Configure
Use the Configure menus to configure port setting, IP filtering, RADIUS policies, PoE schedules, and other Nebula Switch settings for Nebula Switches of the selected site.
Switch Ports
Use this screen to view port summary and configure Nebula Switch settings for the ports. To access this screen, click Site-wide > Configure > Switch > Switch ports or click the Configure ports button in the Site-wide > Devices > Switch: Switch Details screen.
Site-wide > Configure > Switch > Switch ports
The following table describes the labels in this screen.
Label | Description |
|---|---|
Switch ports | Select to view the detailed information and connection status of the Nebula Switch port in the past two hours, day, week or month. |
 | Click this button to reload the data-related frames on this page. |
Edit | Select the ports you want to configure and click this button to configure Nebula Switch settings on the ports, such as link aggregation, PoE schedule, LLDP and STP. |
Aggregate | Select more than one port and click this button to group the physical ports into one logical higher-capacity link.  This button is unavailable when a port is bound with a port profile. See Port Profiles for more information on creating Nebula Switch port profiles. You cannot aggregate ports of different media types, for example, an Ethernet port and a Fiber port. |
Split | Select a trunk group and click this button to delete the trunk group. The ports in this group then are not aggregated. A trunk group is one logical link containing multiple ports. |
Tag | Click this button to create a new tag or delete an existing tag. |
Power reset | Click this button to reboot the PD (powered device) connected to the PoE port. Follow the prompt and click Confirm to reboot the PD connected to this port. This button is not available for an uplink port. |
Search | Specify your desired filter criteria to filter the list of Nebula Switch ports. You can filter the search by selecting one or more Nebula Switches. Under Ports, you can search for multiple ports separated by a comma, or a range separated by a hyphen. For example: 1,2,4–6. |
Switch ports | This shows the number of ports on the Nebula Switch. |
Export | Click this button to save the Nebula Switch port list as a CSV or XML file to your computer. |
CRC alert icon | This prompt appears if CRC errors are detected in the port(s). Go to Site-wide > Devices > Switch: Switch Details: Port Details for the details. |
Switch / Port | This shows the Nebula Switch name and port number. If the port is added to a trunk group, this also shows whether it is configured as a static member of the trunk group (Static) or configured to join the trunk group through LACP (LACP). If the port is connected to an uplink gateway, it shows Uplink. If the port is a stacking port, it shows the stacking name, slot ID and port number. Click details to display the port details screen. |
Port name | This shows the descriptive name of the port. |
Port profiles | This shows the name of the port profile applied on this port. |
# Port | This shows the port number. |
LLDP | This shows whether Link Layer Discovery Protocol (LLDP) is supported on the port. |
Received broadcast packets | This shows the number of good broadcast packets received. |
Received bytes | This shows the number of bytes received on this port. |
Received packets | This shows the number of received frames on this port. |
Sent broadcast packets | This shows the number of good broadcast packets transmitted. |
Sent bytes | This shows the number of bytes transmitted on this port. |
Sent multicast packets | This shows the number of good multicast packets transmitted. |
Received multicast packets | This shows the number of good multicast packets received. |
Sent packets | This shows the number of transmitted frames on this port. |
Total bytes | This shows the total number of bytes transmitted or received on this port. |
Enabled | This shows whether the port is enabled or disabled. |
Link | This shows the speed of the Ethernet connection on this port. Auto (auto-negotiation) allows one port to negotiate with a peer port automatically to obtain the connection speed and duplex mode that both ends support. |
Connection | This shows the connection status of the port. • Gray (#888888): The port is disconnected. • Orange (#FF8900): The port is connected and is transmitting data at 10 or 100 Mbps. • Green (#64BE00): The port is connected and is transmitting data at 1000 Mbps (1 Gbps). • Azure (#00B2FF): The port is connected and is transmitting data at 2.5 Gbps. • Violet (#8800FF): The port is connected and is transmitting data at 5 Gbps. • Blue (#004FEE): The port is connected and is transmitting data at 10000 Mbps (10 Gbps). When the port is in the STP blocking state, failed LACP negotiation state, or failed port authentication state, a blocked icon displays. Move the cursor over a time slot to see the actual date and time when a port is connected or disconnected. |
Auth. policy | This shows the name of authentication policy applied to the port. |
Allowed VLAN | This shows the VLANs from which the traffic comes is allowed to be transmitted or received on the port. |
PoE | This shows whether PoE is enabled on the port. |
RSTP | This shows whether RSTP is enabled on the port. |
Status | If STP/RSTP is enabled, this field displays the STP state of the port. If STP/RSTP is disabled, this field displays FORWARDING if the link is up, otherwise, it displays Disabled. |
Schedule | This shows the name of the PoE schedule applied to the port. |
Type | This shows the port type (Trunk or Access). |
PVID | This shows the port VLAN ID. It is a tag that adds to incoming untagged frames received on the port so that the frames are forwarded to the VLAN group that the tag defines. |
Tag | This shows the user-specified tag that the Nebula Switch adds to the outbound traffic on this port. |
Storm Control | This shows whether traffic storm control is enabled or disabled on the port. |
Broadcast Limit (pps) | This shows the maximum number of broadcast packets the Nebula Switch accepts per second on this port. |
Multicast Limit (pps) | This shows the maximum number of multicast packets the Nebula Switch accepts per second on this port. |
DLF Limit (pps) | This shows the maximum number of Destination Lookup Failure (DLF) packets the Nebula Switch accepts per second on this port. |
Loop Guard | This shows whether loop guard is enabled or disabled on the port. |
Flow control | This shows if flow control is enabled on this port. See Site-wide > Configure > Switch > Switch ports: Edit for more information. |
Network Analytic Alert | An amber alert icon displays if the NCC generates alerts when an error or something abnormal is detected on the port for the IPTV network. Move the cursor over the alert icon to view the alert details. |
Number of IGMP Group | This shows the number of IGMP groups the port has joined. |
Received CRC packets | This shows the number of CRC (Cyclic Redundancy Check) errors received on the port. |
IPSG protected | This shows whether IP source guard protection is enabled on this port. |
Mgmt VLAN control | This shows if management control is enabled on this port. See Site-wide > Configure > Switch > Switch ports: Edit for more information. When the Nebula Switch’es Set IP address: Global VLAN configuration is enabled, it will use the site-wide management VLAN ID.When the Nebula Switch’es Set IP address: Global VLAN configuration is disabled, the Nebula Switch’es management VLAN will use its individual VLAN settings rather than the site-wide management VLAN ID. |
Template status | This shows if the port is bound to a template (Synced), bound to a template but has override profile settings (Overriden), or not bound to a template (– ‘dash’). See Port Profiles for more information on binding a port to a template. |
 | Click this icon to display a greater or lesser number of configuration fields. |
Update ports
Click to select the port you want to configure in the Site-wide > Configure > Switch > Switch ports screen.
Site-wide > Configure > Switch > Switch ports: Edit
The following table describes the labels in this screen.
Label | Description |
|---|---|
Switch ports | This shows the Nebula Switch name and port number for the ports you are configuring in this screen. |
Name | Enter a descriptive name for the ports. |
Tags | Select or create a new tag for outgoing traffic on the ports. |
Port profile | Select the port profile you created in Site-wide > Configure > Switch > Port profiles > Create port profile and make sure to enable this port profile to apply to this port. You cannot create link aggregation on ports that have applied a port profile. |
Port enabled | Select to enable or disable the ports. A port must be enabled for data transmission to occur. |
RSTP | Select to enable or disable RSTP (Rapid Spanning Tree Protocol) on the ports. RSTP detects and breaks network loops and provides backup links between switches, bridges or routers. It ensures that only one path exists between any two stations on the network. |
STP guard | This field is available only when RSTP is enabled on the ports. Select Root guard to prevent the Nebula Switches attached to the ports from becoming the root bridge. Select BPDU guard to have the Nebula Switch shut down the ports if there is any BPDU received on the ports. Otherwise, select None. |
LLDP | Select to enable or disable LLDP (Link Layer Discovery Protocol) on the ports. LLDP allows the connected network device to advertise its identity and capabilities on the local network. |
Link | Select the speed and the duplex mode of the Ethernet connection on the ports. Choices are 10M/Half Duplex, 10M/Full Duplex, 100M/Half Duplex, 100M/Full Duplex, 1000M/Full Duplex, Auto, 10M/AN, and 100M/AN (Gigabit connections only). |
Extended range | Select to enable or disable extended range. Extended range allows the port to transmit power and data at a distance of 250 meters. When enabled, the port’s PoE Power up mode is locked to 802.3at, and the port’s Link speed is limited to 10M/Full Duplex. |
Media type | You can insert either an SFP+ transceiver or an SFP+ Direct Attach Copper (DAC) cable into the 10 Gigabit interface of the Nebula Switch. Select the media type (SFP+ or DAC 10G) of the SFP+ module that is attached to the 10 Gigabit interface. Select the media type (SFP+, SFP28, DAC 10G, or DAC 25G) of the SFP+ module that is attached to the 25 Gigabit interface. Select the media type (QSFP28 or DAC 100G) of the SFP+ module that is attached to the 100 Gigabit interface. Or, just select Auto (default setting). The Nebula Switch will automatically detect the Zyxel transceiver type. Auto is supported for Zyxel transceivers only. |
FEC | To minimize signal degradation of data at high transmission speeds (for example, 25 Gbps or 100 Gbps), set the same FEC (Forward Error Correction) type between the Nebula Switch and the connected device. Select Auto to allow both connected ports to automatically set the FEC type according to the following rules: • For 10G transceivers, the FEC type on the port will automatically be Disabled. • For 25G transceivers, the FEC type on the port will automatically be CL108. • For 100G transceivers, the FEC type on the port will automatically be Disabled if the transceiver type is 100G LR4/ER4; all other types of transceiver will automatically be CL91. Select CL74 when both connected ports support 25 Gbps speed and require low latency in data transmission. Select CL91 when both connected ports support 25 Gbps and 100 Gbps speeds. Select CL108 when both connected ports support 25 Gbps speed but low latency in data transmission is not required. Alternatively, select Disabled when you do not need to set the FEC type. Make sure to set the correct Link on this screen (see the previous field). |
Port Isolation | Select to enable or disable port isolation on the ports. The ports with port isolation enabled cannot communicate with each other. They can communicate only with the CPU management port of the same Nebula Switch and the Nebula Switch’es other ports on which the isolation feature is not enabled. |
IPSG protected | Select to enable or disable IP source guard protection on the port. IP source guard checks incoming IPv4 packets on that port. A packet is allowed when it matches any entry in the IPSG binding table. If a user tries to send IPv4 packets to the Nebula Switch that do not match an entry in the IPSG binding table, the Nebula Switch will drop these packets. The Nebula Switch forwards matching traffic normally. |
Auth. policy | This field is available only when you select Access in the Type field. Select the authentication policy type and name of the pre-configured authentication policy that you want to apply to the ports. See Site-wide > Configure > Switch > Authentication for more information on authentication policy type. See Authentication for more information on configuring authentication policy. Select Open if you do NOT want to enable port authentication on the ports. This field is unavailable when a port is a member of link aggregation. |
Bandwidth Control | Select to enable or disable bandwidth control on the port. Bandwidth control means defining a maximum allowable bandwidth for incoming and/or outgoing traffic flows on a port. |
Ingress | Specify the maximum bandwidth allowed in kilobits per second (Kbps) for the incoming traffic flow on the ports. |
Egress | Specify the maximum bandwidth allowed in kilobits per second (Kbps) for the out-going traffic flow on the ports. |
Loop guard | Select to enable or disable loop guard on the ports. Loop guard allows you to configure the Nebula Switch to shut down a port if it detects that packets sent out on that port to the edge of your network loop back to the Nebula Switch. While you can use STP (Spanning Tree Protocol) to prevent loops in the core of your network, STP cannot prevent loops that occur on the edge of your network. The loop guard feature cannot be enabled on the ports that have Spanning Tree Protocol (RSTP, MRSTP or MSTP) enabled. |
Flow control | Select to enable or disable flow control on all ports. Enable flow control to allow the Nebula Switch’es port to send a pause signal to the connected device, and for the connected device to send a pause signal to the Nebula Switch. The Nebula Switch will temporarily stop sending signals after receiving a pause signal. Make sure the connected device also supports flow control. |
Storm control | Select to enable or disable broadcast storm control on the ports. Storm control limits the number of broadcast, multicast and destination lookup failure (DLF) packets the Nebula Switch receives per second on the ports. When the maximum number of allowable packets is reached per second, the subsequent packets are discarded. |
Broadcast Limit (pps) | Specifies the maximum number of broadcast packets the Nebula Switch accepts per second on the ports. |
Multicast Limit (pps) | Specifies the maximum number of multicast packets the Nebula Switch accepts per second on the ports. |
DLF Limit (pps) | Specifies the maximum number of DLF packets the Nebula Switch accepts per second on the ports. |
Type | Set the type of the port. Select Access to configure the port as an access port which can carry traffic for just one VLAN. Frames received on the port are tagged with the port VLAN ID. Select Trunk to configure the port as a trunk port which can carry traffic for multiple VLANs over a link. A trunk port is always connected to a Nebula Switch or router. |
Mgmt VLAN control | Select Enabled to configure the port as a management port. This allows the administrator to set the Nebula Switch ports through which the device management VLAN traffic is allowed. The default value depends on your setting for the previous Type field. The default value is Enabled when the Type is Trunk. The default value is Disabled when the Type is Access. Make sure to enable this for an uplink port to maintain connection with Nebula. |
VLAN type | This field is available only when you select Access in the Type field. None: This port is a regular access port and follows the device’s access port rules. Vendor ID based VLAN: Apply the Vendor ID based VLAN settings from Switch > Configure > Switch settings to this port. Voice VLAN: Apply the Voice VLAN settings from Site-wide > Configure > Switch > Switch settings to this port. For details on configuring Vendor ID based VLAN and Voice VLAN settings, see Switch Settings. |
PVID | A PVID (Port VLAN ID or native VLAN) is a tag that adds to incoming untagged frames received on a port so that the frames are forwarded to the VLAN group that the tag defines. Enter a number between 1 and 4094 as the port VLAN ID. |
Allowed VLANs | This field is available only when you select Trunk in the Type field. Specify the VLANs from which the traffic comes. You can then transmit or receive traffic on the ports. See Set Up Dynamic VLAN With RADIUS (for Nebula Switches only) for the steps in setting up dynamic VLAN with RADIUS. See Monitor Dynamic VLAN Using Event Logs (for Nebula Switches only) for more information on monitoring dynamic VLANs using event logs. |
PoE Settings | The following PoE Settings fields are unavailable when a port is a member of link aggregation. |
PoE | Select Enabled to provide power to a PD connected to the ports. |
PoE schedule | This field is available only when you enable PoE. Select a pre-defined schedule (created using the Site-wide > Configure > Switch > PoE schedules screen) to control when the Nebula Switch enables PoE to provide power on the ports. You must select Unschedule in the PoE schedule field before you can disable PoE on the ports.If you enable PoE and select Unschedule, PoE is always enabled on the ports. The Nebula Switch will follow the PoE schedule even when the Nebula Switch is not connected to NCC.Click Edit to go to Site-wide > Configure > Switch > PoE schedules screen to create a new PoE schedule. |
PoE priority | When the total power requested by the PDs exceeds the total PoE power budget on the Nebula Switch, you can set the PD priority to allow the Nebula Switch to provide power to ports with higher priority. Select Low to set the Nebula Switch to assign the remaining power to the port after all critical and medium priority ports are served. Select Medium to set the Nebula Switch to assign the remaining power to the port after all critical priority ports are served. Select Critical to give the highest PD priority on the port. |
Power up mode | Set how the Nebula Switch provides power to a connected PD at power-up. 802.3at – the Nebula Switch supports the IEEE 802.3at High Power over Ethernet standard and can supply power of up to 30W per Ethernet port. IEEE 802.3at is also known as PoE+ or PoE Plus. An IEEE 802.3at compatible device is referred to as Type 2. Power Class 4 (High Power) can only be used by Type 2 devices. If the connected PD requires a Class 4 current when it is turned on, it will be powered up in this mode. 802.3af – the Nebula Switch follows the IEEE 802.3af Power over Ethernet standard to supply power to the connected PDs during power-up. Legacy – the Nebula Switch can provide power to the connected PDs that require high inrush currents at power-up. Inrush current is the maximum, instantaneous input current drawn by the PD when first turned on. Pre-802.3at – the Nebula Switch initially offers power on the port according to the IEEE 802.3af standard, and then switches to support the IEEE 802.3at standard within 75 milliseconds after a PD is connected to the port. Select this option if the Nebula Switch is performing 2-event Layer-1 classification (PoE+ hardware classification) or the connected PD is NOT performing Layer 2 power classification using Link Layer Discovery Protocol (LLDP). Force 802.3at – the Nebula Switch provides PD Wide Range Detection (WRD) with power of up to 33 W on the port without performing PoE classification. Select this if the connected PD does not comply with any PoE standard. 802.3bt – the Nebula Switch follows the IEEE 802.3bt standard to supply power of up to 60 W per Ethernet port to the connected PDs at power-up. Pre-802.3bt – the Nebula Switch offers power on the port according to the IEEE 802.3bt standard. Select this if the connected PD was manufactured before the IEEE 802.3bt standard was implemented on September 2018, but requires power between 33 W and 60 W. IEEE 802.3bt is also known as PoE++ or PoE Plus Plus. |
Power up mode | Set how the Nebula Switch provides power to a connected PD at power-up. Standard – the Nebula Switch follows the IEEE 802.3 Power over Ethernet standard to supply power to the connected PDs during power-up. Compatible – the Nebula Switch provides PD with power on the port without performing PoE classification. Select this if the connected PD does not comply with any PoE standard. When you change the Power-Up mode, you need to do any of the following: • Click Confirm on the Power reset field of the port supplying PoE power to the connected PD in Site-wide > Configure > Switch > Switch port, or • Disconnect and reconnect the Ethernet cable supplying PoE power from the port to the connected PD. At the time of writing, this option is only available for Nebula XS1935 Series. |
Auto PD recovery | Select to enable or disable automatic PD recovery on the port. Automatic PD recovery allows the Nebula Switch to restart a Powered Device (PD) connected to the port by turning the device on and off again. |
Detecting mode | Select LLDP to have the Nebula Switch passively monitor current status of the connected Powered Device (PD) by reading LLDP packets from the PD on the port. Select Ping to have the Nebula Switch ping the IP address of the connected Powered Device (PD) through the designated port to test whether the PD is reachable or not. |
Action | Set the action to take when the connected Powered Device (PD) has stopped responding. Select Reboot-Alarm to have the Nebula Switch send an SNMP trap and generate a log message, and then turn off the power of the connected PD and turn it back on again to restart the PD. Select Alarm to have the Nebula Switch send an SNMP trap and generate a log message. |
Neighbor IP | Set the IPv4 address of the Powered Device (PD) connected to this port. If Detecting Mode is set to Ping and the PD supports LLDP, the connected PD’s IPv4 address to which the Nebula Switch sends ping requests is displayed automatically. |
Polling interval (sec) | Specify the number of seconds the Nebula Switch waits for a response before sending another ping request. For example, the Nebula Switch will try to detect the PD status by performing ping requests every 20 seconds. |
Polling count | Specify how many times the Nebula Switch resends a ping request before considering the PD unreachable. |
Resume polling interval (sec) | Specify the number of seconds the Nebula Switch waits before monitoring the PD status again after it restarts the PD on the port. |
PD reboot count | Specify how many times the Nebula Switch attempts to restart the PD on the port. The PD Reboot Count resets if any of the following conditions are true: • The Nebula Switch successfully pings the PD. • You modify any Auto PD Recovery settings and apply them. • The Nebula Switch restarts. |
Resume power interval (sec) | Specify the number of seconds the Nebula Switch waits before supplying power to the connected PD again after it restarts the PD on the port. |
IPTV Setting | |
Override advanced IGMP setting | Select ON to overwrite the port’s advanced IGMP settings (configured in the Site-wide > Configure > Switch > Advanced IGMP screen) with the settings you configure in the fields below. Otherwise, select OFF. |
Leave mode | Select Immediate Leave to remove this port from the multicast tree immediately when an IGMP leave message is received on this port. Select this option if there is only one host connected to this port. Select Normal Leave or Fast Leave and enter an IGMP normal/fast leave timeout value to have the Nebula Switch wait for an IGMP report before the leave timeout when an IGMP leave message is received on this port. You need to specify how many milliseconds the Nebula Switch waits for an IGMP report before removing an IGMP snooping membership entry when an IGMP leave message is received on this port from a host. In Normal Leave mode, when the Nebula Switch receives an IGMP leave message from a host on a port, it forwards the message to the multicast router. The multicast router then sends out an IGMP Group-Specific Query (GSQ) message to determine whether other hosts connected to the port should remain in the specific multicast group. The Nebula Switch forwards the query message to all hosts connected to the port and waits for IGMP reports from hosts to update the forwarding table. In Fast Leave mode, right after receiving an IGMP leave message from a host on a port, the Nebula Switch itself sends out an IGMP Group-Specific Query (GSQ) message to determine whether other hosts connected to the port should remain in the specific multicast group. This helps speed up the leave process. |
Maximum Group | Select Enable and enter the maximum number of multicast groups this port is allowed to join. Once a port is registered in the specified number of multicast groups, any new IGMP join report received on this port will replace the earliest group entry in the multicast forwarding table. Otherwise, select Disable to turn off multicast group limits. |
IGMP filtering profile | An IGMP filtering profile specifies a range of multicast groups that clients connected to the Nebula Switch are able to join. Select the name of the IGMP filtering profile to use for this port. Otherwise, select No Select to remove restrictions and allow the port to join any multicast group. |
Fixed router port | Select Auto to have the Nebula Switch use the port as an IGMP query port if the port receives IGMP query packets. The Nebula Switch forwards IGMP join or leave packets to an IGMP query port. Select Fixed to have the Nebula Switch always use the port as an IGMP query port. This helps prevent IGMP network topology changes when query packet losses occur in the network. |
Close | Click this button to exit this screen without saving. |
Update | Click this button to save your changes and close the screen. |
Port Profiles
Use this screen to create profiles that can be applied to each port on the Nebula Switch. A port profile can contain features such as RSTP (Rapid Spanning Tree Protocol), STP guard, port isolation, loop guard, storm control, and PoE (Power over Ethernet). To access this screen, click Site-wide > Configure > Switch > Port profiles.
Site-wide > Configure > Switch > Port profiles
The following table describes the labels in this screen.
Label | Description |
|---|---|
Port profile | This shows the number of port profiles configured on this site. |
used by port(s) | This shows the port profile name and the number of ports that are using this port profile. Click the number to go to the Site-wide > Configure > Switch > Switch ports screen. |
edit | Click this icon to go to Site-wide > Configure > Switch > Port profiles > Update port profile to edit an existing port profile. |
delete | Click this icon to remove the port profile. You can remove a port profile only when the port profile is not applied to any port. |
+ Add | Click this button to create a new port profile for Nebula Switches on the site. |
Save | Click Save to save your changes and create the port profile. |
Cancel | Click Cancel to exit this screen without saving. |
Port Profile Configuration
Click the Add button or click the Edit button in the Port profile screen to open the Site-wide > Configure > Switch > Port profiles > Create/Edit port profile screen.
Site-wide > Configure > Switch > Port profiles > Create/Edit port profile
The following table describes the labels in this screen.
Label | Description |
|---|---|
General settings | |
Profile name | Enter a name for this profile for identification purposes. Use up to 127 characters (0 to 9 a to z). The casing does not matter. |
Port enabled | Select to enable or disable the port. A port must be enabled for data transmission to occur. |
RSTP | Select to enable RSTP (Rapid Spanning Tree Protocol) on this profile. RSTP detects and breaks network loops and provides backup links between switches, bridges, or routers. It ensures that only one path exists between any two stations on the network. |
STP guard | This field is available only when RSTP is enabled on this profile. Select Root guard to prevent the Nebula Switches attached to the ports from becoming the root bridge. Select BPDU guard to have the Nebula Switch shut down the ports if there is any BPDU received on the ports. Otherwise, select None. |
Port isolation | Select to enable port isolation on the ports. The ports with port isolation enabled cannot communicate with each other. They can communicate only with the CPU management port of the same Nebula Switch and the ports on which the isolation feature is disabled. |
Loop guard | Select to enable loop guard on the ports. Loop guard allows you to configure the Nebula Switch to shut down a port if it detects that packets sent out on that port to the edge of your network loop back to the Nebula Switch. While you can use STP (Spanning Tree Protocol) to prevent loops in the core of your network, STP cannot prevent loops that occur on the edge of your network. You cannot enable the loop guard feature on the ports with Spanning Tree Protocol (RSTP, MRSTP, or MSTP) enabled. |
Storm control | Select to enable broadcast storm control on the ports. Storm control limits the number of broadcast, multicast, and destination lookup failure (DLF) packets the Nebula Switch receives per second on the ports. When the maximum number of allowable packets per second is reached, the subsequent packets are discarded. |
Broadcast Limit (pps) | Specify the maximum number of broadcast packets per second the Nebula Switch accepts on the ports. |
Multicast Limit (pps) | Specify the maximum number of multicast packets per second the Nebula Switch accepts on the ports. |
DLF Limit (pps) | Specify the maximum number of DLF packets per second the Nebula Switch accepts on the ports. |
Type | Set the type of the port. Select Access to configure the port as an access port that can carry traffic for just one VLAN. Frames received on the port are tagged with the port VLAN ID. Select Trunk to configure the port as a trunk port to carry traffic for multiple VLANs over a link. A trunk port always connects to a Nebula Switch or router. |
Management control | Select Enabled to configure the port as a management port. The default is Enabled. This allows the administrator to set the Nebula Switch ports to allow the device to manage VLAN traffic. Make sure to enable this for an uplink port to maintain a connection with Nebula. |
PVID | A PVID (Port VLAN ID or native VLAN) is a tag that adds to incoming untagged frames received on a port so that the frames are forwarded to the VLAN group that the tag defines. Enter a number between 1 and 4094 as the port VLAN ID. |
Allowed VLANs | This field is available only when you select Trunk in the Type field. Specify the VLANs from which the traffic comes. You can then transmit or receive traffic on the ports. See Set Up Dynamic VLAN With RADIUS (for Nebula Switches only) for steps in setting up dynamic VLAN with RADIUS. See Monitor Dynamic VLAN Using Event Logs (for Nebula Switches only) for more information on monitoring dynamic VLANs using event logs. |
PoE settings | |
PoE | Select Enabled to provide power to a PD connected to the ports. |
PoE schedule | This field is available only when you enable PoE. Select a pre-defined schedule (created using the Site-wide > Configure > Switch > PoE schedules screen) to control when the Nebula Switch enables PoE to provide power on the ports. You must select Unscheduled in the PoE schedule field before disabling PoE on the ports.If you enable PoE and select Unscheduled, then PoE is always enabled on the ports. The Nebula Switch will follow the PoE schedule even when the Nebula Switch is disconnected from NCC.Click Edit to go to Site-wide > Configure > Switch > PoE schedules screen to create a new PoE schedule. |
Close | Click this button to exit this screen without saving. |
Create | Click this button to save your changes and close the screen. |
Cloud Stacking Mode
In Cloud Stacking mode, you can stack Nebula Switches using the NCC. You can set the Nebula Switch to Cloud Stacking mode and configure the stacking settings on the NCC.
In NCC, a Nebula Switch in the stacking system is referred to as a slot. For example, slot 4 refers to the fourth Nebula Switch in the stacking system.
When you change modes, all Nebula Switch configurations, including Running Config, Config1, Config2 and Custom Default configuration, are erased. User accounts will be kept after mode changing if saved to a configuration file. The Nebula Switch will automatically reboot with the Cloud Stacking mode or Cloud mode factory default settings correspondingly. You have to reconfigure everything again on each Nebula Switch.From Cloud Mode to Cloud Stacking Mode
Follow the steps below to stack Nebula Switches in Cloud mode:
1 Add the Nebula Switches to your site. See Add a Nebula Device for more information.
Each Nebula Switch must have a successful connection to the Internet. The stacking ports of the Nebula Switches must not be connected to each other.2 Use the Create new stacking wizard to add the Nebula Switch to a stacking system on the NCC. See Stacking management for more information. The Nebula Switch will then go into Cloud Stacking mode.
When you change from Cloud mode to Cloud Stacking mode, the Nebula Switch keeps the IP address settings (DHCP-assigned or static IP address) you set in Cloud mode.From Cloud Stacking Mode to Cloud Mode
Follow the steps below to change from Cloud Stacking mode to Cloud mode, that is remove stacking in Cloud Stacking mode:
1 Go to Site-wide > Configure > Switch > Stacking management to remove the Nebula Switch from the stack system on the NCC. See Stacking management for more information.
2 Reset the Nebula Switch to its factory defaults. The Nebula Switch will go to Standalone mode after you reset the Nebula Switch, and you will lose all configurations done in NCC.
3 Make sure the Nebula Switch can access the NCC and is registered on the NCC. The Nebula Switch will then go into Cloud mode.
Important Notes
• Someone must be onsite to connect the stacking ports for each Nebula Switch and then check the LED status. See the User’s Guide for the stacking ports and LED status for each model. Follow the instructions on the wizard to connect the stacking ports on your Nebula Switches.
• The Nebula Switch can only connect to other Nebula Switches of the same model and firmware version.
• NCC allows up to twenty stacks per site.
• Each Nebula Switch should have a valid Nebula Professional license.
• Each Nebula Switch must belong to the same site in NCC.
• If the NCC detects any connection abnormality in your stack system, the NCC will pause the configuration process until all Nebula Switches in your stacking system are online and connected properly. You can check the stacking system status on the NCC. See Stacking management for more information.
• You cannot switch from 2-Port Mode stacking to 4-Port Mode directly. You need to remove the stacking and re-create the stacking system. See From Cloud Stacking Mode to Cloud Mode for more information on removing stacking. See Create a New Stacking System Wizard for more information on creating the stacking system.
Stacking Nebula Switches
Stacking is directly connecting Nebula Switches to form a larger system that behaves as a single Nebula Switch or a virtual chassis with increased port density.
Switch Stacking Concept
You can manage each Nebula Switch in the stack from a master Nebula Switch using the NCC.
‘Nebula Switch’ refers to a Switch in the stacking system.Each Nebula Switch supports up to two stacking channels.
The Nebula Switch ports of a stacking channel can only connect to the Nebula Switch ports of one stacking channel on the neighboring Nebula Switch. A stacking channel cannot simultaneously connect to two different stacking channels on the neighboring Nebula Switch. For example, ports 25 and 26 (channel 1) on Nebula Switch A can connect to ports 25 and 26 (channel 1) or ports 27 and 28 (channel 2) on Nebula Switch B. You cannot connect port 26 (channel 1) on Nebula Switch A to port 28 (channel 2) on Nebula Switch B while connecting port 25 (channel 1) on Nebula Switch A to port 25 (channel 1) on Nebula Switch B at the same time.
Stacking Channel and Port Examples
4-Port and 2-Port Stacking Modes (CX4800-56F)
In 4-port or 2-port mode, all four or two 100G stacking ports are used for stacking. You can stack Nebula Switches with automatic link aggregation using the src-dst-mac algorithm, giving a stacking bandwidth of 200 Gbps or 100 Gbps.
You must make the stacking connections as shown in the following tables.
model | staCking channel | stacking port |
|---|---|---|
CX4800-56F | 1 | 55 |
2 | 56 |
model | Stacking Channel | Stacking Port |
|---|---|---|
CX4800-56F | 1 | 53, 54 |
2 | 55, 56 |
At the time of writing, CX4800-56F with firmware version FaOS 2.00(ACJN.0) and later supports Cloud Stacking mode (‘ACJN’ refers to the Nebula Switch’es model code).See Cloud Stacking Mode for more information on Cloud Stacking mode.
The maximum number of CX4800-56F in a stack is 2.
4-Port and 2-Port Stacking Modes (XGS2220 Series)
In 4-port mode, all four 10G stacking ports are used for stacking. Use this mode if you want to stack Nebula Switches with automatic link aggregation giving a stacking connection of 20 Gbps. The default algorithm type is src-dst-mac, and is not configurable.
In 2-port mode, just the last two 10G stacking ports of the Nebula Switch are used for stacking. Use this mode if you want to use the first two fiber ports for high-speed connections such as a fiber uplink connection and a connection to a 10G NAS. You may stack Nebula Switches without automatic link aggregation giving a stacking connection of 10 Gbps.
You must make the stacking connections as shown in the following tables.
model | staCking channel | stacking port |
|---|---|---|
XGS2220-30 / XGS2220-30HP / XGS2220-30F | 1 | 29 |
2 | 30 | |
XGS2220-54 / XGS2220-54HP / XGS2220-54FP | 1 | 53 |
2 | 54 |
model | staCking channel | stacking port |
|---|---|---|
XGS2220-30 / XGS2220-30HP / XGS2220-30F | 1 | 27, 28 |
2 | 29, 30 | |
XGS2220-54 / XGS2220-54HP / XGS2220-54FP | 1 | 51, 52 |
2 | 53, 54 |
At the time of writing, XGS2220 Series with firmware version ZyNOS 4.80 (patch 3) and later supports Cloud Stacking mode.The maximum number of XGS2220 Series in a stack is 4.
4-Port and 2-Port Stacking Modes (XMG2230 Series)
In 4-port mode, all four 10G stacking ports are used for stacking. Use this mode if you want to stack Nebula Switches with automatic link aggregation giving a stacking connection of 20 Gbps. The default algorithm type is src-dst-mac, and is not configurable.
In 2-port mode, just the last two 10G stacking ports of the Nebula Switch are used for stacking. Use this mode if you want to use the first two fiber ports for high-speed connections such as a fiber uplink connection and a connection to a 10G NAS. You may stack Nebula Switches without automatic link aggregation giving a stacking connection of 10 Gbps.
You must make the stacking connections as shown in the following tables.
model | staCking channel | stacking port |
|---|---|---|
XMG2230-28HP | 1 | 27 |
2 | 28 | |
XMG2230-52HP | 1 | 51 |
2 | 52 |
model | staCking channel | stacking port |
|---|---|---|
XMG2230-28HP | 1 | 25, 26 |
2 | 27, 28 | |
XMG2230-52HP | 1 | 49, 50 |
2 | 51, 52 |
At the time of writing, XMG2230 Series with firmware version FaOS 3.00 and later supports Cloud Stacking mode. The maximum number of XMG2230 Series in a stack is 4.
4-Port Stacking Mode (XS3800-28)
model | Stacking Channel | Stacking Port |
|---|---|---|
XS3800-28 | 1 | 25, 26 |
2 | 27, 28 |
At the time of writing, XS3800-28 with firmware version ZyNOS 4.80(ABML.2) (patch 2) and later supports Cloud Stacking mode (‘ABML’ refers to the Nebula Switch’es model code). The maximum number of XS3800-28 in a stack is 4.
Chain Topology and Ring Topology
You can build a Nebula Switch stack using a ring or chain topology.
In a chain (C) topology, each Nebula Switch connects to the next Nebula Switch with the last Nebula Switch connected to the Nebula Switch before it. If Nebula Switch 3 fails, then only Nebula Switches 1 and 2 will still function.
In a ring (R) topology, each Nebula Switch connects to the next Nebula Switch with the last Nebula Switch connected to the first. If Nebula Switch 3 fails, then Nebula Switches 1, 2 and 4 will function as a chain topology.
Stacking Topology
Stacking will automatically choose a master Nebula Switch. The Nebula Switch with the longest up-time is selected. Uptime is measured in increments of 10 minutes. The Nebula Switch with the higher number of increments is selected. If they have the same uptime, then the Nebula Switch with the lowest MAC address will be the master.
This is the master election priority in a stack system:
1 Longest uptime
2 Lowest MAC address.
Master election occurs when:– a stacking port cable is disconnected
– a Nebula Switch in the stack reboots
– you add a Nebula Switch to the stack or
– a Nebula Switch in the stack shuts down.
Stacking management
Use this screen to create a stack, configure the stack settings, and view the stack status of Nebula Switches on the NCC.
Click Site-wide > Configure > Switch > Stacking management to access this screen.
Site-wide > Configure > Switch > Stacking management 
The following table describes the labels in this screen.
Label | Description |
|---|---|
Stack status/Name/Members | Use this field to display the stacking system configured in NCC using criteria such as Stack status/Name/Members. This field is blank if there is no stacking configured on the NCC. |
| The following fields will appear after you create at least one stacking system. | |
Status | This shows the status of the stacking system. • Green – all the Nebula Switches in the stacking system are online and the stack is configured correctly. • Green with lock icon – NCC has locked the stack system because it lacks provisioning. NCC needs to apply the site-wide port settings to all Nebula Switches in the stacking system (provisioning). To unlock, click the Provision button. See Create a New Stacking System Wizard for more information. • Orange with lock icon – NCC has locked the stacking system because of one of the following reasons: One or more Nebula Switches are offline. Make sure all the stacking ports of the Nebula Switches are connected, the power is on, and one Nebula Switch is connected to the Internet. You removed a Nebula Switch from the stacking system in NCC but did not disconnect the onsite stacking cable. Disconnect the stacking cable. NCC has detected that the onsite Nebula Switch’es cable connection does not match the Slot ID configuration in NCC. • Red – the stacking system is offline. Make sure a Nebula Switch has Internet connection. • Gray – the stacking system is offline for more than six days. |
Name | This shows the NCC-assigned name of the stacking system. To change, click the Name to go to the Slot management screen. Click the Name on any Nebula Switch to go to the Site-wide > Devices > Switch detail screen. |
Model | This shows the model type of the Nebula Switch in the stacking system. |
Configuration status | This shows Up to date when NCC has finished applying the site-wide settings to the stacking Nebula Switch. Otherwise, it shows Not up to date. |
Current version | This shows the ZyNOS firmware that is currently running on the Nebula Switches in the stacking system. |
Slot | This shows the Nebula Switch’es name in the stacking system. |
Stacking mode | This shows the number of stacking ports. 2-port means the last 2 SFP+ slots are dedicated for Nebula Switch stacking. 4-port means the last 4 SFP+ slots are dedicated for Nebula Switch stacking. At the time of writing, only the following models support 2-port / 4-port Stacking mode:– CX4800-56F with firmware version FaOS 2.00 and later – XGS2220 Series with firmware version ZyNOS 4.80 (patch 4) and later – XMG2230 Series with firmware version FaOS 3.00 and later – XS3800-28 with firmware version ZyNOS 4.80 (patch 2) and later |
Media type | This shows the media type (SFP+, QSFP28, DAC, or DAC100G) of the SFP+ module that is attached to the 10 or 100 Gigabit interface. |
FEC | To avoid link issues between the Nebula Switch and the connected device, set the correct FEC (Forward Error Correction) type based on the transceiver specification. The SFP28 / QSFP28 specification defines a hot-swappable interface that enables a high-speed port to support a wide range of physical media, including copper and optical fiber. Select Clause 74 when both connected ports support the same Gbps speed and require low latency in data transmission. Select Clause 91 when both connected ports support the same Gbps speed and require strong error correction. A strong error correction can detect and repair more bit errors in the data stream but with higher latency. Alternatively, select Disabled when you do not need to set the FEC type. |
Delete | Click this when you want to remove the stacking system on the NCC. The Nebula Switches will appear as individual devices in NCC. Reset the Nebula Switches to factory-default settings so that the Nebula Switches will not appear offline in NCC. Follow the steps in From Cloud Stacking Mode to Cloud Mode to change from Cloud Stacking mode to Cloud mode. |
Create new Stack | Click this button to run the Create a new Stacking wizard. See the next section for more information. |
Create a New Stacking System Wizard
The wizard helps you create a stacking system quickly.
Step1: Run the Wizard
Go to Site-wide > Configure > Switch > Stacking management and click Create new Stack.
Step2: Before you start
Make sure to do the steps listed on the screen. Then click Next.
Someone must be onsite to connect the stacking ports for each Nebula Switch and then check the LED status. Make sure that you do not make the stacking port connections yet.
Step3: Add slot
1 Click +Add (1) and then select the first Nebula Switch in the Name field (2) to add to the stacking system. Click +Add (1) and then select the second Nebula Switch in the Name field (2) to add to the stacking system.
The Slot ID is assigned based on the order the Nebula Switch is added. The first Nebula Switch (S1) added to the stacking system had Slot ID 1.2 Select the media type (SFP+, QSFP28, DAC, or DAC100G) (3) of the SFP+ module to attach to the stacking port.
3 Select the FEC (Forward Error Correction) type (CL74, CL91, or Disabled) (4).
At the time of writing, this field is only available for the CX4800-56F. 4 Select the number of stacking ports (2-ports or 4-ports) (5).
At the time of writing, this field is only available for the CX4800-56F and XGS2220 Series. This field is not configurable for the XS3800-28, 4-ports stacking mode.Slot ID Sequence
Click Refresh to have NCC update the status of the Nebula Switch(es), for example, from offline to online. 5 Click the I acknowledge the Switch will erase running configuration when it is set to Stacking mode checkbox (6). This means that you will lose all configurations made in NCC for each Nebula Switch. You cannot back up the configurations in NCC first.
6 Then click Create (7). The Nebula Switches will automatically reboot to Cloud Stacking mode. NCC will assign the Slot ID to each Nebula Switch.
The Create button is enabled when:• There are at least two online Nebula Switches in the stacking system
• The ‘erase running configuration’ confirmation box is selected.
Step4: Setup guidance (onsite hardware connections)
1 Perform the hardware connections onsite. See Hardware Connections (for Stacking) for the steps.
2 Then click Next.
Setup Guidance (2-Port Mode) 
Setup Guidance (4-Port Mode) 
Step5: Ready to Provision
NCC must apply the site-wide port settings to all Nebula Switches in the stack. The Slot Status of the stacking Nebula Switch appear green in the following screen when:
• All the Nebula Switches in the stacking system are online
• The Nebula Switch connection order matches the Slot ID configuration in NCC.
Click Provision to apply the site-wide port settings and exit the wizard.
Ready to Provision 
The following screen appears when:
• One or more Nebula Switches in the stacking system are offline
• You remove a Nebula Switch from the stacking system in NCC, but did not disconnect the onsite stacking port cable
• The Nebula Switch’es onsite cable connection does not match the Slot ID configuration in NCC.
After fixing the problem, click Refresh to have NCC update the stacking status. Click Provision when each stacking Nebula Switch’es Slot Status shows green with lock icon.
Not Ready to Provision 
Hardware Connections (for Stacking)
Do the following steps onsite:
1 Remove all Ethernet cable connections from all ports on all the Nebula Switches that are going to be in the stacking system.
2 Check the STACK ID LED on each Nebula Switch to find the Slot ID. Position the Nebula Switches accordingly.
Nebula Switch STACK ID LED
3 Connect the stacking cables to the stacking ports. See the example figure below.
• Ports 25 and 26 (channel 1) on Slot ID 1 (S1) connects to ports 27 and 28 (channel 2) on Slot ID 2 (S2).
• Ports 25 and 26 (channel 1) on Slot ID 2 (S2) connects to ports 27 and 28 (channel 2) on Slot ID 3 (S3).
• Ports 25 and 26 (channel 1) on Slot ID 3 (S3) connects to ports 27 and 28 (channel 2) on Slot ID 4 (S4).
• Ports 25 and 26 (channel 1) on Slot ID 4 (S4) connects to ports 27 and 28 (channel 2) on Slot ID 1 (S1).
Onsite Stacking Cable Connection: Ring Topology
4 Connect one Nebula Switch’es uplink Ethernet port only to the Internet for the stacking system.
A stacking port cannot be the uplink port.5 Wait until all the Nebula Switch’es SYS LED are steady green. You are now ready to manage your stacking system through NCC.
Slot Management
Use this screen to add, remove, or swap Nebula Switches in a stacking system. Click Site-wide > Configure > Switch > Stacking management, then click the name of the stacking system to access this screen.
Site-wide > Configure > Switch > Stacking management: Slot management 
Remove a non-Master Nebula Switch
To remove a Nebula Switch except the master in a stacking system, do the following:
1 Select the Nebula Switch you want to remove. Then click the delete icon on the right.
2 The following pop-up window appears. Select Retain the slot’s port setting if you want to apply the setting to the new Nebula Switch. Then, click Delete slot.
To apply the slot’s port setting to another Nebula Switch, make sure the Nebula Switch is the same model and firmware version. 3 Disconnect the stacking cable on the Nebula Switch onsite.
4 Press the RESTORE button on the front panel of the Nebula Switch for more than 7 seconds to reset to the factory-default settings.
Remove a Master Nebula Switch
To remove a master Nebula Switch in a stacking system, do the following:
1 Disconnect the stacking cable to the master Nebula Switch and reconnect. NCC will elect a new master Nebula Switch for the stacking system. You can now remove the old master Nebula Switch.
To ensure continuity of the stacking system’s management MAC address, the new master Nebula Switch will inherit the old master Nebula Switch’es MAC address.This is the MAC address that will display in the Site-wide > Topology, Site-wide > Clients > Client list, and Site-wide > Devices > Switch: Switch Details screens.
2 On the Nebula Switch you want to remove, click the delete icon on the right.
3 The following pop-up window appears. Select Retain the slot’s port setting if you want to apply the setting to the new Nebula Switch. Then, click Delete slot.
To apply the slot’s port setting to another Nebula Switch, make sure the Nebula Switch is the same model and firmware version. 4 Disconnect the stacking cable on the Nebula Switch onsite.
5 Press the RESTORE button on the front panel of the Nebula Switch for more than 7 seconds to reset to the factory-default settings.
Add a Nebula Switch
To add a Nebula Switch to the stacking system, do the following:
2 On the Swap/Add Slot screen, click + Add to add another Nebula Switch to the stacking system.
3 In the Name field, select the Nebula Switch in your site to add to the stacking system.
4 When the Slot Status of the new Nebula Switch is green, click I acknowledge.
The Slot Status will show red when the Nebula Switch is offline.5 Click Change. The Nebula Switch will automatically reboot to Cloud Stacking mode. NCC will assign the new Slot ID to the Nebula Switch, see the STACK ID LED of the Nebula Switch.
6 Update the stacking cable connection onsite. See Hardware Connections (for Stacking) for the steps.
7 Then click Next.
8 Click Provision to apply the site-wide port settings to the new Nebula Switch and exit the wizard.
If the new Nebula Switch is the same model and firmware version, NCC will automatically restore the configurations to the new Nebula Switch.Otherwise, the Nebula Switch will restore to its factory-default settings to prevent mis-configurations in NCC. You need to reconfigure the port settings in NCC.
The Provision button may be disabled (gray-out) when:– One or more Nebula Switches in the stacking system are offline
– The Nebula Switch’es order of connection do not match the Slot ID configuration in NCC.
After fixing the problem, click Reload to update the stacking status. Then click Provision when all the stacking Nebula Switch’es Slot Status shows green with lock icon.
Swap a Nebula Switch
To replace a faulty Nebula Switch in a stacking system and keep the configurations, do NOT remove or swap the Nebula Switch. See I need to replace a defective Nebula Device in my stacking system. I want to keep the NCC configurations. for more information.If the new Nebula Switch is the same model and firmware version, NCC will automatically restore the configurations to the new Nebula Switch. Use the swap icon to replace the Nebula Switch, see step 2.Otherwise, after replacing a new Nebula Switch on a stacking system, the Nebula Switch will restore to its factory-default settings to prevent mis-configurations in NCC. You need to reconfigure the port settings in NCC.
To swap a Nebula Switch in the stacking system, do the following:
2 On the Swap/Add Slot screen, select the Nebula Switch you want to swap and click the swap icon.
3 In the Name field, select the Nebula Switch in your site to swap in the stacking system.
4 When the Slot Status of the new Nebula Switch is green, click I acknowledge.
5 Click Change. The new Nebula Switch will automatically reboot to Cloud Stacking mode. NCC will assign the previous Slot ID to the new Nebula Switch, see the STACK ID LED on the front panel.
The new Nebula Switch will inherit the configuration of the old Nebula Switch when both models are the same. For example, replace XGS2220-30F with another XGS2220-30F. 
6 Update the stacking cable connection onsite. See Hardware Connections (for Stacking) for the steps.
7 Then click Next.
8 Click Provision to apply the site-wide port settings to the new Nebula Switch and exit the wizard.
ACL
ACL lets you allow or block traffic going through the Nebula Switches according to the rule settings. Use this screen to configure ACL rules on the Nebula Switches.
Click Site-wide > Configure > Switches > ACL to access this screen.
Site-wide > Configure > Switch > ACL
The following table describes the labels in this screen.
Label | Description |
|---|---|
Management rules | The NCC automatically creates rules to allow traffic from/to the Nebula Control Center IP addresses in the list. |
Customization rules | |
 | Click the icon of a rule and drag the rule up or down to change the order. |
Enabled | Select the checkbox to turn on the rule. Otherwise, clear the checkbox to turn off the rule. |
Policy | Select to allow or deny traffic that matches the filtering criteria in the rule. |
Protocol | Select the type of IP protocol used to transport the traffic to which the rule is applied. |
Source MAC | Enter the source MAC address of the packets that you want to filter. |
Source IP | Enter the source IP address of the packets that you want to filter. |
Source port | Enter the source port numbers that defines the traffic type. |
Destination MAC | Enter the destination MAC address of the packets that you want to filter. |
Destination IP | Enter the destination IP address of the packets that you want to filter. |
Destination port | Enter the destination port numbers that defines the traffic type. |
VLAN | Enter the ID number of the VLAN group to which the matched traffic belongs. |
Description | Enter a descriptive name for the rule. |
Delete | Click the delete icon to remove the rule. |
Add | Click this button to create a new rule. |
IP & Routing
This screen enables you to create IP interfaces, static routes, and DHCP option 82 profiles on Nebula Switches in the site. This allows you to do the following:
• Create IP interfaces on a Layer 2 Nebula Switch for management or monitoring services, such as IGMP querier, auto PD recovery, ping, and ONVIF discovery.
• Create multiple IP interface on a Layer 3 Nebula Switch to route across VLANs.
• Create an IP interface and static route to specify the next hop to a specific destination subnet.
• Add Nebula Switch (relay agent) information when forwarding client-originated DHCP packets to a DHCP server. This feature provides additional security when DHCP allocates network IPv4 addresses. This prevents DHCP client requests from untrusted sources.
Click Site-wide > Configure > Switch > IP & Routing to access this screen.
Site-wide > Configure > Switch > IP & Routing
The following table describes the labels in this screen.
Label | Description |
|---|---|
IP interface | |
Switch | This shows the name of the Nebula Switch. |
Name | This shows the name of the interface (network) on the Nebula Switch. |
IP address | This shows the IP address of the interface (network). |
Subnet mask | This shows the subnet mask of the interface (network). |
VLAN ID | This shows the ID number of the VLAN with which the interface (network) is associated. |
DHCP setting | This shows the type of DHCP service the Nebula Switch provides to the network in the site. This shows None when the Nebula Switch does not provide any DHCP services. This shows DHCP relay when the Nebula Switch routes DHCP requests to one or more DHCP servers you specify. The DHCP servers may be on another network in the site. This shows DHCP server when the Nebula Switch assigns IP addresses and provides subnet mask, gateway, and DNS server information to the network. The Nebula Switch is the DHCP server for the network. |
Relay profile | This shows the name of the DHCP option 82 profile that is bound to the IP interface. See Add Option 82 Profile on adding and enabling a DHCP option 82 profile on the IP interface. Otherwise, this shows None. |
 | Click this icon to modify the interface. |
 | Click this icon to delete the interface. |
+ Add | Click this button to create a new interface on a Nebula Switch in the site. |
Static route | |
Switch | This shows the name of the Nebula Switch. |
Name | This shows the name of the static route. |
Destination | This shows the destination IP address. |
Subnet mask | This shows the IP subnet mask. |
Next hop IP | This shows the IP address of the next-hop gateway or the interface through which the traffic is routed. The gateway is a router or Nebula Switch on the same segment as your Security Appliance's interfaces. It helps forward packets to their destinations. |
 | Click this icon to modify the static route. |
 | Click this icon to delete the static route. |
+ Add | Click this button to create a new static route on a Nebula Switch in the site. |
DHCP option 82 profile | A DHCP option 82 profile allows the Nebula Switch to send additional information (such as the VLAN ID) together with the DHCP requests to the DHCP server. This allows the DHCP server to assign the appropriate IP address according to the VLAN ID. This shows the DHCP option 82 profile that is created on NCC. |
 | Click the edit icon to change the DHCP option 82 profile settings. |
 | Click the remove icon to delete the DHCP option 82 profile. Make sure the option 82 profile is not in use before deleting it. See Add Option 82 Profile for more information. |
+ Add | Click this button to create a new DHCP option 82 profile on a Nebula Switch in the site. |
Add IP Interface
Click the + Add button on the Site-wide > Configure > Switch > IP & Routing > IP Interface screen to access this screen.
Site-wide > Configure > Switch > IP & Routing > IP Interface > Add
The following table describes the labels in this screen.
Label | Description |
|---|---|
Switch | Select a Nebula Switch in the site on which to create the interface. |
Name | Enter a name of the interface (network) on the Nebula Switch. |
Interface IP | Enter the IP address of the interface (network). To prevent an IP address conflict, NCC will prevent input of an IP address already used by another Nebula Switch in the same site. |
Subnet mask | Enter the subnet mask of the interface (network). |
VLAN | Enter the ID number of the VLAN with which the interface (network) is associated. |
DHCP setting | |
DHCP | Select DHCP Relay if you want the Nebula Switch to route DHCP requests to one or more DHCP servers you specify. The DHCP servers may be on another network in the site. Select DHCP Server if you want the Nebula Switch to assign IP addresses and provide subnet mask, gateway, and DNS server information to the network. The Nebula Switch is the DHCP server for the network. DHCP Server is available for Layer 3 Nebula Switches only. Each Layer 3 Nebula Switch supports a maximum of 16 DHCP servers. You cannot use DHCP Relay and DHCP Server on the same Layer 3 Nebula Switch. When you configure an IP interface as a DHCP Server, DHCP Relay is grayed out. Otherwise, select None. |
The following fields appear when you select DHCP Relay from the DHCP list. | |
Relay server 1 | Enter the IPv4 address of a DHCP server for the network in the site. |
Relay server 2 / 3 | These fields are optional. Enter the IP address of another DHCP server for the network in the site. |
Option 82 profile | Select an existing option 82 profile. Alternatively, click Create new profile to go to the Option 82 profile screen to add information such as port, VLAN ID, hostname, and MAC address (in hexadecimal format) to DHCP messages. This allows the DHCP server to assign the appropriate IP address according to the port, VLAN ID, hostname, and MAC address. Go to Add Option 82 Profile for more information. Otherwise, select None. |
The following fields appear when you select DHCP Server from the DHCP list. | |
IP pool start address | Enter the start IP address for the Nebula Switch’s IP address pool. The IP Pool start address must be in the same subnet as the Interface IP address. If this field is blank, leave the Pool size field blank too. The Nebula Switch can then assign all available IP addresses within the interface’s subnet, except the network address, broadcast address, and interface IP address. The default Pool size is 200. The maximum is 1021. If the IP pool start address or Pool size overlaps a subnet used by another Nebula Device (for example, Nebula Firewall) in the same site, NCC blocks the configuration. |
Default gateway | Enter the IP address of the default outgoing gateway in dotted decimal notation, for example 192.168.1.254. When an interface cannot find a routing information for a frame’s destination, it forwards the packet to the default gateway. |
Primary DNS server | Enter the IP address of the DNS server that DHCP clients use. The Domain Name System (DNS) resolves domain names to IP addresses. The Nebula Switch uses the primary DNS server first followed by the secondary DNS server. The DNS resolves domain names for VPN, DDNS, and the time server. Leave this field blank if you do not want to configure DNS servers. |
Secondary DNS server | Enter the IP address of the secondary DNS server. This field is optional. |
Lease time | Specify how long DHCP clients can use an assigned IP address before renewing its lease. Infinite – IP addresses remain valid until you change this setting. Enter the lease duration in days, hours (Optional), or minutes (Optional). The default Lease time is 2 days. The minimum Lease time is 1 minute. The maximum is 365 days. |
Unavailable lease time | Specify how long the Nebula Switch waits before reassigning an unavailable IP address to DHCP clients. An IP address becomes unavailable when a DHCP client rejects it because another device already uses it. For example, another DHCP server may have assigned the address. The Nebula Switch removes the unavailable IP address from the IP address pool until the specified time expires. Enter the unavailable lease duration in days, hours (Optional), or minutes (Optional). The default Unavailable lease time is 3 minutes. The minimum Unavailable lease time is 1 minute. The maximum is 365 days. |
Close | Click Close to exit this screen without saving. |
Create | Click Create to save your changes and create the interface. |
To select the DHCP server option for an IP interface, configure the Layer 3 Nebula Switch’s IP type as Static IP on the Mgmt VLAN. If the IP type is DHCP on the Mgmt VLAN, an error message appears when you try to enable the DHCP server. Add Static Route
Click the + Add button on the Site-wide > Configure > Switch > IP & Routing > Static Route screen to access this screen.
Site-wide > Configure > Switch > IP & Routing > Static Route > Add
The following table describes the labels in this screen.
Label | Description |
|---|---|
Switch | Select a Nebula Switch in the site on which to create the interface. |
Name | Enter a descriptive name for this route. |
Destination | Specifies the IP network address of the final destination. |
Subnet mask | Enter the IP subnet mask. |
Next hop IP | Enter the IP address of the next-hop gateway. |
Close | Click Close to exit this screen without saving. |
Create | Click Create to save your changes and create the static route. |
Add Option 82 Profile
Use this screen to add information such as port, VLAN ID, hostname, and MAC address (in hexadecimal format) to DHCP messages. DHCP servers then create policies that match these new identifiers for DHCP assignment. Click the + Add button on the Site-wide > Configure > Switch > IP & Routing > DHCP option 82 profile screen to access this screen.
Each site can have up to 16 option 82 profiles only.Site-wide > Configure > Switch > IP & Routing > DHCP option 82 profile > Add
The following table describes the labels in this screen.
Label | Description |
|---|---|
Profile name | Enter a descriptive name for this profile, up to 64 keyboard characters. |
Circuit-ID | Use this section to configure the Circuit ID sub-option to include information such as port, VLAN ID, and hostname (in hexadecimal format) that is specific to the DHCP relay agent (the Nebula Switch). For example: ‘0014000a475331333530string’. Where: • ‘0014’ is the port information, ‘00’ is the slot ID and ‘14’ is the port number • ‘000a’ is the VLAN ID • ‘475331333530’ is the hostname • ‘string’ is the optional string. See String (Optional) for more information. |
Enabled | Select this checkbox to have the Nebula Switch add the Circuit ID sub-option to client DHCP requests that it relays to a DHCP server. |
ID | This identifies the row for Circuit-ID sub-option. |
Sub-option | Select the Port option to have the Nebula Switch add the port information that the DHCP client connects to. This allows the DHCP server to assign IPv4 addresses to the Nebula Switch with the corresponding port information. Select the VLAN ID option to have the Nebula Switch add the VLAN ID information to which the port belongs. This allows the DHCP server to assign IPv4 addresses to the Nebula Switch with the corresponding VLAN ID. Select the Hostname option to add the system name information to the client DHCP requests that it relays to a DHCP server. This allows the DHCP server to assign IPv4 addresses to the Nebula Switch with the corresponding hostname. Otherwise, leave this field blank. |
String (Optional) | Enter an optional string of up to 64 printable ASCII characters that the Nebula Switch adds into the client DHCP requests, except the characters inside the square brackets [ ? ], [ | ], [ ' ], [ " ] or [ , ]. |
Remote-ID | Use this section to configure the Remote ID sub-option to include information such as the MAC address (in hexadecimal format) that is specific to the DHCP relay agent (the Nebula Switch). For example: ‘bccf4f000001custom’. Where: • ‘bccf4f000001’ is the MAC address • ‘custom’ is the optional string. See String (Optional) for more information. |
Enabled | Select this checkbox to have the Nebula Switch append the Remote ID sub-option to the option 82 field of DHCP requests. |
ID | This identifies the row for Remote-ID sub-option. |
Sub-option | Select the MAC option to have the Nebula Switch add its MAC address information to the client DHCP requests that it relays to a DHCP server. Otherwise, leave this field blank. |
String (Optional) | Enter an optional string of up to 64 printable ASCII characters that the Nebula Switch adds into the client DHCP requests, except the characters inside the square brackets [ ? ], [ | ], [ ' ], [ " ] or [ , ]. |
Close | Click Close to exit this screen without saving. |
Save & Back | Click Save & Back to save your changes and close this screen. |
ONVIF Discovery
IP-based security products use a specific protocol for communication. One of the most common protocols is ONVIF (Open Network Video Interface Forum). ONVIF is a standard interface for interoperability of IP-based security products. When ONVIF is enabled and configured on a Nebula Switch, the Nebula Switch can obtain information from connected ONVIF-compatible devices, such as a device’s system name and IP address.
In NCC, you can configure ONVIF-compatible Nebula Switches (for example, GS1350) in a site to discover ONVIF-compatible devices in one designated VLAN.
ONVIF and UPnP are similar protocols and may conflict with each other. If NCC detects UPnP packets on the same network as ONVIF, then it will prompt you to automatically create an ACL rule that blocks UPnP traffic (UDP, port 1900).
Configuring ONVIF Discovery
Follow these steps to configure ONVIF discovery within a site.
1 Decide on the VLAN ID you want to use for ONVIF discovery within the site. This VLAN is the ONVIF discovery VLAN.
2 Go to Site-wide > Configure > Switch > IP & Routing. For each Nebula Switch that you want to enable ONVIF discovery on, add an IP interface for the Nebula Switch on the ONVIF discovery VLAN.
3 Go to Site-wide > Configure > Switch > ONVIF discovery. Enable ONVIF discovery, and then set ONVIF VLAN ID to the ID of your ONVIF discovery VLAN.
4 For each Nebula Switch that you want to enable ONVIF discovery on, click + Add. Select the Nebula Switch, and then enter the ports that you want to listen for ONVIF devices.
ONVIF Discovery Screen
Click Site-wide > Configure > Switch > ONVIF discovery to access this screen.
Site-wide > Configure > Switch > ONVIF discovery
The following table describes the labels in this screen.
Label | Description |
|---|---|
Model list | Click this to view a list of Zyxel Nebula Switch models that support ONVIF discovery. |
ONVIF discovery | Enable this to allow ONVIF-compatible Nebula Switches in the site to send ONVIF packets to discover or scan for ONVIF-compatible IP-based security devices. |
ONVIF VLAN ID | Enter the ID number of the VLAN to run ONVIF. You can enter multiple VLAN IDs separated by a comma (,). For example, enter “1,2” for VLAN IDs 1 and 2. |
Switch name | Select the Nebula Switch that you want to enable ONVIF discovery on. |
Port list | Enter the port numbers to allow discovery of ONVIF-compatible devices. You can enter multiple ports separated by comma (,) or hyphen (-) without spaces. For example, enter “3-5” for ports 3, 4, and 5. Enter “3,5,7” for ports 3, 5, and 7. |
Description | Enter a descriptive name for this Nebula Switch. |
Model | This shows the Nebula Switch model. |
 | Click this icon to delete the ONVIF configuration for the Nebula Switch. |
+ Add | Click this to configure ONVIF discovery on another Nebula Switch in the site. |
Advanced IGMP
A Nebula Switch can passively snoop on IGMP packets transferred between IP multicast routers/Nebula Switches and IP multicast hosts to learn the IP multicast group membership. It checks IGMP packets passing through it, picks out the group registration information, and configures multi-casting accordingly. IGMP snooping allows the Nebula Switch to learn multicast groups without you having to manually configure them.
The Nebula Switch forwards multicast traffic destined for multicast groups (that it has learned from IGMP snooping or that you have manually configured) to ports that are members of that group. IGMP snooping generates no additional network traffic, allowing you to significantly reduce multicast traffic passing through your Nebula Switch.
Use this screen to enable IGMP snooping on the Nebula Switches in the site, create IGMP filtering profiles and configure advanced IGMP snooping settings that apply to all ports on the Nebula Switch for your IPTV network. Click Site-wide > Configure > Switch > Advanced IGMP to access this screen. You can make adjustments on a per-port basis using the Site-wide > Configure > Switch > Switch ports screen.
Site-wide > Configure > Switch > Advanced IGMP
The following table describes the labels in this screen.
Label | Description |
|---|---|
IGMP snooping | Select ON to enable and configure IGMP snooping settings on all Nebula Switches in the site. Select OFF to disable it. |
IGMP-snooping VLAN | Select Auto-detect to have the Nebula Switch learn multicast group membership information of any VLANs automatically. Select User Assigned VLANs and enter the VLAN IDs to have the Nebula Switch only learn multicast group membership information of the VLANs that you specify. Click Model List to view a list of Zyxel Nebula Switch models that do not support this feature. The Nebula Switch can perform IGMP snooping on up to 16 VLANs. |
Unknown multicast drop | Specify the action to perform when the Nebula Switch receives an unknown multicast frame. Select ON to discard the frames. Select OFF to send the frames to all ports. Click Model List to view a list of Zyxel Nebula Switch models that do and do not support this feature. |
Drop on VLAN | This allows you to define the VLANs in which unknown multicast packets can be dropped. The Nebula Switch can drop unknown multicast packets on up to 8 VLANs. |
IGMP filtering profiles | An IGMP filtering profile specifies a range of multicast groups that clients connected to the Nebula Switch are able to join. You can set the Nebula Switch to filter the multicast group join reports on a per-port basis by configuring an IGMP filtering profile and associating a port to the profile. |
 | Click the edit icon to change the profile settings. See Add/Edit IGMP Filtering Profiles. |
 | Click the remove icon to delete the profile. |
+Add | Click this button to create a new profile. See Add/Edit IGMP Filtering Profiles. |
IPTV topology setup The following three buttons are available only when there are multiple Nebula Switches in the site and your administrator account has full access to this screen. | |
IGMP snooping | Select the Nebula Switches you want to configure and click this button to turn on or off IGMP snooping on the selected Nebula Switches. |
Role | Select the Nebula Switches you want to configure and click this button to change the IGMP role of the selected Nebula Switches. |
Port settings | Select the Nebula Switches you want to configure and click this button to open the Port settings screen, where you can change IGMP leave mode and IGMP filtering profile for the ports on the selected Nebula Switches. See IGMP Port Settings. |
IGMP topology tips | Click this to view information about configuring your network and device roles to optimize IPTV performance. |
The following list shows you the IGMP settings for each Nebula Switch in the site. | |
Switch Name | This shows the name of the Nebula Switch in the site. |
IGMP snooping | Click this to enable IGMP snooping on the Nebula Switch. See Advanced IGMP for more information on IGMP snooping. |
IGMP report proxy | Click this to enable IGMP report proxy on the Nebula Switch. An IGMP report is generated when monitoring multicast address or membership query. It is highly recommended to disable this in the following conditions: • When the Nebula Switch is deployed in a Networked AV environment. A Networked AV environment is specifically designed to simplify configuration and management of the Nebula Switch for AVoIP (Audio-Video over Internet Protocol) application. • When the Nebula Switch is connected to CPEs (customer premise equipment) that require a specific IPTV source. Some CPEs validate IPTVs based on the source IP and MAC address of their IGMP join request. IGMP report proxy trims down the amount of IGMP join packets and sends its own IGMP join request. |
Role | This shows whether the Nebula Switch is acting as an IGMP snooping querier, aggregation Nebula Switch or access Nebula Switch in the IPTV network. |
Port settings | Click Advanced setup to open the Port settings screen, where you can change IGMP leave mode and IGMP filtering profile for the ports on the Nebula Switch. See IGMP Port Settings. |
The following fields display when the IGMP role of a Nebula Switch is set to Querier. | |
VLAN | Enter the ID number of the VLAN on which the Nebula Switch learns the multicast group membership. |
Querier IP Interface | Enter the IP address of the Nebula Switch interface in IGMP querier mode. The Nebula Switch acts as an IGMP querier in that network/VLAN to periodically send out IGMP query packets with the interface IP address and update its multicast forwarding table. |
Mask | Enter the subnet mask of the Nebula Switch interface in IGMP querier mode. |
 | Click the remove icon to delete the rule. |
Add | Click this button to create a new rule. |
Add/Edit IGMP Filtering Profiles
Use this screen to create a new IGMP filtering profile or edit an existing profile. To access this screen, click the Add button or a profile’s Edit button in the IGMP filtering profiles section of the Site-wide > Configure > Switch > Advanced IGMP screen.
Site-wide > Configure > Switch > Advanced IGMP: Add IGMP Filtering Profile
The following table describes the labels in this screen.
Label | Description |
|---|---|
Profile name | Enter a descriptive name for this profile for identification purposes. |
This shows the index number of the rule. | |
Start IP address | Enter the starting multicast IP address for a range of multicast IP addresses that you want to belong to the IGMP filter profile. |
End IP address | Enter the ending multicast IP address for a range of IP addresses that you want to belong to the IGMP filter profile. If you want to add a single multicast IP address, enter it in both the Start IP Address and End IP Address fields. |
 | Click the remove icon to delete the rule. |
+Add | Click this button to create a new rule in this profile. |
Close | Click this button to exit this screen without saving. |
Save & Back | Click this button to save your changes and close the screen. |
IGMP Port Settings
Use this screen to modify the IGMP snooping settings, such as IGMP leave mode and filtering profile for all ports on the Nebula Switch. To access this screen, select one or more Nebula Switches and click the Port settings button or click a Nebula Switch’es Advanced setup button in the IPTV topology setup section of the Site-wide > Configure > Switch > Advanced IGMP screen.
Site-wide > Configure > Switch > Advanced IGMP: Port settings
The following table describes the labels in this screen.
Label | Description |
|---|---|
Switch name | This shows the name of the Nebula Switches that you select to configure. |
Role | This shows whether the Nebula Switches you selected is an IGMP snooping querier, aggregation Nebula Switch or access Nebula Switch in the IPTV network. |
Leave mode | Select Immediate Leave to set the Nebula Switch to remove this port from the multicast tree immediately when an IGMP leave message is received on this port. Select this option if there is only one host connected to this port. Select Normal Leave or Fast Leave and enter an IGMP normal/fast leave timeout value to have the Nebula Switch wait for an IGMP report before the leave timeout when an IGMP leave message is received on this port. You need to specify how many milliseconds the Nebula Switch waits for an IGMP report before removing an IGMP snooping membership entry when an IGMP leave message is received on this port from a host. In Normal Leave mode, when the Nebula Switch receives an IGMP leave message from a host on a port, it forwards the message to the multicast router. The multicast router then sends out an IGMP Group-Specific Query (GSQ) message to determine whether other hosts connected to the port should remain in the specific multicast group. The Nebula Switch forwards the query message to all hosts connected to the port and waits for IGMP reports from hosts to update the forwarding table. In Fast Leave mode, right after receiving an IGMP leave message from a host on a port, the Nebula Switch itself sends out an IGMP Group-Specific Query (GSQ) message to determine whether other hosts connected to the port should remain in the specific multicast group. This helps speed up the leave process. |
Maximum group | Select Enable and enter the maximum number of multicast groups this port is allowed to join. Once a port is registered in the specified number of multicast groups, any new IGMP join report received on this port will replace the earliest group entry in the multicast forwarding table. Otherwise, select Disable to turn off multicast group limits. |
IGMP filtering profile | An IGMP filtering profile specifies a range of multicast groups that clients connected to the Nebula Switch are able to join. Select the name of the IGMP filtering profile to use for this port. Otherwise, select No Select to remove restrictions and allow the port to join any multicast group. |
Reset | Click this button to return the screen to its last-saved settings. |
Close | Click this button to exit this screen without saving. |
Save | Click this button to save your changes and close the screen. |
Authentication
Use this screen to configure authentication servers and policies to validate access to ports on the Nebula Switch using the Nebula cloud authentication server or an external RADIUS server.
Network traffic from clients will be denied when the Nebula cloud authentication (A) server (NCAS) cannot be reached.NCAS Disconnect Behavior
The following figure shows an example Nebula Switch with ports enabled for MAC authentication. Clients 1 and 2 (C1, C2) passes MAC authentication (authorized). Client 3 (C3) fails MAC authentication (not authorized).
MAC Authentication Application
Click Site-wide > Configure > Switch > Authentication to access this screen.
Site-wide > Configure > Switch > Authentication
The following table describes the labels in this screen.
Label | Description |
|---|---|
Authentication Server | |
Server type | Select External radius server to have both IEEE 802.1x (WPA-Enterprise) authentication and MAC-based authentication. The Nebula Switch sends a request message to a RADIUS server in order to authenticate clients. The administrator must enter the IP address of the RADIUS server. The default port is 1812. Make sure to configure VLAN for the Nebula Switch before enabling VLAN assignment in the external RADIUS server.Select Nebula cloud authentication to have MAC-based authentication only. The Nebula Switch sends HTTPS message to NCAS (Nebula Cloud Authentication Server) to authenticate clients. The default port is 443. See Set Up MAC Authentication With NCAS (for Nebula Switches only) for the steps in setting up MAC authentication with NCAS. Blocked clients do not appear in the Nebula Switch MAC address table. The Nebula Switch re-authenticates blocked clients when: • 5 minutes after blocked client failed authentication • Blocked client disconnects and reconnects to the Nebula Switch port. The Blocked client in the Site-wide > Clients > Client list screen has a higher priority than MAC-based authentication.All network traffic from clients will be denied when the NCAS cannot be reached. |
The following fields appear when you select External radius server as the Server type. | |
 | Click the icon of a rule and drag the rule up or down to change the order. |
Host | Enter the IP address of the external RADIUS server. |
Port | Enter the port of the RADIUS server for authentication (default 1812). |
Secret | Enter a password (up to 32 alphanumeric characters) as the key to be shared between the external RADIUS server and the Nebula Switch. |
 | Click the remove icon to delete the entry. |
Add | Click this button to create a new RADIUS server entry. |
Authentication policy | You apply the policy to a port in Site-wide > Configure > Switch > Switch ports: Edit (a selected port). |
Password for MAC-Base Auth | Enter the password the Nebula Switch sends along with the MAC address of a client for authentication with the RADIUS server. You can enter up to 32 printable ASCII characters. |
Name | Enter a descriptive name for the policy. |
Auth. type | Select MAC-Base if you want to validate access to the ports based on the MAC address and password of the client. Select 802.1X if you want to validate access to the ports based on the user name and password provided by the client. 802.1X is not supported when you select Nebula cloud authentication in Server type. |
Guest VLAN | A guest VLAN is a pre-configured VLAN on the Nebula Switch that allows non-authenticated users to access limited network resources through the Nebula Switch. Enter the number that identifies the guest VLAN. |
Port security | Click On to enable port security on the ports. Otherwise, select Off to disable port security on the ports. |
MAC limitation | This field is configurable only when you enable port security. Specify the maximum number of MAC addresses learned on a port. For example, if you set the MAC limitation to 5, then only five clients can be learned on a specific port on any time. |
Auth. ports | This shows the number of the Nebula Switch ports to which this policy is applied. |
 | Click the remove icon to delete the profile. |
Add | Click this button to create a new policy. |
PoE Schedules
Use this screen to view and configure Power over Ethernet (PoE) schedules which can be applied to the ports. PoE is enabled at the specified time/date. Click Site-wide > Configure > Switch > PoE schedules to access this screen.
The NCC will not generate an alert when PoE is disabled and the connected APs go offline because of the pre-defined PoE schedules.The table shows the name of the existing schedules and the number of ports to which a schedule is applied. Click a schedule’s edit icon to modify the schedule settings or click the Add button to create a new schedule. See Create new schedule.
Site-wide > Configure > Switch > PoE schedules
Create new schedule
Click the Add button in the Site-wide > Configure > Switch > PoE schedules screen to access this screen.
Site-wide > Configure > Switch > PoE schedule: Add
The following table describes the labels in this screen.
Label | Description |
|---|---|
Name | Enter a descriptive name for this schedule for identification purposes. |
Schedule templates | Select a pre-defined schedule template. • Available 8–5 daily • Available 8–5 daily except weekends • Weekdays only • Always on • Always off Or select Custom schedule to configure the day and time at which PoE is enabled or disabled. For example, to enable PoE on Monday: 08:00 to 12:00, click the 08:00 to 10:00 block and drag the right corner to include the 10:00 to 12:00 block (1). Click the Copy icon (2) to copy Monday’s schedule by selecting the day(s) of the week on the Copy schedule to window that appears. Click Apply to confirm. To set multiple PoE schedules, click a block or click the Repeat icon (3) to set the Time range, Allowed period and Disabled period on the Add repeated slots window that appears. Click Apply to confirm.   Time range – Specify the time range for the repeated schedule slots. Allowed period – Specify how long PoE remains enabled during each repeated cycle. Disabled period – Specify how long PoE remains disabled during each repeated cycle. You can click the block (1) to change the Start and End or select All Day on the Edit time window that appears. Click Save to confirm. |
Day | This shows the day of the week. |
Close | Click this button to exit this screen without saving. |
Add | Click this button to save your changes and close the screen. |
feature | specification |
|---|---|
Maximum PoE schedules | up to 10 per schedule |
Switch Settings
Use this screen to configure global Nebula Switch settings, such as (R)STP, QoS, port mirroring, voice VLAN, DHCP server guard, and IP source guard.
Click Site-wide > Configure > Switch > Switch settings to access this screen.
Site-wide > Configure > Switch > Switch settings
The following table describes the labels in this screen.
Label | Description |
|---|---|
Auto configuration recovery | |
Auto configuration recovery | When On, connectivity check to NCC is done 5 minutes after any configuration change. If an NCC connection problem is detected, the Nebula Switch will return to its last saved custom default configuration. The Nebula Switch will be locked by NCC and the banner N Switches are currently protected by Auto Configuration Recovery will be displayed. Otherwise, the latest configuration will be saved as the new custom default configuration. If the NCC connectivity error occur 5 minutes after a configuration change, the Nebula Switch will not return to its last saved configuration.When Auto configuration recovery is turned Off, a pop-up message appears informing you that the locked Nebula Switch(es) will be unlocked. Click Confirm if you wish to continue. |
VLAN configuration | |
Management VLAN (Mgmt VLAN) | Enter the VLAN identification number associated with the Nebula Switch IP address. This is the VLAN ID of the CPU and is used for management only. The default is "1". All ports, by default, are fixed members of this "management VLAN" in order to manage the device from any port. If a port is not a member of this VLAN, then users on that port cannot access the device. To access the Nebula Switch make sure the port that you are connected to is a member of Management VLAN. Before changing the management VLAN for an uplink port, check the following to avoid disconnection with NCC: • Management Control is enabled in Site-wide > Configure > Switch > Switch ports • The uplink port belongs to the management VLAN in Site-wide > Configure > Switch > Switch ports: PVID. |
STP configuration | |
Rapid spanning tree protocol (RSTP) | Select On to enable RSTP on the Nebula Switch. Otherwise, select Off. |
STP bridge priority | Bridge priority is used in determining the root Nebula Switch, root port and designated port. The Nebula Switch with the highest priority (lowest numeric value) becomes the STP root Nebula Switch. If all Nebula Switches have the same priority, the Nebula Switch with the lowest MAC address will then become the root Nebula Switch. The lower the numeric value you assign, the higher the priority for this bridge. Click Set the bridge priority for another switch to create a new entry. Select the Nebula Switches for which you want to configure the bridge priority, and select a value from the drop-down list box. |
Quality of service | |
Quality of service | Enter a VLAN ID and select the priority level that the Nebula Switch assigns to frames belonging to this VLAN. Enter a descriptive name for the QoS (Quality of Service). Click Add to create a new entry. |
Port mirroring | |
Port mirroring | Click Add to create a new entry. Select a Nebula Switch (standalone or in a stack (Switch)). Specify the Destination Port to which you copy the traffic. You can then examine the copied traffic without affecting the original traffic flow. Specify the Source Port from which you mirror the traffic. The maximum number of Source Ports is the total port number minus the Destination Port. For example, XGS2220-30 supports up to 29 Source Ports. For a Nebula Switch in a stack, specify ports using the slot ID/port number format. For example, enter ‘2/20’ for slot ID 2 port 20. For a Nebula Switch in a stack, first confirm the stacking mode, 2-ports or 4-ports. For 2-ports mode stacking, exclude stacking ports from the maximum number of Source Ports. Then, exclude one additional port for the Destination Port. For example, XGS2220-30 and XGS2220-54 support up to 79 source ports (28 + 52 − 1). For 4-ports mode stacking, exclude stacking ports from the maximum number of Source Ports. Then, exclude one additional port for the Destination Port. For example, XGS2220-30F, XGS2220-54FP, and XGS2220-54 support 125 source ports (26 + 50 + 50 − 1). |
Err-disable recovery | |
Err-disable recovery | Enter the number of seconds (from 30 to 86400) to wait to activate a port or allow specific packets on a port, after the loop guard / BPDU guard error was gone. The loop guard feature shuts down a port if it detects that packets sent out on that port loop back to the Nebula Switch. The BPDU guard feature allows you to prevent any new STP-aware (Spanning Tree Protocol) switch from connecting to an existing network and causing STP topology changes in the network. If there is any BPDU detected on the ports on which BPDU guard is enabled, the Nebula Switch disables the ports automatically. • Loop guard recovery is always enabled. • Click the switch to enable BPDU guard recovery. Default setting is disabled. • The range of Expiration time (seconds) for both Loop guard recovery and BPDU guard recovery is 30 to 86400. |
Voice VLAN | |
Voice VLAN | Select On to enable the Voice VLAN feature on the Nebula Switch. Otherwise, select Off. It groups the voice traffic with defined priority into an assigned VLAN which enables the separation of voice and data traffic coming into the Nebula Switch port. |
Voice VLAN ID | Enter a VLAN ID number. |
Priority | Select the priority level of the Voice VLAN from 1 to 6. |
Assign VLAN by | Select how the Nebula Switch assigns ports connected to VoIP devices to the Voice VLAN. OUI (Organizationally Unique Identifier): The Nebula Switch assigns a port connected to a VoIP device to the Voice VLAN if the connected device’s OUI matches any OUI in the list. LLDP-MED: The Nebula Switch assigns a port connected to a VoIP device to the voice VLAN if the connected device is identified as a VoIP device using the LLDP-MED protocol. The connected device must support LLDP-MED and have LLDP-MED enabled. |
OUI | This field appears when you select OUI in the Assign VLAN by field. Click Add OUI on this network to add an OUI and a description for the OUI. An Organizationally Unique Identifier identifies a manufacturer. Typically, a device’s OUI is the first three octets of the device’s MAC address. For example, if you have an IP phone from Company A with MAC address 00:0a:95:9d:68:16, you can enter OUI 00:0a:95 to match all devices from Company A. |
DSCP | This field appears when you select LLDP-MED in the Assign VLAN by field. Enter the Differentiated Services Code Point (DSCP) value for traffic on the voice VLAN. The value is defined from 0 through 63, and 0 is the default. |
Vendor ID based VLAN | |
Vendor ID based VLAN | Select On to enable the Vendor ID based VLAN feature on the Nebula Switch. Otherwise, select Off. Click the Add Vendor-ID on this network button to define the vendor MAC address OUI, assign to which VLAN, and set the priority. Enter a descriptive name for the Vendor ID based VLAN. Enter up to 64 characters for this field including special characters inside the square quotes [~!@#$%^&*()_+{}|:”<>–=[]\;’,/ ]. |
DHCP Server Guard | |
DHCP Server Guard | Select On to enable the DHCP server guard feature on the Nebula Switch in order to prevent illegal DHCP servers. Only the first DHCP server that assigned the Nebula Switch IP address is allowed to assign IP addresses to devices in this management VLAN. Otherwise, select Off to disable it. |
IP source guard | |
IP source guard | Select On to enable IP source guard protection. IP source guard uses a binding table to distinguish between authorized and unauthorized DHCP and ARP packets in your network. When the client does not exist in the binding table, the client is unauthorized and traffic will be blocked. To successfully access the network: • Client with static IP address will need to be added to the Allowed client list • Client with dynamic IP address will need to get their IP address from an authorized DHCP server. |
Protected switch | This shows the Nebula Switch/stacking system. • Select On to enable IP source guard protection on the Nebula Switch/stacking system. Then click Save. • Click the edit icon to go to Site-wide > Configure > Switch > Switch ports to configure Protected ports (see Switch Ports for more information). • Click Run to display a pop-up window showing the current client table. • Select the DHCP-snooping or Block entries and click Transfer to add these to the allowed client list. Then click Save. |
Allowed client list | This allows the administrator to define a set of clients. Click Add client to define the IPv4 address, MAC address, and VLAN of the static client. A previous entry will be overwritten when you enter a duplicate MAC address and VLAN ID. Click Action > Edit to modify the static client entry. Then click Update. The MAC address and VLAN ID will appear in red when you enter a duplicate entry. Click Action > Delete to remove the static client entry. Click Save to activate the settings. Maximum of 128 static entries is allowed per site. |