<<

NAME

pf::Switch::ThreeCom::SS4500

SYNOPSIS

The pf::Switch::ThreeCom::SS4500 module implements an object oriented interface to manage 3COM Huawei SuperStack 3 Switch - 4500 switches.

STATUS

Supports
linkUp / linkDown mode
port-security (maybe broken! see below)

Developed and tested on Switch 4200G firmware version 3.02.04s56 and 3.02.00s56

BUGS AND LIMITATIONS

VLAN ID 1

This switch cannot assign VLAN ID 1 to a port. It is recommended that you try to avoid using this VLAN as a VLAN managed by PacketFence.

Port-Security could be broken

Because of the problem documented in pf::Switch::ThreeCom::Switch_4200G we think that port-security might be broken on the SS4500. If you try it out, please let us know the status.

ROOM FOR IMPROVEMENT

Performance: Use secure table instead of Fdb

The Fdb is too large because it will hold all exposed MAC on all the VLANs. There's a smaller "secure" table but you can only use it if the port is in "port-security autolearn" so the Fdb was used instead. Maybe we can switch to use autolearn with forced 02:00... addresses to fill the learning table.

SUBROUTINES

Switch capabilities
getIfIndexForThisDot1dBasePort

returns ifIndex for a given "normal" port number (dot1d)

_setVlan

Note: setting a VLAN empties the static MAC table for the port. Because of this, in port-security mode, the MAC authorization process will take two intrusion traps before adding the correct MAC to the correct VLAN.

getPortListPositionFromDot1dBasePort

This switch does something fancy with PortList bit order. This method hides that complexity.

authorizeMAC

Authorize and deauthorize MAC addresses. A core component of port-security handling.

_authorizeMacWithSnmp

Authorize / De-authorize MAC Addresses using SNMP. Uses the Fdb and static entries instead of port-security table because port-security MAC entries are only valid for ports in autolearn mode.

_authorizeMacWithTelnet

Uses "mac-address static" instead of "mac-address security" because the latter only work if port is in autolearn

getAllSecureMacAddresses

Method that fetches all the secure (staticly assigned) MAC addresses for a given switch.

Returns a hash table with mac, ifIndex, vlan

getSecureMacAddresses

Method that fetches all the secure (staticly assigned) MAC addresses for a given ifIndex.

Returns a hash table with mac, vlan

_getLLDPIndex

We extract the LLDP index from SNMP request to the switch

getPhonesLLDPAtIfIndex

Using SNMP and LLDP we determine if there is VoIP connected on the switch port

isVoIPEnabled

Returns 1 if VoIP is enabled

AUTHOR

Mr. Chinasee BOONYATANG <chinasee.b@psu.ac.th>

Mr.Ponpitak SANTIPAPTAWON <ponpitak.s@psu.ac.th>

Prince of Songkla University, Thailand http://netserv.cc.psu.ac.th

Inverse inc. <info@inverse.ca>

COPYRIGHT

Copyright (C) 2005-2015 Inverse inc.

LICENSE

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

<<