Model-Based Configurations

You can create and edit ACL, Layer 2, and Layer 3 configuration settings for a family of switches. You can also create or update the ACL to configure QoS profiles that prioritize VOIP and VIDEO VLAN traffic.
    Note:
  • Configuring the QoS Profiles requires ICX Firmware version 08.0.95.
  • When SmartZone is configured in 'IPv6 only' mode, it removes the support for ACL and Static Route.
  1. On the menu, click Network > Wired > Switches to display the Switches window.
  2. Select Domain > Switch Group or Switch Group and click the Configuration tab.
  3. In the Model Configuration section, select the Switch Model from the drop-down list and click Configure to display the Feature Configuration <group name> dialog box.
    Note: The Feature Configuration dialog box displays details about the ACL, VLAN, and static for the selected model. You can create, edit, and delete these configurations as necessary.

    Feature Configuration <group name>

    1. Configure the ACL settings.
      1. Click the ACL tab.
      2. Click Create to display the ACL fields.
      3. Complete the following fields:
        • ACL Name/ID: Enter the name of the access control list or provide the list identifier.
        • ACL Type: Select Standard or Extended from the drop down list.
        • Rules: Click Create to create an ACL rule.
          • Complete the following fields to configure the following ACL rule for the Extended ACL type:

            You must provide the list sequence (Seq#), Action (Permit or Deny) and Source Network information to create the rule.

            Note: Controller supports the "equal to" operator only.
            Note: When ACL is enabled on the CPU and the ACL configuration uses a Deny action, the controller will display an error message and reject the configuration.
            Note: The Controller release 5.2.1 adds three new fields adds three fields (DSCP Matching, DSCP Marking and Internal Priority Marking) to configure QoS. After creating or updating the three fields, apply the ACL on a port or a VE to prioritize/de-prioritize traffic.
          • Complete the following fields to configure the following ACL rule for the Extended ACL type:
            • Seq#: Enter the sequence number, which determines the order in which the ACL rules are applied.
            • Action: Select Permit to allow traffic or Deny to block traffic based on the rule
            • Source Network: Enter the source network address, specifying where the traffic originates.
            • Destination Network: Enter the destination network address, specifying where the traffic is headed.
            • Source Port: Enter the source port number. By default, port 22 (commonly used for SSH) is selected.
            • Destination Port: Enter the destination port number. By default, port 22 is selected.
            • DSCP Matching: Enter the Differentiated Services Code Point (DSCP) value to match incoming traffic for quality of service (QoS) purposes. DSCP values are used to classify and manage network traffic to ensure efficient data transmission.
            • DSCP Marking: Enter the DSCP value to mark outgoing traffic, setting its priority for QoS. This helps in managing bandwidth and ensuring that high-priority traffic is transmitted efficiently.
            • Internal Priority Marking: Enter the internal priority value to classify and prioritize traffic within the network.
            • Traffic Policy: Select a traffic policy from the drop-down list to apply to the rule.
              Note: Only an Extended ACL can have a traffic policy applied to it.
        • Apply ACL Config: Select Now or Schedule Later. If you choose to schedule the configuration deployment for later, provide the time and date.
        • Click OK to add the newly created ACL configuration to the ACL page. You can edit the configuration by selecting Configure.
      Note: You can also edit and delete the ACL configuration by selecting the options Configure and Delete respectively, from the ACL tab.
      Note: Beginning with the 7.0 release, when you Delete an ACL, the ICX System log displays the SZ Administrator name associated with this activity. In the earlier releases, the ICX System log showed a generic message indicating that the network controller made the change.
    2. Configure the VLAN settings.
      1. Click the VLAN tab.
      2. Click Create to display the VLAN fields.

        VLAN Configuration

      3. Complete the following VLAN fields:
        • VLAN #: Enter the number of the VLAN.
        • VLAN Name: Enter the name of the Layer 2 VLAN.
        • As Default VLAN: If you enable the As Default VLAN the VLAN Name is changed to DEFAULT-VLAN and the Management settings correspond to the previous VLAN settings.
        • Management VLAN: By enabling this, you can configure Management VLAN for the switches or switch groups.
        • 7.0 Beta Feature
          IPv4 DHCP Snooping: Monitors and filters DHCP traffic on a network switch to prevent unauthorized or rogue DHCP servers from distributing IP addresses. If you enable IPv4 DHCP Snooping, you must provide the breakout port for this option in the DHCP Snooping Trust Port field.
          Attention: To complete this change, the ICX will reboot after the controller syncs the configuration updates.
        • APR Inspection: Validates ARP packets to prevent ARP spoofing and man-in-the-middle attacks by ensuring correct MAC-to-IP address bindings. You must provide the breakout port for this option in the ARP Inspection Trust Port field.
          Attention: To complete this change, the ICX reboots after the controller syncs the configuration updates.
        • IGMP Snooping: Ensures that multicast traffic is only forwarded to devices that have requested it, thereby preventing unnecessary traffic and conserving bandwidth. Select None, Active, or Passive from the list. Ensures that multicast traffic is only forwarded to devices that have requested it, thereby preventing unnecessary traffic and conserving bandwidth. If you select Active or Passive, you are required to select the Multicast Version as well.
        • Spanning Tree: Select None, STP (802.1d), or RSTP (802.1w) from the list. If you select STP 802.1d or RSTP 802.1w, you are required to select the Spanning Tree Priority as well.
        • Ports: Click Create and complete the following fields:
          Note: Different set of ports can be entered for each switch model.
          • Switch Model: Select the switch model from the drop down list.
          • 7.0 Beta Feature
            Untagged Ports: Enter the breakout port.
          • 7.0 Beta Feature
            Tagged Ports: Enter the breakout port.
          • Click Update
        • Apply VLAN Config: Select Now or Schedule Later. If you choose to schedule the configuration deployment for later, provide the time and date.
        • Click OK to add the newly created VLAN configuration to the VLAN page.
      Note: You can also edit and delete the VLAN configuration by selecting the options Configure and Delete respectively, from the VLAN tab.

      Note: Beginning with the 7.0 release, when you modify the VLAN # and VLAN Name , the ICX System log displays the SZ Administrator name associated with this configuration activity. In the earlier releases, the ICX System log showed a generic message indicating that the network controller made the change.

    3. Configure the Static Route settings.
      1. Click the Static Route tab.
      2. Click Create to display the Static Route fields.

        Static Route Configuration

      3. Complete the following Static Route fields:
        • Destination IP: Enter the destination IP address.
        • Next Hop: Enter the next-hop IP address. Multicast and broadcast IP addresses are not allowed.
        • Admin Distance: Enter a value from 1 through 255.
        • Apply Static Route Config: Select Now or Schedule Later. If you choose to schedule the configuration deployment for later, provide the time and date.
        • Click OK to add the newly created static route configuration to the Static Route page.
      Note: You can also edit and delete the Static Route configuration by selecting the options Configure and Delete respectively, from the Static Route tab.
    4. Click Close.
    The IP address is added to the Model Configuration page under Property. If you want to edit the configuration, select it and click Edit to edit the settings.
    Note: Any changes made to the group level configuration including common configuration and switch model-based configuration will be applied to all the switches belonging to the group.

    Configuration defined at group level can be chosen to be applied instantaneously by selecting the Now option or schedule for a later time using Schedule later option. The scheduling option is only applicable if you are trying to make changes to existing switches in the group. For any new switches that are joining the group, this configuration gets applied instantaneously.

Parent topic: Configuring the Switches