I wanted to take a moment to look at spanning tree. By default, ICX switches run 802.1d spanning tree on a per-vlan basis. Ideally, we want to use a protocol with faster convergence such as rapid spanning tree (802.1w). I will go through some general configuration steps and a few best practices. These configurations will not suit all customers, but it is a good starting point for many. 

Enabling RSTP on vlan(s) 

ICX#conf t
ICX(config)#vlan 10 20 30 <--edits three vlans at once. You can edit vlans one at a time or using a range via the 'to' syntax (vlan 1 to 20)
ICX(config-mvlan-10*30)#spanning-tree 802-1w

Now that 802.1w is running, we will want to set a root bridge priority. If no priority is defined, the default of 32768 will be used. Let us assume you want this switch to be the root bridge. A lower priority number wins, so let us go ahead and set it to zero to ensure this switch becomes root bridge:

ICX(config-mvlan-10*30)#spanning-tree 802-1w priority 0

The resulting configuration will look like this:

vlan 10 by port
 tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8
 spanning-tree 802-1w
 spanning-tree 802-1w priority 0
!
vlan 20 by port
 tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8
 spanning-tree 802-1w
 spanning-tree 802-1w priority 0
!
vlan 30 by port
 tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8
 spanning-tree 802-1w
 spanning-tree 802-1w priority 0

Now that our RSTP instances are running, let's take a look at a couple best practices.

Switch-to-switch connections should be defined as point-to-point links to optimize convergence times. In this example, let us assume ports 1/2/1 through 1/2/8 are all switch-to-switch links:

ICX#conf t
ICX(config)#interface ethernet 1/2/1 to 1/2/8
ICX(config-mif-1/2/1-1/2/8)#spanning-tree 802-1w admin-pt2pt-mac

The resulting configuration:

interface ethernet 1/2/1
 port-name Switch-to-Switch-Connection
 spanning-tree 802-1w admin-pt2pt-mac

Switch-to-client (edge) connections should be defined as operational edge ports. In this example, let us assume ports 1/1/1 through 1/1/48 are all client edge ports:

ICX#conf t
ICX(config)#interface ethernet 1/1/1 to 1/1/48
ICX(config-mif-1/1/1-1/1/48)#spanning-tree 802-1w admin-edge-port

Client ports can also have STP BPDU Guard enabled. This will shut down the port if any BPDUs are received on the port. 

ICX#conf t
ICX(config)#interface ethernet 1/1/1 to 1/1/48
ICX(config)#stp-bpdu-guard

The resulting configuration:

interface ethernet 1/1/1
 port-name Client-Port
 spanning-tree 802-1w admin-edge-port
 stp-bpdu-guard

To see RSTP information, you can use the following commands:

ICX#show 802-1w
ICX#show 802-1w detail

Note: If you are running 802.1d, you will use 'show spanning-tree' and 'show spanning-tree detail'. MSTP also has unique commands such as 'show mstp' and 'show mstp detail'

To see all available configuration options for spanning tree, please see our FastIron Layer 2 Switching Configuration Guide:

HTML Version

PDF Version (requires login)

Let us know if you have any questions!

When a 3m DAC cable connection is made in 7150 between port 1/3/1 to 2/3/3

The link remains down, and the two switches will not stack with each other.

Details from Ruckus optic guide:

Link to Ruckus optic guide for reference:

• https://www.commscope.com/globalassets/digizuite/61722-ds-ethernet-optics-family.pdf

Below is link to KBA which briefs about the problem:

• https://support.ruckuswireless.com/articles/000011828

Technical Bulletin link:

• https://support.ruckuswireless.com/technical_support_bulletins/607

Boot Loop Process

When a unit is stuck in a boot loop and fails to stabilize, the first step is to console into the unit directly and review the boot process. This can provide insights into why the unit is not booting correctly.

Example Error:

Booting image from Secondary

Wrong Image Format for bootm command

ERROR: can't get kernel image!

could not boot from secondary, no valid image; trying to boot from primary

Booting image from Primary

Wrong Image Format for bootm command

ERROR: can't get kernel image!

1. Console the Unit:
2. Connect to the unit via a console cable and monitor the boot process. Interrupt the boot process by pressing b at the boot counter.

   Ruckus Networks Bootloader: 10.1.26T215 (Nov 29 2022 - 04:42:59)

   Validate Shmoo parameters stored in flash ..... OK

   Restoring Shmoo parameters from flash .....

   Running simple memory test ..... OK

   ICX7450-24 Copper (Non-POE), PVT1

   SYS CPLD VER: 0x10, Released Ver: 0

   Enter 'b' to stop at boot monitor:  3 >>>> Press 'b' to stop the process.

   ICX7450-Boot>

1. Access Boot Mode:
2. Check the installed images using the show_image command.

   ICX7450-Boot> show_image

   ===========================

   Primary  : SPR08095k(33554432)

   Secondary: SPS08095j(31457280)

   ===========================

1. Set Up for Recovery:
2. Connect an Ethernet cable from the management port to the TFTP server.
3. Ensure the device is in boot mode for recovery.

Example:

1. Configure Environment Variables:
2. Set the TFTP server IP and other necessary network settings.

   ICX 7450-48> setenv serverip 10.10.10.21

   ICX 7450-48> setenv ipaddr 10.10.10.22

   ICX 7450-48> setenv gatewayip 10.10.10.1

   ICX 7450-48> setenv netmask 255.255.255.0

   ICX 7450-48> saveenv

• Verify the settings:

   ICX 7450-48> printenv

   baudrate=9600

   ipaddr=10.10.10.22

   gatewayip=10.10.10.1

   netmask=255.255.255.0

   serverip=10.10.10.21

   uboot=ruckus/ICX7450/bootcode/spz10115

   Version:10.1.06T215 (May 15 2015 - 11:28:23)

1. Test Connectivity:
2. Ping the TFTP server to ensure connectivity.
3. Disable the Windows Firewall

   ICX 7450-48> ping 10.10.10.21

   ethPortNo = 0

   Using egiga0 device

   host 10.10.10.21 is alive

1. Update the Flash:
2. Set the image file name and update the flash.

   ICX 7450-48> setenv image_name images/ICX/SPR08090.bin

   ICX 7450-48> update_primary

• For versions below 8080f, update the uboot file.

Provide the file name of the boot image to be copied from the tftp server.

   ICX 7450-48> setenv uboot <xxx.bin>

   ICX 7450-48> update_uboot

1. Boot the Unit:
2. Load the image from the primary or secondary flash.

   ICX 7450-48> boot_primary

Video Link as reference: https://www.youtube.com/watch?v=RHriOYYD_iI

Link as reference : https://docs.commscope.com/bundle/fastiron-09010-upgradeguide/page/GUID-9B5D5A56-039D-44FB-8FD2-B9B55E71ADE8.html

• For ICX-8200 models, boot from the golden image if necessary.

   boot_golden_primary - Flash the Golden UFI Image to Primary and boot from Primary

Name : sysDescr

OID : 1.3.6.1.2.1.1.1

Output / Value (OctetString): Ruckus Wireless, Inc. Stacking System ICX7750-48F, IronWare Version 08.0.90kT201 Compiled on Feb 22 2021 at 23:56:00 labeled as SWS08090k

Name : sysObjectID

OID : 1.3.6.1.2.1.1.2

Output / Value (OID): snFastIronStackICX7750Switch

Name : sysUpTime

OID : 1.3.6.1.2.1.1.3

Output / Value (TimeTicks): 2418 hours 16 minutes 35 seconds (870579500)

Name : sysName

OID : 1.3.6.1.2.1.1.5

Output / Value (OctetString): Superman1

Memory :

Name : snAgGblDynMemUtil

OID : 1.3.6.1.4.1.1991.1.1.2.1.53

Output / Value (Gauge): 14

Name : snAgGblDynMemTotal

OID : 1.3.6.1.4.1.1991.1.1.2.1.54

Output / Value (Gauge): 3853291520

Name : snAgGblDynMemFree

OID : 1.3.6.1.4.1.1991.1.1.2.1.55

Output / Value (Gauge): 3246243840

Hardware :

CPU :

Name : snAgGblCpuUtil1SecAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.50

Output/ Value (Gauge): 1

Name : snAgGblCpuUtil5SecAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.51

Output/ Value (Gauge): 1

Name : snAgGblCpuUtil1MinAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.52

Output/ Value (Gauge): 1

Power supply :

Without Stacking

Name : snChasPwrSupplyIndex

OID  : 1.3.6.1.4.1.1991.1.1.1.2.1.1.1

Output / Value (Integer): 1

Name : snChasPwrSupplyDescription

OID : 1.3.6.1.4.1.1991.1.1.1.2.1.1.2

Output / Value (OctetString): Power supply 1 (AC - Regular) present, status ok

       Model Number:  BRCD-10G

       Serial Number: CUB2V34L06M

       Firmware Ver: 2.1

Name : snChasPwrSupplyOperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.2.1.1.3

output / Value (Integer): normal (2)

With Stacking :

Name : snChasPwrSupply2Unit

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.1

Output :

Name/OID: snChasPwrSupply2Unit.1.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Unit.2.1; Value (Integer): 2

Name/OID: snChasPwrSupply2Unit.3.1; Value (Integer): 3

Name : snChasPwrSupply2Index

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.2

Output :

Name/OID: snChasPwrSupply2Index.1.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Index.2.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Index.3.1; Value (Integer): 1

Name : snChasPwrSupply2Description

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.3

Output :

Name/OID: snChasPwrSupply2Description.1.1; Value (OctetString): Power supply 1

Name/OID: snChasPwrSupply2Description.2.1; Value (OctetString): Power supply 1

Name/OID: snChasPwrSupply2Description.3.1; Value (OctetString): Power supply 1

Name : snChasPwrSupply2OperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.4

Output :

Name/OID: snChasPwrSupply2OperStatus.1.1; Value (Integer): normal (2)

Name/OID: snChasPwrSupply2OperStatus.2.1; Value (Integer): normal (2)

Name/OID: snChasPwrSupply2OperStatus.3.1; Value (Integer): normal (2)

Fan

Without stacking :

Name : snChasFanIndex

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.1

Output :

Name/OID: snChasFanIndex.1; Value (Integer): 1

Name/OID: snChasFanIndex.2; Value (Integer): 2

Name/OID: snChasFanIndex.3; Value (Integer): 3

Name/OID: snChasFanIndex.4; Value (Integer): 4

Name : snChasFanDescription

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.2

Output :

Name/OID: snChasFanDescription.1; Value (OctetString): Fan 1 (from left when facing back side)

Name/OID: snChasFanDescription.2; Value (OctetString): Fan 2 (from left when facing back side)

Name/OID: snChasFanDescription.3; Value (OctetString): Fan 3 (from left when facing back side)

Name/OID: snChasFanDescription.4; Value (OctetString): Fan 4 (from left when facing back side)

Name : snChasFanOperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.3

Output :

Name/OID: snChasFanOperStatus.1; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.2; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.3; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.4; Value (Integer): normal (2)

With stacking

Name : snChasFan2Unit

OID : 1.3.6.1.4.1.1991.1.1.1.3.2.1.1

Output :

Name/OID: snChasFan2Unit.1.1; Value (Integer): 1

Name/OID: snChasFan2Unit.1.2; Value (Integer): 1

Name/OID: snChasFan2Unit.1.3; Value (Integer): 1

Name/OID: snChasFan2Unit.1.4; Value (Integer): 1

Name/OID: snChasFan2Unit.2.1; Value (Integer): 2

Name/OID: snChasFan2Unit.2.2; Value (Integer): 2

Name/OID: snChasFan2Unit.2.3; Value (Integer): 2

Name/OID: snChasFan2Unit.2.4; Value (Integer): 2

Name/OID: snChasFan2Unit.3.1; Value (Integer): 3

Name/OID: snChasFan2Unit.3.2; Value (Integer): 3

Name/OID: snChasFan2Unit.3.3; Value (Integer): 3

Name/OID: snChasFan2Unit.3.4; Value (Integer): 3

When a user goes through enrolment and gets a DPSK. When they then use that DPSK each device shows up as AccountDPSK-xxxxxx for the username:

Since the user went through an enrollment, CloudPath knows the username and we can use a POLICY to return the username attribute.

1. Create a RADIUS Attribute Group that associates the RADIUS value “User-name” to the variable ${USERNAME} make sure to modify the assignment behavior to add or replace:
2. Create a POLICY that returns that attribute:
3. Apply that POLICY to the DPSK pool:

    

During the next auth of that device, the returned value of the variable ${USERNAME} will be visible in the controller:

Thanks.

In 8200, The Switching image was deprecated with 10.0 and each platform will only use one image starting with 10.0.

ALL the L3 image support L2 features starting with 10.0, Only routing image are available for all supported models.
Switching features are still available in the routing image.

>The 8200 by design doesn't support l2 image so there is no ip default-gateway command.

>Instead we need to specify the route to forward the traffic to an external subnet. We can either use static routes, default routes or a routing protocol.

>If you want to use the ICX8200 switch as a L2 device follow the below steps:

You just need to add a default route to the device, And then add the VLANs you want. The ICX8200 model can only run L3 firmware images. That's why we need to add a default route for it to start behaving as an L2 switch, where it is only passing VLAN traffic in and out. We also need to identify the VLAN where this default route communication goes through. And then create a virtual interface and assign the IP that will be used for management and for communication with the default gateway.

Example:

-Create the virtual interface and assign the IP form MGMT and default route:

ICX8200-switch#conf t
ICX8200-switch(config)#vlan 10
ICX8200-switch(config-vlan10)#interface ve 10
ICX8200-switch(config-if-ve10)#ip address 10.10.10.2/24

Here's the command for the default route:

ICX8200-switch#conf t
ICX8200-switch(config)#ip route 0.0.0.0/0 10.10.10.1 (IP address of your ICX7850 router, which is the default gateway for the management vlan)

ICX8200 with the code 10.00, this code only came in routing, so you can configure the IP address under a VE, loopback or port.

Beginning with the 09.0.00 release, when a VLAN is configured, a virtual routing interface is statically mapped to the VLAN ID. However,
only when you issue the interface ve-num command does the virtual interface get created.

Please refer to the below link of the L3 Routing configuration Guide under Subheading "Assigning an IPv4 Address to an Ethernet Port"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

Please refer to the below link of the L3 Routing Configuration Guide under Subheading "Assigning an IP address to a virtual interface"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

Please refer to the below link of the L3 Routing Configuration Guide under Subheading "Assigning an IP address to a loopback interface"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

Port mirroring is an effective network traffic monitoring technique. It involves duplicating each packet entering or leaving a specific port on a network switch and sending this copy to another port for analysis. This technique is particularly useful for diagnostic and debugging purposes, as well as for enhancing network security.

To set up port mirroring, you designate a 'monitor port' from which packets are copied, and a 'mirror port' that receives these copies. Both incoming and outgoing packets from the monitor port are sent to the mirror port. A network analysis tool, like Wireshark, can then be connected to the mirror port to capture and analyze the traffic. This process allows for detailed examination of data packets without interfering with the normal operation of the network.

Standalone(config)# mirror-port ethernet x/x/x - This command designates the connection to the analyzer tool.
Standalone(config)# interface ethernet x/x/x - This command selects the specific interface from which data capture is desired.
Standalone(config-if-e1000-x/x/x)# monitor ethernet x/x/x both - This command establishes the monitoring of the specified interface and directs the traffic to the analyzer tool.

Verification of Configuration:

To verify the configuration, use the "show mirror" command. This will display the current mirror configuration, confirming the setup for traffic capture and analysis.

Here is an example using the given topology. Our objective is to capture traffic from port 1/2/1 and redirect it to an analyzer tool connected to port 1/1/1, where Wireshark is installed.

Device(config)#mirror-port ethernet 1/1/1
Device(config)#interface ethernet 1/2/1
Device(config-if-e25000-1/2/1)#monitor ethernet 1/1/1 both

Device(config-if-e25000-1/2/1)#show mirror
Mirror port 1/1/1
  Input monitoring      : (U1/M2)   1
  Output monitoring     : (U1/M2)   1

For additional details, please refer to our guides :

Official Guide Port Mirroring and Monitoring Configuration:

https://docs.commscope.com/bundle/fastiron-10010-monitoringguide/page/GUID-7165A5D9-141A-4F23-9965-2940D12A672E.html

Official Guide Configuration Notes for Port Mirroring and Monitoring:

https://docs.commscope.com/bundle/fastiron-10010-monitoringguide/page/GUID-8CDDEB0F-08D9-41A9-9681-B3C05D315BD7.html

Monitoring an Individual LAG Port:

https://docs.commscope.com/bundle/fastiron-08095-monitoringguide/page/GUID-35140D88-386B-438B-A700-59AFDE2297B7.html

Best Regards 

Fernando Vasquez 

Command “aaa authentication login privilege-mode” was removed in 9010 and 10.0.00 versions.

This command was missing in certain 9010 and 10.0.0 versions. Below is the example the output looked like.

ICX7850-48FS Router(config)#aaa authentication login

  default   The default authentication list

In the above output it is noticed that privilege mode option is missing.

Solution:

This command was added back in version 9010h and below is a example from lab output where 7650 switch is running on 9010h version

ICX7650_test(config)#aaa authentication login

  default          The default authentication list

  privilege-mode   Take user to privilege mode after successful authentication

ICX7650_test(config)#aaa authentication login privilege-mode 

For 8200 switches this command was added back in version 10.0.10b and above and below is an example

ICX8200_test(config)#aaa authentication login

  default          The default authentication list

  privilege-mode   Take user to privilege mode after successful authentication

If you are looking to enable privilege mode on the switch and switches are on 9010 and 10.0.00 versions then they would need a upgrade to 9010h and above or 10.0.10b and above.

Run “show ip ssh config” to view all SSH details.

Device#show ip ssh config

SSH server                 : Enabled

SSH port                   : tcp\22

Host Key                   : RSA 2048

Encryption                 : aes256-cbc, aes192-cbc, aes128-cbc, aes256-ctr, aes192-ctr, aes128-ctr, 3des-cbc

Permit empty password      : No

Authentication methods     : Password, Public-key, Interactive

Authentication retries     : 3

Login timeout (seconds)    : 120

Idle timeout (minutes)     : 5

SCP                        : Enabled

SSH IPv4 clients           : All

SSH IPv6 clients           : All

SSH IPv4 access-group      :

SSH IPv6 access-group      :

SSH Client Keys            :

Client Rekey               : 0 Minute, 0 KB

Server Rekey               : 0 Minute, 0 KB

To disable weak SSH cipher:

The diffie-hellman-group1-sha1 key exchange method is a weaker algorithm and can be disabled using the “no ip ssh key-exchange-method dh-group1-sha1” command.

Command:

• Device(config)#no ip ssh key-exchange-method dh-group1-sha1

To disable CBC encryption mode:

Command:

• Device(config)# ip ssh encryption disable-aes-cbc

Output after disabling CBC encryption mode:

ICX7150-24F Switch(config)#show ip ssh config

SSH server                 : Enabled

SSH port                   : tcp\22

Host Key                   : RSA 2048

Encryption                 : aes256-ctr, aes192-ctr, aes128-ctr

Permit empty password      : No

Authentication methods     : Password, Public-key, Interactive

Authentication retries     : 3

Login timeout (seconds)    : 120

Idle timeout (minutes)     : 5

SCP                        : Enabled

SSH IPv4 clients           : All

SSH IPv6 clients           : All

SSH IPv4 access-group      :

SSH IPv6 access-group      :

SSH Client Keys            :

Client Rekey               : 0 Minute, 0 KB

Server Rekey               : 0 Minute, 0 KB

Reference links below:

Enabling SSH

• https://docs.commscope.com/bundle/fastiron-09010-securityguide/page/GUID-8AAB14D8-A662-493A-8504-F7457B9BED02_1.html

Viewing SSH

• https://docs.commscope.com/bundle/fastiron-09010-securityguide/page/GUID-CA1D6AD1-861E-49B3-8CC3-2C14BBA51136.html

Disabling telnet Access

• https://docs.commscope.com/bundle/fastiron-08030-securityguide/page/GUID-0352E51C-3BF4-4F44-9853-466821A8E83E.html

Disable CBC

• https://docs.commscope.com/bundle/fastiron-08030-adminguide/page/GUID-FFF3988D-6510-4D9E-B134-D484DB6BFE7C.html

Disable weak SSH cipher:

• https://docs.commscope.com/bundle/fastiron-08090-securityguide/page/GUID-E6D5CCBB-B8BA-4818-B589-8FA464F2D4B6.html

This Article explains about how to setup QinQ in ICX switches. QinQ setup in used in networks like service provider, ISP’s etc. to help mange the network easily and provide more sublets independent of each other.

Question:

How to configure QinQ using tag profile in ICX switches

Customer Environment:

Customer environment would be mostly a service provider network.

Topology:

Note:

• Service provider switch model is 7550-24 port model.
• Client switch model is a 7150-24 port model.
• Firmware version running is SPR8095m.

Configuration:

Client switch 1 Configuration:

!
vlan 100 by port
tagged ethe 1/1/2
router-interface ve 100
spanning-tree 802-1w
!

!
interface ve 100
ip address 100.0.0.2 255.255.255.0
!

Client switch 2 Configuration:

!
vlan 100 by port
tagged ethe 1/1/1
router-interface ve 100
spanning-tree 802-1w
spanning-tree 802-1w priority 1
!

!
interface ve 100
ip address 100.0.0.1 255.255.255.0
!

Service provider switch 1 Configuration:

!
vlan 1000 by port
tagged ethe 1/1/3
untagged ethe 1/1/2
!
tag-profile 9100
!
!
interface ethernet 1/1/2
tag-profile enable
l2protocol dot1q-tunnel stp
l2protocol dot1q-tunnel lacp
l2protocol dot1q-tunnel cdp
l2protocol dot1q-tunnel lldp
!

Service provider switch 2 Configuration:

vlan 1000 by port
tagged ethe 1/1/3
untagged ethe 1/1/1
!
tag-profile 9100
!
interface ethernet 1/1/1
tag-profile enable
l2protocol dot1q-tunnel stp
l2protocol dot1q-tunnel lacp
l2protocol dot1q-tunnel cdp
l2protocol dot1q-tunnel lldp
!

Outputs:

Client Switch 1:

LLDP details:

client_sw1#show lldp ne
Lcl Port Chassis ID Port ID Port Description System Name
1/1/2 28b3.713f.bcec 28b3.713f.bced 2.5GigabitEthernet1/1/2 service_sw1
1/1/2 609c.9ffe.44d0 609c.9ffe.44d0 2.5GigabitEthernet1/1/1 client_sw2
client_sw1#

Ping details:
client_sw1#show ip int
Interface IP-Address OK? Method Status Protocol VRF
Eth mgmt1 10.176.193.210 YES manual up up default-vrf
Ve 100 100.0.0.2 YES manual up up default-vrf
client_sw1#

client_sw1#ping 100.0.0.1
Sending 1, 16-byte ICMP Echo to 100.0.0.1, timeout 5000 msec, TTL 64
Type Control-c to abort
Reply from 100.0.0.1 : bytes=16 time=3ms TTL=64
Success rate is 100 percent (1/1), round-trip min/avg/max=3/3/3 ms.

client_sw1#traceroute 100.0.0.1

Type Control-c to abort
Tracing the route to IP node 100.0.0.1(100.0.0.1) from 1 to 30 hops

1 1 ms 1 ms 5 ms 100.0.0.1

STP details:
client_sw1#show 802-1w

IEEE 802-1w is not configured on port-vlan 1

--- VLAN 100 [ STP Instance owned by VLAN 100 ] ----------------------------

Bridge IEEE 802.1W Parameters:

Bridge Bridge Bridge Bridge Force tx
Identifier MaxAge Hello FwdDly Version Hold
hex sec sec sec cnt
8000609c9fe853c0 20 2 15 Default 3

RootBridge RootPath DesignatedBri- Root Max Fwd Hel
Identifier Cost dge Identifier Port Age Dly lo
hex hex sec sec sec
0001609c9ffe44d0 20000 0001609c9ffe44d0 1/1/2 20 15 2

Port IEEE 802.1W Parameters:

<--- Config Params --><-------------- Current state ----------------->
Port Pri PortPath P2P Edge Role State Designa- Designated
Num Cost Mac Port ted cost bridge
1/1/2 128 20000 F F ROOT FORWARDING 0 0001609c9ffe44d0
client_sw1#

Client switch 2:
LLDP details:
client_sw2#show lldp ne
Lcl Port Chassis ID Port ID Port Description System Name
1/1/1 28b3.7129.9a4e 28b3.7129.9a4e GigabitEthernet1/1/1 service_sw2
1/1/1 609c.9fe8.53c0 609c.9fe8.53c1 GigabitEthernet1/1/2 client_sw1
client_sw2#

Ping details:
client_sw2#show ip int
Interface IP-Address OK? Method Status Protocol VRF
Eth mgmt1 10.176.194.211 YES NVRAM up up default-vrf
Ve 100 100.0.0.1 YES manual up up default-vrf
client_sw2#

client_sw2#ping 100.0.0.2
Sending 1, 16-byte ICMP Echo to 100.0.0.2, timeout 5000 msec, TTL 64
Type Control-c to abort
Reply from 100.0.0.2 : bytes=16 time=1ms TTL=64
Success rate is 100 percent (1/1), round-trip min/avg/max=1/1/1 ms.

client_sw2#traceroute 100.0.0.2

Type Control-c to abort
Tracing the route to IP node 100.0.0.2(100.0.0.2) from 1 to 30 hops

1 1 ms 1 ms 1 ms 100.0.0.2
client_sw2#

STP details:
client_sw2#show 802-1w

IEEE 802-1w is not configured on port-vlan 1

--- VLAN 100 [ STP Instance owned by VLAN 100 ] ----------------------------

Bridge IEEE 802.1W Parameters:

Bridge Bridge Bridge Bridge Force tx
Identifier MaxAge Hello FwdDly Version Hold
hex sec sec sec cnt
0001609c9ffe44d0 20 2 15 Default 3

RootBridge RootPath DesignatedBri- Root Max Fwd Hel
Identifier Cost dge Identifier Port Age Dly lo
hex hex sec sec sec
0001609c9ffe44d0 0 0001609c9ffe44d0 Root 20 15 2

Port IEEE 802.1W Parameters:

<--- Config Params --><-------------- Current state ----------------->
Port Pri PortPath P2P Edge Role State Designa- Designated
Num Cost Mac Port ted cost bridge
1/1/1 128 20000 F F DESIGNATED FORWARDING 0 0001609c9ffe44d0
client_sw2#

This Article explains about how to setup SNMPv2 and SNMPv3 Traps in ICX switches. SNMP traps are used to trace Issues related to switches using monitoring tools. This article will help with configuration and tracing SNMP traps using captures.

Question:

How to configure and troubleshooting SNMPv2 and SNMPv3 Traps in ICX switches

Customer Environment:

Monitoring tools would be used to capture SNMPv2 and SNMPv3 traps. These monitoring tool could be for example SolarWinds , PRTG etc.

SNMPv2 Configuration:

This configuration applies on all versions for a ICX switches.

Configuration:

snmp-server community public rw
snmp-server host 10.177.89.241 version v2c public

SNMPv2 trap troubleshooting: To troubleshoot and isolate if the polling and trap are working good use the Wireshark to run Packet capture in the uplink of the switch or on port which falls in path of traffic that helps lead the traffic to monitoring tool.

SNMPv2 request from SNMP tool:

SNMPv2 response from Switch:

SNMPv2 Trap Response from the switch:

Here port 1/1/23 is disabled and enabled to generate SNMPv2 trap:

Port disabled:

Port Enabled:

SNMPv3 Configuration:

This configuration applies on all versions for a ICX switches.

Configuration:

snmp-server enable ethernet 1/1/7
snmp-server host 10.177.89.241 version v3 auth test
snmp-server group admin v3 auth notify all read all write all
snmp-server user test admin v3 auth md5 testmd5123 priv des testdes123

SNMPv3 trap troubleshooting: To troubleshoot and isolate if the polling and trap are working good use the Wireshark to run Packet capture in the uplink of the switch or on port which falls in path of traffic that helps lead the traffic to monitoring tool.

SNMPv3 request from SNMP tool:

SNMPv3 response from Switch:

SNMPv3 Trap Response from the switch:

Here port 1/1/11 is disabled and enabled to generate SNMPv2 trap:

Port disabled:

Port Enabled:

How to Decrypt SNMPv3 packets in Wireshark

SNMPv3 Configuration used:

snmp-server enable ethernet 1/1/7
snmp-server host 10.177.89.241 version v3 auth test
snmp-server group admin v3 auth notify all read all write all
snmp-server user test admin v3 auth md5 testmd5123 priv des testdes123

When the SNMP packets are not decrypted it would look like below

Steps:

• Go to Edit > Preferences > Protocols.

• In protocols go to “SNMP” -> Edit “User Table”

• Click on “+” and add SNMPv3 details like Username, Authentication and privacy method and password

Once the details are added the decoded SNMPv3 traps would look like below picture in Wireshark

1. Create the Workflow on Cloudpath and add the required Plug-Ins except the SAML authentication plug-in. We will add this plug-in after the configuration on PingIdentity (IdP) side and will publish it.

2. Copy the Workflow URL (Enrollment portal URL) from Advanced tab and keep it handy for use in later steps.

3. Go to PingIdentity Portal. Select Applications > Click on + sign to create a new SAML application for Cloudpath.

4. Enter the name of the Application, add description and choose SAML as the Application type and hit Save button.

5. At this point, it will give us three options for SAML Configuration. Use "Manually Enter" option to enter the ACS URL and the Entity ID of the Service Provider (SP) which in our case is the Cloudpath server. ACS URL and SP Entity Id configuration is given in the next step.

6. In the ACS URL option, paste the Workflow URL we copied in Step 2 and append it with /samlAssertionConsumer as shown in the following screenshot :-

6. In the Entity Id option, enter the Cloudpath URL followed by /sp as shown in the screenshot below and hit Save.

7. Next, Go to the Configuration tab of the SAML app and download the metadata. This will be used in Configuring the SAML based plug-in on Cloudpath Workflow.

8. Now go to Cloudpath and edit the Workflow you created and add a plug-in “Authenticate to a Traditional authentication server” and choose SAML.

9. Choose the IdP metadata type as XML and copy the metadata into the IdP metadata XML option.

10. Next comes the IdP Entity-Id. For this, go back to PingIdentity, under the Configuration tab where we had downloaded the metadata, we can see the “Issuer Id”. This is our IdP Entity-Id that needs to be entered in the Cloudpath IdP Entity-Id option :-

11. In the SP Entity ID option, enter the same URL as in Step 6.

12. Scroll down to SAML options and select "Exact" in the AuthN Context Comparison. This may change based on your requirement.

13. Leave all other settings as default unless you want to customize the configuration based on your requirement and publish the Workflow and test it. Following is a screenshot of the Enrollment details tab showing user successfully completed the SAML authentication of the workflow :- 

Regards,

How can we check this?  The data sheet of the device(s) !.
Let’s consider, RUCKUS ICX 7150-48P Switch, which has the following hardware specifications: 

• 48× 10/100/1000 Mbps RJ-45 PoE+ ports  
• 370 W PoE budget  
• 2× 10/100/1000 Mbps uplink RJ-45 ports  
• 4× 1/10 GbE uplink/stacking SFP/SFP+ ports 

 Which shows that,  It has a PoE budget of 370 W and there are 48 ports that can support PoE+ or 802.3at.

For more reading, refer : https://www.commscope.com/globalassets/digizuite/61729-ds-icx-7150.pdf 
Note that in this example we have considered 7150, but for other models such as 8200, 7550, etc. Please refer to the data sheets for the respective switch families.

Number of devices it can deliver PoE to.  

This relates to the PoE budget of the device and the type of Powered Devices (PDs) used. Nowadays, PDs typically come with PoE+ capabilities, although there are still some that support only PoE. The crucial factor is understanding the PD's capability to determine how many of them the switch can accommodate or power up. For instance, consider an Access Point (AP) rated for PoE+. When negotiating for PoE, the device communicates with the switch through the LLDP TLV field, specifying its class and power requirements. Based on this class, the switch allocates power accordingly.

The above reference is as per IEEE Documentation for PoE standards 802.3at and 802.3bt.  
Based on this, considering that the PD is PoE+ capable, on RUCKUS ICX 7150-48P that has 370 W PoE budget. 
We can calculate the below:  
PSE's budget = 370W 
PD's PoE Class = PoE+ that reserves max. of 30W at PSE  
Number of devices = PSE's PoE budget / PoE Class of the device = 370 / 30 = 12.3333 
It can power up to 12 PDs at PoE+ power level. Any additional PDs would not activate due to insufficient remaining power in the budget.

Now the question arises, why not define the power limit manually?  
    Strict manipulation can indeed bring up more PDs, but it carries a risk. After all PDs are operational and receiving optimal power, reallocating power back to the budget pool is possible. However, if a reload or power cycle of the Power Sourcing Equipment (PSE) occurs unexpectedly, PDs may encounter power-up issues. During the initial power-up or startup phase, the PSE delivers full power to the PDs. Consequently, some connected PDs may experience power shortages and struggle to come online.

Can it be done? And how?  
To configure the power limit manually on a interface based on power limit.  
Please do refer.  
https://docs.commscope.com/bundle/fastiron-08095-managementguide/page/GUID-58622E67-07D7-41E4-B4C6-A9B6F3EA8C74.html 
To configure the power limit manually on a interface based on class of the PD. 
Please do refer. 
https://docs.commscope.com/bundle/fastiron-08095-managementguide/page/GUID-155FABD5-F3C2-4579-ADBB-CC240997524A.html 

How does Ruckus address this?
Ruckus offers two well-known ways for Power Management methods for ICX line that are PoE capable.
Static Power Management:
Power is set aside for each powered device (PD) connected to switch ports when in static PM. This approach adheres to the previously discussed procedure, wherein the maximum power is set aside according to the linked power device's class. If the power reservation is not possible, even when the overall usage is less than the entire power budget, no new PDs will be powered. 
The ICX devices are configured or made available in this mode for PoE management Out of the Box. 

To overcome this, we have Dynamic Power management.  
Dynamic Power Management: 
Where this helps via having the power allocation done based on the consumption of the PD that’s connected.  Here power is not set aside for any ports in dynamic PM. Until the overall power consumption is within the ICX device's total power budget, PDs are turned on automatically.  
However here the switch will immediately shut down any PDs with low priority ports or, if all ports have the same priority, shut down PDs attached to higher-numbered ports in order to keep the total power consumption within the total power budget if the power consumption increases, either by increasing the power consumption of connected PDs or by adding new PDs. 

How to go about setting this?  
Do refer here:  https://community.ruckuswireless.com/t5/RUCKUS-Self-Help/How-to-enable-Dynamic-PoE-power-on-the-ICX-switches/m-p/68751 

There however is a third way, that is Hybrid Power Management. 
This is a mix of the above 2 methods and can be achieved by configuring static PM for a few of the ports and dynamic PM for a few of the ports. The way this works to differentiate between the two methods is based on the priority that is set for the specific interfaces, priority of 1 dictate that it uses static PM, as priority of 2 or higher dictates it uses dynamin PM. This priority can be set per interface or globally as well.  

Under this method, after enabling dynamic poe, below settings are needed enable Hybrid PM,
(1) to enable Static PM, use "inline power ethernet unit/slot/port priority 1" on those specific ports. 
Example: in config mode,  
Inline power ethernet 1/1/1 priority 1 
(2) to enable Dynamic PM, use a priority of 2 or 3 instead of 1 on those specific ports. 
Example: in config mode,  
inline power ethernet 1/1/4 priority 2 

Apart from this, there is also Perpetual PoE and Fast Boot PoE.
Perpetual PoE, where PoE power delivery to the equipment is uninterrupted, when the device is rebooting or reloading.  
Fast Boot PoE, where the PoE is delivered as soon as the switch is turned on, where the PD would not have to wait until the system is up.  
To enable this, Use “inline power poe-ha” in interface configuration prompt.  

For Further reading on PoE features on the ICX line-up, Click here,  

Abbreviations used:
PD - Power Device. 
PSE - Power Source Equipment also known as Endspan device. 
PoE - Power over ethernet. 
PoE Injector is also known as Midspan device. 

ICX7750-26Q Router# show stack

T=1d17h49m48.5: alone: standalone, 😧 dynamic cfg, S: static

ID      Type                   Role             Mac Address            Pri     State       Comment

1 S ICX7750-26QXG active      cc4e.2438.7280            128     local         Ready

2 S ICX7750-26QXG member   748e.f8f9.6300           128     remote       Ready

3 S ICX7750-26QXG member   0000.0000.0000           0        reserve

4 D ICX7750-48XGF member   609c.9f7f.9400            128     remote      Ready

Reasons:

-If unit stuck in boot loop.    

-If there is a physical layer issue such as stacking cable, stacking module.

-If unit is faulty or hardware issue.

Recovery Steps:

If unit stuck in boot loop.

-Try software recovery by taking console access for this unit.

https://docs.commscope.com/bundle/fastiron-08095-upgradeguide/page/GUID-9B5D5A56-039D-44FB-8FD2-B9B55E71ADE8.html

-Try power cycling the switch after removing it from the stack.

-Check if it’s related to any known defect.

-Try factory resetting the switch.

-Try below steps by removing switch from the stack taking console access.

>>Enter switch boot mode
>>Give command: use default-configuration
>>Reload the switch.

If there is a physical layer issue such as stacking cable, stacking module.

-Try changing the stacking cables and stacking ports.

If unit is faulty or hardware issue

-Switch not powering on try checking the power cable and power source.

-Replace the switch with the same model if switch fails to power on.

For devices running FastIron release 09.0.10a to 09.0.10h, attempting to establish an SSH connection with a device running FastIron release 08.0.95 or earlier can lead to a mismatch in algorithms, preventing the SSH connection from being established. This problem occurs during the negotiation phase, where the server offers key exchange and host key algorithms that are not compatible with the default settings of the device running FastIron release 09.0.10a to 09.0.10h.

For devices running FastIron release 09.0.10j and later, RUCKUS recommends configuring specific key exchange and host key algorithms on the devices to resolve this issue and enable SSH communication. Please follow the procedure below to enable SSH communication with devices running FastIron release 08.0.95 or earlier:

device# configure terminal
device(config)# ip ssh key-exchange-method
ASCII string Enter algorithms separated by a space:
             diffie-hellman-group-exchange-sha256
             diffie-hellman-group14-sha256
             diffie-hellman-group16-sha512
             diffie-hellman-group18-sha512
             curve25519-sha256@libssh.org
             diffie-hellman-group14-sha1
             ecdh-sha2-nistp256
             ecdh-sha2-nistp384
             ecdh-sha2-nistp521
             curve25519-sha256
device(config)# ip ssh key-exchange-method diffie-hellman-group14-sha1
device(config)# ip ssh host
   host-key-method                 SSH host key method
device(config)# ip ssh host-key-method
ASCII string Enter algorithms separated by a space:
             ecdsa-sha2-nistp256
             ecdsa-sha2-nistp384
             rsa-sha2-512
             rsa-sha2-256
             ssh-rsa
device(config)# ip ssh host-key-method ssh-rsa

1. You must access the switch via console.
2. Press Ctrl + Y.
3. Enter "reset_login"
4. Exit the console.
5. Try logging in using the default credentials: username "super" and password "sp-admin."

OS> reset_login
This is a temporary login. Please reconfigure users once you login.
OS> exit

Trying to access ICX 7150 switch model through Web UI but getting an error “Server error. Will be fixed in few minutes”.

Tried different browsers such as Edge, Chrome, Firefox, but same issue.

Switch is up in Cloud Ruckus one and running version 9.0.10h_cd2.

Found Web-management is getting disabled automatically and it needs to be enabled by using below command but after few days it again gets disabled.

#No web-management disable

Solution:

There is a behavior change with the 9010h version onwards such as web-management disable get pushed from the Cloud (Ruckus one) or SmartZone when switches connect to it.

Link (Refer page no.11)
https://support.ruckuswireless.com/documents/4607

For workaround, Refer the below link.

Link (Refer page no. 253

https://support.ruckuswireless.com/documents/4031-fastiron-09-0-10-ga-management-configuration-guide

Note: Adding to above we can also manage the switch from R1, using remote cli if needed.

Issue noticed:

When the user chooses to downgrade from 9010 version and above to 8095 versions in ICX switches, they will notice that the “ve” commands and layer 3 related configurations within the “ve” are wiped out.

Lab output:

If the switch running 9010 version have the below configuration:

!

interface ve 1

 ip address 1.1.1.1 255.255.255.0

 no spanning-tree

!

interface ve 3

 ip address 2.2.2.1 255.255.255.0

 no spanning-tree

!

interface ve 5

 ip address 3.3.3.1 255.255.255.0

 no spanning-tree

!

When the customer would downgrade from 9010 and above to 8095 versions the configuration would be removed and any configurations included within the ve’s would also be removed.

Reason:

This is an expected behavior. The reason why this is noticed is because on 8095 versions, if we would have to configure “ve ” interface we use command “router-interface ve “ve ID””

Example:

device(config)# vlan 2

device(config-vlan-2)# untag ethernet 1 to 4

device(config-vlan-2)# router-interface ve 2

device(config-vlan-2)# interface ve 2

But from 9010 and above versions the “router-interface ve “ve ID”” command is deprecated and when a “vlan” is created a “ve” with same ID as vlan is also created.

Example:

device(config)# vlan 2

device(config-vlan-2)# interface ve 2

Due to the above changes when you upgrade from 8095 version to 9010 version or above you would not see a problem but when you downgrade from 9010 version and above to 8095 you will notice that since the command “router-interface ve “ve ID”” is not appended to the running configuration the “ve” interface would be completely deleted.

It is recommended to save the configuration as a backup when downgraded from 9010 and above to 8095 and have sufficient downtime to revert back the configurations.

SYSLOG: <14> Mar 17 15:10:57 Security: SSH login by super from src IP 10.177.95.153 from src MAC 50a7.3360.5054 to USER EXEC mode using RSA as Server Host Key.

SYSLOG: <14> Mar 17 15:10:57 scp -t flash:sec:SWR08095m.bin

 !!! Downloading this application image can result in application-boot image mismatch. Please use UFI image.

The code type 33 is not correct for the target hardware, abort!

It is noticed when a user is trying to upgrade the switch to a code from a destination which is a switch.

The user would try to upgrade the firmware using SCP method from switch to switch.

Reason the error message is noticed:

If the user is trying to upgrade from a switch model which is not the same switch model as the one user is trying to upgrade, the error would be noticed.

For example, if the user tries to upgrade 7150 secondary version from a destination switch which is a 7750 or other models then the error would be noticed.

The error also remains the same if the user is using incorrect firmware file which is for a different model switch.

Below is the scenario considered as an example:

Consider the customer is trying to upgrade 7150 switches from 7750 or using an incorrect firmware code of a different switch model.

ICX7150-48ZP Switch#copy flash scp 10.177.95.155 flash:sec:SWR08095m.bin secondary

User name:super

Password:

In 7750 switch you would see a below message:

ICX7750-48F Router#

SYSLOG: <14> Mar 17 15:10:57 Security: SSH login by super from src IP 10.177.95.153 from src MAC 50a7.3360.5054 to USER EXEC mode using RSA as Server Host Key.

SYSLOG: <14> Mar 17 15:10:57 scp -t flash:sec:SWR08095m.bin

 !!! Downloading this application image can result in application-boot image mismatch. Please use UFI image.

The code type 33 is not correct for the target hardware, abort!

SYSLOG: <14> Mar 17 15:10:57 Security: SSH logout by super from src IP 10.177.95.153 from src MAC 50a7.3360.5054 from USER EXEC mode using RSA as Server Host Key.

And in 7150 switch you would see the below message:

ICX7150-48ZP Switch#copy flash scp 10.177.95.155 flash:sec:SWR08095m.bin secondary

User name:super

Password:

Connecting to remote host......

Sending data (8192 bytes per dot)

Outbound Connection Closed

Solution:

The customer would need to validate the switch model he is trying to upgrade. User also must validate from which switch model he is trying to upgrade the firmware from.

It is important to check the code is specific to which model of the switch.

It is not recommended to copy firmware from one switch to another even if they are same model as below are few factors that will cause an issue when you are trying to upgrade the firmware from switch to switch.

• There could be mismatch of SSH Server host keys.
• You would notice a challenge with key exchange method if the same key exchange method is not supported on the switches.
• You could encounter “channel 0” issue which is noticed when the SSH port used is incorrect.

The customer can choose to upgrade the switch using TFTP method or USB method upgrade mentioned in the below links.

TFTP upgrade method link:

• https://community.ruckuswireless.com/t5/RUCKUS-Support-for-Lennar-Homes/How-to-Upgrade-a-Switch-ICX-7150-C12P-via-TFTP/td-p/47187

USB upgrade method link:

• https://community.ruckuswireless.com/t5/RUCKUS-Support-for-Lennar-Homes/How-to-Upgrade-a-Switch-ICX-7150-C12P-using-a-USB-flash-drive/td-p/46781

When we chose to replace or upgrade the network devices it is also very important to erase the sensitive data from being decoded by a 3rd party.

Secure wipe is one such feature which is introduced from 9010 and above versions which helps you wipe flash memory related contents permanently.

It only erases flash memory and does not erase EEPROM.

During this process except TPM keys, all the files, configurations, licenses, and other keys would be lost.

Difference between factory defaulting and secure wipe procedure used for the ICX switches:

When a switch is factory defaulted, it will restore the switch to its original default settings but does not completely erase the data.

When we factory default the switch, the data can still be recovered if a specialized software is being used by the 3rd party.

Secure wipe is a method were all the data is thoroughly wiped out from the flash memory of the switch.

This process would take about 30 to 40 min to completely wipe out the data from the switch.

Below is how you can wipe the data from the switches completely:

Device#securewipe 7pass

**************************************************************

*               SECUREWIPE Alert                             *

**************************************************************

* Please pay attention to the details listed below           *

* 1. U-Boot params will be erased                            *

* 2. All flash partitions will be erased and loose all files *

* 3. FIPS will be disabled and related keys will be erased   *

* 4. License and config files will be erased                 *

* 5. Only FI image, U-Boot and TPM keys will be restored.    *

* 6. All warm memory contents will be erased                 *

* 7. Device may fail to boot and/or fail to connect cloud if *

*    power cycled or power down during secure wipe process   *

* 8. Performing secure wipe frequently may reduce the flash  *

*    life cycle                                              *

**************************************************************

**************************************************************

* I have read the alert and SECUREWIPE can be performed now. *

* Please enter 'y' to confirm, 'n' to exit :                 *

**************************************************************

(enter 'y' or 'n'): y

Device boot source is :1

Current booted partition: Primary, UFI used for secure wipe: Primary

Prerequisite check success,securewipe is processing....

 ********************************************

 PLEASE WAIT SYSTEM WILL GO FOR RESTART....

 ********************************************

Process that would occur when you run “securewipe 7pass” command.

Secondary flash partition process may take 10 to 15 min.

Checking for secure wipe feature enable status...

******************************************************************

* 7-Pass Secure Wipe enabled, secure erase will be performed now *

* This may take some time, do NOT power down/cycle the device    *

* Device will be rebooted automatically after secure erase       *

* Interrupting secure wipe process may cause device to fail boot *

******************************************************************

proccessing securewipe for 7 pass

1+0 records in

1+0 records out

#############################

#       SESSION START       #

#############################

Uboot manager: Requested for command type 0

Platform type: (ICX8150) RODAN

set_uboot_partition:264 CMD: i2cset -y -f 0 0x33 0xe 0x2 1>/dev/null 2>&1

Secondary partition setting success

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

#############################

#       SESSION START       #

#############################

Primary flash partition process may take 10 to 15 min.

#############################

#       SESSION START       #

#############################

Uboot manager: Requested for command type 0

Platform type: (ICX8150) RODAN

set_uboot_partition:264 CMD: i2cset -y -f 0 0x33 0xe 0x1 1>/dev/null 2>&1

Primary partition setting success

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

#############################

#       SESSION START       #

#############################

Boot partition process may take 10 to 15 min.

Allocating group tables: done

Writing inode tables: done

Creating journal (4096 blocks): done

Writing superblocks and filesystem accounting information: done

securewipe started for fastiron  partition

mke2fs 1.43.4 (31-Jan-2017)

Discarding device blocks: done

Creating filesystem with 655360 4k blocks and 164160 inodes

Filesystem UUID: 2408ba58-7247-4cf0-ab4d-9e929399849a

Superblock backups stored on blocks:

        32768, 98304, 163840, 229376, 294912

Allocating group tables: done

Writing inode tables: done

Creating journal (16384 blocks): done

Writing superblocks and filesystem accounting information: done

securewipe started for boot partition

mke2fs 1.43.4 (31-Jan-2017)

Discarding device blocks: done

Creating filesystem with 131072 4k blocks and 32768 inodes

Filesystem UUID: b3a7ad8e-7514-47c3-8403-f51d8a280153

Superblock backups stored on blocks:

        32768, 98304

Allocating group tables: done

Writing inode tables: done

Creating journal (4096 blocks): done

Writing superblocks and filesystem accounting information: done

securewipe started for warm memory

securewipe done for warm memory

securewipe 7 pass completed

EEPROM Write Protect disable success

EEPROM Write success

EEPROM Write Protect enable success

INIT: Sending processes the TERM signal

Prerequisites:

• 802.1x SSID with Cloudpath as AAA with default ‘Radius options’
• Cloudpath 5.7 and above
• Vsz/sz 5.0 and above
• Segregate the locations using WLAN/AP group.

In SmartZone controller:

Go to > WLAN > Group 1 > Edit > Select WLANs > Toggle ‘NAS-ID’ to ‘User Defined’ then mention ‘Group1’  (Required attribute value)

In Cloudpath:

Step 1: Go to >  Configuration > Policies > RADIUS Attribute Groups > Add RADIUS Attribute Group > Under ‘VLAN ID’ mention desired VLAN

Step 2: : Go to >  Configuration > Policies > Policies > Add Policy > NAS Identifier (regex): ‘Group1’ (Mention the ‘User Defined’ value set as ‘NAS-ID’ in Vsz WLAN group)

Step 3a: If Certificate based Authentication

Go to > Certificate Authority > Manage Templates >  Certificate Template > Manage > Radius Policies > +Assign Policy ‘Group1’

Step 3b: If eDPSK based Authentication

Go to > Configuration > DPSK Pools > Manage > Radius Policies > +Assign Policy ‘Group1

Where the highlight shows the firmware they are currently on,.

Now to update the firmware:
First, to set the version :
Hence
Administration [ bottom left corner ] >> version management >>>

Here go to , Switch firmware and select the venue >> and click on Change Update Schedule:

Once there the below dialog-box will appear:

Where we select the code that’s needed.

And generally the code available on the cloud is the recommended releases for the cloud connected devices or devices that would be connected to the cloud.

Here in this example : the devices are already on the recommended release : 10.0.10c_cd1

However for one of them : we'll be selecting 9010j_cd1 and setting the date and time for the activity as well

Here once the version is selected and saved,:

Once done, click on save,

Below will be displayed :

That’s for scheduling the code update,

In an event, there needs to be an immediate update done : update now is the option you need :

once the version are selected : click on run update : that will initiate the file transfer to the switches and get the update done.

Do note :

• This option is only applicable if the ICX switches are connected to the cloud.
• During this activity as usual  downtime is needed as the switches will reload for the firmware to be applied.
• Also this process/procedure applied to specific venue and all switches under the venue will get the update : hence do consider the below points

  if you are an MSP :

  1. Make sure that the switches that are to be updated are of the specific venue.

  2 . If there are multiple locations managed under the same venue  and only a specific location needs to be updated : then this may not be the best option to follow.

  3 . In case, point 2 applied to you : then device local updates are best way to go about the upgradation. Via TFTP,USB etc.

  if you are not an MSP, and there are multiple locations of install : but all are devices are under the same venue.
  Then device local updates are best way to go about the upgradation. Via TFTP,USB etc.

  If different locations are managed under different venues, there should be no issues in following this process/procedure.

ICX7850-48F Router(config)#interface eth 1/1/1

ICX7850-48F Router(config-if-e25000-1/1/1)#speed-duplex 10g-full

This speed is not allowed on port 1/1/1 due to quad portgroup speed restriction(portgroup: 1/1/1 to 1/1/4)

ICX7850-48F Router(config-if-e25000-1/1/1)#

ICX7850-48F Router(config-if-e25000-1/1/1)#end

Applicable ICX switch model:

• 7850-48F

If the switches are running version 8095 and below, then the below details will help you configure the quad port setting:

If the switches are running version 8095 and below, then there is a workaround which will help you set individual ports to 10g or 1g.

Example:

In this case switch is running 8095m version

ICX7850-48F Router(config)#int e 1/1/9 to 1/1/12

ICX7850-48F Router(config-mif-1/1/9-1/1/12)#speed-duplex 10g-full

ICX7850-48F Router(config-mif-1/1/9-1/1/12)#exit

ICX7850-48F Router(config)#int e 1/1/9

ICX7850-48F Router(config-if-e25000-1/1/9)#speed-duplex 1000-full

ICX7850-48F Router(config-if-e25000-1/1/9)#exit

From running configuration 8095m

!

interface ethernet 1/1/9

 speed-duplex 1000-full

!

interface ethernet 1/1/10

 speed-duplex 10G-full

!

interface ethernet 1/1/11

 speed-duplex 10G-full

!

interface ethernet 1/1/12

 speed-duplex 10G-full

Port speed for port groups, cannot be changed individually. If required, the speed must be changed to all ports in the same quad-group and then we would be able to change speed to 1g on individual ports. This was a workaround in versions 8095 and below.

If the switches are running version 9010 and above versions, then the below details will help you configure the quad port setting:

If the switches are running version 9010 and above, then there is no workaround which will help change speed on interfaces. It is only considering four ports in group to be set to same speed.

Example:

In this case switch is running 10.0.10b version

ICX7850-48F Router(config)#int e 1/1/10

ICX7850-48F Router(config-if-e25000-1/1/10)#speed-duplex 1000-full

This speed is not allowed on port 1/1/10 due to quad portgroup speed restriction(portgroup: 1/1/9 to 1/1/12)

From versions 9010 and above in 7850-48F model speed settings is a design change to maintain consistency to the port group.

Details from documents:

Management guide for 8095 version:

Link: https://docs.commscope.com/bundle/fastiron-08095-managementguide/page/GUID-EDD7D44C-A627-4B76-A9FE-D7657FFF62D3.html

Management guide for 9010 version:

Link: https://docs.commscope.com/bundle/fastiron-09010-managementguide/page/GUID-EDD7D44C-A627-4B76-A9FE-D7657FFF62D3.html

Customer Environment

APs and Switches deployed behind a firewall and inbound/outbound traffic needs to be allowed for successful communication between RUCKUS network devices and RUCKUS One.

Symptoms

Newly added APs and switches are in Never Contacted Cloud state, not joining RUCKUS One.

Resolution

To allow RUCKUS One to function properly, please configure your firewall to allow for outbound connectivity according to the following guidelines:
 

Outbound HTTPS (TCP 443) from APs and Switches to:

https://ap-registrar.ruckuswireless.com
https://sw-registrar.ruckuswireless.com
https://ocsp.comodoca.com
https://ocsp.entrust.net
https://ruckus.cloud
https://eu.ruckus.cloud
https://asia.ruckus.cloud
https://device.ruckus.cloud
https://device.eu.ruckus.cloud
https://device.asia.ruckus.cloud
https://storage.googleapis.com
http://ocsp.godaddy.com

Outbound SSH (TCP 22) from APs and Switches to:

device.ruckus.cloud
device.eu.ruckus.cloud
device.asia.ruckus.cloud

Network Requirements

The following list of firewall ports is required to allow APs to enable Cloud discovery and continued connection with the Cloud

Checking the firewall ports is the first step of troubleshooting if an AP is unable to connect to the Cloud or disconnects from the Cloud.

https://docs.cloud.ruckuswireless.com/ruckusone/userguide/GUID-D00EA4CC-7B8A-4F99-969B-2A5FB5DDB178-low.png 

If these information helped you in any way, please click on "KUDOs", so you can help other users.

Trying to upgrade or flash the 8200-switch to version RDR10010bufi.bin using the SCP (Secure Copy Protocol)  but getting an error message: "scp: error while loading shared libraries: libpthread.so.0: wrong ELF class: ELFCLASS64.  

Using servers for SCP upgrade on the switches. 

Command used to flash the Switch: "scp RDR10010bufi.bin fdp@x.x.x.x: flash: primary".  

Executing the command from the folder containing the firmware image on the local (Ubuntu) server.

Solution: 

SCP push/pull from server is not allowed anymore. 
SCP must be initiated from FI CLI only. This was a design/security change in 9.x/10. x. 
SCP push/pull is being purposefully blocked in 9.x/10. x. It will not be added back in and was blocked as a security consideration. 

 We can use SCP via CLI with the help of the commands below. 

 copy scp flash x.x.x.x RDR10010bufi.bin primary  

 copy scp flash x.x.x.x RDR10010bufi.bin secondary 

Link: 
https://support.ruckuswireless.com/documents/4298-fastiron-10-0-00-ga-software-upgrade-guide 

1. In firmware 8095k and 8095g below details were noticed
   •  If you use “web-management http” and “web-management https” command to enable http and https
   • Then you execute “no web-management” the state of http and https remains enabled, and the command does not disable the http and https.
   • Here to disable we must use “no web-management http” and “no web-management https” command to disable http and https.
   • If we use “web-management” this enables both http and https
   • But if we use “no web-management http” and “no web-management https” command to disable http and https it does not disable
   • Instead, when we use “no web-management” both http and https is disabled.
2. In firmware 9010f and 1010a below details were noticed
   • In this version instead of “no web-management” and “web-management”, “web-management disable” command is introduced.
   • Here we use “web-management http” and “web-management https” command to enable http and https.
   • And after that if we use “web-management disable” it will not disable both http and https
   • We again must use “no web-management http” and “no web-management https” command to disable http and https.

Lab test and outputs to validate if the issue is same as the scenario mentioned in this article:

Tested in firmware 8095k and 8095g:

Using “Web-management” to enable both http and https and to disable we use “no web-management”

ICX7650-48ZP Switch(config)#show web

HTTP server status: Disabled

HTTPS server status: Disabled

No web connection.

ICX7650-48ZP Switch(config)#web-management

ICX7650-48ZP Switch(config)#show web

HTTP server status: Enabled

HTTPS server status: Enabled

No web connection.

ICX7650-48ZP Switch(config)#no web-management

ICX7650-48ZP Switch(config)#show web

HTTP server status: Disabled

HTTPS server status: Disabled

No web connection.

ICX7650-48ZP Switch(config)#

Now when we use “web-management http” and “web-management https” to enable and using “no web-management” to disable.

ICX7650-48ZP Switch(config)#web-management http

ICX7650-48ZP Switch(config)#web-management https

ICX7650-48ZP Switch(config)#show web

HTTP server status: Enabled

HTTPS server status: Enabled

No web connection.

ICX7650-48ZP Switch(config)#no web-management

ICX7650-48ZP Switch(config)#show web

HTTP server status: Enabled

HTTPS server status: Enabled

No web connection.

ICX7650-48ZP Switch(config)#no web-management http

ICX7650-48ZP Switch(config)#no web-management https

Note: ip ssl client continues to be in enabled mode if enabled

ICX7650-48ZP Switch(config)#show web

HTTP server status: Disabled

HTTPS server status: Disabled

No web connection.

Tested in firmware 9010f and 1010a:

Using “web-management http” and “web-management https” to enable and “web-management disable” to disable http and https

ICX7650-48ZP Switch(config)#show web

HTTP server status: Disabled

HTTPS server status: Disabled

No web connection.

ICX7650-48ZP Switch(config)#web-management http

ICX7650-48ZP Switch(config)#web-management https

ICX7650-48ZP Switch(config)#show web

HTTP server status: Enabled

HTTPS server status: Enabled

No web connection.

ICX7650-48ZP Switch(config)#web-management disable

Error - WebUI already disabled

ICX7650-48ZP Switch(config)#show web

HTTP server status: Enabled

HTTPS server status: Enabled

No web connection.

ICX7650-48ZP Switch(config)#no web-management http

ICX7650-48ZP Switch(config)#no web-management https

ICX7650-48ZP Switch(config)#show web

HTTP server status: Disabled

HTTPS server status: Disabled

No web connection.

We can see notice that in both tests even when “no web-management” in 8095 version and “ web-management disable”  command is used in 9010 version the HTTP and HTTPS connection stays enabled.

Solution:

The above issue is fixed on below versions and logged with defect ID FI-279953

• For 8095 versions its fixed in 8095n
• For 9010 versions fix in process in 9010k
• For 10.0.10 versions fix in process in 10.0.10d

#sh qos-tos

DSCP-->Traffic-Class map: (DSCP = d1d2: 00, 01...63)

  d2   |  0   1   2   3   4   5   6   7   8   9

  d1   |

  -----+----------------------------------------

   0   |  0   0   0   0   0   0   0   0   1   1

   1   |  1   1   1   1   1   1   2   2   2   2

   2   |  2   2   2   2   3   3   3   3   3   3

   3   |  3   3   4   4   4   4   4   4   4   4

   4   |  5   5   5   5   5   5   5   5   6   6

   5   |  6   6   6   6   6   6   7   7   7   7

   6   |  7   7   7   7

Traffic-Class-->802.1p-Priority map (use to derive DSCP--802.1p-Priority):

Traffic | 802.1p

Class   | Priority

--------+---------

   0    |    0

   1    |    1

   2    |    2

   3    |    3

   4    |    4

   5    |    5

   6    |    6

   7    |    7

--------+---------

That 802.1p priority is then in turn mapped to HW buffer-queues: this can be configured as well: however: this is an in-depth config/details: same is not needed in the overview of this discussion.

In case, for further reading on the same: refer: https://support.ruckuswireless.com/documents/4470-fastiron-10-0-10-ga-qos-and-traffic-management-configuration-guide

Quality of Service 10.0.10

This entails all details of how the bits and bytes work behind the scenes on the HW and how that can be configured to a specific preference.

Now back to the above 2 methods:
1 > the Application/Appliance based approach.
2 > the Network Based Approach

For the Application based approach:
Let’s consider the application Zoom: here the system admins have the option to have the Zoom clients installed on the PCs to have the traffic generated, and marked before it's sent out.
And this will mark only the traffic generated by the Zoom application.
Link:
https://support.zoom.us/hc/en-us/articles/207368756-Using-QoS-DSCP-Marking

As this is marked on the network: all that’s needed is on the interfaces to: trust the incoming DSCP marking.
Command to be used on ports:
Router#conf t
Router (config)#int eth 1/1/4
Router (config-if-e1000-1/1/4)#trust dscp

And that should help you achieve the task.

For the Network Based Approach :
Let’s consider the application MS Teams: here the application rules specify: that there are 3 specific traffic it generates: audio, video, and application/screen sharing
Link
https://learn.microsoft.com/en-us/microsoftteams/qos-in-teams

And this traffic flows over the below TCP/UDP ports :

From <https://learn.microsoft.com/en-us/microsoftteams/qos-in-teams>

Hence here comes the challenge: how do we mark it and honor it?

In remote settings, we cannot.
But in a setting of the organization: where all users use the common LAN: this can be done in the below manner.

Suppose the network layout is as below [it is usually more complicated than this ]: where we have the core layer or device where all traffic aggregates/converges be it going out to the internet or coming into the site from the internet.

Courtesy Google Images.

That’s usually the core router or the multilayered switch that’s designated as the core router.

Here, the implementation of a QoS policy for marking needs to be done for the above-mentioned range of TCP/UDP ports to those DSCPs.

Once this is done: on the subsequent downstream devices [ switches ]: the incoming traffic needs to be trusted for dscp for the markings to be honored.

Now what would a QOS policy look like: as we make use of ACL based marking system: we define it as below:

ip access-list extended qos
sequence 1 permit tcp any any eq 50000 dscp-marking 46
sequence 2 permit tcp any any eq 50001 dscp-marking 46
…………
sequence 151 permit udp any any eq 50058 dscp-marking 46
sequence 152 permit udp any any eq 50059 dscp-marking 46

Once the same is defined :
• under Layer 2 vlan that is defined for the users and its Virtual interface (ve) is defined with the IP address for the subnet
• Have the ACL called on the VLAN as an inbound ACL

As below :

Router(config)#vlan 2
Router(config-vlan-2)#ip access-group qos in
Warning: Binding of large ACL Operation may take few minutes


Once this is done: any traffic coming in on the Vlan 2 will have its frames marked.

Post this, with the trust dscp: on the downstream devices' interfaces, should ensure it getting honored as well.

Note :
In the above policy, the same is shortened for reading purposes,
When setting up the same: statements for both TCP and UDP need to be added, individually.

You most likely have to completely wipe out the configuration and treat the ICX as a completely factory default settings switch.

To do this, it depends on the software version the device is running, please see the steps below:

08.0.90 - 08.0.95 codes:

1- Press Ctrl + Y, release the keys then immediately press M + Enter.

2- Once you are in OS mode, enter reset 

              OS>reset

3- Press "b" continuously to enter into boot mode:

Enter 'b' to stop at boot monitor: 0
ICX77xx-Boot> bbbbbbbbbbbbbbbbbbb<INTERRUPT>

4- Enter the command factory set-default

          ICX77xx-Boot> factory set-default
Execution of "factory set-default" will remove all user data like config, keys etc.

5- Enter capital Y to confirm:

           Do you want to continue? (Y/N)Y

6- Enter the command boot

7- The swill will boot up and it will ask for default credentials.
username: super
password: sp-admin
Then, you will be able to create a new password.

09.0.10 - 10.0.10 codes:

1- Press Ctrl + Y

2- Once you are in OS mode, enter reboot 

              OS>reboot

3- Press "b" continuously to enter into boot mode:

Enter 'b' to stop at boot monitor: 0
ICX77xx-Boot> bbbbbbbbbbbbbbbbbbb<INTERRUPT>

4- Enter the command factory set-default

          ICX77xx-Boot> factory set-default
Execution of "factory set-default" will remove all user data like config, keys etc.

5- Enter capital Y to confirm:

           Do you want to continue? (Y/N)Y

6- Enter the command boot

7- The swill will boot up and it will ask for default credentials. 

username: super

password: sp-admin

Then, you will be able to create a new password.

I hope this helps!

This feature is designed to collect logs from various ICX modules, which can then be shared with technical support for thorough investigation. RUCKUS advises running support save prior to firmware upgrades to ensure the availability of essential information in the event of any complications.

Available options :

1) TFTP / SCP 

This option facilitates the retrieval of Support Save files through an external server using TFTP or SCP.

Command example:

TFTP :

supportsave all <Tftp_IP_Address> <File_name>

SCP :

supportsave all <SCP_IP_Address> <File_name>

Official data: https://docs.commscope.com/bundle/fastiron-09010-debugcommandref/page/GUID-461F5776-AB07-4D39-924D-EE4F0C425FF9.html

Video link as reference: https://www.youtube.com/watch?v=QndYv7igZe4

2)  Via Smart Zone / Virtual Smart Zone

If the Switch is connected to a Smart Zone or Virtual Smart Zone, the download can be initiated from the controller dashboard via web.

Network > Switches

If the switch is part of a specific group, choose that group, and then select the switch on which you want to save the support save.

Next, click on 'More', and then select the 'Download Support Logs' option.

Upon clicking, an option will emerge, asking whether you wish to download the file. Subsequently, the file will be downloaded to your local machine.

3) Via Web UI

This option is only available for versions 9010 or higher.

Login into the Web UI in the ICX

Management > Infra.

In the SUPPORT SAVE panel, click on 'Start' to start downloading the files.

Note: To cancel an ongoing supportsave operation, click 'Cancel'. While the cancellation is in progress, the 'Start' and 'Cancel' options will be unavailable. These options will become accessible again once the cancellation is complete.

Note: If you are running supportsave from the web interface for the first time, you must select Allow in the dialog box requesting permission to download multiple files to start the multiple file download.

Once the file is downloaded, it will be in the 'Downloads' folder in the local machine.

Official data: https://docs.commscope.com/bundle/fastiron-10010-webguide/page/GUID-06CD7A36-3E4D-48EE-8A02-D29C59069989.html

STP Protection Enhancement https://docs.commscope.com/bundle/fastiron-09010-l2guide/page/GUID-A4F0188F-A7FE-49D3-A79D-5E48AC481E0E.html

The BPDU Guard feature is a  security measure in Layer 2 Spanning Tree Protocol (STP) networks, designed to defend against BPDU-related threats and prevent accidental misconfigurations. When enabled on an access port, BPDU Guard ensures that if a BPDU is received, the port will enter an error-disabled state. Recovery from this state requires a manual shutdown and restart of the interface or configuring an auto recovery.

Re-enabling ports disabled by BPDU guard :  https://docs.commscope.com/bundle/fastiron-08090-l2guide/page/GUID-072E446B-D157-4815-8C02-E5EA4D2D50C8.html

Enabling an error-disabled port automatically : https://docs.commscope.com/bundle/fastiron-08090-l2guide/page/GUID-5B6686B1-CAAB-44FA-B2EB-2854B0805950.html

Ruckus's implementation of 802.1W allows for the configuration of Edge ports in the network topology. Edge ports, typically connecting to workstations or computers, do not process incoming BPDUs and are assumed to have Designated port roles.

 These ports are not considered in STP calculations, meaning that port flapping on Edge ports does not trigger topology change events. This makes Edge ports a critical component in maintaining the stability and security of the network.

Edge ports and edge port roles  https://docs.commscope.com/bundle/fastiron-08090-l2guide/page/GUID-27AA7467-42F3-4D32-81EB-975051BA3562.html

Configuring 802.1W Rapid Spanning Tree Protocol  https://docs.commscope.com/bundle/fastiron-09010-l2guide/page/GUID-A7C9E7F9-8349-4B09-82D5-A4AA81723673.html

As Summary STP Protect concentrates on ensuring the stability of the STP network. In contrast, BPDU Guard serves as a security feature that safeguards the network against detrimental BPDU packets. This protection helps prevent complications such as STP loops and unauthorized alterations in the network topology.

For additional information, please refer to the Layer 2 guide available on the support portal.

https://support.ruckuswireless.com/documents/4465-fastiron-10-0-10-ga-layer-2-switching-configuration-guide