enter the

time-out period, in seconds, for an Auto-Switch port that has turned to Spanning Tree

Bridge mode port to revert back to Optimized Switching mode. When in Auto-Switch

mode, a port switches to Spanning Tree Bridge mode as soon as it detects a BPDU or

more than one MAC address. The port will switch back to Optimized Switching mode after

the time-out value you define here.

Optimized

Device

Switching

Mode

Greater

Than 1

MAC?

BPDUs

Detected?

Yes

Spanning

Tree

Bridge

Mode

Yes

Switch

Timer Period

Elapsed?

BPDU

Detected?

Only 1

MAC Address

Detected?

Yes No

Yes

Creating a New Group

Page 16-30

4) Flood Limit

The flood limit allows you to tune a virtual port to limit the flooding of broadcast, multicast,

and unknown destination packets. This feature is useful for controlling broadcast

storms on your network. While each network is different, in general the amount of

flooded traffic represents a relatively small percentage of network traffic.

The flood limit is actually a "transmit credit" that is issued every five (5) seconds. When a

packet is flooded on this port, the size of the packet, in bytes, is decremented from the

current credit value. The credit value is the value you enter in this field multiplied by five.

An additional credit, in the amount of the value you enter here multiplied by five, is allocated

to each virtual port every five (5) seconds. If the credit value ever falls below zero,

then all flooded packets are discarded until another credit is allocated. Flood limit checking

is disabled if you enter a flood limit of zero (0). The flood limit default is 192,000

bytes per second, which equates to a transmit credit of 960,000 bytes every five seconds.

5) Output Format Type

The options will be different for Ethernet, Token Ring, and FDDI ports.

The output format setting determines the kind of frame that will be sent out this physical

port. If translation is necessary, then incoming frames will be translated to this format

before being sent out this port. For example, on an Ethernet port incoming FDDI frames

need to be translated to Ethernet. However, there are four types of Ethernet frames—

Ethernet II, IPX 802.3, SNAP, and LLC. The format type you select here would determine

the frame format to which non-Ethernet frames would be translated. The following figure

illustrates how a port's framing type affects communication with attached devices.

_ Note _

This parameter differs from the router framing type

selected during the configuration of the virtual router

port. The router framing type is the encapsulation done

on a router port, whereas this output format type

applies only to translations on this virtual port.

Creating a New Group

Page 16-31

Output Framing Type on Physical Ports

Note that for Ethernet, the default output format option is Ethernet II for IP frames and

802.3 for IPX frames. On Token-Ring and FDDI, only SNAP and LLC are available as output

format choices; FDDI ports may be configured to output 802.3 frames (i.e., "FDDI raw"),

but that must be configured through the Switch menu.

You can customize your frame translation settings even further through the Switch menu.

The Switch menu allows you to set translations at the frame format level (i.e., incoming

SNAP frames could be translated one way, while incoming LLC frames could be translated

another way) based on protocol type (IP or IPX). The Switch menu is explained in Chapter

15, "Configuring LAN Switch Translations."

6) Ethernet 802.2 Pass Through

For Ethernet ports only. If you answer Yes to this prompt, then frames received in the

IEEE 802.2 format will not be translated according the Output Format Type chosen in line

5; they will be sent as is in their native IEEE 802.2 format. If you answer No, then 802.2

frames will be subject to the Output Format Type chosen in line 5.

OmniAccess 512

12345678

123456

Group 2

Ports 1 and 2

Server

Receives frames in

Ethernet II format.

Ethernet Port 1:

Format set to

Ethernet II

VLAN 1

(default VLAN #1)

Virtual Router

Workstation

Receives frames in SNAP

format.

Ethernet Port 2:

Format set to

SNAP

The Output Format Type

you set for each port determines

the type of frames

that devices attached to

that port receive.

Creating a New Group

Page 16-32

7) Admin, Operational Status

Select whether to administratively enable or disable this port. When you enable the port,

the port can transmit and receive data as long as a cable is connected and no physical or

operational problems exist. When you disable a port, the port will not transmit or receive

data even if a cable is connected and the physical connection is operational. If you

disable the port at this point, you can enable it later through the modvp command (see

Modifying a Virtual Port on page 16-44).

8) Mirrored Port Status

If the port you are configuring is Ethernet (10 or 10/100 Mbps) or Token Ring, you can set

up port mirroring. You can mirror traffic on this port to another like port. Port mirroring is

a useful feature for monitoring traffic on particular ports. It is discussed in more detail

later in this chapter in Port Mirroring on page 16-55.

If you want to mirror this port, enter a 8=e, press <Enter> and you will be prompted for

the slot and port number of the "mirroring" port (i.e., the port that can "see" all traffic for

this port):

Mirroring vport slot/port ? ( ) :

Enter the mirroring port's slot and port number and press <Enter>.

If port mirroring is not supported on this port, then the following prompt will display:

mirroring not supported on this port type

9) MAC address

Enter the MAC address for this virtual port if it is known.

After the MAC address prompt, the switch confirms the addition of the port to the group

with a message similar to the following:

Adding port 2/8 to Group 6. . .

Make configuration changes to the port until you are satisfied. If you have completed the

final virtual port, then your work is complete. You can always alter Group parameters

(including virtual router parameters for the default VLAN) later through the modvl

command (see Modifying a Group or VLAN on page 16-39) and modify virtual port parameters

through the modvp command (see Modifying a Virtual Port on page 16-44).

Creating a New Group

Page 16-33

Step 5. Configuring AutoTracker Policies (Mobile Groups Only)

When you have completed configuring mobile group and auto-activated LANE services, you

can begin configuring AutoTracker policies for this mobile group. Instructions for configuring

these rules can be found in Chapter 17, "Configuring Group and VLAN Policies." Please refer

to that chapter for instructions on configuring each policy type. After you configure

AutoTracker policies, you are done configuring this mobile group and a prompt similar to the

following displays:

VLAN 9: 1 created successfully

You can configure rules for this group later through the modatvl command. This command

also works with mobile groups as long as you indicate you want to alter VLAN 1 in the

mobile group (i.e., the command line would read modatvl 3:1 to modify mobile group 3).

_ Note _

If the mobile group is initially created without rules, the

modatvl command cannot be used to add them later.

You must turn off group mobility and then reinstate it

to add the rules.

Creating a WAN Routing Group

Page 16-34

Creating a WAN Routing Group

After entering basic Group information as described in Step 1. Entering Basic Group Information

on page 16-19, you should have answered Yes to the following prompt:

Enable WAN Routing? (n):

if you want to enable WAN Routing. WAN Routing Groups are treated differently than other

Groups, as described earlier. The following steps complete the configuration of the WAN

Routing Group.

a. After answering y to the Enable WAN Routing? prompt, the following prompt displays:

Enable IP (y):

Press <Enter> if you want to enable IP Routing on the virtual router port for this Group. If

you do not enable IP, then this WAN Group will not be able to route IP data. If you don't

want to set up IP routing, enter n, press <Enter> and skip to Step g.

_ Note _

You may enable routing of both IP and IPX traffic over

a WAN connection. If you set up dual-protocol routing,

you must fill out information for both IP and IPX

parameters.

b. The following prompt displays:

IP Address:

Enter the IP address for this virtual router port in dotted decimal notation or hexadecimal

notation (e.g., 198.206.181.10). This IP address is assigned to the virtual router port of the

default VLAN within this Group. After you enter the address, press <Enter>.

c. The following prompt displays:

IP Subnet Mask (0xffffff00):

The default IP subnet mask (in parentheses) is automatically derived from the default

VLAN IP address class. Press <Enter> to select the default subnet mask or enter a new

subnet mask in dotted decimal notation or hexadecimal notation and press <Enter>.

d. The following prompt displays:

IP Broadcast Address (198.200.10.255):

The default IP broadcast address (in parentheses) is automatically derived from the default

VLAN IP address class. Press <Enter> to select the default IP broadcast address or enter a

new broadcast address in dotted decimal notation or hexadecimal notation and press

<Enter>.

e. The following prompt displays:

Description (30 chars max):

Enter a useful description for this virtual IP router port using alphanumeric characters. The

description may be up to 30 characters long. Press <Enter>.

Creating a WAN Routing Group

Page 16-35