CableFree RadioOS - User contributions [en]

Main Page

2022-06-10T14:11:09Z

Administrator:

'''Welcome to the Wireless Excellence Support Pages'''

Software Documentation for CableFree Carrier Class Radio Products.

== Product Documentation ==
* [[Manual:TOC|CableFree RadioOS Manual - Table of Contents]]
* [[SwitchOS|CableFree SwitchOS Manual - Table of Contents]]

== Links to Websites ==
CableFree Websites:
* [https://www.cablefree.net: CableFree Website]
* [https://www.4g-lte.net: 4G LTE Website]
* [https://www.private-lte.net: Private LTE Website]
* [https://www.5gradio.com: 5G Radio Website]
* [https://www.5gmmwave.com: 5G mmWave (Millimeter Wave) Website]
* [https://www.5g-networks.net: 5G Networks Website
* [http://www.60ghz-wireless.com: 60GHz V-Band Radio Website]
* [https://www.microwave-link.com: Microwave Link Website]
* [https://www.gigabit-wireless.com: Gigabit Wireless Website]

(C) 2015-2022 Wireless Excellence Limited

Main Page

2022-05-19T13:32:20Z

Administrator:

SwitchOS

2020-09-03T10:22:36Z

Administrator: /* List of Examples */

CableFree SwitchOS is an operating system designed specifically for administration of CableFree IP/Ethernet switch products.

SwitchOS is easily configurable using a web browser. SwitchOS gives you all the basic functionality for a managed switch, plus more: allows to manage port-to-port forwarding, broadcast storm control, apply MAC filter, configure VLANs, mirror traffic, apply bandwidth limitation and even adjust some MAC and IP header fields.

== CableFree Switch Manuals ==
* [[SwitchOS/CF-SW-1G-4S+ | CF-SW-xx series Manual]]
* [[SwitchOS/CF-SW-5G-1S | CF-SW-5G-1S series Manual]]
* [[SwitchOS/CF-SW-24G-2S+ | CF-SW-24G-2S+ Manual ]]

== List of Examples ==
* [[SwitchOS/CF-SW-VLAN-Example | CF-SW-1G-4S+ port based VLAN configuration ]]

SwitchOS

2020-09-03T09:52:01Z

Administrator: /* CableFree Switch Manuals */

CableFree SwitchOS is an operating system designed specifically for administration of CableFree IP/Ethernet switch products.

SwitchOS is easily configurable using a web browser. SwitchOS gives you all the basic functionality for a managed switch, plus more: allows to manage port-to-port forwarding, broadcast storm control, apply MAC filter, configure VLANs, mirror traffic, apply bandwidth limitation and even adjust some MAC and IP header fields.

== CableFree Switch Manuals ==
* [[SwitchOS/CF-SW-1G-4S+ | CF-SW-xx series Manual]]
* [[SwitchOS/CF-SW-5G-1S | CF-SW-5G-1S series Manual]]
* [[SwitchOS/CF-SW-24G-2S+ | CF-SW-24G-2S+ Manual ]]

== List of Examples ==
* [[SWITCHOS/ CF-SW-1G-4S+ -VLAN-Example | CF-SW-1G-4S+ port based VLAN configuration ]]

File:Basic vlan switching.png

2020-09-03T09:50:26Z

Administrator:

Manual:Basic VLAN switching

2020-09-03T09:49:18Z

Administrator: Created page with "{{Versions| v6.41 +}} __TOC__ =Introduction= Many CableFree devices come with a built-in switch chips that usually have an option to do VLAN switching on a hardware level,..."

{{Versions| v6.41 +}}

__TOC__

=Introduction=

Many CableFree devices come with a built-in switch chips that usually have an option to do VLAN switching on a hardware level, this means that you can achieve wire-speed performance using VLANs if a proper configuration method is used. The configuration method changes across different models, this guide will focus on setting up a basic trunk/access port setup with a management port from the trunk port using different devices with the right configuration to achieve best performance and to fully utilize the available hardware components.

[[File:basic vlan switching.png|700px|thumb|center|alt=Alt text|Basic VLAN switching]]

=CF-SW-xx series switches=
<pre>
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1 hw=yes
add bridge=bridge1 interface=ether2 hw=yes pvid=20
add bridge=bridge1 interface=ether3 hw=yes pvid=30
/interface bridge vlan
add bridge=bridge1 tagged=ether1 untagged=ether2 vlan-ids=20
add bridge=bridge1 tagged=ether1 untagged=ether3 vlan-ids=30
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=99
/interface vlan
add interface=bridge1 vlan-id=99 name=MGMT
/ip address
add address=192.168.99.1/24 interface=MGMT
/interface bridge
set bridge1 vlan-filtering=yes
</pre>

More detailed examples can be found [[Manual:Interface/Bridge#Bridge_VLAN_Filtering | here]].

=CF-SW-1xx/-2xx series switches=
<pre>
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1 hw=yes
add bridge=bridge1 interface=ether2 hw=yes
add bridge=bridge1 interface=ether3 hw=yes
/interface ethernet switch ingress-vlan-translation
add ports=ether2 customer-vid=0 new-customer-vid=20 sa-learning=yes
add ports=ether3 customer-vid=0 new-customer-vid=30 sa-learning=yes
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether1 vlan-id=20
add tagged-ports=ether1 vlan-id=30
add tagged-ports=ether1,switch1-cpu vlan-id=99
/interface ethernet switch vlan
add ports=ether1,ether2 vlan-id=20 learn=yes
add ports=ether1,ether3 vlan-id=30 learn=yes
add ports=ether1,switch1-cpu vlan-id=99 learn=yes
/interface vlan
add interface=bridge1 vlan-id=99 name=MGMT
/ip address
add address=192.168.99.1/24 interface=MGMT
/interface ethernet switch
set drop-if-invalid-or-src-port-not-member-of-vlan-on-ports=ether1,ether2,ether3
</pre>

=Other devices with built-in switch chip=
{{ Warning | Not all devices with a switch chip are capable of VLAN switching on a hardware level, check the supported features for each switch chip, the compatibility table can be found [[ Manual:Switch_Chip_Features#Introduction | Here]]. If a device has <code>VLAN table</code> support, then it is capable of VLAN switching using the built-in switch chip. You can check the device's switch chip either in the provided link or by using <code>/interface ethernet switch print</code> }}

<pre>
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1 hw=yes
add bridge=bridge1 interface=ether2 hw=yes
add bridge=bridge1 interface=ether3 hw=yes
/interface ethernet switch vlan
add ports=ether1,ether2 switch=switch1 vlan-id=20
add ports=ether1,ether3 switch=switch1 vlan-id=30
add ports=ether1,switch1-cpu switch=switch1 vlan-id=99
/interface vlan
add interface=bridge1 vlan-id=99 name=MGMT
/ip address
add address=192.168.99.1/24 interface=MGMT
/interface ethernet switch port
set ether1 vlan-mode=secure vlan-header=add-if-missing
set ether2 vlan-mode=secure vlan-header=always-strip default-vlan-id=20
set ether3 vlan-mode=secure vlan-header=always-strip default-vlan-id=30
set switch1-cpu vlan-header=leave-as-is vlan-mode=secure
</pre>

More detailed examples can be found [[Manual:Switch_Chip_Features#Setup_Examples | here]].

{{ Note | This type of configuration should be used on some CableFree devices. }}

{{ Note | By default, the bridge interface is configured with <var>protocol-mode</var> set to <code>rstp</code>. For some devices, this can disable hardware offloading because specific switch chips do not support this feature. See the manual section with supported features. }}

{{ Note | For devices that have multiple switch chips, each switch chip is only able to switch VLAN traffic between ports that are on the same switch chip, VLAN filtering will not work on a hardware level between ports that are on different switch chips, this means you should not add all ports to a single bridge if you are intending to use VLAN filtering using the switch chip, VLANs between switch chips will not get filtered. You can connect a single cable between both switch chips to work around this hardware limitation, another option is to use [[Manual:Basic_VLAN_switching#Other_devices_without_a_built-in_switch_chip | Bridge VLAN Filtering]], but it disables hardware offloading (and lowers the total throughput). }}

=Other devices without a built-in switch chip=
It is possible to do VLAN filtering using the CPU, there are multiple ways to do it, but it is highly recommended by using bridge VLAN filtering.
<pre>
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1 hw=no
add bridge=bridge1 interface=ether2 hw=no pvid=20
add bridge=bridge1 interface=ether3 hw=no pvid=30
/interface bridge vlan
add bridge=bridge1 tagged=ether1 untagged=ether2 vlan-ids=20
add bridge=bridge1 tagged=ether1 untagged=ether3 vlan-ids=30
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=99
/interface vlan
add interface=bridge1 vlan-id=99 name=MGMT
/ip address
add address=192.168.99.1/24 interface=MGMT
/interface bridge
set bridge1 vlan-filtering=yes
</pre>

More detailed examples can be found [[Manual:Interface/Bridge#Bridge_VLAN_Filtering | here]].

[[Category:Bridging and switching]]
[[Category:Case Studies]]

File:WebFIG PoE WRN.png

2020-09-02T12:22:11Z

Administrator: Administrator uploaded a new version of File:WebFIG PoE WRN.png

File:WebFIG PoE WRN.png

2020-09-02T12:20:23Z

Administrator:

Manual:PoE-Out

2020-09-02T12:11:35Z

Administrator: Created page with "{{Versions | v6.0 +}} ==Summary== Sub-menu: <code>/interface ethernet poe</code> This page describes how PoE-Out ([https://en.wikipedia.org/w..."

{{Versions | v6.0 +}}
==Summary==

Sub-menu: <code>/interface ethernet poe</code> 


This page describes how PoE-Out ([https://en.wikipedia.org/wiki/Power_over_Ethernet Power over Ethernet]) feature can be used on CableFree devices with at least one PoE-Out interface. CableFree uses
RJ45 mode B pinout for power distribution over [https://en.wikipedia.org/wiki/Power_over_Ethernet#Pinouts spare pairs], where the PoE is passed through pins 4,5 (+) and 7,8 (-). If a device supports powering other devices using PoE-out, then it is recommended to use '''at least 18V''' as the input voltage, except for devices that support multiple output voltages.

==CableFree supported PoE-Out standards==

CableFree devices can support some or all of the following PoE standards:

*'''Passive PoE-Out up to 30 V''' - PoE standard, which does not require negotiation between PSE (Power Sourcing Equipment) and PD (Powered Device). For PoE-out uses the same voltage as supplied to the PSE (Power Sourcing Equipment). PoE-Out Standard for devices which supports input voltage up to 30 V. PD resistance on spare pairs should have range from 3kΩ to 26.5kΩ.

*'''Passive PoE-Out up to 57 V''' - Works same as low voltage (up to 30 V) PoE-Out, but is also capable to deliver high voltage over PoE ports. The output voltage depends from the power source connected to PSE. Can power up af/at compatible devices, which accepts power over 4,5 (+) and 7,8 (-), and does not require PoE negotiation. PD resistance on spare pairs should have range from 3kΩ to 26.5kΩ.
*'''IEEE Standards 802.3af/at''' - Also called PoE Type 1/PoE+ Type 2, are PoE standards Defined by the IEEE. The aim of these standards is to reduce incompatibility between vendors. CableFree PSE with af/at support is capable of powering both a Type 1 and a Type 2 PD. Valid PD should have PoE-In resistance from 23.75kΩ to 26.25kΩ. CableFree devices which support af/at standard can also switch to Passive PoE-Out mode

Each PoE-Out implementation supports overload and short-circuit detection.

{{Note| Some CableFree devices support all of the described standards }}

==PoE-Out Configuration==

PoE Configuration is supported on all CableFree devices with PoE-Out interfaces, the configurations can be edited from the RadioOS and SwitchOS interfaces.

===RadioOS===

====Usage====

RadioOS provides an option to configure PoE-Out over Winbox, Webfig and CLI, basic commands using the CLI are

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-ro-table
|arg=print
|type=
|desc=Prints PoE-Out related settings.
}}

{{Mr-arg-ro-table
|arg=export
|type=
|desc=export is displayed under <code>/interface ethernet</code> menu.
}}

{{Mr-arg-ro-table
|arg=monitor
|type=string{{!}} interface
|desc=Shows poe-out-status of a specified port, or all ports with <code>/interface ethernet poe monitor [find]</code> command.
}}

{{Mr-arg-table-end
|arg=power-cycle
|type=time:0..1m {{!}}
|default=5s
|desc=Disables PoE-Out power for a specified period of time.
}}

====Global Settings====

Some CableFree PoE-Out devices support global PoE setting which can be configured under <code>/interface ethernet poe settings</code> menu.
Global setting ether1-poe-in-long-cable feature disables strict input/output current monitoring (short detection) to allow the use of PoE-Out with long ethernet cables and/or avoiding improper short-circuit detection.

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-ro-table-end
|arg=ether1-poe-in-long-cable
|type=yes {{!}} no
|default=no
|desc=Setting it to "yes" will disable short detection on all poe-out ports. This is potentially dangerous settings and should be used with caution
}}

{{Note| Global setting of '''''ether1-poe-in-long-cable''''' can also affect PoE-Out behaviour on PSE which is powered using a DC connector}}

====Port Settings====

PoE-Out can be configured under <code>/interface ethernet poe</code> menu. Each port can be controlled independently.

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-ro-table
|arg=name
|type=
|default=
|desc=Name of an interface
}}

{{Mr-arg-table
|arg=poe-out
|type=auto-on {{!}} forced-on {{!}} off
|default=auto-on
|desc=Specifies PoE-Out state
* <var>auto-on</var> - the board will attempt to detect if power can be applied on the port. For power-on to happen there should be resistance on spare pairs in the range from 3kΩ to 26.5kΩ
* <var>forced-on</var> - detection range is removed. As a result power over Ethernet will be always on
* <var>off</var> - all detection and power is turned off for this port
}}

{{Mr-arg-table
|arg=poe-priority
|type=integer:0..99 {{!}} any
|default=10
|desc=poe-priority specifies the importance of PoE-Out ports, in cases when a total PoE-Out limit is reached, interface with the lowest port priority will be powered off first.

Highest priority is 0, lowest priority is 99. If there are 2 or more ports with the same priority then port with the smallest port number will have a higher priority. For example, if ether2 and ether3 have the same priority and over-current is detected then PoE-Out on ether3 will be turned off.

Every 6 seconds ports will be checked for a possibility to provide PoE-Out if it was turned off due to port priority.
}}

{{Mr-arg-table-end
|arg=poe-voltage
|type=auto {{!}} low {{!}} high
|default=auto
|desc=Feature which allows to manually switch between two voltage outputs on PoE-Out ports. Will take effect only on PSE with switchable voltage modes
}}

====Power-cycle settings====

RadioOS provides a possibility to monitor PD using a ping, and power-cycle a PoE-Out port when the host does not respond. power-cycle-ping feature can be enabled under <code>/interface ethernet poe</code> menu.

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-table
|arg=power-cycle-ping-enabled
|type=yes {{!}} no
|default=no
|desc=Enables ping watchdog, power-cycles port if a host does not respond to ICMP or MAC-Telnet packets.
}}

{{Mr-arg-table
|arg=power-cycle-ping-address
|type=IPv4 {{!}} IPv6 {{!}} MAC
|default=
|desc=An address which will be monitored. Since RadioOS 6.46beta16, an active route towards PD is required in case an IP address is configured, so make sure PSE can reach the PD. In case MAC address is specified, PSE will send MAC-Telnet ping requests only from specified ethernet interface. When configuring a [[Manual:Interface/Bridge#Bridge_VLAN_Filtering | bridge vlan-filtering]] or some way of [[Manual:Basic_VLAN_switching| VLAN switching]], it is recommended to use IP address for monitoring your PD.
}}

{{Mr-arg-table
|arg=power-cycle-ping-timeout
|type=time:0..1h {{!}}
|default=5s
|desc=If the host does not respond for more than <timeout> period of time, then PoE-Out port is switched off for 5s.
}}

{{Mr-arg-table-end
|arg=power-cycle-interval
|type=time{{!}} any
|default=
|desc=Disables PoE-Out power for 5s between specified interval. Not related with power-cycle-ping feature.
}}

If power-cycle is enabled, <code>/interface ethernet poe monitor</code> will show actual status of the host and time when power cycle will be performed

===SwitchOS===

SwitchOS interface provides basic PoE-Out configuration options:

<ul>
<li> PoE Out - Change between [[#Port_Settings|PoE-out]] modes (auto/on/off)
<li> PoE Priority - Change the [[#Port_Settings|Priority]] of port (0...8)
<li> Voltage Level - Change between two voltage outputs on PoE-Out ports (auto/low/high)
</ul>

==PoE-Out Monitoring==

===RadioOS===

CableFree devices with PoE-Out controller (not injector) provides port monitoring option. <code>/interface ethernet poe monitor [find]</code>

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-ro-table
|arg=name
|type=
|default=
|desc=Name of an interface
}}

{{Mr-arg-ro-table
|arg=poe-out
|type=
|default=
|desc=Shows PoE-Out settings
}}

{{Mr-arg-ro-table
|arg=poe-out-status
|type=
|default=
|desc=Shows current PoE-Out status on port
* <var>powered-on</var> - Power is applied to the port, and PoE-Out is operating normally,
* <var>waiting-for-load</var> - PSE attempts to detect if power can be applied to the port. For power-on to happen there should be resistance on spare pairs in the range from 3kΩ to 26.5kΩ;
* <var>short-circuit</var> - Short-circuit is detected on PoE-Out port, power is switched off, the only detection with low voltage takes place.
* <var>overload</var> - The PoE-Out current limit is exceeded, power is switched off on PoE-Out port. For port limits see each model specifications.
* <var>voltage-too-low</var> - PD can not be powered with voltage provided from PSE.
* <var>current-too-low</var> - current-too-low means that PD draws too low current (<10mA) than normal PoE-Out device should, reason for this can be:
Delivered voltage at PD is too low for normal powering (for example Vmin = >30V, but provided 24V);

PD uses second power source which has a higher voltage than PSE, so all current is taken from second DC source, not PSE PoE-Out port;
* <var>off</var> - all detection and power is turned off for this port;
}}

{{Mr-arg-ro-table
|arg=poe-out-voltage
|type=
|default=
|desc=Displays PoE Voltage which is applied to the PD.
}}

{{Mr-arg-ro-table
|arg=poe-out-current
|type=
|default=
|desc=Displays port current (mA) which is drawn by the PD.
}}

{{Mr-arg-ro-table-end
|arg=poe-out-power
|type=
|default=
|desc=Displays PD power consumption
}}

If <code>power-cycle-ping</code> feature is used, <code>/interface ethernet poe monitor [find]</code> will show additional fields:
<pre>
power-cycle-host-alive: <YES/NO> (Shows if monitored host is reachable)
power-cycle-after:<TIME> (Shows time, after which the port will be power-cycled)
</pre>

===SNMP===

It is possible to monitor PoE-Out values using SNMP protocol, this requires enabled SNMP on PSE.

SNMP OID tables:
<ul>
<li> 1.3.6.1.4.1.14988.1.1.15.1.1.1 - interface id
<li> 1.3.6.1.4.1.14988.1.1.15.1.1.2 - interface names
<li> 1.3.6.1.4.1.14988.1.1.15.1.1.4 - voltage in dV (decivolt)
<li> 1.3.6.1.4.1.14988.1.1.15.1.1.5 - current in mA
<li> 1.3.6.1.4.1.14988.1.1.15.1.1.6 - power usage in dW (deciwatt)
</ul>

SNMP values can be requested also from the RadioOS, for example, <code>snmp-walk</code> will print current mA from all available PoE-Out ports:
<pre>
/tool snmp-walk address=10.155.149.252 oid=1.3.6.1.4.1.14988.1.1.15.1.1.5
</pre>
To get very specific OID value, use <code>snmp-get</code> tool (displays current mA on ether3 interface):
<pre>
tool snmp-get address=10.155.149.252 oid=1.3.6.1.4.1.14988.1.1.15.1.1.5.3
</pre>

===SwitchOS===

A PoE-Out controller will enable certain monitoring features also from SwitchOS, such as PoE-Out Status, PoE-Out Current, PoE-Out Voltage and PoE-Out Power usage.

All PoE-Out configuration and monitoring is located on one page, under PoE tab <code>http://<IP>/index.html#poe</code>:

[[file:SwitchOS PoE.png]]

==PoE-Out notifications==

===PoE-Out LEDs===

====Models with dependant voltage output====

PoE-Out LED behaviour can differ between models, but most of them will indicate PoE-Out state on one additional LED. Devices with one voltage output will light:

<ul>
<li> Red colour LED - PoE-Out port state is '''powered-on''' (auto or forced-on mode).
<li> Blinking Red colour LED - PoE-Out port state is '''short-circuit'''
</ul>

====Models with selectable voltage output====

Models with multiple voltage options can indicate additional information:

<ul>
<li> Green colour triangle LED - PoE-Out port state is '''powered-on''' (auto or forced-on mode), PD uses low voltage.
<li> Red colour triangle LED - PoE-Out port state is '''powered-on''' (auto or forced-on mode), PD uses high voltage (af/at or passive).
<li> Blinking Green colour triangle LED - PoE-Out port state is '''short-circuit''' or '''overload'''
<li> Blinking Red colour triangle LED - PoE-Out port state is '''short-circuit''' or '''overload'''
</ul>

===PoE-Out Logs===

By default PoE-Out event is enabled and uses "warning" and "info" topics to notify the user about PoE-Out state changes. Log entries will be added on each PoE-Out state change. Important logs will be added with "warning" topic, informative logs will be added with "info" topic.

To avoid unnecessary logging in cases when PD is not powered because of current-too-low, RadioOS will filter such events, and add one log per every 512 current-too-low events.

Logs can be disabled if necessary:
<pre>
/system logging set [find topics~"info"] topics=info,!poe-out
/system logging set [find topics~"warning"] topics=warning,!poe-out
</pre>

===PoE-Out Warnings in GUI/CLI===

To notify a user about important PoE-Out related problems, messages will be shown in Winbox / Webig and CLI interface fields:
<pre>
1 RS ;;; poe-out status: overload
ether1 ether 1500 1588 9204 64:D1:54:61:D5:E0
</pre>

Webfig and Winbox will notify user under interfaces:

[[file:WebFIG PoE WRN.png]]

==How it works==

===PoE-Out Modes===

====auto-on mode====

If auto-on is selected on PoE-Out interface, then port operates in this strict order:

<ul>
<li>PSE with low voltage checks for a resistance on the connected port. If detected resistance range is between (3kΩ to 26.5kΩ) power is turned on;
<li>When power is applied, the PSE continuously checks if overload limit is not reached or short circuit detected
<li>If the cable is unplugged, the port returns in detection state and will remain off until suitable PD is detected
</ul>

====forced-on mode====

If forced-on is selected then port operates in this strict order:
<ul>
<li>PSE disables resistance check on the port, and apply power on pins 4,5 (+) and 7,8 (-), even if no cable is attached
<li>When power is applied, PSE still continuously checks if an overload or short circuit is not detected
<li>After the cable is unplugged, the power still remains enabled on the port.
</ul>

====off mode====

If off mode is used, PoE-Out on the port will be turned off, no detection will take place, and interface will behave as a simple Ethernet port.

===PoE-Out limitations===

It is important to check PoE-Out specification to find out hardware limitations because it can differ between models

====PoE-Out port limitation====

PoE-Out ports are limited with max amp values which are supported in particular voltage, usually max current will differ for low voltage devices (up to 30 V), and for high voltage devices (31 to 57 V).

====PoE-Out total limitation====

PSE has also a total PoE-Out current limitation which can't be exceeded, even if individual port limit allows it.

====PoE Out polarity====

All CableFree PSE uses the same PoE-Out pin polarity [https://en.wikipedia.org/wiki/Power_over_Ethernet#Pinouts Mode B] 4,5 (+) and 7,8 (-), however other vendors can use opposite or Mode A pinout on PD, this would require using a special [https://en.wikipedia.org/wiki/Power_over_Ethernet#Pinouts crossover cable].

{{Note| Passive PD with high input inrush current can result in overcurrent protection on PSE, make sure that PD specification supports powering from PSE (not only from the passive power injector) }}

===Safety===

PSE has following safety features:

====PoE-Out compatibility detection====

The auto-on mode is considered safe, it will check if the resistance on the port is within allowed range and only then enable PoE out on the interface. The range is 3kΩ to 26.5kΩ

====Overload protection====

When a PoE-Out port is powered-on, it is constantly checked for overload. If overload is detected, PoE-Out is turned off on the port to avoid damage to the PD or PSE.

In seconds the PoE Out feature will be turned on again to see if the environment has changed and PD can be supplied with power again. That is important for configurations that are not connected to mains (solar installations, equipment running on batteries due to mains failure) so that when voltage drops - overload will be detected and connected devices turned off. After a while when voltage level returns to usual operating value - connected equipment can be powered up again.

====Short circuit detection====

When power is enabled on PoE-Out port, PSE continuously checks for a short circuit. If it is detected to ensure that there is no additional damage on PD and PSE, the power is turned off on all ports. PSE will continue to check PoE-Out port until environment returns to normal.

{{warning| Make sure that non-standard incompatible PD which does not have the resistance range 3kΩ to 26.5kΩ are not attached, so the PSE would not try to apply power on them}}

==PoE Out examples==

RadioOS allows to define priorities on PoE-Out ports, so if your installation is going over power budget, the PSE will disable less important PD with the lowest priority.

Priority of ''0'' is the highest priority, ''99'' - lowest

===Setting up priority===
Example of how to set priorities from CLI:

<pre>
/interface ethernet poe set ether2 poe-priority=10
/interface ethernet poe set ether3 poe-priority=13
/interface ethernet poe set ether4 poe-priority=11
/interface ethernet poe set ether5 poe-priority=14
</pre>

What will happen when power budget will go over total PoE-Out limit - first, if overload is detected, ether5 will be turned off (lowest priority), then recheck is done and if still total limit overload is detected next port in priority will be turned off, in this example, ether3 will be turned off. Both of these ports will be reached every few seconds to check if it is possible to turn PoE-Out on for these ports. Power up will happen in reverse order as the power was cut.

===Same priority===

if all, or some ports will have the same poe-priority, then port with the lowest port number will have higher priority
<pre>
/interface ethernet poe set ether2 poe-priority=10
/interface ethernet poe set ether3 poe-priority=10
/interface ethernet poe set ether4 poe-priority=10
/interface ethernet poe set ether5 poe-priority=10
</pre>

In this example, if the total PoE-Out limit is reached ether5 will be turned off first, then ether4 then ether3 as all of these ports have same poe priority.

===Monitoring PoE-Out===

PoE-Out ports can be monitored using a command <code>/interface ethernet poe monitor <interface></code>

[admin@CableFree] > interface ethernet poe monitor [find]
name: ether2 ether3 ether4 ether5
poe-out-voltage: 23.2V 23.2V 23.2V
poe-out-current: 224mA 116mA 64mA
poe-out-power: 5.1W 2.6W 1.4W

===Power-cycle ping ===

Monitor connected PD with power-cycle-ping feature:

<pre>
/interface ethernet poe set ether1 power-cycle-ping-enabled=yes power-cycle-ping-address=192.168.88.10 power-cycle-ping-timeout=30s
</pre>

In this example, PD attached to ether1 will be continuously monitored using a power-cycle-ping feature, which will send ICMP ping requests and wait for a reply. If PD with IP address 192.168.88.10 will not respond for more than 30s, the PoE-Out port will be switched off for 5s.

==Troubleshooting==

In cases where a PD does not power-up or reboots unexpectedly when powered from your PSE, it's suggested to first check:
<ul>
<li>'''PD supported input voltage''' - PSE output voltage must be in the range supported by the PD. Otherwise the PD is incompatible with the PSE, and will not be able to power-up. Check the PD datasheet.
<li>'''PD supported input PoE-in standard''' - Some PDs do not support af/at standard even if it has PoE-in support up to 57 V, check PD datasheet.
<li>'''PD is rebooted from PSE'''
<ul>
<li>Check if PD does not exceed PoE-Out port limit and Total-PoE-Out port limit of the PSE, check PSE datasheet.
<li>Check if Voltage limit does not drop bellow supported (Can be caused by voltage drop on the wires).
<li>Check if you are using a proper power supply, the output power of PSU should be calculated from:
<pre>(MAX power consumption of PSE) + (MAX power consumption of all PD) + 10%)</pre>
<li>Check if you are using good quality ethernet cables, it's important especially in cases if PoE is used.
</ul>
<li>'''Check RadioOS version''' - it's possible, that some PoE related features will be updated with RadioOS, make sure that you are running the latest version].
<li>'''PD Does not power up'''
<ul>
<li> There can be cases where a PD does not power up, even though it supports passive PoE, and does not consume more power than the specified PSE port limit. This can be caused by inrush current triggering overcurrent protection on the PSE. Make sure that PD specification supports powering from PSE (not only from passive power injector)
<li> Polarity - Devices with opposite or different pinout can be unable to powerup from all PSE. Check PD datasheet.
<li> Incompatible resistance - PD resistance on spare pairs should have range from 3kΩ to 26.5kΩ (For Passive-PoE) and from 23.75kΩ to 26.25kΩ on af/at.
</ul>
</ul>

==Legacy==

===PoE-Out Controller upgrade===

PoE-Out devices which are running RadioOS 5.x can also hold old PoE-Out controller firmware, upgrade to RadioOS 6.x will automatically update the PoE-Out firmware.
Changes between 1.x and 2.x PoE-Out controller firmware will result in higher Max-port limits (0.5A to 1A) in case if it's supported by the hardware, also will provide some additional data which can be monitored, and allow to use PoE-Out priorities.

All CableFree devices which come with RadioOS 6.x already support the latest PoE-Out firmware.

==FAQ==

[[Category:Manual|PoE]]
[[Category:Hardware|PoE]]
[[Category:Interface|PoE]]
[[Category:Case Studies|PoE]]

SwitchOS/CF-SW-VLAN-Example

2020-09-02T11:51:27Z

Administrator:

{{ Note | These are basic VLAN configuration examples, in case you need more advanced options (e.g. ingress VLAN filtering, VLAN mirroring) then please refer to [[SwitchOS/CF-SW-1G-4S%2B#VLAN_and_VLANs | VLAN Manual ]] for a more detailed property description.}}

===VLAN Example #1 (Trunk and Access Ports)===

[[File:Port-Based.png|center|frame|alt=Alt text|Example 1 Setup Diagram]]
 
1) In VLAN menu configure Default VLAN ID on planned access ports to assign untagged traffic to specific VLAN in the switch.
 
[[File:vlane1_CF-SW.png|alt=Alt text|Access Ports|center|frame]]
 
2) In VLANs menu add VLAN entries and specify port membership to certain VLANs.
 
[[File:vlane2_CF-SW.png|alt=Alt text|VLAN Membership|center|frame]]
 
3) At the end, enable strict VLAN filtering to ensure only allowed VLANs can pass through the ports.
 
[[File:vlane3_CF-SW.png|alt=Alt text|VLAN Filtering|center|frame]]
 

===VLAN Example #2 (Trunk and Hybrid Ports)===

[[File:Portbased-vlan2.png|center|frame|alt=Alt text|Example 2 Setup Diagram]]
 
1) In VLAN menu configure Default VLAN ID on planned hybrid ports to assign untagged traffic to specific VLAN in the switch.
[[File:vlane1_CF-SW.png|alt=Alt text|Default VLAN ID for untagged traffic|center|frame]]
 
2) In VLANs menu add VLAN entries and specify port membership to certain VLANs. Just like the previous example, add ports with untagged traffic (defined by Default VLAN ID) to certain VLAN (black arrows). Also, we need to add ports, which are allowed to forward tagged traffic.
[[File:SwitchOS_vlan_example2.png|alt=Alt text|VLAN Membership|center|frame]]
 
3) At the end, enable strict VLAN filtering to ensure only allowed VLANs can pass through the ports. For hybrid ports to work properly, make sure VLAN Receive is selected as <code>any</code>, otherwise ingress tagged or untagged traffic can be dropped (depending on selected option), but for the trunk port, it is possible to allow only packets with VLAN tag. To filter specific ingress VLAN traffic on hybrid ports, use [[SwitchOS/CSS326#ACL_Tab | ACL rules]].
[[File:vlane3_CF-SW.png|alt=Alt text|VLAN Filtering|center|frame]]

File:Vlane1 CF-SW.png

2020-09-02T11:50:11Z

Administrator:

File:Vlane2 CF-SW.png

2020-09-02T11:49:36Z

Administrator:

File:Vlane3 CF-SW.png

2020-09-02T11:48:54Z

Administrator:

File:SwitchOS vlan example2.png

2020-09-02T11:48:10Z

Administrator:

SwitchOS/CF-SW-VLAN-Example

2020-09-02T11:47:14Z

Administrator:

{{ Note | These are basic VLAN configuration examples, in case you need more advanced options (e.g. ingress VLAN filtering, VLAN mirroring) then please refer to [[SwitchOS/CRS3xx#VLAN_and_VLANs | VLAN Manual ]] for a more detailed property description.}}

===VLAN Example #1 (Trunk and Access Ports)===

[[File:Port-Based.png|center|frame|alt=Alt text|Example 1 Setup Diagram]]
 
1) In VLAN menu configure Default VLAN ID on planned access ports to assign untagged traffic to specific VLAN in the switch.
 
[[File:vlane1_CF-SW.png|alt=Alt text|Access Ports|center|frame]]
 
2) In VLANs menu add VLAN entries and specify port membership to certain VLANs.
 
[[File:vlane2_CF-SW.png|alt=Alt text|VLAN Membership|center|frame]]
 
3) At the end, enable strict VLAN filtering to ensure only allowed VLANs can pass through the ports.
 
[[File:vlane3_CF-SW.png|alt=Alt text|VLAN Filtering|center|frame]]
 

===VLAN Example #2 (Trunk and Hybrid Ports)===

[[File:Portbased-vlan2.png|center|frame|alt=Alt text|Example 2 Setup Diagram]]
 
1) In VLAN menu configure Default VLAN ID on planned hybrid ports to assign untagged traffic to specific VLAN in the switch.
[[File:vlane1_CF-SW.png|alt=Alt text|Default VLAN ID for untagged traffic|center|frame]]
 
2) In VLANs menu add VLAN entries and specify port membership to certain VLANs. Just like the previous example, add ports with untagged traffic (defined by Default VLAN ID) to certain VLAN (black arrows). Also, we need to add ports, which are allowed to forward tagged traffic.
[[File:SwitchOS_vlan_example2.png|alt=Alt text|VLAN Membership|center|frame]]
 
3) At the end, enable strict VLAN filtering to ensure only allowed VLANs can pass through the ports. For hybrid ports to work properly, make sure VLAN Receive is selected as <code>any</code>, otherwise ingress tagged or untagged traffic can be dropped (depending on selected option), but for the trunk port, it is possible to allow only packets with VLAN tag. To filter specific ingress VLAN traffic on hybrid ports, use [[SwitchOS/CSS326#ACL_Tab | ACL rules]].
[[File:vlane3_CF-SW.png|alt=Alt text|VLAN Filtering|center|frame]]

File:Port-Based.png

2020-09-02T11:45:50Z

Administrator:

SwitchOS/CF-SW-VLAN-Example

2020-09-02T11:41:52Z

Administrator: Created page with "{{ Note | These are basic VLAN configuration examples, in case you need more advanced options (e.g. ingress VLAN filtering, VLAN mirroring) then please refer to SwitchOS/CRS..."

{{ Note | These are basic VLAN configuration examples, in case you need more advanced options (e.g. ingress VLAN filtering, VLAN mirroring) then please refer to [[SwitchOS/CRS3xx#VLAN_and_VLANs | VLAN Manual ]] for a more detailed property description.}}

===VLAN Example #1 (Trunk and Access Ports)===

[[File:Port-Based.png|center|frame|alt=Alt text|Example 1 Setup Diagram]]
 
1) In VLAN menu configure Default VLAN ID on planned access ports to assign untagged traffic to specific VLAN in the switch.
 
[[File:vlane1_css326.png|alt=Alt text|Access Ports|center|frame]]
 
2) In VLANs menu add VLAN entries and specify port membership to certain VLANs.
 
[[File:vlane2_css326.png|alt=Alt text|VLAN Membership|center|frame]]
 
3) At the end, enable strict VLAN filtering to ensure only allowed VLANs can pass through the ports.
 
[[File:vlane3_css326.png|alt=Alt text|VLAN Filtering|center|frame]]
 

===VLAN Example #2 (Trunk and Hybrid Ports)===

[[File:Portbased-vlan2.png|center|frame|alt=Alt text|Example 2 Setup Diagram]]
 
1) In VLAN menu configure Default VLAN ID on planned hybrid ports to assign untagged traffic to specific VLAN in the switch.
[[File:vlane1_css326.png|alt=Alt text|Default VLAN ID for untagged traffic|center|frame]]
 
2) In VLANs menu add VLAN entries and specify port membership to certain VLANs. Just like the previous example, add ports with untagged traffic (defined by Default VLAN ID) to certain VLAN (black arrows). Also, we need to add ports, which are allowed to forward tagged traffic.
[[File:SwitchOS_vlan_example2.png|alt=Alt text|VLAN Membership|center|frame]]
 
3) At the end, enable strict VLAN filtering to ensure only allowed VLANs can pass through the ports. For hybrid ports to work properly, make sure VLAN Receive is selected as <code>any</code>, otherwise ingress tagged or untagged traffic can be dropped (depending on selected option), but for the trunk port, it is possible to allow only packets with VLAN tag. To filter specific ingress VLAN traffic on hybrid ports, use [[SwitchOS/CSS326#ACL_Tab | ACL rules]].
[[File:vlane3_css326.png|alt=Alt text|VLAN Filtering|center|frame]]

SwitchOS/CF-SW-1G-4S+

2020-09-02T11:39:08Z

Administrator: /* Reset and Reinstall */

==Summary==

SwitchOS is an operating system designed specifically for administration of CableFree switch products.


SwitchOS is configurable from your web browser. It gives you all the basic functionality for a managed switch, plus more: allows to manage port-to-port forwarding, broadcast storm control, apply MAC filter, configure VLANs, mirror traffic, apply bandwidth limitation and even adjust some MAC and IP header fields.

{{Warning | Each CableFree device switch series device has its own firmware which cannot be installed on other series models!
}}

==CF-SW- 1G-4S+ series features==
<table class="styled_table">
<tr><th width="25%">Features</th><th>Description</th></tr>
<tr>
<td>'''Forwarding'''</td>
<td><ul class="bullets">
<li>Full non-blocking wirespeed switching</li>
<li>Up to 16k MAC entries in Host table</li>
<li>Forwarding Database works based on SVL or IVL</li>
<li>Port Isolation</li>
<li>Jumbo frame support - 10218 bytes</li>
</ul></td>
</tr>
<tr>
<td>'''Spanning Tree Protocol'''</td>
<td>
<ul class="bullets">
<li>RSTP support</li>
</ul></td>
</tr>
<tr>
<td>'''Link Aggregation'''</td>
<td>
<ul class="bullets">
<li>Supports 802.3ad LACP groups</li>
<li>Supports static link aggregation groups</li>
<li>Up to 16 link aggregation groups</li>
<li>Up to 8 member ports per a group</li>
<li>Hardware automatic failover and load balancing</li>
</ul></td>
</tr>
<tr>
<td>'''Multicast Forwarding'''</td>
<td>
<ul class="bullets">
<li>IGMP Snooping support</li>
<li>Unknown Multicast Filtering</li>
</ul></td>
</tr>
<tr>
<td>'''Mirroring'''</td>
<td>
<ul class="bullets">
<li>Port based mirroring</li>
</ul></td>
</tr>
<tr>
<td>'''VLAN'''</td>
<td>
<ul class="bullets">
<li>Fully compatible with IEEE802.1Q</li>
<li>Port based VLAN</li>
<li>Up to 250 VLAN entries (limited by SwitchOS)</li>
<li>VLAN filtering</li>
</ul></td>
</tr>
<tr>
<td>'''Security'''</td>
<td>
<ul class="bullets">
<li>Port Lock</li>
<li>Broadcast Storm Control</li>
<li>DHCP & PPPoE Snooping</li>
</ul></td>
</tr>
<tr>
<td>'''Quality of Service (QoS)'''</td>
<td>
<ul class="bullets">
<li>Ingress traffic limiting</li>
</ul></td>
</tr>
<tr>
<td>'''Access Control List'''</td>
<td><ul class="bullets">
<li>Ingress ACL tables</li>
<li>Up to 32 ACL rules (limited by SwitchOS)</li>
<li>Classification based on ports, L2, L3, L4 protocol header fields</li>
<li>ACL actions include filtering, forwarding and modifying of the protocol header fields</li>
</ul></td>
</tr>
</table>

==Models==
This table clarifies the main differences between CableFree Switch-OS enabled Switch models.

{| border="1" class="wikitable collapsible sortable" style="text-align: center"
| nowrap style="background-color: #CCC;* " | Model
| nowrap style="background-color: #CCC;* " | Switch Chip
| nowrap style="background-color: #CCC;* " | Serial console
| nowrap style="background-color: #CCC;* " | PoE-in support
| nowrap style="background-color: #CCC;* " | PoE-out support
| nowrap style="background-color: #CCC;* " | Health monitor
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-24G-2S+
| Marvell-98DX3236
| +
| ether1, Passive PoE
| -
| CPU temperature
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-24P-4S+
| Marvell-98DX3236
| +
| -
| ether1 - ether24, 802.3af/at
| CPU and board temperature, fan speed, PSU voltage and current, PoE-out monitoring
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-4C-20S-4S+
| Marvell-98DX3236
| +
| -
| -
| CPU temperature, fan speed, PSU state
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-1G-16S+
| Marvell-98DX8216
| +
| -
| -
| CPU temperature, fan speed, PSU state
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-1G-4S+
| Marvell-98DX3236
| -
| ether1, 802.3af/at
| -
| CPU temperature
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-1G-8S+
| Marvell-98DX8208
| +
| ether1, 802.3af/at
| -
| CPU temperature
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-4C+8XG
| Marvell-98DX8212
| +
| -
| -
| CPU temperature, fan speed, PSU state
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-24S+2Q+
| Marvell-98DX8332
| +
| -
| -
| CPU temperature, fan speed, PSU state
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-16P-2S+
| Marvell-98DX226S
| -
| -
| ether1 - ether16, 802.3af/at
| CPU temperature, PSU voltage and current, PoE-out monitoring.
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-18-1Fi-15Fr-2S
| Marvell-98DX224S
| -
| ether1-ether14, ether16, Passive PoE
| ether15, Passive PoE
| CPU temperature
|}

==Connecting to the Switch==

Open your web browser and enter IP address of your Switch (192.168.88.1 by default) and login screen will appear.

[[File:SwitchOS_login_CF-SW.png|center|alt=Alt text|SwitchOS Login|frame]]

SwitchOS default IP address: 192.168.88.1, user name: admin and there is no password.


{{ Note | CableFree Neighbor Discovery protocol tools can be used to discover IP address of CableFree switch. [[Manual:IP/Neighbor_discovery]]. Currently LLDP is not supported.}}

==Interface Overview==


SwitchOS interface menu consists of multiple tabs depending on the device model. These are all possible SwitchOS menus: Link, PoE, SFP, Port Isolation, LAG, Forwarding, RSTP, Stats, Errors, Hist, VLAN, VLANs, Hosts, IGMP, SNMP, ACL, System, Health and Upgrade.



Description of buttons in SwitchOS configuration tool:
* Append - add new item to the end of the list
* Apply All - applies current configuration changes
* Cut - removes item from the list
* Clear - resets properties of the item
* Discard Changes - removes unsaved configuration
* Insert - add new item to the list (places it before current item)
* Sort - sort VLAN table by VLAN-IDs; sort host table by MAC addresses
 
* Change Password - changes password of the switch
* Logout - logout from current Switch
* Reboot - reboot the switch
* Reset Configuration - reset configuration back to factory defaults
* Choose File - browse for upgrade or backup file
* Upgrade - upgrade firmware of the Switch
* Restore Backup - restore Switch using selected backup file
* Save Backup - generate and download backup file from the Switch


==System==

System Tab performs the following functions:
* General information about Switch
* Switch management
* Configuration reset
* Backup and restore configuration

{{ Note | SwitchOS uses a simple algorithm to ensure TCP/IP communication - it just replies to the same IP and MAC address packet came from. This way there is no need for Default Gateway on the device itself.}}

[[File:SwitchOS_system_CF-SW.png|alt=Alt text|General Settings|center|frame]]
 
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Address Acquisition</td><td>Specify which address acquisition method to use:
* <code>DHCP with fallback</code> - For first 10 seconds switch uses DHCP client. If request is unsuccessful, then address is set as a Static IP Address value
* <code>static</code> - Address is set as a Static IP Address value
* <code>DHCP only</code> - Switch uses DHCP client to acquire address</td>
</tr>
<tr>
<td>Static IP Address</td><td>IP address of the switch in case of Address Acquisition is set as <code>DHCP with fallback</code> or <code>static</code></td>
</tr>
<tr>
<td>Identity</td><td>Name of the switch (for CableFree Neighbor Discovery protocol)</td>
</tr>
<tr>
<td>Allow From</td><td>IP address from which the switch is accessible. Default value is '0.0.0.0/0' - any address</td>
</tr>
<tr>
<td>Allow From Ports</td><td>List of switch ports from which it is accessible</td>
</tr>
<tr>
<td>Allow From VLAN</td><td>VLAN ID from which the switch is accessible (VLAN Mode on ingress port must be other than <code>'''disabled'''</code> in order to connect)</td>
</tr>
<tr>
<td>Watchdog</td><td>Enable or disable system Watchdog. It will reset CPU of the switch in case of fault condition</td>
</tr>
<tr>
<td>Independent VLAN Lookup</td><td>Enable or disable independent VLAN lookup in the Host table for packet forwarding</td>
</tr>
<tr>
<td>IGMP Snooping</td><td>Enable or disable IGMP Snooping</td>
</tr>
<tr>
<td>CableFree Discovery Protocol</td><td>Enable or disable CableFree Neighbor Discovery protocol</td>
</tr>
<tr>
<td>MAC Address</td><td>MAC address of the switch (Read-only)</td>
</tr>
<tr>
<td>Serial Number</td><td>Serial number of the switch (Read-only)</td>
</tr>
<tr>
<td>Board Name</td><td>CableFree model name of the switch (Read-only)</td>
</tr>
<tr>
<td>Uptime</td><td>Current switch uptime (Read-only)</td>
</tr>
</table>

===DHCP & PPPoE Snooping===

[[File:CF-SW_DHCPSnooping.png|alt=Alt text|DHCP & PPPoE snooping settings|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Trusted Ports</td><td>Group of ports, which allows DHCP or PPPoE servers to provide a requested information. Mainly used to limit unauthorized servers to provide malicious information for users, access ports usually do not configure as trusted</td>
</tr>
<tr>
<td>Add Information Option</td><td>Enables or disables DHCP Option-82 information. When enabled, the Option-82 information (Agent Remote ID and Circuit ID) is added for DHCP packets received from untrusted ports. Can be used together with Option-82 capable DHCP server to assign IP addresses and implement policies</td>
</tr>
</table>

===Password and Backup===
[[File:SwitchOS_system3_CF-SW.png|alt=Alt text|System Management Settings|center|frame]]

==Link==
Link Tab allows you to configure each interface settings and monitor link status

[[File:SwitchOS_link_CF-SW.png|center|alt=Alt text|Link Settings|center|frame]]
 
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Enabled</td><td>Enable or disable port</td>
</tr>
<tr>
<td>Name</td><td>Editable port name</td>
</tr>
<tr>
<td>Link Status</td><td>Current link status (Read-only)</td>
</tr>
<tr>
<td>Auto Negotiation</td><td>Enable or disable auto negotiation</td>
</tr>
<tr>
<td>Speed</td><td>Specify speed setting of the port (requires auto negotiation to be disabled)</td>
</tr>
<tr>
<td>Full Duplex</td><td>Specify duplex mode of the port (requires auto negotiation to be disabled)</td>
</tr>
<tr>
<td>Flow control </td><td>Enable or disable 802.3x Flow control</td>
</tr>
</table>

==PoE==

Devices with PoE-out support have some configuration options and certain monitoring features, like PoE-out current, voltage, etc. For more detailed description, see [[Manual:PoE-Out]].

[[File:SwitchOS PoE.png|alt=Alt text|PoE tab|center|frame]]

==SFP==
SFP tab allows you to monitor status of SFP/SFP+ modules.
[[File:SwitchOS_sfp1_CF-SW.png|alt=Alt text|SFP Tab|center|frame]]

==Port Isolation==
Port Isolation table allows or restricts traffic forwarding between specific ports. By default, all available switch chip ports can communicate with any other port, there is no isolation used. When the checkbox is enabled/ticked you allow to forward traffic from this port towards the ticked port. Below are some port isolation examples.

{|align="center"
|[[File:SwitchOS_IsolatedGroups.png|alt=Alt text|In some scenarios you might need to isolate a group of devices from other groups. In this example devices on '''Port1-Port5''' are not able to communicate with '''Port6-Port10''' devices, and vice versa. |frame]]
|[[File:SwitchOS_PrivateVLAN.png|alt=Alt text|In some scenarios you might need to forward all traffic to an uplink port while all other ports are isolated from each other. This kind of setup is called '''Private VLAN''' configuration. The switch will forward all Ethernet frames only to the uplink '''Port1''', while uplink can reach all other ports|frame]]
|[[File:SwitchOS Management.png|alt=Alt text|Individual isolated '''Port1''' (e.g. for management purpose), it cannot send or receive traffic from any other port|frame]]
|}

{{ Note | It is possible to check/uncheck multiple checkboxes by checking one of them and then dragging horizontally (Click & Drag).}}
{{ Note | (R)STP will only work properly in Private VLAN setups. In setups with multiple isolated switch groups (R)STP might not properly receive BPDUs and therefore fail to detect network loops.}}

==LAG==
IEEE 802.3ad (LACP) compatible link aggregation is supported, as well as static link aggregation to ensure failover and load balancing based on Layer2 and Layer3 hashing.
Up to 16 link aggregation groups with up to 8 ports per a group are supported.
[[File:SwitchOS_lag_CF-SW.png|alt=Alt text|LAG Tab|center|frame]]

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>


Each individual port can be configured as Passive LACP, Active LACP or a Static LAG port.


<tr>
<td>Mode ''(default: passive)''</td>
<td>Specify LACP packet exchange mode or Static LAG mode on ports:
* <code>Passive</code>: Place port in listening state, use LACP only when it's contrary port uses active LACP mode
* <code>Active</code>: Prefer to start LACP regardless contrary port mode
* <code>Static</code>: Set port in a Static LAG mode</td>
</tr>
</table>
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<tr>
<td>Group</td><td>Specify a Static LAG group </td>
</tr>
<tr>
<td>Trunk ''(read only)''</td><td>Represents group number port belongs to.</td>
</tr>
<tr>
<td>Partner ''(read only)''</td><td>Represents partner mac-address.</td>
</tr>
</table>

==Forwarding==
Forwarding Tab provides advanced forwarding options among switch ports, port locking, port mirroring, bandwidth limit and broadcast storm control features.
[[File:SwitchOS_forw_CF-SW.png|center|alt=Alt text|Forwarding Settings|center|frame]]
 
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Port Lock</td><td>
* <code>Port Lock</code> - Enables or disables MAC address learning on this port. When option is enabled, it will restrict MAC address learning and static MAC addresses should be configured. Any received frames with unknown source MAC address will be dropped
* <code>Lock On First</code> - Allows to learn source MAC address from the first received frame, this property should be used together with <code>Port Lock</code>. Learning of the first MAC address will reset every time an interface status changes</td>
</tr>
<tr>
<td>Port Mirroring</td><td>
* <code>Mirror Ingress</code> - Whether traffic entering this port must be copied and forwarded to mirroring target port
* <code>Mirror Egress</code> - Whether traffic leaving this port must be copied and forwarded to mirroring target port
* <code>Mirror To</code> - Mirroring target port</td>
</tr>
<tr>
<td>Broadcast Storm Control</td><td>
* <code>Storm Rate (%)</code> - Limit the number of broadcast packets transmitted by an interface. The rate is measured in percents of the link speed.

* <code>Include Unknown Unicast</code> - Include unicast packets without an entry in host table in <code>Storm Rate</code> limitation</td>
</tr>
<tr>
<td>Bandwidth Limit</td><td>
* <code>Ingress Rate</code> - Limit traffic entering this port (bps)
</tr>
</table>

==RSTP==
Per port and global RSTP configuration and monitoring is available in the RSTP menu.
[[File:SwitchOS_rstp_CF-SW.png|center|alt=Alt text|RSTP Settings|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<tr>
<td>Bridge Priority (hex)</td><td>RSTP bridge priority for Root Bridge selection</td>
</tr>
<tr>
<td>Port Cost Mode</td><td>There are two methods for automatically detecting RSTP port cost depending on link speed.
* <code>'''short'''</code>: 40G - 1; 10G - 2; 1G - 4; 100M - 10; 10M - 100
* <code>'''long'''</code>: 40G - 500; 10G - 2000; 1G - 20000; 100M - 200000; 10M - 2000000</td>
</tr>
<tr>
<td>Root Bridge</td><td>The priority and MAC address of the selected Root Bridge in the network (Read-only)</td>
</tr>
</table>
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>RSTP</td><td>Enable or disable STP/RSTP functionality on this port</td>
</tr>
<tr>
<td>Mode</td><td> Shows STP/RSTP functionality mode on specific port (Read-only):
* <code>RSTP</code>
* <code>STP</code></td>
</tr>
<tr>
<td>Role</td><td>Shows specific port role (Read-only):
* <code>root</code> - port that is facing towards the root bridge and will be used to forward traffic from/to the root bridge
* <code>alternate</code> - port that is facing towards root bridge, but is not going to forward traffic (a backup for root port)
* <code>backup</code> - port that is facing away from the root bridge, but is not going to forward traffic (a backup for non-root port)
* <code>designated</code> - port that is facing away from the root bridge and is going to forward traffic
* <code>disabled</code> - port that is not strictly part of STP (RSTP functionality is disabled) </td>
</tr>
<tr>
<td>Root Path Cost</td><td>Shows root path cost for ports that are facing root bridge (Read-only)</td>
</tr>
<tr>
<td>Type</td><td>
* <code>edge</code> - ports that are not supposed to receive any BPDUs, should be connected to end station (Read-only)
* <code>point-to-point</code> - ports that operates in full-duplex links, can be part of STP and operate in forwarding state (Read-only)</td>
</tr>
<tr>
<td>State</td><td>Shows each port state (Read-only):
* <code>forwarding</code> - port participates in traffic forwarding and is learning MAC addresses, is receiving BPDUs
* <code>discarding</code> - port does not participate in traffic forwarding and is not learning MAC addresses, is receiving BPDU
* <code>learning</code> - port does not participate in traffic forwarding, but is learning MAC addresses</td>
</tr>
</table>

==Stats, Errors and Histogram==
These menus provide detailed information about received and transmitted packets.
[[File:SwitchOS_stat1_CF-SW.png|center|alt=Alt text|Port statistics|center|frame]]
[[File:SwitchOS_stat2_CF-SW.png|center|alt=Alt text|Port error statistics|center|frame]]
[[File:SwitchOS_stat3_CF-SW.png|center|alt=Alt text|Port histogram statistics|center|frame]]

{{ Note | Statistics for SFP+ interface are cleared whenever an active SFP+ link is established.}}

==VLAN and VLANs==

VLAN configuration for switch ports.

[[File:SwitchOS_vlan_CF-SW.png|center|alt=Alt text|Port VLAN Settings|center|frame]]
 

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-table
|arg=VLAN Mode
|type=disabled {{!}} optional {{!}} enabled {{!}} strict
|default=optional
|desc=VLAN filtering mode, these options are relevant to egress ports (except for <var>strict</var> mode).
* <var>disabled</var> - VLAN table is not used. Switch discards packets with a VLAN tag on egress ports. If the packet has a VLAN tag and the VLAN ID matches <code>Default VLAN ID</code> on egress ports, then with <code>VLAN Receive=any</code> the switch will remove the VLAN tag and forward the packet.
* <var>optional</var> - Disabled VLAN filtering. Handle packets with VLAN tag ID that is not present in VLAN table just like packets without VLAN tag.
* <var>enabled</var> - Enabled VLAN filtering. Drop packets with VLAN tag ID that is not present in VLAN table. Default VLAN ID must be specified for access ports since it will be used to tag ingress traffic and untag egress traffic for the certain port.
* <var>strict</var> - Enabled VLAN filtering with additional ingress filtering, which checks if the ingress port is a member of the received VLAN ID in the VLAN table. Received packets on the ingress port with a VLAN ID that does not match with VLAN table will be dropped. Default VLAN ID must be specified for access ports since it will be used to tag ingress traffic and untag egress traffic for the certain port.
}}

{{Mr-arg-table
|arg=VLAN Receive
|type=any {{!}} only tagged {{!}} only untagged
|default=optional
|desc=Ingress traffic filtering based on VLAN tag presence.
* <var>any</var> - Allows tagged and untagged packets on a certain port
* <var>only tagged</var> - Allows only packets with a VLAN tag
* <var>only untagged</var> - Allows only packets without a VLAN tag
}}

{{Mr-arg-table
|arg=Default VLAN ID
|type=integer: 1..4095
|default=1
|desc=VLAN ID which will be assigned on ingress traffic. Only has effect on untagged traffic, it will be ignored for tagged traffic. This parameter is usually used to allocate access ports with specific VLAN. It is also used to untag egress traffic if packet's VLAN ID matches Default VLAN ID.
}}

{{Mr-arg-table-end
|arg=Force VLAN ID
|type=integer: yes {{!}} no
|default=no
|desc=Assigns the <code>Default VLAN ID</code> value to all ingress traffic (tagged and untagged). Has effect in all VLAN Modes. If port receives tagged traffic and <code>Default VLAN ID</code> is set to 1, then with this parameter the egress traffic will be untagged.
}}

 
VLAN membership configuration for switch ports.
[[File:SwitchOS_vlans_CF-SW.png|center|alt=Alt text|VLAN Table Settings|center|frame]]
 

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-table
|arg=VLAN ID
|type=integer: 1..4095
|default=0
|desc=VLAN ID to which assign ports.
}}

{{Mr-arg-table
|arg=Port Isolation
|type=yes {{!}} no
|default=yes
|desc=Use settings from <code>Port Isolation</code> menu to isolate the defined VLAN to only certain ports. When disabled, the switch will ignore port isolation configuration and forward traffic with the defined VLAN ID only to ports that are checked as members.
}}

{{Mr-arg-table
|arg=Learning
|type=yes {{!}} no
|default=yes
|desc=Enables or disables MAC address learning on the defined VLAN. If disabled, then all learned MAC addresses will appear as they have had been learned from VLAN 1.
}}

{{Mr-arg-table
|arg=Mirror
|type=yes {{!}} no
|default=no
|desc=Enables or disables VLAN based mirroring. When enabled and <code>Mirror To</code> is set in the <code>Forwarding</code> menu, then all traffic from the defined VLAN will be mirrored to the selected port.
}}

{{Mr-arg-table
|arg=IGMP Snooping
|type=yes {{!}} no
|default=no
|desc=Enables or disables IGMP Snooping on the defined VLAN. When enabled, the switch will listen to IGMP Join and Leave requests from the defined VLAN and only forward traffic to ports, which have sent IGMP membership requests from the defined VLAN. When disabled, the switch will flood all VLAN member ports with Multicast traffic.
}}

{{Mr-arg-table-end
|arg=Members
|type=ports
|default=none
|desc=Group of ports, which are allowed to forward traffic on the defined VLAN.
}}

===VLAN Configuration Example===

Simple trunk and access port configuration, as well as trunk and hybrid port configuration examples can be found in this article - [[SwitchOS/CF-SW-VLAN-Example]].

==Hosts==
This table represents dynamically learnt MAC address to port mapping entries. It can contain two kinds of entries: dynamic and static. Dynamic entries get added automatically, this is also called a learning process: when switch receives a packet from certain port, it adds the packet's source MAC address and port it received the packet from to host table, so when a packet comes in with certain destination MAC address it knows to which port it should forward the packet. If the destination MAC address is not present in host table then it forwards the packet to all ports in the group. Dynamic entries take about 5 minutes to time out. CF-SW-xx devices supports 16383 host table entries.
Static entries will take over dynamic if dynamic entry with same mac-address already exists. Also by adding a static entry you get access to some more functionality.

[[File:SwitchOS_shost_CF-SW.png|center|alt=Alt text|Host Table|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Ports</td><td>Ports the packet should be forwarded to</td>
</tr>
<tr>
<td>MAC</td><td>MAC address</td>
</tr>
<tr>
<td>VLAN ID</td><td>VLAN ID</td>
</tr>
<tr>
<td>Drop</td><td>Packet with certain MAC address coming from certain ports can be dropped</td>
</tr>
<tr>
<td>Mirror</td><td>Packet can be cloned and sent to mirror-target port</td>
</tr>
</table>
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Port</td><td>Ports the packet should be forwarded to (Read-only)</td>
</tr>
<tr>
<td>MAC</td><td>Learned MAC address (Read-only)</td>
</tr>
<tr>
<td>VLAN ID</td><td>Learned VLAN ID (Read-only)</td>
</tr>
</table>

==IGMP Snooping==

IGMP Snooping which controls multicast streams and prevents multicast flooding is implemented in SwitchOS starting from version 2.5. The feature allows a switch to listen in the IGMP conversation between hosts and routers.

Enable this option under System tab.
[[File:IGMP-snooping.png|alt=Alt text|IGMP Snooping under System tab|center|frame]]
 

Available IGMP snooping data can be found under IGMP tab:
[[File:CF-SW-xx-IGMP.png|alt=Alt text|IGMP Snooping table|center|frame]]
 

It is possible to enable IGMP Snooping for a specific VLAN ID under VLANs menu.

{{ Note | IGMP Snooping for VLANs requires enabled "Independent VLAN Lookup" in the System menu.}}

[[File:IGMP-vlantab.png|alt=Alt text|IGMP Snooping VLANs settings|center|frame]]

==SNMP==

SwitchOS supports SNMP v1 and uses IF-MIB, SNMPv2-MIB, BRIDGE-MIB and CABLEFREE-MIB (only for health, PoE-out and SFP diagnostics) for SNMP reporting.


Available SNMP data:
* <code>System information</code>
* <code>System uptime</code>
* <code>Port status</code>
* <code>Interface statistics</code>
* <code>Host table information</code>

[[File:SwitchOS-snmp2.png|alt=Alt text|SNMP settings|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Enabled</td><td>Enable or disable SNMP service</td>
</tr>
<tr>
<td>Community</td><td>SNMP community name</td>
</tr>
<tr>
<td>Contact Info</td><td>Contact information for the NMS</td>
</tr>
<tr>
<td>Location</td><td>Location information for the NMS</td>
</tr>
</table>

==ACL Tab==

An access control list (ACL) rule table is very powerful tool allowing wire speed packet filtering, forwarding and VLAN tagging based on L2,L3 protocol header field conditions. Each rule contains a conditions part and an action part.

[[File:CF-SW-ACL-table.png|frameless|border|upright=4.4|center|CF-SW-24G-2S+ ACL table]]

<div style="clear:both"></div>

<h3>Conditions part parameters</h3>

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>From</td><td>Port that packet came in from</td>
</tr>
<tr>
<td>MAC Src</td><td>Source MAC address and mask</td>
</tr>
<tr>
<td>MAC Dst</td><td>Destination MAC address and mask</td>
</tr>
<tr>
<td>Ethertype</td><td>Protocol encapsulated in the payload of an Ethernet Frame</td>
</tr>
<tr>
<td>VLAN</td><td>
VLAN header presence:
* any
* present
* not present</td>
</tr>
<tr>
<td>VLAN ID</td><td>VLAN tag ID</td>
</tr>
<tr>
<td>Priority</td><td>Priority in VLAN tag</td>
</tr>
<tr>
<td>IP Src (IP/netmask:port)</td><td>Source IPv4 address, netmask and L4 port number</td>
</tr>
<tr>
<td>IP Dst (IP/netmask:port)</td><td>Destination IPv4 address, netmask and L4 port number</td>
</tr>
<tr>
<td>Protocol ''(integer)''</td><td>IP protocol</td>
</tr>
<tr>
<td>DSCP</td><td>IP DSCP field</td>
</tr>
</table>

<h3>Action part parameters</h3>

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Redirect To</td><td>Force new packets destination port</td>
</tr>
<tr>
<td>Mirror</td><td>Clones packet and sends it to mirror-target port</td>
</tr>
<tr>
<td>Rate</td><td>Limits bandwidth (bps)</td>
</tr>
<tr>
<td>Drop</td><td>Drop packet</td>
</tr>
<tr>
<td>Set VLAN ID</td><td>Changes the VLAN tag ID, if VLAN tag is present</td>
</tr>
<tr>
<td>Priority</td><td>Changes the VLAN tag priority bits, if VLAN tag is present</td>
</tr>
</table>

==Health==

This menu provides different health related properties.

[[File:SwitchOS_CF-SW_health.png|alt=Alt text|CF-SW-24P-4S+ Health|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>CPU Temperature</td><td>Shows CPU temperature in celsius temperature scale (Read-only)</td>
</tr>
<tr>
<td>Board Temperature</td><td>Shows PCB temperature in celsius temperature scale (Read-only)</td>
</tr>
<tr>
<td>FAN</td><td>Shows FAN rotational speed (Read-only)</td>
</tr>
<tr>
<td>PSU</td><td>Shows PSU related information depending on device model (Read-only):
* PSU state, either failed or ok
* PSU voltage and consumed miliamperes by PoE-out connected devices
</td>
</tr>
</table>

{{ Note | For devices with only a CPU temperature sensor health information is available under System menu.}}

== Reset and Reinstall ==

With a reset button you can restore RadioOS default-configuration, from where you can configure SwitchOS using RadioOS.

CF-SW-xx devices with a serial console have some additional options.
* To change between RadioOS and SwitchOS follow these steps:
# Connect to the device using a serial console
# Enter R-BOOT setup
# Chose "j - boot os"
# Chose either RadioOS or SwitchOS

* It is possible to load a SwitchOS backup firmware in case standard firmware breaks or upgrade fails:
# Connect to the device using a serial console
# Boot SwitchOS
# Choose "p - boot primary SwitchOS"
# After loading backup firmware, it is possible to connect to 192.168.88.1 using a web browser and install new SwitchOS firmware.

* To reset SwitchOS configuration:
# Connect to the device using a serial console
# Boot SwitchOS
# Choose "r - reset configuration"

<div style="clear:both"></div>

SwitchOS/CF-SW-1G-4S+

2020-09-02T11:38:25Z

Administrator: /* Reset and Reinstall */

File:SwitchOS CF-SW health.png

2020-09-02T11:37:25Z

Administrator:

File:CF-SW-ACL-table.png

2020-09-02T11:37:12Z

Administrator:

File:SwitchOS-snmp2.png

2020-09-02T11:37:04Z

Administrator:

File:IGMP-vlantab.png

2020-09-02T11:36:46Z

Administrator:

File:CF-SW-xx-IGMP.png

2020-09-02T11:36:34Z

Administrator:

File:IGMP-snooping.png

2020-09-02T11:36:25Z

Administrator:

File:SwitchOS shost CF-SW.png

2020-09-02T11:35:08Z

Administrator:

File:SwitchOS vlans CF-SW.png

2020-09-02T11:33:06Z

Administrator:

File:SwitchOS vlan CF-SW.png

2020-09-02T11:32:08Z

Administrator:

File:SwitchOS stat3 CF-SW.png

2020-09-02T11:32:02Z

Administrator:

File:SwitchOS stat2 CF-SW.png

2020-09-02T11:31:57Z

Administrator:

File:SwitchOS stat1 CF-SW.png

2020-09-02T11:31:51Z

Administrator:

File:SwitchOS rstp CF-SW.png

2020-09-02T11:26:59Z

Administrator:

File:SwitchOS forw CF-SW.png

2020-09-02T11:26:47Z

Administrator:

File:SwitchOS lag CF-SW.png

2020-09-02T11:26:15Z

Administrator:

File:SwitchOS Management.png

2020-09-02T11:25:46Z

Administrator:

File:SwitchOS PrivateVLAN.png

2020-09-02T11:25:41Z

Administrator:

File:SwitchOS IsolatedGroups.png

2020-09-02T11:25:18Z

Administrator:

File:SwitchOS sfp1 CF-SW.png

2020-09-02T11:01:33Z

Administrator:

File:SwitchOS PoE.png

2020-09-02T11:01:19Z

Administrator:

File:SwitchOS link CF-SW.png

2020-09-02T11:00:36Z

Administrator:

File:SwitchOS system3 CF-SW.png

2020-09-02T11:00:11Z

Administrator:

File:CF-SW DHCPSnooping.png

2020-09-02T10:59:46Z

Administrator:

File:SwitchOS system CF-SW.png

2020-09-02T10:59:05Z

Administrator:

File:SwitchOS login CF-SW.png

2020-09-02T10:36:07Z

Administrator:

SwitchOS

2020-09-01T14:36:14Z

Administrator: /* CableFree Switch Manuals */

CableFree SwitchOS is an operating system designed specifically for administration of CableFree IP/Ethernet switch products.

SwitchOS is easily configurable using a web browser. SwitchOS gives you all the basic functionality for a managed switch, plus more: allows to manage port-to-port forwarding, broadcast storm control, apply MAC filter, configure VLANs, mirror traffic, apply bandwidth limitation and even adjust some MAC and IP header fields.

== CableFree Switch Manuals ==
* [[SwitchOS/CF-SW-5G-1S | CF-SW-5G-1S series Manual]]
* [[SwitchOS/CF-SW-24G-2S+ | CF-SW-24G-2S+ Manual ]]
* [[SwitchOS/CF-SW-1G-4S+ | CF-SW-xx series Manual]]

== List of Examples ==
* [[SWITCHOS/ CF-SW-1G-4S+ -VLAN-Example | CF-SW-1G-4S+ port based VLAN configuration ]]

SwitchOS/CF-SW-1G-4S+

2020-09-01T14:35:16Z

Administrator: Created page with "==Summary== SwitchOS is an operating system designed specifically for administration of CableFree switch products. SwitchOS is configurable from your web browse..."

==Summary==

SwitchOS is an operating system designed specifically for administration of CableFree switch products.


SwitchOS is configurable from your web browser. It gives you all the basic functionality for a managed switch, plus more: allows to manage port-to-port forwarding, broadcast storm control, apply MAC filter, configure VLANs, mirror traffic, apply bandwidth limitation and even adjust some MAC and IP header fields.

{{Warning | Each CableFree device switch series device has its own firmware which cannot be installed on other series models!
}}

==CF-SW- 1G-4S+ series features==
<table class="styled_table">
<tr><th width="25%">Features</th><th>Description</th></tr>
<tr>
<td>'''Forwarding'''</td>
<td><ul class="bullets">
<li>Full non-blocking wirespeed switching</li>
<li>Up to 16k MAC entries in Host table</li>
<li>Forwarding Database works based on SVL or IVL</li>
<li>Port Isolation</li>
<li>Jumbo frame support - 10218 bytes</li>
</ul></td>
</tr>
<tr>
<td>'''Spanning Tree Protocol'''</td>
<td>
<ul class="bullets">
<li>RSTP support</li>
</ul></td>
</tr>
<tr>
<td>'''Link Aggregation'''</td>
<td>
<ul class="bullets">
<li>Supports 802.3ad LACP groups</li>
<li>Supports static link aggregation groups</li>
<li>Up to 16 link aggregation groups</li>
<li>Up to 8 member ports per a group</li>
<li>Hardware automatic failover and load balancing</li>
</ul></td>
</tr>
<tr>
<td>'''Multicast Forwarding'''</td>
<td>
<ul class="bullets">
<li>IGMP Snooping support</li>
<li>Unknown Multicast Filtering</li>
</ul></td>
</tr>
<tr>
<td>'''Mirroring'''</td>
<td>
<ul class="bullets">
<li>Port based mirroring</li>
</ul></td>
</tr>
<tr>
<td>'''VLAN'''</td>
<td>
<ul class="bullets">
<li>Fully compatible with IEEE802.1Q</li>
<li>Port based VLAN</li>
<li>Up to 250 VLAN entries (limited by SwitchOS)</li>
<li>VLAN filtering</li>
</ul></td>
</tr>
<tr>
<td>'''Security'''</td>
<td>
<ul class="bullets">
<li>Port Lock</li>
<li>Broadcast Storm Control</li>
<li>DHCP & PPPoE Snooping</li>
</ul></td>
</tr>
<tr>
<td>'''Quality of Service (QoS)'''</td>
<td>
<ul class="bullets">
<li>Ingress traffic limiting</li>
</ul></td>
</tr>
<tr>
<td>'''Access Control List'''</td>
<td><ul class="bullets">
<li>Ingress ACL tables</li>
<li>Up to 32 ACL rules (limited by SwitchOS)</li>
<li>Classification based on ports, L2, L3, L4 protocol header fields</li>
<li>ACL actions include filtering, forwarding and modifying of the protocol header fields</li>
</ul></td>
</tr>
</table>

==Models==
This table clarifies the main differences between CableFree Switch-OS enabled Switch models.

{| border="1" class="wikitable collapsible sortable" style="text-align: center"
| nowrap style="background-color: #CCC;* " | Model
| nowrap style="background-color: #CCC;* " | Switch Chip
| nowrap style="background-color: #CCC;* " | Serial console
| nowrap style="background-color: #CCC;* " | PoE-in support
| nowrap style="background-color: #CCC;* " | PoE-out support
| nowrap style="background-color: #CCC;* " | Health monitor
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-24G-2S+
| Marvell-98DX3236
| +
| ether1, Passive PoE
| -
| CPU temperature
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-24P-4S+
| Marvell-98DX3236
| +
| -
| ether1 - ether24, 802.3af/at
| CPU and board temperature, fan speed, PSU voltage and current, PoE-out monitoring
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-4C-20S-4S+
| Marvell-98DX3236
| +
| -
| -
| CPU temperature, fan speed, PSU state
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-1G-16S+
| Marvell-98DX8216
| +
| -
| -
| CPU temperature, fan speed, PSU state
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-1G-4S+
| Marvell-98DX3236
| -
| ether1, 802.3af/at
| -
| CPU temperature
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-1G-8S+
| Marvell-98DX8208
| +
| ether1, 802.3af/at
| -
| CPU temperature
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-4C+8XG
| Marvell-98DX8212
| +
| -
| -
| CPU temperature, fan speed, PSU state
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-24S+2Q+
| Marvell-98DX8332
| +
| -
| -
| CPU temperature, fan speed, PSU state
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-16P-2S+
| Marvell-98DX226S
| -
| -
| ether1 - ether16, 802.3af/at
| CPU temperature, PSU voltage and current, PoE-out monitoring.
|-
| style="background-color: #CCC;font-weight: bold;" | CF-SW-18-1Fi-15Fr-2S
| Marvell-98DX224S
| -
| ether1-ether14, ether16, Passive PoE
| ether15, Passive PoE
| CPU temperature
|}

==Connecting to the Switch==

Open your web browser and enter IP address of your Switch (192.168.88.1 by default) and login screen will appear.

[[File:SwitchOS_login_CF-SW.png|center|alt=Alt text|SwitchOS Login|frame]]

SwitchOS default IP address: 192.168.88.1, user name: admin and there is no password.


{{ Note | CableFree Neighbor Discovery protocol tools can be used to discover IP address of CableFree switch. [[Manual:IP/Neighbor_discovery]]. Currently LLDP is not supported.}}

==Interface Overview==


SwitchOS interface menu consists of multiple tabs depending on the device model. These are all possible SwitchOS menus: Link, PoE, SFP, Port Isolation, LAG, Forwarding, RSTP, Stats, Errors, Hist, VLAN, VLANs, Hosts, IGMP, SNMP, ACL, System, Health and Upgrade.



Description of buttons in SwitchOS configuration tool:
* Append - add new item to the end of the list
* Apply All - applies current configuration changes
* Cut - removes item from the list
* Clear - resets properties of the item
* Discard Changes - removes unsaved configuration
* Insert - add new item to the list (places it before current item)
* Sort - sort VLAN table by VLAN-IDs; sort host table by MAC addresses
 
* Change Password - changes password of the switch
* Logout - logout from current Switch
* Reboot - reboot the switch
* Reset Configuration - reset configuration back to factory defaults
* Choose File - browse for upgrade or backup file
* Upgrade - upgrade firmware of the Switch
* Restore Backup - restore Switch using selected backup file
* Save Backup - generate and download backup file from the Switch


==System==

System Tab performs the following functions:
* General information about Switch
* Switch management
* Configuration reset
* Backup and restore configuration

{{ Note | SwitchOS uses a simple algorithm to ensure TCP/IP communication - it just replies to the same IP and MAC address packet came from. This way there is no need for Default Gateway on the device itself.}}

[[File:SwitchOS_system_CF-SW.png|alt=Alt text|General Settings|center|frame]]
 
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Address Acquisition</td><td>Specify which address acquisition method to use:
* <code>DHCP with fallback</code> - For first 10 seconds switch uses DHCP client. If request is unsuccessful, then address is set as a Static IP Address value
* <code>static</code> - Address is set as a Static IP Address value
* <code>DHCP only</code> - Switch uses DHCP client to acquire address</td>
</tr>
<tr>
<td>Static IP Address</td><td>IP address of the switch in case of Address Acquisition is set as <code>DHCP with fallback</code> or <code>static</code></td>
</tr>
<tr>
<td>Identity</td><td>Name of the switch (for CableFree Neighbor Discovery protocol)</td>
</tr>
<tr>
<td>Allow From</td><td>IP address from which the switch is accessible. Default value is '0.0.0.0/0' - any address</td>
</tr>
<tr>
<td>Allow From Ports</td><td>List of switch ports from which it is accessible</td>
</tr>
<tr>
<td>Allow From VLAN</td><td>VLAN ID from which the switch is accessible (VLAN Mode on ingress port must be other than <code>'''disabled'''</code> in order to connect)</td>
</tr>
<tr>
<td>Watchdog</td><td>Enable or disable system Watchdog. It will reset CPU of the switch in case of fault condition</td>
</tr>
<tr>
<td>Independent VLAN Lookup</td><td>Enable or disable independent VLAN lookup in the Host table for packet forwarding</td>
</tr>
<tr>
<td>IGMP Snooping</td><td>Enable or disable IGMP Snooping</td>
</tr>
<tr>
<td>CableFree Discovery Protocol</td><td>Enable or disable CableFree Neighbor Discovery protocol</td>
</tr>
<tr>
<td>MAC Address</td><td>MAC address of the switch (Read-only)</td>
</tr>
<tr>
<td>Serial Number</td><td>Serial number of the switch (Read-only)</td>
</tr>
<tr>
<td>Board Name</td><td>CableFree model name of the switch (Read-only)</td>
</tr>
<tr>
<td>Uptime</td><td>Current switch uptime (Read-only)</td>
</tr>
</table>

===DHCP & PPPoE Snooping===

[[File:CF-SW_DHCPSnooping.png|alt=Alt text|DHCP & PPPoE snooping settings|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Trusted Ports</td><td>Group of ports, which allows DHCP or PPPoE servers to provide a requested information. Mainly used to limit unauthorized servers to provide malicious information for users, access ports usually do not configure as trusted</td>
</tr>
<tr>
<td>Add Information Option</td><td>Enables or disables DHCP Option-82 information. When enabled, the Option-82 information (Agent Remote ID and Circuit ID) is added for DHCP packets received from untrusted ports. Can be used together with Option-82 capable DHCP server to assign IP addresses and implement policies</td>
</tr>
</table>

===Password and Backup===
[[File:SwitchOS_system3_CF-SW.png|alt=Alt text|System Management Settings|center|frame]]

==Link==
Link Tab allows you to configure each interface settings and monitor link status

[[File:SwitchOS_link_CF-SW.png|center|alt=Alt text|Link Settings|center|frame]]
 
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Enabled</td><td>Enable or disable port</td>
</tr>
<tr>
<td>Name</td><td>Editable port name</td>
</tr>
<tr>
<td>Link Status</td><td>Current link status (Read-only)</td>
</tr>
<tr>
<td>Auto Negotiation</td><td>Enable or disable auto negotiation</td>
</tr>
<tr>
<td>Speed</td><td>Specify speed setting of the port (requires auto negotiation to be disabled)</td>
</tr>
<tr>
<td>Full Duplex</td><td>Specify duplex mode of the port (requires auto negotiation to be disabled)</td>
</tr>
<tr>
<td>Flow control </td><td>Enable or disable 802.3x Flow control</td>
</tr>
</table>

==PoE==

Devices with PoE-out support have some configuration options and certain monitoring features, like PoE-out current, voltage, etc. For more detailed description, see [[Manual:PoE-Out]].

[[File:SwitchOS PoE.png|alt=Alt text|PoE tab|center|frame]]

==SFP==
SFP tab allows you to monitor status of SFP/SFP+ modules.
[[File:SwitchOS_sfp1_CF-SW.png|alt=Alt text|SFP Tab|center|frame]]

==Port Isolation==
Port Isolation table allows or restricts traffic forwarding between specific ports. By default, all available switch chip ports can communicate with any other port, there is no isolation used. When the checkbox is enabled/ticked you allow to forward traffic from this port towards the ticked port. Below are some port isolation examples.

{|align="center"
|[[File:SwitchOS_IsolatedGroups.png|alt=Alt text|In some scenarios you might need to isolate a group of devices from other groups. In this example devices on '''Port1-Port5''' are not able to communicate with '''Port6-Port10''' devices, and vice versa. |frame]]
|[[File:SwitchOS_PrivateVLAN.png|alt=Alt text|In some scenarios you might need to forward all traffic to an uplink port while all other ports are isolated from each other. This kind of setup is called '''Private VLAN''' configuration. The switch will forward all Ethernet frames only to the uplink '''Port1''', while uplink can reach all other ports|frame]]
|[[File:SwitchOS Management.png|alt=Alt text|Individual isolated '''Port1''' (e.g. for management purpose), it cannot send or receive traffic from any other port|frame]]
|}

{{ Note | It is possible to check/uncheck multiple checkboxes by checking one of them and then dragging horizontally (Click & Drag).}}
{{ Note | (R)STP will only work properly in Private VLAN setups. In setups with multiple isolated switch groups (R)STP might not properly receive BPDUs and therefore fail to detect network loops.}}

==LAG==
IEEE 802.3ad (LACP) compatible link aggregation is supported, as well as static link aggregation to ensure failover and load balancing based on Layer2 and Layer3 hashing.
Up to 16 link aggregation groups with up to 8 ports per a group are supported.
[[File:SwitchOS_lag_CF-SW.png|alt=Alt text|LAG Tab|center|frame]]

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>


Each individual port can be configured as Passive LACP, Active LACP or a Static LAG port.


<tr>
<td>Mode ''(default: passive)''</td>
<td>Specify LACP packet exchange mode or Static LAG mode on ports:
* <code>Passive</code>: Place port in listening state, use LACP only when it's contrary port uses active LACP mode
* <code>Active</code>: Prefer to start LACP regardless contrary port mode
* <code>Static</code>: Set port in a Static LAG mode</td>
</tr>
</table>
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<tr>
<td>Group</td><td>Specify a Static LAG group </td>
</tr>
<tr>
<td>Trunk ''(read only)''</td><td>Represents group number port belongs to.</td>
</tr>
<tr>
<td>Partner ''(read only)''</td><td>Represents partner mac-address.</td>
</tr>
</table>

==Forwarding==
Forwarding Tab provides advanced forwarding options among switch ports, port locking, port mirroring, bandwidth limit and broadcast storm control features.
[[File:SwitchOS_forw_CF-SW.png|center|alt=Alt text|Forwarding Settings|center|frame]]
 
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Port Lock</td><td>
* <code>Port Lock</code> - Enables or disables MAC address learning on this port. When option is enabled, it will restrict MAC address learning and static MAC addresses should be configured. Any received frames with unknown source MAC address will be dropped
* <code>Lock On First</code> - Allows to learn source MAC address from the first received frame, this property should be used together with <code>Port Lock</code>. Learning of the first MAC address will reset every time an interface status changes</td>
</tr>
<tr>
<td>Port Mirroring</td><td>
* <code>Mirror Ingress</code> - Whether traffic entering this port must be copied and forwarded to mirroring target port
* <code>Mirror Egress</code> - Whether traffic leaving this port must be copied and forwarded to mirroring target port
* <code>Mirror To</code> - Mirroring target port</td>
</tr>
<tr>
<td>Broadcast Storm Control</td><td>
* <code>Storm Rate (%)</code> - Limit the number of broadcast packets transmitted by an interface. The rate is measured in percents of the link speed.

* <code>Include Unknown Unicast</code> - Include unicast packets without an entry in host table in <code>Storm Rate</code> limitation</td>
</tr>
<tr>
<td>Bandwidth Limit</td><td>
* <code>Ingress Rate</code> - Limit traffic entering this port (bps)
</tr>
</table>

==RSTP==
Per port and global RSTP configuration and monitoring is available in the RSTP menu.
[[File:SwitchOS_rstp_CF-SW.png|center|alt=Alt text|RSTP Settings|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<tr>
<td>Bridge Priority (hex)</td><td>RSTP bridge priority for Root Bridge selection</td>
</tr>
<tr>
<td>Port Cost Mode</td><td>There are two methods for automatically detecting RSTP port cost depending on link speed.
* <code>'''short'''</code>: 40G - 1; 10G - 2; 1G - 4; 100M - 10; 10M - 100
* <code>'''long'''</code>: 40G - 500; 10G - 2000; 1G - 20000; 100M - 200000; 10M - 2000000</td>
</tr>
<tr>
<td>Root Bridge</td><td>The priority and MAC address of the selected Root Bridge in the network (Read-only)</td>
</tr>
</table>
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>RSTP</td><td>Enable or disable STP/RSTP functionality on this port</td>
</tr>
<tr>
<td>Mode</td><td> Shows STP/RSTP functionality mode on specific port (Read-only):
* <code>RSTP</code>
* <code>STP</code></td>
</tr>
<tr>
<td>Role</td><td>Shows specific port role (Read-only):
* <code>root</code> - port that is facing towards the root bridge and will be used to forward traffic from/to the root bridge
* <code>alternate</code> - port that is facing towards root bridge, but is not going to forward traffic (a backup for root port)
* <code>backup</code> - port that is facing away from the root bridge, but is not going to forward traffic (a backup for non-root port)
* <code>designated</code> - port that is facing away from the root bridge and is going to forward traffic
* <code>disabled</code> - port that is not strictly part of STP (RSTP functionality is disabled) </td>
</tr>
<tr>
<td>Root Path Cost</td><td>Shows root path cost for ports that are facing root bridge (Read-only)</td>
</tr>
<tr>
<td>Type</td><td>
* <code>edge</code> - ports that are not supposed to receive any BPDUs, should be connected to end station (Read-only)
* <code>point-to-point</code> - ports that operates in full-duplex links, can be part of STP and operate in forwarding state (Read-only)</td>
</tr>
<tr>
<td>State</td><td>Shows each port state (Read-only):
* <code>forwarding</code> - port participates in traffic forwarding and is learning MAC addresses, is receiving BPDUs
* <code>discarding</code> - port does not participate in traffic forwarding and is not learning MAC addresses, is receiving BPDU
* <code>learning</code> - port does not participate in traffic forwarding, but is learning MAC addresses</td>
</tr>
</table>

==Stats, Errors and Histogram==
These menus provide detailed information about received and transmitted packets.
[[File:SwitchOS_stat1_CF-SW.png|center|alt=Alt text|Port statistics|center|frame]]
[[File:SwitchOS_stat2_CF-SW.png|center|alt=Alt text|Port error statistics|center|frame]]
[[File:SwitchOS_stat3_CF-SW.png|center|alt=Alt text|Port histogram statistics|center|frame]]

{{ Note | Statistics for SFP+ interface are cleared whenever an active SFP+ link is established.}}

==VLAN and VLANs==

VLAN configuration for switch ports.

[[File:SwitchOS_vlan_CF-SW.png|center|alt=Alt text|Port VLAN Settings|center|frame]]
 

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-table
|arg=VLAN Mode
|type=disabled {{!}} optional {{!}} enabled {{!}} strict
|default=optional
|desc=VLAN filtering mode, these options are relevant to egress ports (except for <var>strict</var> mode).
* <var>disabled</var> - VLAN table is not used. Switch discards packets with a VLAN tag on egress ports. If the packet has a VLAN tag and the VLAN ID matches <code>Default VLAN ID</code> on egress ports, then with <code>VLAN Receive=any</code> the switch will remove the VLAN tag and forward the packet.
* <var>optional</var> - Disabled VLAN filtering. Handle packets with VLAN tag ID that is not present in VLAN table just like packets without VLAN tag.
* <var>enabled</var> - Enabled VLAN filtering. Drop packets with VLAN tag ID that is not present in VLAN table. Default VLAN ID must be specified for access ports since it will be used to tag ingress traffic and untag egress traffic for the certain port.
* <var>strict</var> - Enabled VLAN filtering with additional ingress filtering, which checks if the ingress port is a member of the received VLAN ID in the VLAN table. Received packets on the ingress port with a VLAN ID that does not match with VLAN table will be dropped. Default VLAN ID must be specified for access ports since it will be used to tag ingress traffic and untag egress traffic for the certain port.
}}

{{Mr-arg-table
|arg=VLAN Receive
|type=any {{!}} only tagged {{!}} only untagged
|default=optional
|desc=Ingress traffic filtering based on VLAN tag presence.
* <var>any</var> - Allows tagged and untagged packets on a certain port
* <var>only tagged</var> - Allows only packets with a VLAN tag
* <var>only untagged</var> - Allows only packets without a VLAN tag
}}

{{Mr-arg-table
|arg=Default VLAN ID
|type=integer: 1..4095
|default=1
|desc=VLAN ID which will be assigned on ingress traffic. Only has effect on untagged traffic, it will be ignored for tagged traffic. This parameter is usually used to allocate access ports with specific VLAN. It is also used to untag egress traffic if packet's VLAN ID matches Default VLAN ID.
}}

{{Mr-arg-table-end
|arg=Force VLAN ID
|type=integer: yes {{!}} no
|default=no
|desc=Assigns the <code>Default VLAN ID</code> value to all ingress traffic (tagged and untagged). Has effect in all VLAN Modes. If port receives tagged traffic and <code>Default VLAN ID</code> is set to 1, then with this parameter the egress traffic will be untagged.
}}

 
VLAN membership configuration for switch ports.
[[File:SwitchOS_vlans_CF-SW.png|center|alt=Alt text|VLAN Table Settings|center|frame]]
 

{{Mr-arg-table-h
|prop=Property
|desc=Description
}}

{{Mr-arg-table
|arg=VLAN ID
|type=integer: 1..4095
|default=0
|desc=VLAN ID to which assign ports.
}}

{{Mr-arg-table
|arg=Port Isolation
|type=yes {{!}} no
|default=yes
|desc=Use settings from <code>Port Isolation</code> menu to isolate the defined VLAN to only certain ports. When disabled, the switch will ignore port isolation configuration and forward traffic with the defined VLAN ID only to ports that are checked as members.
}}

{{Mr-arg-table
|arg=Learning
|type=yes {{!}} no
|default=yes
|desc=Enables or disables MAC address learning on the defined VLAN. If disabled, then all learned MAC addresses will appear as they have had been learned from VLAN 1.
}}

{{Mr-arg-table
|arg=Mirror
|type=yes {{!}} no
|default=no
|desc=Enables or disables VLAN based mirroring. When enabled and <code>Mirror To</code> is set in the <code>Forwarding</code> menu, then all traffic from the defined VLAN will be mirrored to the selected port.
}}

{{Mr-arg-table
|arg=IGMP Snooping
|type=yes {{!}} no
|default=no
|desc=Enables or disables IGMP Snooping on the defined VLAN. When enabled, the switch will listen to IGMP Join and Leave requests from the defined VLAN and only forward traffic to ports, which have sent IGMP membership requests from the defined VLAN. When disabled, the switch will flood all VLAN member ports with Multicast traffic.
}}

{{Mr-arg-table-end
|arg=Members
|type=ports
|default=none
|desc=Group of ports, which are allowed to forward traffic on the defined VLAN.
}}

===VLAN Configuration Example===

Simple trunk and access port configuration, as well as trunk and hybrid port configuration examples can be found in this article - [[SwitchOS/CF-SW-VLAN-Example]].

==Hosts==
This table represents dynamically learnt MAC address to port mapping entries. It can contain two kinds of entries: dynamic and static. Dynamic entries get added automatically, this is also called a learning process: when switch receives a packet from certain port, it adds the packet's source MAC address and port it received the packet from to host table, so when a packet comes in with certain destination MAC address it knows to which port it should forward the packet. If the destination MAC address is not present in host table then it forwards the packet to all ports in the group. Dynamic entries take about 5 minutes to time out. CF-SW-xx devices supports 16383 host table entries.
Static entries will take over dynamic if dynamic entry with same mac-address already exists. Also by adding a static entry you get access to some more functionality.

[[File:SwitchOS_shost_CF-SW.png|center|alt=Alt text|Host Table|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Ports</td><td>Ports the packet should be forwarded to</td>
</tr>
<tr>
<td>MAC</td><td>MAC address</td>
</tr>
<tr>
<td>VLAN ID</td><td>VLAN ID</td>
</tr>
<tr>
<td>Drop</td><td>Packet with certain MAC address coming from certain ports can be dropped</td>
</tr>
<tr>
<td>Mirror</td><td>Packet can be cloned and sent to mirror-target port</td>
</tr>
</table>
<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Port</td><td>Ports the packet should be forwarded to (Read-only)</td>
</tr>
<tr>
<td>MAC</td><td>Learned MAC address (Read-only)</td>
</tr>
<tr>
<td>VLAN ID</td><td>Learned VLAN ID (Read-only)</td>
</tr>
</table>

==IGMP Snooping==

IGMP Snooping which controls multicast streams and prevents multicast flooding is implemented in SwitchOS starting from version 2.5. The feature allows a switch to listen in the IGMP conversation between hosts and routers.

Enable this option under System tab.
[[File:IGMP-snooping.png|alt=Alt text|IGMP Snooping under System tab|center|frame]]
 

Available IGMP snooping data can be found under IGMP tab:
[[File:CF-SW-xx-IGMP.png|alt=Alt text|IGMP Snooping table|center|frame]]
 

It is possible to enable IGMP Snooping for a specific VLAN ID under VLANs menu.

{{ Note | IGMP Snooping for VLANs requires enabled "Independent VLAN Lookup" in the System menu.}}

[[File:IGMP-vlantab.png|alt=Alt text|IGMP Snooping VLANs settings|center|frame]]

==SNMP==

SwitchOS supports SNMP v1 and uses IF-MIB, SNMPv2-MIB, BRIDGE-MIB and CABLEFREE-MIB (only for health, PoE-out and SFP diagnostics) for SNMP reporting.


Available SNMP data:
* <code>System information</code>
* <code>System uptime</code>
* <code>Port status</code>
* <code>Interface statistics</code>
* <code>Host table information</code>

[[File:SwitchOS-snmp2.png|alt=Alt text|SNMP settings|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Enabled</td><td>Enable or disable SNMP service</td>
</tr>
<tr>
<td>Community</td><td>SNMP community name</td>
</tr>
<tr>
<td>Contact Info</td><td>Contact information for the NMS</td>
</tr>
<tr>
<td>Location</td><td>Location information for the NMS</td>
</tr>
</table>

==ACL Tab==

An access control list (ACL) rule table is very powerful tool allowing wire speed packet filtering, forwarding and VLAN tagging based on L2,L3 protocol header field conditions. Each rule contains a conditions part and an action part.

[[File:CF-SW-ACL-table.png|frameless|border|upright=4.4|center|CF-SW-24G-2S+ ACL table]]

<div style="clear:both"></div>

<h3>Conditions part parameters</h3>

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>From</td><td>Port that packet came in from</td>
</tr>
<tr>
<td>MAC Src</td><td>Source MAC address and mask</td>
</tr>
<tr>
<td>MAC Dst</td><td>Destination MAC address and mask</td>
</tr>
<tr>
<td>Ethertype</td><td>Protocol encapsulated in the payload of an Ethernet Frame</td>
</tr>
<tr>
<td>VLAN</td><td>
VLAN header presence:
* any
* present
* not present</td>
</tr>
<tr>
<td>VLAN ID</td><td>VLAN tag ID</td>
</tr>
<tr>
<td>Priority</td><td>Priority in VLAN tag</td>
</tr>
<tr>
<td>IP Src (IP/netmask:port)</td><td>Source IPv4 address, netmask and L4 port number</td>
</tr>
<tr>
<td>IP Dst (IP/netmask:port)</td><td>Destination IPv4 address, netmask and L4 port number</td>
</tr>
<tr>
<td>Protocol ''(integer)''</td><td>IP protocol</td>
</tr>
<tr>
<td>DSCP</td><td>IP DSCP field</td>
</tr>
</table>

<h3>Action part parameters</h3>

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>Redirect To</td><td>Force new packets destination port</td>
</tr>
<tr>
<td>Mirror</td><td>Clones packet and sends it to mirror-target port</td>
</tr>
<tr>
<td>Rate</td><td>Limits bandwidth (bps)</td>
</tr>
<tr>
<td>Drop</td><td>Drop packet</td>
</tr>
<tr>
<td>Set VLAN ID</td><td>Changes the VLAN tag ID, if VLAN tag is present</td>
</tr>
<tr>
<td>Priority</td><td>Changes the VLAN tag priority bits, if VLAN tag is present</td>
</tr>
</table>

==Health==

This menu provides different health related properties.

[[File:SwitchOS_CF-SW_health.png|alt=Alt text|CF-SW-24P-4S+ Health|center|frame]]
 

<table class="styled_table" >
<tr>
<th width="25%">Property</th>
<th >Description</th>
</tr>
<tr>
<td>CPU Temperature</td><td>Shows CPU temperature in celsius temperature scale (Read-only)</td>
</tr>
<tr>
<td>Board Temperature</td><td>Shows PCB temperature in celsius temperature scale (Read-only)</td>
</tr>
<tr>
<td>FAN</td><td>Shows FAN rotational speed (Read-only)</td>
</tr>
<tr>
<td>PSU</td><td>Shows PSU related information depending on device model (Read-only):
* PSU state, either failed or ok
* PSU voltage and consumed miliamperes by PoE-out connected devices
</td>
</tr>
</table>

{{ Note | For devices with only a CPU temperature sensor health information is available under System menu.}}

== Reset and Reinstall ==

With a [[Manual:Reset#Button_reset | reset button]] you can restore RadioOS default-configuration, from where you can [[Manual:CF-SW_series_switches#Configuring_SwitchOS_using_RadioOS | configure SwitchOS using RadioOS]].

CF-SW-xx devices with a serial console have some additional options.
* To change between RadioOS and SwitchOS follow these steps:
# Connect to the device using a serial console
# Enter R-BOOT setup
# Chose "j - boot os"
# Chose either RadioOS or SwitchOS

* It is possible to load a SwitchOS backup firmware in case standard firmware breaks or upgrade fails:
# Connect to the device using a serial console
# Boot SwitchOS
# Choose "p - boot primary SwitchOS"
# After loading backup firmware, it is possible to connect to 192.168.88.1 using a web browser and install new SwitchOS firmware.

* To reset SwitchOS configuration:
# Connect to the device using a serial console
# Boot SwitchOS
# Choose "r - reset configuration"

{|
|[[File:dual-boot-option.png|alt=Alt text|Dual boot|left|frame]]
|[[File:SwitchOS-reset.png|alt=Alt text|SwitchOS serial console access|left|frame]]
|}

<div style="clear:both"></div>

Main Page

2020-09-01T13:35:11Z

Administrator: /* Links to Websites */

Main Page

2020-09-01T13:32:04Z

Administrator: /* Product Documentation */

SwitchOS

2020-09-01T13:31:06Z

Administrator: Created page with "CableFree SwitchOS is an operating system designed specifically for administration of CableFree IP/Ethernet switch products. SwitchOS is easily configurable using a web brows..."

CableFree SwitchOS is an operating system designed specifically for administration of CableFree IP/Ethernet switch products.

SwitchOS is easily configurable using a web browser. SwitchOS gives you all the basic functionality for a managed switch, plus more: allows to manage port-to-port forwarding, broadcast storm control, apply MAC filter, configure VLANs, mirror traffic, apply bandwidth limitation and even adjust some MAC and IP header fields.

== CableFree Switch Manuals ==
* [[SwitchOS/CF-SW-5G-1S | CF-SW-5G-1S series Manual]]
* [[SwitchOS/CF-SW-24G-2S+ | CF-SW-24G-2S+ Manual ]]
* [[SwitchOS/CF-SW-1G-4S+ | CRS3xx series Manual]]
== List of Examples ==
* [[SWITCHOS/ CF-SW-1G-4S+ -VLAN-Example | CF-SW-1G-4S+ port based VLAN configuration ]]

Manual:TR069-client

2020-01-29T19:07:06Z

Administrator: /* Parameters and Data Models */

TR069-client implements CPE WAN Management Protocol (CWMP) for remote device management, which is standardized by the Broadband Forum (BBF).
CWMP works over IP network using HTTP(S) to communicate with an Auto Configuration Server (ACS), which can monitor, configure attributes and update the firmware of a remote device.

Typically used by ISPs to manage CPEs, but also can be used for Network Infrastructure Device management.

==Configuration Settings==

TR069-client menu Parameters.
When the package is installed (first available in RadioOS 6.38). The configuration is in ''/tr069-client''

====Writable Settings====

Client configuration settings.
{| cellpadding="2"
!width="300px" style="background:#cccccc; border-bottom:1px solid gray;"| Property
!width="450px" style="background:#cccccc; border-bottom:1px solid gray;"| Desciption
|-
|style="border-bottom:1px solid gray;" valign="top"|'''enabled'''
|style="border-bottom:1px solid gray;" valign="top"|enable/disable CWMP protocol
|-
|style="border-bottom:1px solid gray;" valign="top"|'''acs-url'''
|style="border-bottom:1px solid gray;" valign="top"|URL of ACS. Examples: "https://example.com:8080/path/", "http://192.168.1.100/"
|-
|style="border-bottom:1px solid gray;" valign="top"|'''username'''
|style="border-bottom:1px solid gray;" valign="top"|HTTP authentication username (used by CPE to "login" into ACS)
|-
|style="border-bottom:1px solid gray;" valign="top"|'''password'''
|style="border-bottom:1px solid gray;" valign="top"|HTTP authentication password (used by CPE to "login" into ACS)
|-
|style="border-bottom:1px solid gray;" valign="top"|'''periodic-inform-enabled'''
|style="border-bottom:1px solid gray;" valign="top"|enable/disable CPE periodical session initiation. Timer is started after every successful session. When session is started by periodic interval then Inform RPC contains "2 PERIODIC" event. Maps to "Device.ManagementServer.PeriodicInformEnable" Parameter
|-
|style="border-bottom:1px solid gray;" valign="top"|'''periodic-inform-interval'''
|style="border-bottom:1px solid gray;" valign="top"|timer interval of periodic inform. Maps to "Device.ManagementServer.PeriodicInformInterval"
|-
|style="border-bottom:1px solid gray;" valign="top"|'''client-certificate'''
|style="border-bottom:1px solid gray;" valign="top"|certificate of client/CPE, which can be used by ACS for extra authentication
|}

====Read-only Settings====
Reald only parameters to monitor state of the client.
{| cellpadding="2"
!width="300px" style="background:#cccccc; border-bottom:1px solid gray;"| Property
!width="450px" style="background:#cccccc; border-bottom:1px solid gray;"| Desciption
|-
|style="border-bottom:1px solid gray;" valign="top"| '''status'''
|style="border-bottom:1px solid gray;" valign="top"| informative status of CWMP.
*disabled - protocol disabled,
*waiting-URL - protocol enabled, but ACS URL not configured,
*running - CWMP is configured correctly and will communicate with ACS on events
|-
|style="border-bottom:1px solid gray;" valign="top"|'''last-session-error'''
|style="border-bottom:1px solid gray;" valign="top"|user-friendly error description indicating why the previous session didn't finish successfully
|-
|style="border-bottom:1px solid gray;" valign="top"|'''retry-count'''
|style="border-bottom:1px solid gray;" valign="top"|consecutive unsuccessful session count. If > 0, then last-session-error should indicate error. Resets to 0 on a successful session, disabled protocol or reboot
|}

====Commands====

{| cellpadding="2"
!width="300px" style="background:#cccccc; border-bottom:1px solid gray;"| Command
!width="450px" style="background:#cccccc; border-bottom:1px solid gray;"| Desciption
|-
|style="border-bottom:1px solid gray;" valign="top"|'''reset-tr069-config'''
|style="border-bottom:1px solid gray;" valign="top"|completely resets and forgets tr069-client configuration and state (without affecting other ROS configurations). Use when CWMP goes into unresponsive/hanged state and should be restored without re-installation of the RadioOS.
|}

==CWMP Session==
CWMP client usually starts communication(Session) with ACS on different events - first boot, reboot, periodic interval, remote request, value change etc.
In each session, CPE and ACS can call RPCs to be "executed" on the other side. CPE always starts with Inform RPC, which contains connection reason, device info and some Parameter values depending on configuration.
When CPE has nothing more to say, then ACS executes its RPCs (which most of the time are Parameter management RPCs).

==Parameters and Data Models==
Parameters are simple name+value pairs and each vendor can decide which Parameters to support in its devices. A combination of all supported Parameters is called Data Model (DM). BBF defines three root Data Models(TR-098, TR-181:1, TR-181:2) on which vendors should base their supported Parameters. '''RadioOS Data Model is based on "TR-181 Issue 2 Amendment 11"''', which is the newest DM and recommended by BBF.

[RadioOS TR069 client supported parameter reference document]

==Download RPC==

====RadioOS Update (1 Firmware Upgrade Image)====
CWMP standard defines that CPE's firmware can be updated using Download RPC with FileType="1 Firmware Upgrade Image" and single URL of a downloadable file (HTTP and HTTPS are supported). Standard also states that downloaded file can be any type and vendor specific process can be applied to finish firmware update. Because CableFree's update is package based (and also for extra flexibility), an XML file is used to describe firmware upgrade/downgrade. For now, XML configuration supports providing multiple URLs of files, which will be downloaded and applied similarly as regular RadioOS update through firmware/package file upload.

An example of RadioOS bundle package and tr069-client package update (don't forget to also update tr069-client package).
An XML file should be put on some HTTP server, which is accessible from CPE for download.
Also, downloadable RadioOS package files should be accessible the same way (can be on any HTTP server).
Using ACS execute Download RPC with URL pointing to XML file (e.g. "https://example.com/path/upgrade.xml") with contents:

<upgrade version="1" type="links">
<config/>
<links>
<link>
<url>https://example.com/RadioOS-mipsbe-X.Y.Z.npk</url>
</link>
<link>
<url>https://example.com/tr069-client-X.Y.Z-mipsbe.npk</url>
</link>
</links>
</upgrade>

CPE will download XML, parse/validate its contents, download files from provided URLs and try to upgrade. The result will be reported with TransferComplete RPC.

{{Warning|Use HTTPS in production for firmware management}}

{{Note|Always make firmware updates incremental - first, update locally tested device and make sure that CWMP communication is resumed with a new version and required ROS functionality works. Secondly, repeat steps by updating groups of CPEs incrementally. We do not recommend updating all remote devices at once.}}

====Configuration Change (3 Vendor Configuration File)====
The same Download RPC can be used to perform complete configuration overwrite (as intended by standard) OR configuration alteration (when URL's filename extension is ".alter").

======Alter configuration ======
RadioOS has a lot of configuration attributes and not everything can be ported to CWMP Parameters, that's why RadioOS provides a possibility to execute its powerful scripting language to configure any attribute. A configuration alteration (which is really a regular script execution) can be performed using Download RPC FileType="3 Vendor Configuration File" with downloadable file extension ".alter". This powerful feature can be used to configure any ROS attributes which are not available through CWMP Parameters.

======Overwrite all configurations======

Full ROS configuration overwrite can be performed using Download RPC FileType="3 Vendor Configuration File" with any URL file name (except with ".alter" extension).

{{warning|Provided configuration file(script) must be "smart" enough to apply configuration correctly right after reboot. This is especially important when using uploaded configuration file with Upload RPC, because it only contains values export. Some things that should be added manually:
* delay at beginning, for interfaces to show up;
* hidden passwords for users;
* certificates.

}}

====RadioOS default configuration change (X CABLEFREE Factory Configuration File)====
This vendor specific FileType allows the change of the RadioOS default configuration script that is executed when '''/system reset-configuration''' command is executed (or the other means when router configuration is beeing reset).
{{Warning|Use this with caution as the failure of uploaded script may render device inoperable and/or inaccessible by the ACS}}
{{Note|If the default configuration script is changed it will not be displayed by '''/system default-configuration print''' as it is the case if that script is altered via Netinstall tool. That command will always show the default script set up by CableFree}}

==FactoryReset RPC==
This is CWMP standard RPC, which performs RadioOS configuration factory-reset. The reset process is performed in the same way as executing the command:
/system reset-configuration skip-backup=yes

Note that the default factory configuration can be different for each device (see Default_Configurations) and execution of this command removes all configurations and executes internally stored default-configuration script.

[Best Practices Guide for preparing CPE with custom factory settings for TR069 , see this page "best practices"]

==Upload RPC==
====Upload current configuration (1 Vendor Configuration File)====
The result of this is file uploaded to the ACS same as the output of '''/export''' command in the RadioOS

====Upload log file (2 Vendor Log File)====
The result of this is file uploaded to the ACS is similar to the output of '''/log print''' command in the RadioOS

====Upload default configuration (X CABLEFREE Factory Configuration File)====
The result of this is file uploaded to the ACS that has contents of the current set default configuration script that will be executed if '''/system reset-configuration''' command is executed. It may differ from one returned using '''/system default-configuration print'''.

==Security==
* HTTP should only be used when testing initial setup in the secured/private network because Man-in-the-middle attacker could read/change configuration parameters. '''In the production environment, HTTPS is a MUST'''.
* CWMP's incoming connection validation by design is safe because CPE will not communicate with any other device except previously configured ACS. Connection Request only signals CPE to start a new connection + new session with previously configured ACS.

==Tested ACSs==
Ordering is alphabetical. CableFree does not imply any one vendor superiority of another. If some ACS is missing you can notify us of the existence of it and it might be added to the list.

====Commercial====

We have tested and verified to be working the following commercial ACS solutions:

* [https://www.avsystem.com AVSystem]
* [http://axiros.com Axiros]
* [http://friendly-tech.com Friendly Tech]

====Open Source====

* [https://github.com/zaidka/genieacs GenieACS]

Note: these ACS systems below seem to be not maintained and thus is not suggested as useful options
* [http://www.freeacs.com FreeACS]
* [https://github.com/navisidhu/libreacs LibreACS]