<<

NAME

pf::Switch::Extreme - Object oriented module to parse SNMP traps and manage Extreme Networks' switches

STATUS

SUPPORTS

linkUp / linkDown mode (Extreme XOS 12.2 and up)
port-security (called MAC Address Lockdown)

Requires XOS 12.7.

Developed and tested on Summit X250e-48p running on image version 12.4.2.17 (never released).

MAC-Authentication / 802.1X

This was tested on XOS 12.4.2.17 and probably worked on earlier versions.

BUGS AND LIMITATIONS

Stacked Switches

Stacked switches are unimplemented but all the mechanism is there. If you have access to the hardware please let us know and we will implement support for it.

Chassis support is unimplemented too.

SNMPv3

SNMPv3 support was not tested.

Port-security mode (MAC Address Lockdown)

Known to work with ExtremeXOS image version 12.7 and later

Relies on XML calls which require web interface to be enabled

HTTPS Web Services

HTTPS support relies on external modules for Extreme OS below 11.2. Even if your Extreme OS version is greater than 11.2 verify the module's presence with 'show ssl' before enabling https.

SSL Web Services (HTTPS) was not tested.

SUBROUTINES

getVersion - obtain image version information from switch
getVlan - return vlan number (dot1Q tag) of a given ifIndex
isDefinedVlan - returns true or false based on if requested vlan exists or not
_getMacAtIfIndex - obtain list of MACs at switch ifIndex

This supersedes the _getMacAtIfIndexPreXOS. It uses the new MIB available in Extreme XOS 12.2+: extremeFdbMacExosFdbTable.

_getMacAtIfIndexPreXOS - obtain list of MACs at switch ifIndex

Starting with version 12.2 the extremeFdbMacFdbTable MIB is no longer supported on Extreme XOS. This method calls the old version (extremeFdbMacFdbTable). A auto-detection layer and code re-routing could be written if there is some incentive to do it.

getMacBridgePortHash - returns an hash of MACs and ifIndex

key: mac address / value: ifIndex of port where mac address is

_getVlanTagFromVlanIfIndex - returns the vlan number (real dot1Q tag number) from a vlan's ifIndex

These switches uses a vlan ifIndex everywhere instead of using directly the vlan (tag) number like most of the other makers do.

_getVlanTagLookupTable - returns the whole table for VLAN ifIndex to VLAN dot1q tags lookups

Useful to avoid multiple lookups in a tight loop.

_getVlanIfIndexFromVlanTag - returns the vlan ifIndex from a vlan's number (real dot1Q tag number)

These switches uses a vlan ifIndex everywhere instead of using directly the vlan (tag) number like most of the other makers do.

_getVlanIfDescrFromVlanTag - returns the vlan ifDescr from a vlan's number (real dot1Q tag number)

These switches uses VLAN ifDescr for Fdb operations over Web Services. Helper method to translate it.

_getVlanTagFromVlanIfDescr - returns the vlan's number (real dot1Q tag number) from a VLAN name (ifDescr)
_getDot1dPortFromIfIndex - retrieve dot1d port from ifIndex
_getIfNameFromIfIndex - returns the ifName based on ifIndex

ifName format is: <switch stack id>:<dot1d port number> (ex: 1:12)

_getIfIndexLookupTable - returns an hashref of ifName to ifIndex

ifName format is: <switch stack id>:<dot1d port number> (ex: 1:12)

parseTrap - interpret traps and populate a trap hash
_setVlan - swap the vlans on a port (ifIndex)
getAllSecureMacAddresses - return all MAC addresses in security table and their VLAN

Returns an hashref with MAC => ifIndex => Array(VLANs)

_getAllSecureMacAddressesWithSNMP - return all MAC addresses in security table and their VLAN

This implementation relies on an SNMP interface that was introduced in 12.2.

Returns an hashref with MAC => ifIndex => Array(VLANs)

_getAllSecureMacAddressesWithWS - return all MAC addresses in security table and their VLAN

This implementation relies on the Web Services interface.

Returns an hashref with MAC => ifIndex => Array(VLANs)

getSecureMacAddresses - return all MAC addresses in security table and their VLAN for a given ifIndex

Returns an hashref with MAC => Array(VLANs)

_getSecureMacAddressesWithWS - return all MAC addresses in security table and their VLAN for a given ifIndex

This implementation relies on the Web Services interface.

Returns an hashref with MAC => Array(VLANs)

_getSecureMacAddressesWithSNMP - return all MAC addresses in security table and their VLAN for a given ifIndex

This implementation relies on an SNMP interface that was introduced in 12.2

Returns an hashref with MAC => Array(VLANs)

isPortSecurityEnabled - returns 1 or 0 whether maclock is activated or not

Requires ExtremeXOS 12.4.3

_isPortSecurityEnabledOld - returns 1 or 0 whether maclock is activated or not

DEPRECATED for reference only. See isPortSecurityEnabled instead.

Here we rely on a special entry we add during the PacketFence setup to work-around a limitation in the capabilities of the Extreme OS (can't know if maclock is activated or not)

authorizeMAC - authorize a MAC address and de-authorize the previous one if required
_authorizeMAC - authorize a MAC address on a given ifIndex and VLAN
_deauthorizeMAC - authorize a MAC address on a given ifIndex and VLAN

On Extreme removing an entry from the secure table is based on MAC and VLAN only. IfIndex is not required. For compatibility we won't change subroutine signature, we will just throw out the param.

_deauthorizeCurrentMac - deauthorize MACs on a given ifIndex / VLAN

Utility method that will find MAC address(es) on the given ifIndex / VLAN and will deauthorize them.

Returns deauthorized MAC(s)

_translateStackDot1dToPortListPosition

Translates the slot # and dot1d port number into a integer position for use in port list. A port list is when all the ports are represented in a binary notation one after the other with ones and zeros.

See extremeFdbPermFdbPortList in EXTREME-FDB-MIB for details.

_getPortsPerSlot - Number of ports in a slots for this Chassis (Switch)
_getSOAPHandle - get a handle to call Extreme's Web Services on the current switch
enablePortSecurityByIfIndex - enable lock-learning on a given ifIndex

On this switch, the lock-learning is a per-vlan attribute so it performs it on the current untagged VLAN of the ifIndex

disablePortSecurityByIfIndex - disable lock-learning on a given ifIndex (by configuring unlock-learning)

On this switch, the lock-learning is a per-vlan attribute so it performs it on the current untagged VLAN of the ifIndex

_setPortSecurityByIfIndex - change lock-learning configuration on a given ifIndex

Requires ExtremeXOS 12.4.3

On this switch, the lock-learning is a per-vlan attribute so it performs it on the current untagged VLAN of the ifIndex

_setPortSecurityByIfIndexCLI - change lock-learning configuration on a given ifIndex

DEPRECATED by SNMP version. See _setPortSecurityByIfIndex.

On this switch, the lock-learning is a per-vlan attribute so it performs it on the current untagged VLAN of the ifIndex

Warning: this method should _never_ be called in a thread. Net::Appliance::Session is not thread safe: http://www.cpanforum.com/threads/6909/ Experienced mostly when using SSH.

Warning: this code doesn't support elevating to privileged mode. See #900 and #1370.

isVoIPEnabled - is Voice over IP enabled on that switch?
getVoiceVlan - in what VLAN should a VoIP device be

AUTHOR

Inverse inc. <info@inverse.ca>

COPYRIGHT

Copyright (C) 2005-2015 Inverse inc.

LICENSE

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

<<