Hello !
Regarding our network admin has left the company, i don´t have acces to two powerconnect 7048 switches.
Is there a possiblility to reset the password without loos of the configuration?
Could some one explain it to me how i can do this?
Thanks
Patirck
Howdy, I'm new to Powerconnect switches, and between the user guide and CLI ref, I still can't figure out how to change the management vlan.
Anyone have the answer?
Thanks!
I started out with two stacked 6248 switches in L3 mode (core). It had 3 VLANs and no ports in VLAN1. I can connect to any one of the VLAN interfaces and manage. I am not sure allowing anyone to hit the management interfaces is a good idea but we will revisit my concern. Life was easy for the most part.
Later we implemented the iSCSI SAN network with the two non-stacked 5524's. Since I want the SAN infrastructure separate from the rest of the network, I didn't connect the 5524's to the network. I just connect a laptop directly to the switch and manage them.
Now we are adding the VoIP to the mix with the four 6248P switches in non-stacked configuration. The entire network is shown below minus the two 5524 SAN switches.
Example:(core switch)
VLAN10: 192.168.1.0/24
VLAN11: 192.168.2.0/24
VLAN12: 192.168.3.0/24
VLAN13: 192.168.4.0/24
VLAN200: 192.168.5.0/24 (Proposed new management VLAN with routing enabled)
VoIP is working fine. The four 6248POE switches work as a L2 switch, no L3 routing. Each ethernet port is in general mode with VLAN10 (U) and VLAN11 (T). There are four trunk lines, one from each POE switch to the core switches with both VLAN 10 and 11 as allowed VLANs. Inter-VLAN routing is handled by the core switches. I like to manage all the switches from my workstation which is in VLAN10.
However, I am facing a switch management problem and need your input. I am probably not clear on VLAN1, mangement vlan and non-routable mangement vlan concepts.
In each POE switch, I thought about moving the default management vlan from VLAN1 to some other vlan (ip address vlan 200) and assigning an IP number (say 192.168.5.10x). Obviously, VLAN 200 will have to be part of the allowed list in each trunk line. Will my proposed solution work? There won't be anything in VLAN 200 on the core and POE switches except the trunk ports. Will 200 be active for routing on the core switch? Doesn't the management vlan 200 need an Ethernet port with a functional node to be active?
Thanks
Hi
We re migration from our cisco 6505 switches to a stack of powerconnect 8164F and we have problems with the way to manage acl.
In our cisco switchs we used to use the following procedures.
we use to download the acl configuration through tftp.
in the configuration file we have at the beginning of the file for each acl a line like that
no access-list inbound-cnsnet
Then we construct the ACL. It was the only way to be ablr to order directive in the acl.
I m trying to do the same thing on my powerconnect with configuration script.
Then i have the following configuration
interface Te1/0/9
speed 1000
ip access-group inbound-cnsnet in
exit
I m trying to applying the following configuration script
configure
no access-list inbound-cnsnet
access-list inbound-cnsnet permit ip 195.83.222.0 0.0.0.255 any
access-list inbound-cnsnet permit ip 195.83.223.0 0.0.0.255 any
access-list inbound-cnsnet deny ip any any
But as soon as i apply the script the Interface lose the directiveip access-group inbound-cnsnet in
Does someone know how to solve that problem?
I have two 5524 switches connected together with FTLX8571D3BCL (A3847590) multi-mode transceivers and the packets are not arriving intact. Is this the wrong transceiver for this model or purpose. I cannot find any information as to compatible transceivers for the models 5524. I inherited this setup, so I'm trying to get it to work. There is another Dell transceiver that I have seen A2002416.
Any ideas?
Thank you in advance for any assistance.
I have 3524 setup and working, vlans configured and looks good. I can't ping the switch itself, and having a trunk port passing all vlans shouldn't I be able to as I would Cisco? Also http works from a switch connected directly to it within the same subnet, as expected, what is the best practice for changing this for secure in-house remote management? Thanks!
Hello All,
I bought a powerconnect 7048P to run as my core switch with my vmware, and then be able to support my 9971 phones and wifi access points with POE. So far every thing was working fine, however now I need to create my voice vlan and get routing working there is where I am running into issues.
My internal network is 10.0.0.0/16
my domain controllers (DNS, DHCP, etc) are at 10.0.2.1 and 10.0.2.2
My current switch config is:
!Current Configuration:
!System Description "PowerConnect 7048P, 5.1.0.1, VxWorks 6.6"
!System Software Version 5.1.0.1
!System Operational Mode "Normal"
!
configure
vlan 5-10,20,30,40
exit
vlan 5
name "WLC_Vlan"
exit
vlan 6
name "AP1_Vlan"
exit
vlan 7
name "AP2_Vlan"
exit
vlan 8
name "AP3_Vlan"
exit
vlan 9
name "AP4_Vlan"
exit
vlan 10
name "Guest_Vlan"
exit
vlan 20
name "Voice_Vlan"
exit
hostname "coresw"
slot 1/0 6 ! PowerConnect 7048P
sntp unicast client enable
sntp client poll timer 128
sntp server 10.0.2.1
sntp server 10.0.2.2
clock summer-time recurring USA
clock timezone -8 minutes 0
stack
member 1 6 ! PCT7048P
exit
ip name-server "10.0.2.1"
ip name-server "10.0.2.2"
ip default-gateway 10.0.0.1
ip route 0.0.0.0 0.0.0.0 10.0.0.1 253
ip helper-address 10.0.2.1 domain
ip helper-address 10.0.2.2 domain
ip helper-address 10.0.2.1 dhcp
ip helper-address 10.0.2.2 dhcp
ip helper-address 10.0.2.1 ntp
ip helper-address 10.0.2.2 ntp
interface vlan 1
ip address 10.0.0.2 255.255.0.0
exit
interface vlan 20
ip address 10.20.0.1 255.255.0.0
ip netdirbcast
ip local-proxy-arp
exit
username "craig" password REMOVED privilege 15 encrypted
voice vlan
ip ssh server
power-usage-history sampling-interval 30
!
interface Gi1/0/38
gvrp enable
switchport mode general
voice vlan 20
voice vlan auth disable
exit
snmp-server engineid local REMOVED
snmp-server agent boot count 2
enable password REMOVED encrypted
exit
So, my issues are, for the life of me I can't get DHCP from my phone on the voice vlan over to my DHCP servers on 10.0.2.1 and 2.2. When I hook up a machine to the port it properly places it in vlan 1 and everything works fine. WHen I plug in a phone, it identifies the vlan as 20, and I never see an ip-helper DHCP request to the server. I did create the scope and range in DHCP for the 10.20.0.0 requests as well.
Any thoughts on what I am missing?
Thanks
Craig
Hi everyone.
I've got a little problem with my authentication configuration on a powerconnect 5548.
I use the MAC adresses of my users to authenticate them and it works perfectly.
I decided to add dynamic vlan assignment, so when the users are identfied, they will be in the appropriate vlan.
But the problem is when a user is identified, he is in two vlans : the vlan where the user is supposed to be and the guest vlan that I configured 'cause the authentication doesn't work without it. But the user must be in only one vlan, not in the guest at the same time.
I read the CLI guide of the switch and it appears that user is in the guest vlan automatically after a successfull authentication.
Here is my switch's configuration :
SW5548# sh run
dot1x guest-vlan timeout 30
vlan database
vlan 10,20,30,40,50,60,70,80,90,100
exit
voice vlan oui-table add 000181 Nortel__________________
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 001049 Shoretel________________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00907a Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
dot1x system-auth-control
gvrp enable
iscsi target port 860 address 0.0.0.0
iscsi target port 3260 address 0.0.0.0
iscsi target port 9876 address 0.0.0.0
iscsi target port 20002 address 0.0.0.0
iscsi target port 20003 address 0.0.0.0
iscsi target port 25555 address 0.0.0.0
hostname SW5548
radius-server host 192.168.12.15 key test
aaa authentication enable default enable
aaa authentication login default radius
aaa authentication dot1x default radius
line telnet
password 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3f encrypted
exit
enable password level 15 encrypted 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3f
username adminsw password encrypted 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3f
privilege 15
ip ssh server
!
interface vlan 40
ip address 192.168.12.20 255.255.255.0
dot1x guest-vlan
!
interface gigabitethernet1/0/1
dot1x max-req 5
dot1x timeout reauth-period 300
dot1x timeout server-timeout 5
switchport mode trunk
interface gigabitethernet1/0/3
dot1x host-mode multi-sessions
dot1x guest-vlan enable
dot1x reauthentication
dot1x mac-authentication mac-only
dot1x radius-attributes vlan
dot1x port-control auto
!
interface gigabitethernet1/0/4
switchport access vlan 100
!
interface gigabitethernet1/0/5
switchport access vlan 100
!
interface gigabitethernet1/0/6
switchport access vlan 100
!
interface gigabitethernet1/0/7
switchport access vlan 100
The other interfaces have the same configuration.
Here is my radius users file configuration :
"0019b91e0b42 Cleartext-Password := "0019b91e0b42"
Service-Type = Framed-User,
Tunnel-type = VLAN,
Tunnel-Medium-Type = IEEE-802,
Tunnel-private-Group-ID = 20"
My questions are :
-Is that a problem that users are in the guest vlan?
-Can I put my users in only one vlan or at least not in the guest-vlan ?
-Where is the problem ?
Thank you very much for your help.
Hi,
I need to upgrade the firmware on the switches on my stack, the stack consists of 3 Powerconnect 6248p switches all currently running firmware version 3.2.1.3.
I am planning on stacking in a 4th switch which is currently running 3.3.1.10 so I need to update my existing stack prior to doing this.
I would like to use automatic update and upgrade the firmware on the master switch which will then upgrade the rest of the stack but the issue I am having is that the Dell documentation tells me to enable firmware synchronization using the command "boot auto-copy-sw" from the cli, however this does not seem to exist at all?
Can anyone advise ?
Thanks
Steve
First of all hi to everyone.
I am a bit stuck and sometimes it is best to ask for help instead of screwing up everything. I am more into vmware and AD than ip routing, vlan and switch config so sorry for my ignorance.
A bit of background : 3 ESXi 5.1 all connected to a powerconnect 6248 for the virtual machine & management network which is also our main switch. No vlan or fancy config on that switch. There is also an iscsi storage for the vm on an isolated network that I managed to configure by the book with the help of many of you and your precious posts. Tkx a lot btw :)
We are implementing vmware view with quite a lot of floating desktops and I would like to have them in a separate & dedicated range 192.168.30.0/23 for exemple. I have already created that new scope on the DHCP and I would need to know how to configure our main switch in order to have all vdi getting their ip from that new range from the dhcp that is on our main range.
So far it is not working and as I don't have a lab to test, it is straight on production so a do it right the first time.
I assume I have to create a new portgroup on the hosts with a given vlan id. Assign the same vlan id on the switch ports of the powerconnect where the phical nics of that portgroup are connected but when it comes to Tagged, Untagged, Trunk, Access and General, ip helper .. I get very very confused.
Any help and advice on how to proceed would really be welcome as I need to move on and get this new scope up and running.
Cheers
Eelm
I have a Dell PowerConnect 5448. I created an acl using the cli. I telnet'ed into the switch and created and acl on port 19. This works well. It does its job and even after i reboot the switch (or loss of power of the switch), the acl on port 19 is never lost.
I now copy the same acl using the gui, using a web browser - Dell OpenManage Switch Administrator to different ports. For example, I click on Switch - Network Security - ACL Bindings. I can see the acl on port 19 that I created using the cli. I use the web gui to copy this acl to many different ports. "bind acl to interface" other ports on the switch. I save the changes. But, after I reboot the switch (or lose power to the switch), these "copied" acl are lost. I still have the original acl that I created using the cli, but lost the ones that I copied to other ports using the gui.
Is it normal behavior to lose these "copied acl's" using the web gui?
I never lose the acl that I created using the cli, but after a reboot or power loss I always lose the acl's that I copied using the web gui. Why? Am I missing a step?
Thanks in advance for any tips or suggestions!!
In order to ward off the effect of rogue DHCP server on my Ethernet network. I need to confine DHCP BOOTREPLY message to a specific LAN port on which the authorized DHCP server resides.
I tried to read the "Configuring DHCP Snooping" section of 54xx User Guide, but does not get a clear idea. That description in that user guide seems to coarse and intuitive for me to understand.
Does "Defining Trusted Interface" help? I think I need "trusted port" feature. I hope only trusted ports on 5448 can receive DHCP BOOTREPLY packets, while BOOTREPLY arriving at untrusted ports is rejected.
Does anyone know is the errdisable timeout function is set?
From the STP best practices guide:
BPDU Guard — PortFast moves an end-user port to forwarding state without going through all of the STP checks and can induce loops in the network. If any BPDU is received on a port where BPDU guard is enabled that port is put into errdisable state. It can then be recovered manually or through the errdisable timeout function. Spanning Tree BPDU Guard is used to disable the port in case a new device tries to enter the already existing topology of STP. Thus devices, which were originally not a part of STP, are not allowed to influence the STP topology.
I could not find this in the CLI manual. I am using 55xx and 35xx series switches.
Hi,
We are currently tasked with implementing a dynamic VLAN assignment network infrastructure based on Dell Switch models 5548p and 8024F. In our setup we will be rolling out two 8024s, one of which will be used as our router and the other one for live-migration. Furthermore six 5548s will be used as layer 2 switches in order to connect the Ethernet clients in our Lan.
Currently we are working with one 5548 and one 8024 as our test setup. The plan foresees to have several VLANs in order to limit access of certain AD user groups to specific network resources. Thus far the setup runs in a lab environment and all necessary roles for dynamic VLAN assignment have been successfully installed and configured. We want to use dot1x authentication involving a RADIUS server which runs on WS2012. The configured policies of our NPS server have been successfully checked with NTRadPing and include all necessary parameters for the dynamic VLAN assignment according to the Dell 5548 manual (e.g. Tunnel-Medium-Type: 802 ; Tunnel-Pvt-Group-ID: 10 ; Tunnel-Type: VLAN”).
However we are not seeing any requests from clients attached at port 0/21 of 5548 arriving at out radius server. Please help us see the possible errors/misconfigurations in our current setup.
Thanks in advance.
Config 5548
console# show running-config
vlan database
vlan 10,15,20,25,30,35,45,50,60,100
exit
voice vlan oui-table add 000181 Nortel__________________
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 001049 Shoretel________________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00907a Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
dot1x system-auth-control
iscsi target port 860 address 0.0.0.0
iscsi target port 3260 address 0.0.0.0
iscsi target port 9876 address 0.0.0.0
iscsi target port 20002 address 0.0.0.0
iscsi target port 20003 address 0.0.0.0
iscsi target port 25555 address 0.0.0.0
ip dhcp relay address 10.10.10.22
ip dhcp relay enable
radius-server host 10.10.10.22 key password_01 source 10.10.10.2
radius-server key password_01
radius-server retransmit 10
radius-server source-ip 10.10.10.2
logging buffered debugging
logging console debugging
logging file debugging
aaa authentication login "VLAN Radius" radius
aaa authentication dot1x default radius
username admin password encrypted ****************************** privilege 15
snmp-server community Dell_Network_Manager rw view DefaultSuper
!
interface vlan 1
ip address 10.10.10.2 255.255.0.0
!
interface vlan 10
name Consulting
!
interface vlan 15
name "Consulting Server"
!
interface vlan 20
name Info
!
interface vlan 25
name "Info Server"
!
interface vlan 30
name "Global Services"
!
interface vlan 35
name "Global Server"
!
interface vlan 45
name "Global Web Server"
!
interface vlan 50
name Printer
!
interface vlan 60
name Guest
dot1x guest-vlan
!
interface vlan 100
name Management
!
interface gigabitethernet1/0/21
dot1x host-mode multi-sessions
dot1x guest-vlan enable
dot1x max-req 10
dot1x reauthentication
dot1x radius-attributes vlan
dot1x port-control auto
switchport access vlan none
!
interface gigabitethernet1/0/31
switchport general pvid 100
!
interface tengigabitethernet1/0/1
switchport mode trunk
!
interface tengigabitethernet1/0/2
switchport mode trunk
!
ip route 0.0.0.0 0.0.0.0 10.10.10.1
Config 8024:
Default settings:
Service tag: *******
SW version 4.1.0.10 (date 18-Mar-2013 time 13:43:04)
Gigabit Ethernet Ports
=============================
no shutdown
speed 1000
duplex full
negotiation
flow-control on
mdix auto
no back-pressure
interface vlan 1
interface port-channel 1 - 32
spanning-tree
spanning-tree mode RSTP
qos basic
qos trust cos
eee enable
console#
console#show running-config
!Current Configuration:
!System Description "Powerconnect 8024F, 5.0.1.3, VxWorks 6.6"
!System Software Version 5.0.1.3
!Cut-through mode is configured as disabled
!
configure
vlan 10,15,20,25,30,35,45,50,60,100
exit
vlan 10
name "Consulting"
vlan association subnet 10.1.0.0 255.255.0.0
exit
vlan 15
name "Consulting Server"
exit
vlan 20
name "Info"
vlan association subnet 10.20.0.0 255.255.0.0
exit
vlan 25
name "Info Server"
exit
vlan 30
name "Global Services"
exit
vlan 35
name "Global Server"
exit
vlan 45
name "Global Web Server"
exit
vlan 50
name "Print"
exit
vlan 60
name "Guest"
exit
vlan 100
name "Management"
exit
stack
member 1 2 ! PC8024F
exit
access-list test permit ip any any
ip routing
ip helper-address 10.10.10.22 dhcp
interface vlan 1
ip address 10.10.10.1 255.255.0.0
exit
interface vlan 10
ip address 10.1.0.1 255.255.0.0
exit
interface vlan 15
ip address 10.15.0.1 255.255.0.0
exit
interface vlan 20
ip address 10.20.0.1 255.255.0.0
exit
interface vlan 25
ip address 10.25.0.1 255.255.0.0
exit
interface vlan 30
ip address 10.30.0.1 255.255.0.0
exit
interface vlan 35
ip address 10.35.0.1 255.255.0.0
exit
interface vlan 45
ip address 10.45.0.1 255.255.0.0
exit
interface vlan 50
ip address 10.50.0.1 255.255.0.0
exit
interface vlan 60
ip address 10.60.0.1 255.255.0.0
exit
interface vlan 100
ip address 10.100.0.1 255.255.0.0
exit
username "admin" password 5f4dcc3b5aa765d61d8327deb882cf99 privilege 15 encrypted
dot1x system-auth-control monitor
aaa authorization network default radius
radius-server host auth 10.10.10.22
name "Default-RADIUS-Server"
key "password_01"
exit
!
interface Te1/0/1
switchport mode trunk
exit
!
interface Te1/0/4
switchport mode trunk
exit
snmp-server engineid local 800002a203d067e59f1265
enable password 5f4dcc3b5aa765d61d8327deb882cf99 encrypted
exit
console#
Hello,
I recently installed the Openmanage Network Manager
Problem is that when running a quick discovery against 3 switch stacks that we have here on the network we get the following " 3 address(es) did not respond to Ping"
Switch Stack #1 contains 4 Powerconnect 6248P switch.
Switch stack #2 contains 2 Powerconnect 6248P switchs.
Switch stack #3 contains 2 Powerconnect 6248P switchs.
ICMP is not enabled on these switch stacks so therefore no pinging allowed to them.
Do I need to turn on ICMP on the switch stacks in order to get OMNN to collect data?
Can OMNN collect info on these switches in another method like SNMP or HTTP?
Thanks
Hi. I need to reset enable password on the switch, but i dont have a console USB-RS232 cable.
Someone have pins picture of it?
I am new to programing Dell switches, have done a few older Cisco switches but never Dell switches. For some reason I can't get a telnet or ssh logins to work. Telnet I get a password to be asked for but nothing works and ssh just refuses connections.
Any quick references to aid me in these setups?
Thanks in advance,
Ken
Good afternoon!
I am looking to implement a 5548 into our existing infrastructure. I want to preface this by saying that I am very new to networking.
I am looking to have at least two separate vlans.
- The first vlan for public facing sites. These will get static, public IP addresses.
- The second vlan is for iSCSI traffic. I would like this to not be public facing.
Is this configuration possible or should I be looking for a different solution.
If this is possible, how do I go about setting it up?
Thank you!
I am wanting to update the firmware on my Powerconnect 6224 switch from Version 3.3.1.10 to Version 3.3.5.5. Is there any issue with this jump or will it not matter?
I also would like some words of wisdom as how to make this upgrade as painless as possible.
Sincerely,
Ken
We recently purchased an 10GBE SFP+ module (0U691D) for our 6248 so that we could use a 10GBE uplink with a 5548 but I have been unable to get a Link Up state between the two switches, we have identical intel SR SFP+ transceiver in each port, but I have been unable to get the link lights to come on anywhere.
On the 6248:
console#show switch
Management Standby Preconfig Plugged-in Switch Code
SW Status Status Model ID Model ID Status Version
--- ---------- --------- ------------- ------------- ------------- -----------
1 Mgmt Sw PCT6248 PCT6248 OK 3.3.5.5
console#show fiber-ports optical-transceiver
Output Input
Port Temp Voltage Current Power Power TX LOS
[Volt] [mA] [dBm] [dBm] Fault
------- ---- ------- ------- ------- ------- ----- ---
1/xg3 35.3 3.265 4.5 -4.482 -4.662 No No
1/xg4 37.9 3.275 4.9 -4.431 -4.888 No No
console#show stack-port
Configured Running
Stack Stack Link Link
Unit Interface Mode Mode Status Speed (Gb/s)
---- ---------------- ---------- ---------- ------------ ------------
1 xg1 Ethernet Ethernet Link Down Unknown
1 xg2 Ethernet Ethernet Link Down Unknown
1 xg3 Ethernet Ethernet Link Down Unknown
1 xg4 Ethernet Ethernet Link Down Unknown
console(config)#interface range ethernet 1/xg3-1/xg4
console(config-if)#speed ?
10 Force 10Mbps Operation
100 Force 100Mbps Operation
1000 Force 1000Mbps Operation
On the 5548:
console# show switch
Unit MAC Address Software Master Uplink Downlink Status
---- ----------------- ---------- -------- --------- --------- -------
1 d0:67:e5:93:ae:10 4.0.1.11 Enabled 2 2 backup
2 d0:67:e5:93:ad:07 4.0.1.11 Enabled 1 1 master
Topology is Ring
Stack image auto synchronization is enabled
console# show fiber-ports optical-transceiver detailed
Port Temp Voltage Current Output Input LOS [Volt] [mA] Power Power
[mWatt] [mWatt]
----------- ------ ------- ------- ------- ------- ---
te2/0/1 39 3.27 5.6 3.56 3.0 No
te2/0/2 42 3.31 5.13 3.57 3.4 No
console(config)# interface range te2/0/1-2
console(config-if-range)# speed
10 Force operation at 10 Mbps.
100 Force operation at 100 Mbps.
1000 Force operation at 1000 Mbps.
10000 Force operation at 10000 Mbps.
I have also tried to switch the TX and RX at then end of the cables but that makes the LOS go to YES. Any healp would be greatly appreciated, thanks.