Today, I configured the next switch D-Link DES-3028, the firmware was 2.94.B07.
And so, connect the console cable to the switch and add the vlan control (I have it 207, 25 port uplink):
create vlan core tag 207 config vlan core add tagged 25
Assign the switch IP address:
config ipif System vlan core ipaddress 192.168.1.2/24 state enable
Let’s specify the default route:
create iproute default 192.168.1.1 1
Add the admin account:
create account admin NAME
Add a client VLAN (I have it 226), specify PVID and remove the standard VLAN:
create vlan local_smart tag 226 config vlan local_smart add tagged 25 config vlan local_smart add untagged 1-24,26-28 disable gvrp config gvrp 1-28 state disable ingress_checking enable acceptable_frame admit_all pvid 226 config vlan default delete 1-28
Let’s configure protection against broadcast flooding:
config traffic trap both config traffic control 1-24,26-28 broadcast enable multicast disable unicast disable action drop threshold 64 countdown 5 time_interval 5
Let’s configure the loop protection:
enable loopdetect config loopdetect recover_timer 3000 config loopdetect interval 10 config loopdetect trap none config loopdetect port 1-24,26-28 state enabled config loopdetect port 25 state disabled
Let’s configure traffic segmentation, if it is necessary that users within the switchboard do not see each other:
config traffic_segmentation 1-24 forward_list 25 config traffic_segmentation 25 forward_list 1-24,26-28
Set up the time zone and time synchronization:
enable sntp config time_zone operator + hour 2 min 0 config sntp primary 192.168.1.1 secondary 0.0.0.0 poll-interval 7000
Let’s specify from what IP the access to WEB, telnet and SNMP of the switch is allowed:
create trusted_host 192.168.1.1 create trusted_host 192.168.5.20
Let’s configure the protection from DOS:
disable dos_prevention trap_log config dos_prevention dos_type land_attack action drop state enable config dos_prevention dos_type blat_attack action drop state enable config dos_prevention dos_type smurf_attack action drop state enable config dos_prevention dos_type tcp_null_scan action drop state enable config dos_prevention dos_type tcp_xmascan action drop state enable config dos_prevention dos_type tcp_synfin action drop state enable config dos_prevention dos_type tcp_syn_srcport_less_1024 action drop state disable
For IP-MAC-Port Binding functions, we allow IP 0.0.0.0 (under it Windows tries to get IP):
config address_binding ip_mac ports 1-28 state disable allow_zeroip enable forward_dhcppkt enable
Configuring SNMP:
delete snmp community public delete snmp community private delete snmp user initial create snmp community TEXT view CommunityView read_write create snmp community TEXT view CommunityView read_only config snmp system_name TEXT config snmp system_location TEXT config snmp system_contact TEXT
Let’s configure protection from third-party DHCP servers:
config filter dhcp_server ports 1-24,26-28 state enable config filter dhcp_server trap_log enable config filter dhcp_server illegal_server_log_suppress_duration 30min
From third-party DHCP servers can also be protected through ACL:
create access_profile ip udp src_port 0xFFFF profile_id 1 config access_profile profile_id 1 add access_id 1 ip udp src_port 67 port 25 permit config access_profile profile_id 1 add access_id 2 ip udp src_port 67 port 1-24,26-28 deny
We will configure protection against BPDU of garbage:
config bpdu_protection ports 1-24,26-28 mode drop
Turn on the function SAFEGUARD_ENGINE, so you can go to the switch at 100% CPU utilization:
config safeguard_engine state enable utilization rising 100 falling 95 trap_log enable mode fuzzy
Fine-Tuning FDB:
config fdb aging_time 300 config multicast port_filtering_mode 1-28 filter_unregistered_groups disable flood_fdb config flood_fdb log disable trap disable
Other small settings:
config serial_port baud_rate 9600 auto_logout 10_minutes enable password encryption config terminal_line default enable clipaging disable command logging enable password_recovery enable syslog config log_save_timing on_demand
Done.