IT Blog

Today, I configured the next switch D-Link DES-3028, the firmware was 2.94.B07.

And so, connect the console cable to the switch and add the vlan control (I have it 207, 25 port uplink):

create vlan core tag 207
config vlan core add tagged 25

Assign the switch IP address:

config ipif System vlan core ipaddress 192.168.1.2/24 state enable

Let’s specify the default route:

create iproute default 192.168.1.1 1

Add the admin account:

create account admin NAME

Add a client VLAN (I have it 226), specify PVID and remove the standard VLAN:

create vlan local_smart tag 226
config vlan local_smart add tagged 25
config vlan local_smart add untagged 1-24,26-28
disable gvrp
config gvrp 1-28 state disable ingress_checking enable acceptable_frame admit_all pvid 226
config vlan default delete 1-28

Let’s configure protection against broadcast flooding:

config traffic trap both
config traffic control 1-24,26-28 broadcast enable multicast disable unicast disable action drop threshold 64 countdown 5 time_interval 5

Let’s configure the loop protection:

enable loopdetect
config loopdetect recover_timer 3000
config loopdetect interval 10
config loopdetect trap none
config loopdetect port 1-24,26-28 state enabled
config loopdetect port 25 state disabled

Let’s configure traffic segmentation, if it is necessary that users within the switchboard do not see each other:

config traffic_segmentation 1-24 forward_list 25
config traffic_segmentation 25 forward_list 1-24,26-28

Set up the time zone and time synchronization:

enable sntp
config time_zone operator + hour 2 min 0
config sntp primary 192.168.1.1 secondary 0.0.0.0 poll-interval 7000

Let’s specify from what IP the access to WEB, telnet and SNMP of the switch is allowed:

create trusted_host 192.168.1.1
create trusted_host 192.168.5.20

Let’s configure the protection from DOS:

disable dos_prevention trap_log
config dos_prevention dos_type land_attack action drop state enable
config dos_prevention dos_type blat_attack action drop state enable
config dos_prevention dos_type smurf_attack action drop state enable
config dos_prevention dos_type tcp_null_scan action drop state enable
config dos_prevention dos_type tcp_xmascan action drop state enable
config dos_prevention dos_type tcp_synfin action drop state enable
config dos_prevention dos_type tcp_syn_srcport_less_1024 action drop state disable

For IP-MAC-Port Binding functions, we allow IP 0.0.0.0 (under it Windows tries to get IP):

config address_binding ip_mac ports 1-28 state disable allow_zeroip enable forward_dhcppkt enable

Configuring SNMP:

delete snmp community public
delete snmp community private
delete snmp user initial
create snmp community TEXT view CommunityView read_write
create snmp community TEXT view CommunityView read_only
config snmp system_name TEXT
config snmp system_location TEXT
config snmp system_contact TEXT

Let’s configure protection from third-party DHCP servers:

config filter dhcp_server ports 1-24,26-28 state enable
config filter dhcp_server trap_log enable
config filter dhcp_server illegal_server_log_suppress_duration 30min

From third-party DHCP servers can also be protected through ACL:

create access_profile ip udp src_port 0xFFFF profile_id 1
config access_profile profile_id 1 add access_id 1 ip udp src_port 67 port 25 permit
config access_profile profile_id 1 add access_id 2 ip udp src_port 67 port 1-24,26-28 deny

We will configure protection against BPDU of garbage:

config bpdu_protection ports 1-24,26-28 mode drop

Turn on the function SAFEGUARD_ENGINE, so you can go to the switch at 100% CPU utilization:

config safeguard_engine state enable utilization rising 100 falling 95 trap_log enable mode fuzzy

Fine-Tuning FDB:

config fdb aging_time 300
config multicast port_filtering_mode 1-28 filter_unregistered_groups
disable flood_fdb
config flood_fdb log disable trap disable

Other small settings:

config serial_port baud_rate 9600 auto_logout 10_minutes
enable password encryption
config terminal_line default
enable clipaging
disable command logging
enable password_recovery
enable syslog
config log_save_timing on_demand

Done.