Displays the physical port reporting runtime data and statistics.
The following ports are available on access points:
To define a profile‘s Ethernet port configuration:
| Name | Displays the physical port name reporting runtime data and statistics. Supported ports vary depending on model. |
| Type | Displays the physical port type. |
| Description | An administrator defined description for the port. |
| Admin Status | A green check mark means the port is active and currently enabled with the profile. A red "X" means the port is currently disabled and not available for use. The interface status can be modified with the port configuration as needed. |
| Mode | The profile's switching mode:
either Access or Trunk (as
defined in the Ethernet Port
Basic Configuration screen). If Access is selected, the port accepts packets only from the native VLAN. Frames are forwarded untagged with no 802.1Q header. All frames received on the port are expected as untagged and mapped to the native VLAN. If Trunk is selected, the port allows packets from a list of VLANs added to the trunk. The port supports multiple 802.1Q tagged VLANs and one native VLAN which can be tagged or untagged. |
| Native VLAN | The VLAN ID (1 - 4094) for the native VLAN. The native VLAN allows an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is included in the frame. Additionally, the native VLAN is the VLAN over which untagged traffic is directed when using a port in Trunk mode. |
| Tag Native VLAN | A green check mark means the
native VLAN is tagged. A red "X" means the native VLAN is
untagged. When a frame is tagged, the 12-bit frame VLAN ID is added to the 802.1Q header so upstream Ethernet devices know which VLAN ID the frame belongs to. The device reads the 12-bit VLAN ID and forwards the frame to the appropriate VLAN. When a frame is received with no 802.1Q header, the upstream device classifies the frame using the default or native VLAN assigned to the Trunk port. A native VLAN allows an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is included in the frame. |
| Allowed VLANs | The VLANs allowed to send packets over the listed port. Allowed VLANs are listed only when the port is in Trunk mode. |
| Description | Enter a brief description for the port (64 characters maximum). The description should reflect the port‘s intended function to differentiate it from others with similar configurations, or it simply can be the name of the physical port. |
| Admin Status | Select Enabled to define this port as active to the profile it supports. Select Disabled to disable this physical port in the profile. It can be activated at any time when needed. Admin status is enabled by default. |
| Speed | Select the speed at which the port
can receive and transmit data, to establish a 10, 100, or
1000 Mbps data transfer rate for the selected half-duplex or
full-duplex transmission. These options are not available if Automatic is selected. Select Automatic to enable the port to automatically exchange information about data transmission speed and duplex capabilities. Auto negotiation is helpful when in an environment where different devices are connected and disconnected on a regular basis. Automatic is the default setting. |
| Duplex | Select either Half,
Full, or Automatic
as the duplex option. Select Half duplex to send data over the port, then immediately receive data from the same direction in which the data was transmitted. Like a full-duplex transmission, a half-duplex transmission can carry data in both directions, just not at the same time. Select Full duplex to transmit data to and from the port at the same time. Using full duplex, the port can send data while receiving data as well. Select Automatic to enable to the controller or service platform to dynamically duplex as port performance needs dictate. Automatic is the default setting. |
| Mode | Set the VLAN switching mode over
the port: either Access or
Trunk. If you select Access, the port accepts packets only from the native VLAN. Frames are forwarded untagged with no 802.1Q header. All frames received on the port are expected as untagged and mapped to the native VLAN. If you select Trunk, the port allows packets from a list of VLANs you add to the trunk. The port supports multiple 802.1Q tagged VLANs and one native VLAN which can be tagged or untagged. Access is the default mode. |
| Native VLAN | Define a VLAN ID (1 - 4094) for the native VLAN. The native VLAN allows an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is included in the frame. Additionally, the native VLAN is the VLAN over which untagged traffic is directed when using a port in Trunk mode. The default VLAN is 1. |
| Tag Native VLAN | Select this option to tag the native VLAN. Controller and service platforms support the IEEE 802.1Q specification for tagging frames and coordinating VLANs between devices. IEEE 802.1Q adds four bytes to each frame identifying the VLAN ID for upstream devices that the frame belongs. If the upstream Ethernet device does not support IEEE 802.1Q tagging, it does not interpret the tagged frames. When VLAN tagging is required between devices, both devices must support tagging and be configured to accept tagged VLANs. When a frame is tagged, the 12 -bit frame VLAN ID is added to the 802.1Q header so upstream Ethernet devices know which VLAN ID the frame belongs to. The device reads the 12 bit VLAN ID and forwards the frame to the appropriate VLAN. When a frame is received with no 802.1Q header, the upstream device classifies the frame using the default or native VLAN assigned to the Trunk port. The native VLAN allows an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is included in the frame. This feature is disabled by default. |
| Allowed VLANs | Selecting Trunk as the mode enables the Allowed VLANs parameter. Add VLANs that exclusively send packets over the listed port. |
| Cisco Discovery Protocol Receive | Select this option to allow the Cisco discovery protocol for receiving data on this port. If enabled, the port sends out periodic interface updates to a multicast address to advertise its presence to neighbors. |
| Cisco Discovery Protocol Transmit | Select this option to allow the Cisco discovery protocol for transmitting data on this port. If enabled, the port sends out periodic interface updates to a multicast address to advertise its presence to neighbors. |
| Link Layer Discovery Protocol Receive | Select this option to allow the Link Layer discovery protocol to be received on this port. If enabled, the port sends out periodic interface updates to a multicast address to advertise its presence to neighbors. This option is enabled by default. |
| Link Layer Discovery Protocol Transmit | Select this option to allow the Link Layer discovery protocol to be transmitted on this port. If enabled, the port sends out periodic interface updates to a multicast address to advertise its presence to neighbors. |
A captive portal is an access policy for providing temporary and restrictive access using a standard Web browser. Captive portals provides authenticated access by capturing and re-directing a wireless user's Web browser session to a captive portal login page where the user must enter valid credentials to access to the network. Once logged into the captive portal, additional Terms and Agreement, Welcome, Fail, and No Service pages provide the administrator with a number of options on captive portal screen flow and user appearance.
For information on configuring a captive portal policy, see Configuring Captive Portal Policies.
| Port Channel | Select to configure the selected
port as a member of a link aggregation group (LAG). Link
aggregation is supported only on the following platforms:
AP 7562, AP 7602, AP 7612, AP 8432, AP 8533, NX 5500, NX 75XX, NX 95XX, NX 9600, and VX 9000. LACP enables combining and managing multiple physical connections like Ethernet ports as a single logical channel as defined in the IEEE 802.1ax standard. LACP provides redundancy and increase in throughput for connections between two peers. It also provides automatic recovery in cases where one or more of the physical links - making up the aggregation - fail. Similarly, LACP also provides a theoretical boost in speed compared to an individual physical link. Note: if enabling LACP, disable or physically disconnect
interfaces that do not use spanning tree to prevent loop
formation until LACP is fully configured on both the
local WiNG device and the remote device.
|
| Port Mode | Set the port mode as Active or
Passive. If setting the port as a LAG member,
specify whether the port is an active or passive member
within the group. An active member initiates and participates in LACP negotiations. It is the active port that always transmits LACPDU irrespective of the remote device‘s port mode. The passive port only responds to LACPDU received from its corresponding active port. At least one port within a LAG, on either of the two negotiating peers, should be in the active mode. LACP negotiations are not initiated if all LAG member ports are passive. Further, the peer-to-peer LACP negotiations are always initiated by the peer with the lower system-priority value. |
| Port Priority | Select the Port Priority check box
and set the selected Ethernet Port‘s priority value, within
the LAG, from 1-65535. The selected port‘s actual priority within the LAG is determined by the port-priority value specified here along with the port‘s number. Higher the value, lower is the priority. Use this option to manipulate a port‘s priority. For example, in a LAG having five physical ports, four active and one standby, manually increasing the standby port‘s priority ensures that if one of the active port fails, the standby port is included in the LAG during re-negotiation. |
Note
To enable FA Client feature, the Ethernet port‘s switching mode should be set to trunk.| VLAN | Set the VLAN from 1 - 4094. |
| ISID | User the spinner control to
specify the ISID from 1 - 16777214. This is the ISID (Individual Service
Identifier) associated with the VLAN interface
specified above. Configuring a VLAN to ISID assignment, enables FA client operation on the selected Ethernet port. The FA Client requests acceptance of the VLAN to ISID mapping from the FAS within the FC (Fabric Connect) network. Once acceptance is achieved, the FC edge switch applies the ISID to the VLAN traffic from the device (AP or controller), and uses this ISID inside the Fabric. Note: A maximum of 94 pairs of I-SID to
VLAN mappings can be configured per Ethernet
port.
|
FA-enabled switches, in the FC network, send out LLDP messages with TLV extensions of Organization-specific TLV with OUI, to discover FA clients and advertise capabilities.
The FA-enabled client associates with the FAS (FA Server), and obtains provisioning information (management VLAN interface details, and whether the interface is tagged or not) that allows the client to be configured with parameters that allow traffic to flow through the Fabric to the WLAN controller. Use this option to configure the ISID to VLAN mapping that the FA Client uses to negotiate with the FAS.
You can configure FA Client capability on a device‘s profile as well as device contexts.
| Trust ARP Responses | Select this option to enable ARP trust on this port. ARP packets received on this port are considered trusted, and the information from these packets is used to identify rogue devices within the network. This option is disabled by default. |
| Trust DHCP Responses | Select this option to enable DHCP trust on this port. If enabled, only DHCP responses are trusted and forwarded on this port, and a DHCP server can be connected only to a DHCP trusted port. This option is enabled by default. |
| ARP Header Mismatch Validation | Select this option to enable a mismatch check for the source MAC in both the ARP and Ethernet header. This option is enabled by default. |
| Trust 802.1p COS values | Select this option to enable 802.1p COS values on this port. This option is enabled by default. |
| Trust IP DSCP | Select this option to enable IP DSCP values on this port. This option is enabled by default. |
Note
Some vendor solutions with VRRP enabled send ARP packets with Ethernet SMAC as a physical MAC and inner ARP SMAC as VRRP MAC. If this configuration is enabled, a packet is allowed, even when a conflict exists.| Trust ND Requests | Select this option to enable the trust of neighbor discovery requests required on an IPv6 network on this Ethernet port. This option is disabled by default. |
| Trust DHCPv6 Responses | Select this option to trust all DHCPv6 responses on this Ethernet port. DHCPv6 is a networking protocol for configuring IPv6 hosts with IP addresses, IP prefixes, or other configuration attributes required on an IPv6 network. This option is enabled by default. |
| ND Header Mismatch Validation | Select this option to enable a mismatch check for the source MAC within the ND header and Link Layer Option. This option is disabled by default. |
| RA Guard | Select this option to enable router advertisements or ICMPv6 redirects from this Ethernet port. This option is disabled by default. |
| Host Mode | Select the port mode for 802.1X authentication. Select single-host to bridge traffic from a single authenticated host. Select multi-host to bridge traffic from any host to this port. The default setting is single-host. |
| Guest VLAN |
Specify a guest VLAN for this port from 1 - 4094. This is the VLAN traffic is bridged on if this port is unauthorized and the guest VLAN is globally enabled. |
| Port Control | Set the way in which the port
bridges traffic. Select one of the following options:
The default setting is force-authorized. |
| Reauthenticate |
Select this setting to force clients to reauthenticate on this port. The default setting is disabled, thus clients do not need to reauthenticate for connection over this port until this setting is enabled. |
| Max Reauthenticate Count | Set the number of reauthentication attempts (1-10) when a port tries to reauthenticate and fails. Once this count exceeds, the port is considered unauthorized. The default setting is 2. |
| Quiet Period |
Set the quiet period for this port from 1 - 65,535 seconds. This is the maximum wait time 802.1x waits upon a failed authentication attempt. The default setting is 60 seconds. |
| Reauthenticate Period | Set the duration after which a controlled port is forced to reauthenticate. Set a value from 0 - 65535 seconds. The default setting is 60 seconds. |
| Port MAC Authentication | When enabled, a port‘s MAC address is authenticated, as only one MAC address is supported per wired port. When successfully authenticated, packets from the source are processed. Packets from all other sources are dropped. Port MAC authentication is supported on RFS 4000 model controllers. Port MAC authentication may be enabled on ports in conjunction with Wired 802.1x settings for a MAC Authentication AAA policy. |
| Enable PortFast | PortFast reduces the time taken for a port to complete
STP. PortFast must only be enabled on ports on the wireless
controller which are directly connected to a
server/workstation and not to another hub or controller.
PortFast can be left unconfigured on the access
point. Select this option to enable drop-down menus for both the Enable PortFast BPDU Filter and Enable PortFast BPDU Guard options. This setting is disabled by default. |
| Enable PortFast BPDU Filter | MSTP BPDUs are messages exchanged when controllers gather
information about the network topology during STP scan. When
enabled, PortFast enabled ports do not transmit or receive
BPDU messages. Default sets the PortFast BPDU Filter value
to the bridge's BPDU filter value. Select Enable to invoke a BPDU filter for this PortFast enabled port channel. Set Disable to disable this feature. |
| Enable PortFast BPDU Guard | When set to Enable, PortFast enabled ports are forced to shut down when they receive BPDU messages. When set to Default sets the PortFast BPDU Guard value to the bridge's BPDU guard value. Set Disable to disable this feature. |
| Link Type | Select either Point-to-Point or Shared.
When Point-to-Point is selected, the port is
treated as connected to a point-to-point link. When Shared is
selected, the port is shared between multiple devices.
Similarly, an example for a Point-to-Point connection would
be when the port is connected to an access point. An example of a Point-to-Point connection is a port that is connected to a controller or service platform. An example of a Shared connection is a port that is connected to a hub. |
| Cisco MSTP Interoperability | Enable or Disable interoperability with Cisco‘s version of MSTP over the port. Cisco's version of MSTP is incompatible with standard MSTP. |
| Force Protocol Version | Select STP to use
the standard Spanning Tree Protocol. Select RSTP to
use Rapid Spanning Tree Protocol. Select MSTP to
use Multiple Spanning Tree Protocol.. MSTP is the default setting. |
| Guard |
Select Root radio to ensure that the port is a designated port. Typically, each guard root port is a designated port, unless two or more ports (within the root bridge) are connected together. If the bridge receives superior BPDUs on a guard root-enabled port, the guard root moves the port to a root-inconsistent STP state. This state is equivalent to a listening state. No data is forwarded across the port. Thus, the guard root enforces the root bridge position. Select None to disable this feature. |
The default path cost depends on the user-defined speed of the port. The cost helps determine the role of the port in the MSTP network. The designated cost is the cost for a packet to travel from this port to the root in the MSTP configuration. The slower the media, the higher the cost.
Spanning Tree Port Cost
| Speed | Default Path Cost |
|---|---|
| <=100,000 bits/sec | 200000000 |
| <=1,000,000 bits/sec | 20000000 |
| <=10,000,000 bits/sec | 2000000 |
| <=100,000,000 bits/sec | 200000 |
| <=1,000,000,000 bits/sec | 20000 |
| <=10,000,000,000 bits/sec | 2000 |
| <=100,000,000,000 bits/sec | 200 |
| <=1,000,000,000,000 bits/sec | 20 |
| >1,000,000,000,000 bits/sec | 2 |
Select + Add Row as needed to include additional indexes.
The lower the priority, the greater likelihood of the port becoming a designated port. Applying a higher override value impacts the port‘s likelihood of becoming a designated port..
Select + Add Row as needed to include additional indexes.
Print
this page
Email this topic
Feedback
View PDF
Download EPUB