spectrum vlan monitoring

7/28/2019 Spectrum Vlan Monitoring

1/42

VLAN Fault Isolation

Users Guide

SPECTRUM Enterprise Manager

Network Management

Titlepage


2/42

VLAN Fault Isolation Page 2

NoticeAprisma Management Technologies, Inc. (Aprisma) reserves the right to make changes inspecifications and other information contained in this document without prior notice. The reader

should in all cases consult Aprisma to determine whether any such changes have been made.

The hardware, firmware, or software described in this manual is subject to change without notice.

IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, ORAFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL

DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUTOF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IFAPRISMA HAS BEEN ADVISED OF, KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY

OF SUCH DAMAGES.

Copyright June 2000 by Aprisma Management Technologies, Inc. All rights reserved.

Printed in the United States of America.

Order Number: 9033543

Aprisma Management Technologies, Inc.

121 Technology Way

Durham NH 03824

SPECTRUM, the SPECTRUM IMT/VNM logo, DCM, IMT, and VNM are registered trademarks,and SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, DeviceCommunications Manager, and Virtual Network Machine are trademarks of Aprisma or its

affiliates.

C++ is a trademark of American Telephone and Telegraph, Inc.

UNIX is a trademark of UNIX System Laboratories, Inc.

OSF/Motif and Motif are trademarks of the Open Software Foundation, Inc.

X Window System is a trademark of X Consortium, Inc.

Ethernet is a trademark of Xerox Corporation.

Virus DisclaimerAprisma makes no representations or warranties to the effect that the Licensed Software is virus-free.

Aprisma has tested its software with current virus checking technologies. However, because noanti-virus system is 100% reliable, we strongly caution you to write protect and then verify that theLicensed Software, prior to installing it, is virus-free with an anti-virus system in which you have

confidence.


3/42


Restricted Rights Notice(Applicable to licenses to the United States Government only.)

1. Use, duplication, or disclosure by the Government is subject to restrictions as set forth in

subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at

DFARS 252.227-7013.

Aprisma Management Technologies, Inc., 121 Technology Way,Durham, New Hampshire 03824.

2. (a) This computer software is submitted with restricted rights. It may not be used, reproduced,or disclosed by the Government except as provided in paragraph (b) of this Notice or as

otherwise expressly stated in the contract.

(b) This computer software may be:

(1) Used or copied for use in or with the computer or computers for which it was acquired,

including use at any Government installation to which such computer or computers maybe transferred;

(2) Used or copied for use in a backup computer if any computer for which it was acquired is

inoperative;

(3) Reproduced for archival or backup purposes;

(4) Modified, adapted, or combined with other computer software, provided that the modified,combined, or adapted portions of the derivative software incorporating restricted

computer software are made subject to the same restricted rights;

(5) Disclosed to and reproduced for use by support service contractors in accordance withsubparagraphs (b) (1) through (4) of this clause, provided the Government makes such

disclosure or reproduction subject to these restricted rights; and(6) Used or copied for use in or transferred to a replacement computer.

(c) Notwithstanding the foregoing, if this computer software is published copyrighted computer

software, it is licensed to the Government, without disclosure prohibitions, with the minimumrights set forth in paragraph (b) of this clause.

(d) Any other rights or limitations regarding the use, duplication, or disclosure of this computer

software are to be expressly stated in, or incorporated in, the contract.

(e) This Notice shall be marked on any reproduction of this computer software, in whole or in part.


4/42

Co n t e nt s Co n te nt s


Contents

Preface 6

Introduction 9

VLAN Overview ............................................................................................................9

Types of VLANs ......................................................................................................10

Benefits of VLANs ..................................................................................................11

SPECTRUM and VLANs ............................................................................................12

Beyond the Bounds of Standards ...........................................................................13

Device Discovery ....................................................................................................13

Configuration ..........................................................................................................13

SecureFast VLAN Management Module ................................................................13

Dynamic Adaptive Modeling ...................................................................................14

VLAN Fault Isolation ...............................................................................................14

Alarms in VLAN Domains .......................................................................................15

VLAN Fault Isolation Views ........................................................................................15

Using VLAN Fault Isolation 19

Preparing to Use VLAN Fault Isolation ......................................................................19

Set Up VLAN Domains ...........................................................................................19Create VLANs .........................................................................................................20

Model VLAN Domain(s) ..........................................................................................20

AutoDiscovery .....................................................................................................20

Manual Modeling .................................................................................................20

Manually Editing Topology Views ...........................................................................21

Isolating VLAN Faults .................................................................................................21

Using the VLAN List View ..........................................................................................22

User View ...............................................................................................................22

Port View ................................................................................................................23Options ...................................................................................................................25

Specifying the SPECTRUM VLAN Modeling Configuration Interval ...................26

Reading Switch Tables Immediately ...................................................................27

Specifying the VLAN Configuration Tool Path ....................................................27

Launching the VLAN Configuration Tool .............................................................27


5/42


6/42


Preface

This preface provides an introduction to the SPECTRUM VLAN Fault Isolationdocumentation, discusses who should read this guide, describes how the guide isorganized, and provides information about viewing and printing this document.

Welcome to the SPECTRUM VLAN Fault Isolation Users Guide. Thisbook is a guide to using SPECTRUM VLAN Fault Isolation. It provides anoverview of VLAN Fault Isolation, provides instructions on how to useVLAN Fault isolation, describes how VLAN Fault Isolation works, andincludes a glossary of VLAN related terms.

Who Should Read This GuideThis guide is intended for use by network administrators and techniciansresponsible for day-to-day administration of a network.

This guide presumes you are familiar with the terms and principlesassociated with traditional network devices such as hubs, routers, andbridges, the terms and principles associated with VLAN networks, as wellas with the terms and principles associated with SPECTRUM. It alsopresumes that you are familiar with traditional networking models andstandards,(i.e., the Open Systems Interconnection (OSI) model, and the802.1d, 802.3, and 802.5 standards).

This manual is written from a Motif windowing environment perspective.If you are using another interface (i.e. OpenLook), screens and mousefunctionality will vary according to the interface being used.

Tip:Tip:

OIT_LOOK

setenv OIT_LOOK

export OIT_LOOK=


7/42

P r e f a c e


Using This ManualThis manual is divided into four sections:

Introduction - This section provides an overview of VLANs and theirbenefits, describes how SPECTRUM supports VLANs, and discussesVLAN Fault Isolation concepts and views.

Using VLAN Fault Isolation - This section provides task orientedinformation which is required to successfully use VLAN Fault Isolation.

Theory of Operations - This section provides information about howVLAN Fault isolation works and how it is integrated into existingSPECTRUM functionality.

VLAN Terminology - This section defines the VLAN terms used in thisguide as well as other common VLAN terms.

Viewing and Printing this DocumentTo view and print the SPECTRUM VLAN Fault Isolation Users Guide,you need Adobe Acrobat Reader 3.0. For your convenience, a copy ofAdobe Acrobat Reader 3.0 is included on the SPECTRUM CD. The startup

file for Adobe Acrobat Reader 3.0, acroread, is located in the Acrobat/binsubdirectory of your installation area.

With Adobe Acrobat Reader 3.0 on your system, you can access thisguide:

From the docs directory on the CD-ROM by starting up Adobe AcrobatReader 3.0 and selecting File ? Open from the menu. (If you are aSPECTRUM user, Adobe Acrobat Reader 3.0 is installed during theSPECTRUM installation process.)

From the SPECTRUM Help menu, since this guide is installed as anintegral part of SPECTRUM. This document is also available in PDFformat on Aprismas Virtual Networking web site athttp://www.aprisma.com/support/manuals.


8/42

P r e f a c e


Related Documentation

802.1Q VLAN Manager Users Guide

SecureFast VLAN Manager Users Guide

Cisco VLAN Director Users Guide

SPECTRUM Integrated VLAN Manager Management Module UsersGuide

Getting Started with SPECTRUM for Administrators

SPECTRUM Modeling with the GnSNMPDev Toolkit

SPECTRUM AutoDiscovery Users Guide

Questions about SPECTRUM Documentation

Send your questions, comments or suggestions regarding SPECTRUMdocumentation to the Technical Communications Department directly viathe following internet address:

[email protected]

Note:Note:

You can access all related documentation listed in thissection with the exception of the Cisco VLAN Director Users

Guide at http://www.cabletron.com/support/manuals.


9/42


Introduction

This section provides an overview of VLANs and their benefits, describes howSPECTRUM supports VLANs, and discusses VLAN Fault Isolation concepts andviews.

VLAN OverviewNormally, bridges and switches do not filter LAN broadcast traffic; ingeneral, they replicate it on all ports. Virtual LAN (VLAN) enabled switchessegment the network into logically defined work groups. Broadcast trafficfrom servers and end-stations in a particular VLAN is replicated only onthose ports connected to end-stations belonging to that VLAN. Broadcasttraffic is blocked from ports with no end-points belonging to that VLAN,creating the same type of broadcast containment that routers provide.

A Virtual LAN is a logical Layer 2 broadcast domain. It is a logicalsegmentation of the network, whereas bridges and switches provide aphysical segmentation of the network.

Figure 1 shows two VLAN domains connected by a router. Two VLANs arealso shown. The Red VLAN consists of workstations B and C. The BlueVLAN contains workstations A and D as well as the SpectroSERVER.


10/42

I n t r o d u c t i o n


Figure 1: VLAN Domains

It may not be obvious from the Figure 1, but the router is not onlyrequired in order for traffic to pass from one domain to the other, but isalso necessary to pass traffic from one VLAN to the other, even if theVLANs are in the same domain. This is because VLANs do not normallyshare user information, so communication between users in differentVLANs is not possible, unless a router, which has been configured as a

member of all VLANs, is used.

Types of VLANsMost VLAN implementations are vendor specific. Within these proprietaryschemes, there are several methods used to determine VLANmembership; by port, by MAC address, by protocol, by IP multicastaddress, by policy, or a combination of these methods. None of theproprietary methods has been adopted as the industry standard which

prevents interoperability between devices of different origin.IEEE 802.1Q defines an industry standard implementation forspecification for port-based VLANs. Currently, many manufacturers areimplementing some support for this standard, so customers can migrateto and take advantage of the benefits of interoperability. However, not todisregard current customer deployment of VLANs, SPECTRUM support of

A

SFS Network

B

SW1

SW2

SW3

1

1

3

3

Domain

C

SFS Network

D

SW1

SW2

SW3

1

1

3

3

Domain


11/42



VLANs includes standard IEEE 802.1Q, Cabletron pre-standard 802.1Q,Cisco ISL, and Cabletron SecureFast.

Benefits of VLANsVLANs simplify the process of adds, moves, and changes that result whencaused by end users moving from one place on the network to anotherplace on the network. These types of changes require reconfiguring ausers workstation and often involve a trip to the wiring closet. Tools havebeen developed to assist administrators in configuring and deplayingVLANs across the entire switching fabric reducing the cost of handlinguser moves, and allowing for a more dynamic workgroup-basedorganizational environment by removing most of the physical contraints

associated with network user moves.

VLANs allow an administrator to strategically control the amount ofbroadcast and multicast traffic on the switched fabric. This enables ahigher level of performance and scaleability over traditional bridged androuted networks. VLAN membership is extremely dynamic and flexiblefurther enhancing an administrators control over the network. An end-station can belong to multiple VLANs.

VLANs can be created that provide virtual private networks. For example,

if the owner of a building who has completely wired the building fornetworking subleases parts of the building to different tenants, the trafficfrom one tenant should not interfere with the traffic from another tenant.To accomplish this, each tenant is placed in its own VLAN, therebycompletely separating network traffic. VLANs offer a significantly lessexpensive solution to private networks of this type by using a singlephysical network which can be partitioned into logically separatesegments rather than having each tenant wire and support their ownnetwork.


12/42


S P E C T R U M a n d V L A N s


SPECTRUM and VLANsSPECTRUM support for 802.1Q, Cisco ISL, and Cabletron SecureFastVLANs consists of the following:

Identify, model, and display Layer 2 connectivity among switches androuters, as inferred from analysis of forwarding and spanning treetables.

Identify, model, and display key logical topology entities such asDomains, VLANs, VLAN trunks, and users (end-stations).

Represent and display the relationship of the logical entities to oneanother, including their relationship to connected routers.

Visualize the relationship between physical and logical topologies.

Diagnose faults within (and between) the physical and logicaltopologies of VLAN networks and provide alarms and probable causesfor detected faults.

Building 1

Finance

Building 2

SmartSwitch 6000 SmartSwitch 6000

Finance Fina nce

R & D R & D R & D

Finance Finance Finance

R & D R & D R & D

SmartSwitch A SmartSwitch B

High Speed Link


13/42




Minimize the number of false alarms generated.

Beyond the Bounds of StandardsSPECTRUM modeling mainly relies on the content of switch forwardingtables to determine VLAN membership. SPECTRUM does not rely on anyrules governing the entry method into the forwarding tables, the creationand definition of VLANs may be vendor specific.

Device DiscoveryAutoDiscovery fully resolves connectivity between switches by examiningthe MIBs associated with the Cisco Discovery Protocol, the Cabletron

Discovery Protocol, Cabletrons SecureFast Protocol. During this process,AutoDiscovery identifies all switches in the network and then creates amodel for each one. Additionally, AutoDiscovery resolves connectivitydown to the port level. Each device is related to all of its ports, and inturn, all ports are related to the entities to which they are connected.Once the environment has been fully scanned, a complete physicaltopology will be modeled and mapped.

ConfigurationOne of SPECTRUM Enterprise Managers goals is to continue to becomemore modular without giving up seamless integration. As a result,SPECTRUM relies on vendor supplied configuration tools to manageVLANs. Cabletrons 802.1Q VLAN Manager is recommended to manage802.1Q VLANs. Ciscos VLAN Director is recommended for managingCisco ISL VLANs. Cabletrons SecureFast VLAN manager is recommendedto manage SecureFast VLANs.

SecureFast VLAN Management ModuleIn addition to SecureFast VLAN Manager, an Integrated VLANManagement Module for SPECTRUM is available. Its purpose is to providea mechanism for starting, stopping, and accessing the SecureFast


14/42




VLANServer and the SecureFast VLAN Client Application (VLANManager). VLAN Management is achieved using VLAN Manager.

Dynamic Adaptive ModelingSPECTRUM has the ability to query devices to understand the type ofservices they support. Since this technology is a core SPECTRUM feature,it does not rely on the presence of a specific management module. Even ifa device is modeled using the default SNMP Device Model, thefunctionality required to understand the services supported by the devicestill applies.

During the modeling process, device models are created for switches and

routers that support 802.1Q, Cisco ISL, or Cabletron SecureFast VLANs.DAM then creates application models for each device depending on theprotocol the device is running. Other SPECTRUM inference handlers willidentify, model (or associate), and display the:

Entities that represent Domains and VLANs

Ports that belong to each VLAN.

Blocked switch ports that result from the Spanning Tree algorithm.

Routers, switches, and links that connect the VLANs and Domains

together. End-stations that are members of each VLAN.

Trunk links that exist between switches.

Alarm condition on Domains, VLANs, links, switches, and routers.

The SpectroSERVER and the VLAN in which it resides.

VLAN Fault IsolationSPECTRUM VLAN Fault Isolation extends SPECTRUMs fault isolationcapability into VLAN environments. Without SPECTRUM VLAN FaultIsolation, SPECTRUMs fault isolation intelligence relies strictly onphysical connectivity to determine the data path from theSpectroSERVER to each managed device. When the SpectroSERVER failsto contact any device, that devices physical neighbors are checked. If theneighbors can be contacted, SPECTRUM assumes the device to be at


15/42


V L A N F a u l t I s o l a t i o n V i e w s


fault. If the neighbors cannot be contacted, SPECTRUM looks for a faultelsewhere.

In a VLAN environment, the management path cannot always be

determined by physical connectivity between switches. In some cases,communication between two users on the same switch must traverseseveral switches and a router. In these cases, a router configurationproblem or a router hardware malfunction could prevent communicationbetween the users, even though the users may be connected to differentports on the same switch. When a router failure is detected, SPECTRUMgenerates a Red (lost contact) alarm on the router model, and writes Gray(suppressed) to the condition value of affected user (end-station) models.You can display status, symptom, probable cause, and recommended

action information associated with the alarm by clicking the ProbableCause tab while running Alarm Manager.

SPECTRUM VLAN Fault Isolation enhances SPECTRUM modeling torepresent a logical VLAN topology, and adds intelligence that uses thismodeling to pinpoint VLAN domain faults such as router failures.

Alarms in VLAN DomainsIn the VLAN views, the condition of the Domain, VLANs, switches, and

routers follow the standard SPECTRUM roll-up idiom. For example,Domain and VLANs will be GREEN if all switches are green (i.e., allswitches and end-stations are reachable from the SpectroSERVER). If theSpectroSERVER narrows the fault down to a router, VLANs and Domainsthat are not reachable, will be GRAY and no alarms will be generated forany of their switches or end-stations. On the other hand, if the routers aredetermined to be operating normally, further analysis will pinpoint thefailing device(s). Core inference handlers provide the roll-up condition forVLAN and Domain containers.

VLAN Fault Isolation ViewsVLAN Fault Isolation views provide useful troubleshooting information sothat you can quickly identify and resolve VLAN related problems.


16/42




The VLAN Fault Isolation Topology View (Figure 2) provides accuratelogical topology representations of VLAN domains within a network andidentifies faulty domain devices. It contains standard SPECTRUMtopology view components as well as Spanning Tree overlays. Spanning

Tree overlays show trunk connections between switches. Spanning Treeprevents looping on the network so if redundant paths exist betweenswitches, Spanning Tree designates one path as the primary path and theother path as the backup path. The primary path between two switches isshown with solid bolded pipes. The backup path between two switches isshown with hashes through the pipe.

Figure 2: VLAN Fault Isolation Topology View

SpectroGRAPH: Topology: 192.168.92.0

192.168.92.0 of type LAN of landscape sugar: Primary

192.168.92.1

SSR-8600

Host_NT

192.168.92.46

192.168.170.77

192.168.92

192.168.170.77

192.168.170.21

192.168.170.77

192.168.170.21

192.168.170.77

192.168.170.21

192.168.170.77

192.168.170.21

192.168.170.77

192.168.170.21

File View Tools Bookmarks Help

192.168.170.21

192.168.170.21

192.168.170.21

192.168.170.21

192.168.92.36

6H262-18


17/42




The VLAN List view (Figure 3) displays a list of all VLANs in a domain andprovides access to additional views and functions as described below.

User View- Provides information about the users with

membership in the selected VLAN. Refer to User View. Port View- Provides information about ports with membership in

the selected VLAN. Traffic can only be forwarded out ports withmembership in a VLAN. Refer to Port View.

Options - Lets you specify how frequently SPECTRUM will read theswitch tables in order to determine port VLAN membership and tospecify the path to your VLAN configuration tool. Refer to Options.

ID/Find - Lets you search for a particular VLAN by VLAN ID or

VLAN name. Refer to Using the VLAN Find Feature.

Apply- Applies the selected VLAN topology overlay (some VLANtechnologies offer multiple spanning trees).

Close - Dismisses the VLAN List View and removes Spanning Treeoverlays from the VLAN Topology View.


18/42




Figure 3: VLAN List

VLAN List - 192.168.92.0

ID Name

User View Port View

ID

Apply Close Options

Find

4412233

bluedefaultredgreen


19/42


Using VLAN Fault Isolation

This section provides task oriented information which is required to successfully useVLAN Fault Isolation.

Preparing to Use VLAN Fault IsolationYou must set up your VLAN domain and model the devices contained inthe domain before you can use VLAN Fault Isolation.

Set Up VLAN DomainsSpecific VLAN domain set up instructions are not provided in this guidesince each network has its own set of unique requirements, however, eachVLAN domain should consist of a set of VLAN-aware switches bounded bya routing device such as a router. Once you have made the physicalconnections for the VLAN domains on your network, download theappropriate firmware to the switches, and then use local management toset the switches to run in VLAN mode.

In addition, the following suggestions are made to help you realize the full

benefits of a VLAN network. Set every end-stations mask to the natural mask.

Set every end-stations default gateway to point to itself.

Enable proxy-arp on all VLAN-aware routers.

Note:Note:

All switches in a VLAN domain must of the same type. Forexample, mixing Cabletron 802.1Q pre-standard, Cabletron802.1Q IETF, Cabletron SecureFast, and Cisco ISL switches inthe same domain is not permitted; however, mixing multi-vendor802.1Q IETF compliant switches in the same domain ispermitted.


20/42

U s i n g V L A N F a u l t I s o l a t i o n

P r e p a r i n g t o U s e V L A N F a u l t I s o l a t i o n


Create VLANsUse your VLAN configuration tool to create VLANs for each VLAN domainon your network. If a domain consists of Cabletron 802.1Q switches, use

Cabletrons VLAN Manager. If the domain consists of CabletronSecureFast switches, use Aprismas SPECTRUM VLAN Manager. If adomain consists of Cisco ISL switches, use Ciscos Cisco Director. In allcases, a switchs local management can be used to create VLANs,however, this can be very time intensive.

Model VLAN Domain(s)There are two methods you can use to create models for devices in a VLANdomain, using AutoDiscovery to model the devices and manuallymodeling the devices.

AutoDiscovery

You can use SPECTRUMs AutoDiscovery feature to create models for thedevices in a VLAN domain.

Manual ModelingIf you prefer, you can manually create models for the devices in a VLANdomain manually by selecting Edit> New Model orEdit> New Model byIP while in edit mode.

Refer to Getting Started With SPECTRUM for Administrators for

modeling instructions.

Note:Note:

Each routing device that bounds a VLAN domain must beconfigured to be a member of all VLANs in the domain.

Note:Note:

All switches in a VLAN domain must use the same protocol,either 802.1Q, SecureFast, or ISL. You cannot mix and matchthe three technologies.


21/42


I s o l a t i n g V L A N F a u l t s


Manually Editing Topology ViewsIf the information SPECTRUM uses during the modeling process is eitherlacking or misleading, the logical and physical representation of the

network may be inaccurate. If this occurs, it may be necessary for you tomake manual adjustments to topology views. To do this:

Collect all switches, that are part of the same Domain, into the sametopology view. This is done by copying and pasting the switch modelsfrom the various subviews into a Network or other topological container.

Make sure that each switch is directly connected to all of its physicalneighbors. This is done by entering the DevTop view of each switch to seeif its ports are connected to the correct devices. If there is a problem witha port, cut the incorrect device from the port and then paste the correctdevice onto the port.

Isolating VLAN Faults

SPECTRUM automatically isolates VLAN faults. When a VLAN fault isdetected, an alarm is generated on the failing device. You can displaystatus, symptom, probable cause, and recommended action infomationassociated with the alarm by clicking the Probable Cause tab whilerunning Alarm Manager. Refer to xx for infomation

Note:Note:

VLAN Fault Isolation will work as long as the switches areconnected properly, even if they are not all in the samecontainer; however, to take advantage of the Spanning Tree

overlays and other views, we recommend placing all switches in adomain into the same container.

Note:Note:

To correctly establish physical connectivity between two devices,the ports of each device must reference each other. For example,id device A (port 1) is connected to device B (port 4), you wouldhave to enter device As DevTop to paste B into its port 1, andthen enter device Bs DevTop to paste A into its port 4.


22/42


U s i n g t h e V L A N L i s t V i e w


Using the VLAN List ViewYou use the VLAN List View (Figure 3) to select a VLAN, to display theUser and Port Views, and to set VLAN configuration options.

User ViewThe User View provides read-only Name, IP, Condition, Switch IP, andSwitch Port information about the users in the selected VLAN. Users areendpoint devices modeled in SPECTRUM that are connected to a VLANswitch port.

To display the User View for a particular VLAN, select a VLAN from the

VLAN list and then clickUser View. You can use the VLAN filter toquickly find a particular VLAN. Refer to Using the VLAN Find Feature.Close dismisses the User View.

Figure 4: User View

UserView - blue

IPName

Name

Close

Find

192.168.92.36192.168.92.46192.168.92.47192.168.92.55192.168.92.56

Condition

SuppressedSuppressed

SuppressedSuppressedSuppressed

Switch IP

192.168.92.35192.168.92.35

192.168.92.35192.168.92.34192.168.92.34

Switch Port

11

11013

192.168.92.36192.168.92.46192.168.92.47192.168.92.55192.168.92.56


23/42




Name - Users name

IP - Users IP address

Condition - Contact Lost, Major, Minor, Initial, Maintenance,

Suppressed

Contact Lost- Contact with the device has been lost.

Major- A loss of service has occurred and immediate action isrequired.

Minor- A situation has occurred but no immediate action isrequired. This condition is also used for alarms created only toconvey information such as Duplicate IP.

Initial - Contact with the device has not yet been established.

Maintenance - Device has been taken off-line for maintenancepurposes.

Suppressed - Device cannot be reached due to a known errorcondition that exists on another device.

Switch IP - Switch to which user is connected.

Switch Port- Physical port to which the user is connected.

Port ViewThe Port View provides read-only Name, IP, Interface, Trunking, and Stateinformation about the ports in the selected VLAN. To display the PortView for a particular VLAN, select a VLAN from the VLAN list and thenclickPort View. You can use the VLAN filter to quickly find a particularVLAN. Refer to Using the VLAN Find Feature on Page 27. Close dismissesthe User View.


24/42




Figure 5: Port View

Name - Name of the switch port.

IP - IP address of the switch.

Interface - Port number.

Trunking - on or off. Trunking refer to a connection between 802.1Qswitches that passes only traffic with a VLAN ID inserted in the frame.By default, a port designated as a 1Q trunk has all VLANs in its egress(forwarding) list and is configured to transmit all frames as tagged. A1Q Trunk port drops all incoming frames that are not tagged.

State - Disabled, Listening, Learning, Forwaring, Blocking.

Disabled - Management disabled this interface. No traffic isreceived or forwarded while the interface is disabled.

Listening - The switch is not adding information associatedwith this interface into its database. The switch is monitoringtraffic while preparing to move from the learning to theforwarding state.

PortView - blue

IPName

Name

Close

Find

192.168.92.34_1192.168.92.34_10192.168.92.34_11192.168.92.34_12192.168.92.34_13192.168.92.34_14192.168.92.34_15192.168.92.34_2192.168.92.34_9192.168.92.35_1192.168.92.35_13192.168.92.35_14

Interface

11011121314152911314

Trunking

nononononononononoyesnono

State

ForwardingForwardingForwardingForwardingForwardingForwardingForwardingForwardingForwardingForwardingForwardingForwarding

192.168.92.34192.168.92.34192.168.92.34192.168.92.34192.168.92.34192.168.92.34192.168.92.34192.168.92.34192.168.92.34192.168.92.35192.168.92.35192.168.92.35


25/42




Learning - The switch is learning addresses on this interface.The switch enters the learning state when the switchs databaseis created (during start-up or after being deleted), or when theSpanning Tree Algorithm detects a network topology change.

Forwarding - The switch is operating and this interface isfrowarding traffic.

Blocking - This interface will not forward any traffic throughthe switch because a loop condition has been detected by theSpanning Tree Algorithm.

OptionsYou use the Options View (Figure 6) to:

Specify how often SPECTRUM reads switch tables to determine portVLAN membership

Read the switch tables immediately.

Specify the path to your VLAN configuration tool

Launch a VLAN configuration tool.

To close the view, selectClose from the File menu.


26/42




Figure 6: Options View

Specifying the SPECTRUM VLAN ModelingConfiguration IntervalTo specify the time interval (in minutes) that SPECTRUM will read theVLAN information from the switches to determine port VLANmembership, enter a value in the SPECTRUM VLAN ModelingConfiguration Interval text field. The following values are recommeded:

10 - 15 minutes for highly dynamic environments in which servers

and/or workstations are modeled. 60 minutes for more static environments.

Note:Note:

A value of zero (0) means that no reading of the switch tables willtake place.

SpectroGRAPH: 192.168.92.0

192.168.92.0 of type LAN of landscape sugar: Primary

File View Tools Bookmarks Help

VLAN Domain Options

SPECTRUM VLAN Modeling Configuration Interval (in minutes)

External VLAN Configuration Application

60

Reconfigure Now

Launch VLAN Config Tool


27/42




Reading Switch Tables ImmediatelyClick Reconfigure Now to immediately read the switch tables to determinecurrent VLAN membership.

Specifying the VLAN Configuration Tool PathEnter the name of the script/executable of your VLAN configuration toolinto the External VLAN Configuration Tool text field. If the script/executable isin the system PATH, SPECTRUM will find it. If the script/executable is not in the

PATH, enter the full path.

Launching the VLAN Configuration ToolTo launch your VLAN configuration tool clickLaunch VLAN Config Tool.

Using the VLAN Find FeatureUse the find feature to search for and find a particular VLAN. You cansearch by VLAN Name or VLAN IP Address.

To use the find feature:

1 Select NameNameNameName or IPIPIPIP from the search criteria pop-up list.

2 Click anywhere in the text box to the right of the search criteria pop-up list, and then, depending on the criteria you selected, enter a VLANName or a VLAN IP address.

Note:Note:

Configure 802.1Q pre-standard and IETF VLAN domainsusing Cabletrons VLAN Manager.

Configure SecureFast domains using CabletronsSecureFast VLAN Manager.

Configure ISL domains using Ciscos VLAN Director.

Note:Note:

A VLAN configuration tool cannot be launched until a valid pathto the tool is entered into the External VLAN Configuration Tooltext field.


28/42




3 Click FindFindFindFind to find the VLAN that matches your search criteria.


29/42


Theory of Operations

This section provides information about how VLAN Fault isolation works and how it isintegrated into existing SPECTRUM functionality.

VLAN Fault Isolation OperationsThe flowchart shown in Figure 7 shows the process used by SPECTRUMto isolate VLAN faults. The following description may help to understandthe process.

Once the VLAN membership of users (a user being a device model inSPECTRUM), has been fully modeled, SPECTRUM has the informationnecessary to fault isolate the VLAN environment. When theSpectroSERVER looses contact with a device, the first question that needsto be answered is Is the device in the same VLAN as theSpectroSERVER?

This can easily be answered by reading the vContains relation to see if theVNM model is associated with the same VLAN model as the device. This is

done by querying the vLanContains relation twice, one with the VNMmodel (on the right side of the association), and then again with the device(on the right side of the association. If the VNM and the device are in thesame VLAN, traditional SPECTRUM fault isolation is used. Otherwise,the logical neighbors of the lost device are queried.

The logical neighbors are found by reading the vlsBoundBy relation withthe VLAN model of the device on the left. All router models that bound theVLAN are considered logical neighbors of all the VLANs members. Theseneighbors are queried by sending the model the ARE_YOU_DOWN action.

If any of the neighbors respond yes, then the device icon is turned Gray.If all logical neighbors are up, traditional SPECTRUM fault isolation isused.


30/42

T h e o r y o f O p e r a t i o n s


Figure 7: VLAN Fault Isolat ion

Can theSS contact

allthe logicalneighbors (routers) inthe path to the faulty

device?

Device isunreachable

Is the faultydevice in a differentVLAN than the SS?

Can the SS contact

anyphysical neighborto the faulty device?

Turn device GRAY

Turn device RED

Standard Physical Fault Isolation

Yes

Yes

No

No

No

Yes


31/42


VLAN Terminology

This section contains definitions for commonly used VLAN Fault Isolation and VLAN(802.1Q, SecureFast, ISL) terms as well as definitions for other common networkrelated terms.

1Q trunk1Q trunk1Q trunk1Q trunk

A connection between 802.1Q switches that passes only traffic with aVLAN Tag Header inserted in the frame.

1d trunk1d trunk1d trunk1d trunk

A connection from a switch that passes only untagged traffic.

802.1Q

The IEEE standard that defines port based VLANs.

access portaccess portaccess portaccess port

A port on a VLAN switch that has been designated for user (end-system)connections.

aliasaliasaliasalias

A way of identifying a user by something other than its MAC address, forexample, by IP or IPX address.

Automatic Membership Registration (AMR)Automatic Membership Registration (AMR)Automatic Membership Registration (AMR)Automatic Membership Registration (AMR)

A SecureFast VLAN Manager feature that dynamically creates VLANs,joins endpoints to those VLANs, and floods packets to those VLANsaccording to the set of criteria rules.

Base VLANBase VLANBase VLANBase VLAN

VLAN that all endpoints in a domain have membership in untiladministratively moved to another VLAN.


32/42

V L A N T e r m i n o l o g y


binderybinderybinderybindery

A database that contains a complete collection of related information.

broadcastbroadcastbroadcastbroadcastData sent from one endpoint to all other network endpoints (point-to-multipoint communications).

community namecommunity namecommunity namecommunity name - Defines security communities to which an SNMPagent is permitted access to a device and establishes Read/ReadWriteprivileges.

Current Table (dot1qVlanCurrentTable)Current Table (dot1qVlanCurrentTable)Current Table (dot1qVlanCurrentTable)Current Table (dot1qVlanCurrentTable)

A map of VLAN IDs to a port egress list and a filtering database so thatnon-unicast and unicast packets can be forwarded appropriately.

default gatewaydefault gatewaydefault gatewaydefault gateway - The switch port configured to service connectionrequests to subnets not serviced by the switches in a domain.

default VLANdefault VLANdefault VLANdefault VLAN

The VLAN assigned to be the default VLAN for a port. All endpointsconnecting to a port will assume membership in the default VLAN for thatport. For 802.1Q VLANs, the default VLAN has a VLAN ID of 1.

directorydirectorydirectorydirectory

A set of data about all users in a domain. Typically, the directory containssuch entries as the users physical address, the switch and port to whichthe user is connected, and the network type, and the users name.

discoverdiscoverdiscoverdiscover

Process used to find switches and users contained in a VLAN domain.

daemondaemondaemondaemon

A software program that generally performs a single task and is executedonly when it is needed.


33/42



domaindomaindomaindomain

A set of VLAN switches that are physically connected together andbounded by a router. A domain identifies the potential physical reach of aVLAN. It also provides scope for the VLAN IDs.

Domain Name Server (DNS)Domain Name Server (DNS)Domain Name Server (DNS)Domain Name Server (DNS)

A protocol used to provide mappings between host names and IPaddresses.

dynamic filtering entriesdynamic filtering entriesdynamic filtering entriesdynamic filtering entries

Entries that have been learned through correspondence with other switchdevices via GVRP. After an agent restart, these entries will have to berelearned.

egress list (dot1qVlanCurrentEgressPorts)egress list (dot1qVlanCurrentEgressPorts)egress list (dot1qVlanCurrentEgressPorts)egress list (dot1qVlanCurrentEgressPorts)

A per port list of all eligible 802.1Q VLANs that can be forwarded out onespecific port and the frame format of transmissions for that port. Theegress list specifies what 802.1Q VLANs are associated with a single portfor transmission purposes.

endpointendpointendpointendpoint

A device attached directly to a switchs network user port (e.g.,workstation, PC, or router).

filtering database (Filtering Identifier - FID)filtering database (Filtering Identifier - FID)filtering database (Filtering Identifier - FID)filtering database (Filtering Identifier - FID)

A table inside a switch that determines which ports unicast packets areforwarded to. The FID is similar to the Source Address table of atraditional bridge.

floodingfloodingfloodingflooding

A method used by SecureFast switches so that, if the switch fails toresolve the destination address for a packet to a host or a VLAN, thepacket is transmitted out all the switchs ports except the port the packetwas received on.

forwarding listforwarding listforwarding listforwarding list


34/42



A list of ports on a particular device that are eligible to transmit frames fora selected 802.1Q VLAN. The forwarding list identifies what ports areassociated with a single 802.1Q VLAN for transmission purposes.

folderfolderfolderfolder

A virtual container used to group users. There are two levels of folders.The first level groups different VLAN types (e.g., VLAN, AMR). The secondlevel groups users of the same type (e.g., inherited, static).

Graphical User Interface (GUI)Graphical User Interface (GUI)Graphical User Interface (GUI)Graphical User Interface (GUI)

An interface that allows a user to select a menu item by using a mouse topoint to a graphic icon or piece of text. This is an alternative to the more

traditional command line interface, where an alphanumeric string is usedto convey instructions. GUIs make computer applications easier to use forhumans (i.e., user friendly).

hubhubhubhub

The center of a star topology network or cabling system in which a multi-node network topology has a central multiplexor with many nodes feedinginto and through the multiplexor or hub. The other nodes do not usuallydirectly interconnect.

Independent VLAN Learning (IVL)Independent VLAN Learning (IVL)Independent VLAN Learning (IVL)Independent VLAN Learning (IVL)

The configuration and operation of the learning process and the filteringdatabase such that, for a given set of VLANs, if a given individual MACaddress is learnt in one VLAN, that learnt information is not used inforwarding decisions taken for that address relative to any other VLAN inthe given set.

Internet Protocol (IP)Internet Protocol (IP)Internet Protocol (IP)Internet Protocol (IP)

One of a collection of communication protocols which has become the defacto solution for open networking.

IP addressIP addressIP addressIP address


35/42



A 32-bit address divided into two fields: a network-identifier and a host-identifier. The network-identifier refers to a particular physical network inan Internet, and the host-identifier refers to a particular device attachedto that physical network.

IP MulticastIP MulticastIP MulticastIP Multicast

A SecureFast VLAN Manager feature that automatically creates IPMulticast groups for each IP Multicast address heard by the switches in aSFS domain. This feature lets you perform many IP Multicastadministrative tasks including adding or removing receivers from an IPMulticast group and setting security for switches and ports associatedwith IP Multicast groups.

LEC failoverLEC failoverLEC failoverLEC failover - A mechanism that lets you create multiple instances of anELAN. Backup ELANs or failovers protect against communication loss ifa primary ELAN fails. LEC failover is a proprietary feature of FORESystems. Failover ELANs are created and configured using your FORELANE Services tool.

legacy networklegacy networklegacy networklegacy network

Traditional router and bridge LANs, using Ethernet, Token Ring, or FDDI.

Logical Fault Isolation (LFI)Logical Fault Isolation (LFI)Logical Fault Isolation (LFI)Logical Fault Isolation (LFI)A process used to determine faults by examining logically connectedneighbors of a device along the path from the SpectroSERVER to thefaulty device. The path usually has a least one router.

MACMACMACMAC

Media access connection of the data link layer.

multicastmulticastmulticastmulticast

Data sent from one endpoint to a group of other network endpoints(point-to-multipoint communications).


36/42



OSI modelOSI modelOSI modelOSI model

A seven layer model that defines the rules for transferring informationfrom one endpoint to another. The seven layers are defined below.

(1) Physical Layer -(1) Physical Layer -(1) Physical Layer -(1) Physical Layer - Responsible for the transmission of bit streamsacross a particular physical transmission medium. It involves aconnection between two endpoints allowing electrical signals to beexchanged between them.

(2) Data Link Layer -(2) Data Link Layer -(2) Data Link Layer -(2) Data Link Layer - Responsible for moving information across aparticular link. Across that link, it ensures good transmission andcorrect delivery by checking errors, retransmitting as necessary, andattaching appropriate addresses to the data sent. The contention

access methods (e.g., CSMA/CD, and Token Passing) are regarded asLayer 2 activities.

(3) Network Layer -(3) Network Layer -(3) Network Layer -(3) Network Layer - Concerned with routing data from one network toanother. It is responsible for establishing, maintaining, andterminating the network connection between two users and fortransferring data along that connection. Although there can be onlyone network connection between two given users, there can be manypossible routes from which to choose when the particular connection

is established.

(4) Transport Layer -(4) Transport Layer -(4) Transport Layer -(4) Transport Layer - Responsible for providing data transfer betweentwo users at an agreed level of quality. When a connection isestablished, this layer is responsible for selecting a particular class ofservice to be used, for monitoring transmissions to ensure theappropriate service quality is maintained, and for notifying the users ifit is not.

(5) Session Layer -(5) Session Layer -(5) Session Layer -(5) Session Layer - Focuses on providing services used to organize and

synchronize the dialog that takes place between users and to managethe data exchange. A primary concern of the session layer iscontrolling when users can send and receive concurrently oralternately.


37/42



(6) Presentation Layer -(6) Presentation Layer -(6) Presentation Layer -(6) Presentation Layer - Responsible for the presentation ofinformation in a way that is meaningful to the network users. Thismay include character code transmission, data conversion, or datacompression and expansion.

(7) Application Layer -(7) Application Layer -(7) Application Layer -(7) Application Layer - Provides a means for application processes toaccess the system interconnection facilities in order to exchangeinformation. This includes services used to establish and terminatethe connections between users and to monitor and manage thesystems being interconnected, as well as the various resources theyemploy.

Local Area Network (LAN)Local Area Network (LAN)Local Area Network (LAN)Local Area Network (LAN)

A data communications network that can cover a limited area of up toabout six miles in radius with moderate to high data speeds. The deviceslinked by a LAN may all be in the same building or in a group of buildingsin relatively close proximity. It is user-owned and does not run overleased lines, although it might have gateways to public and/or privatenetworks.

MAC addressMAC addressMAC addressMAC address

Physical address for a given device.

multicastmulticastmulticastmulticast

Data sent from one endpoint to multiple network endpoints (point-to-multipoint communications).

network portnetwork portnetwork portnetwork port

A port on a VLAN switch that has been designated for networkconnections.

packetpacketpacketpacket

A unit of data consisting of several fields. Packets may be of fixed lengthsor varying lengths.


38/42



Physical Fault Isolation (PFI)

A process used to determine faults by examining the physically connectedneighbors of a device.

pollpollpollpoll

Periodic collection of specific information from a network device which isbeing managed by VLAN Manager.

port restrictionport restrictionport restrictionport restriction

Restriction placed on a port which allows only specified MAC addresses tobe connected to the port.

port tableport tableport tableport tableEach Cisco chassis maintains a vlanPortTable. whose entries specifyVLAN membership for each port on the module. Additionally, each entryin the table indicates whether the port is trunking or not.

port violationport violationport violationport violation

Heard when a MAC address not specified for a restricted port isdiscovered on that port.

Port VLAN ID (PVID)Port VLAN ID (PVID)Port VLAN ID (PVID)Port VLAN ID (PVID)

An identification that encompasses a particular switch portsidentification and that ports VLAN membership.

preferencepreferencepreferencepreference

A client/UI setting about what data to display and how to display to. Forexample, display ToolTips or display the Topology view at 50% zoom.

processdprocessdprocessdprocessdA process launching and tracking daemon that provides the VLANServerwith the ability to control various processes that are run on variousservers and clients in a distributed VLANServer environment.

propertypropertypropertyproperty


39/42



An attribute of an object which is being managed. For example, setting amulticast ports query interval.

provisionprovisionprovisionprovision

To configure a connection manually.

redundant access portredundant access portredundant access portredundant access port

Let you configure endpoints within a VLAN domain to be connected tomore than one switch access port (one active, the others in standby).

repeaterrepeaterrepeaterrepeater

In a LAN, this is a device that repeats a signal from one cable to the next,

thereby, increasing the reach of a LAN signal. In FDDI, a repeater is anopto-electrical module that receives an optical signal and converts it intoan electrical equivalent of the optical signal.

routerrouterrouterrouter

Unlike bridges, routers operate at the Network level (Layer 3) of the OSImodel. Also unlike bridges, routers are protocol specific, acting on routinginformation carried by the communications protocol in the Network layer.Bridges pass Layer 2 (Data Link) packets directly on to the next segmentof a LAN, whereas routers can use the information they have about thenetwork topology to choose the best route for a packet. Because routersare Layer 3 devices, they are independent of the Physical (Layer 1) level.

seed switchseed switchseed switchseed switch

The switch identified to VLAN Manager as the starting point for thedomain discovery process.

shared linkshared linkshared linkshared link

Connections between switches where each switch can hear more than oneneighbor switch.


40/42



Shared VLAN Learning (SVL)Shared VLAN Learning (SVL)Shared VLAN Learning (SVL)Shared VLAN Learning (SVL)

The configuration and operation of the learning process and the filteringdatabase such that, for a given set of VLANs, if a given individual MACaddress is learnt in one VLAN, that learnt information is used inforwarding decisions taken for that address relative to any other VLAN inthe given set.

Simple Network Management Protocol (SNMP)Simple Network Management Protocol (SNMP)Simple Network Management Protocol (SNMP)Simple Network Management Protocol (SNMP)

A application protocol providing network management within the Internetsuite of Protocols.

static filtering entriesstatic filtering entriesstatic filtering entriesstatic filtering entries

Entries created by an administrator. Static filtering entries persist afterthe agent has restarted.

stack-MIB

Contains main VLAN group (vlanGrp) for all Cisco devices supportingVLANs.

VLANVLANVLANVLAN

A set of ports in a domain with the same VLAN ID, including the users

attached to those ports. It represents a broadcast domain.VLAN Fault Isolation (VFI)VLAN Fault Isolation (VFI)VLAN Fault Isolation (VFI)VLAN Fault Isolation (VFI)

A process which uses PFI and LFI to determine faults in networkspartitioned into 802.1Q VLANs, Cisco ISL VLANs, and SecureFast VLANs.

VLAN ID (VID)

A unique numerical identifier for a VLAN within a VLAN domain. The VIDis used to identify what VLAN a packet is assigned to so that switches androuters can forward the packet out correct ports.

VLAN Table

Specifies the existence of VLANs (vlanIndex), including specificinformation about the interface/port (vlanIfIndex) membership.


41/42

I n d ex In de x


Index

AAdobe Acrobat Reader 7autodiscovery 13

Bbroadcast 32

Ccreating VLANs 20

Ddaemon 38

device discovery 13Dynamic Adaptive Modeling 14

Eediting topology views 21endpoint 33

Fflooding 33

GGraphical User Interface 34

IInternet Packet Exchange 35Internet Protocol 34IP address 34isolating VLAN faults 21

Llaunching the configuration tool 27Legacy Network35Local Area Network 37

MMAC 35MAC address 37modeling a VLAN domain 20multicast 35

NNetwork Port37


42/42

I n d ex In de x

OOSI model 35

Ppacket 37printing this document 7

Qquestions about this document 8

Rreading switch tables 27related documentation 8repeater 39Restricted Rights Notice 3router 39

Sseed switch 39setting up VLAN domains 19Simple Network Management

Protocol 40smart hub 34specify modeling configuration

interval 26specifying configuration tool path 27

T

UUser Port31using the list view 22using this document 7using VLAN find 27

Vviewing this document7VLAN

domain alarms 15fault isolation 14

overview 9SecureFast 13types 10

VLAN Fault Isolationisolating faults 21list view22

options view 25port view 23user view22

operation 29

preparation 19views 15

spectrum vlan monitoring

Documents