Does anyone have a part number for the PSU blanking panels for the 6650? I want to pull the redundant ones and put them on the shelf. I can't seem to find the part number anywhere - just seems to be mentioned as part of the base device. Anyone have any they don't need and want to get rid of?
Brocade ICX Series (cheap & powerful 10gbE/40gbE switching)
- Thread starter fohdeesha
- Start date
Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
Are there any recommendations on how to configure a mirror port?
I have configured a mirror port, and then monitoring on several VLANs. However, as the mirror port was still in VLAN1, it learned the IP addresses on the mirror port, instead of the actual port. Resulting in loss of VLAN 1 connectivity, and "[next hop router x.y.z.8 moved from port 1/2/1 to port 1/1/15" log entries. After moving the mirror port into another (non-monitored) VLAN, the problem went away. In hindsight that does make sense. Any other recommendations?
Configuration extract:
I have configured a mirror port, and then monitoring on several VLANs. However, as the mirror port was still in VLAN1, it learned the IP addresses on the mirror port, instead of the actual port. Resulting in loss of VLAN 1 connectivity, and "[next hop router x.y.z.8 moved from port 1/2/1 to port 1/1/15" log entries. After moving the mirror port into another (non-monitored) VLAN, the problem went away. In hindsight that does make sense. Any other recommendations?
Configuration extract:
Code:
vlan 1 name DEFAULT-VLAN by port
monitor ethernet 1/1/15
router-interface ve 1
!
vlan 4 name guest by port
tagged ethe 1/1/17 ethe 1/2/5 ethe 1/2/8 lag 1 to 2
monitor ethernet 1/1/15
!
vlan 999 name monitor by port
untagged ethe 1/1/15
!
mirror-port ethernet 1/1/15 input
!
interface ethernet 1/1/15
no spanning-tree
no inline power
!Can any of these switches or addon modules auto negotiate 2.5Gbe? I'm looking to pick up some Ruckus R750 wifi APs and hoping I can use the SFP+ ports with a 10BASE-T module conversion and POE injector to take full advantage of the 2.5gbps bandwidth of the AP.
STH has a number of reviews of 10BASE-T adapters mostly here and most of them do.
I know some of the older switches won't support the non-1/10 gig ethernet, but that's beyond my level of knowledge as to which.
I know some of the older switches won't support the non-1/10 gig ethernet, but that's beyond my level of knowledge as to which.
try those two threads to see what others have tried.
Great info in here, looking to bite the bullet soon on one of the recommended switches, eyeing the Brocade ICX7250 24 port, but seems in CAD cant find them below $300 + shipping 
just like the infographic says, 2 are 40gbe only, and 2 are 4x 10gbe only. those two cannot be used for 40gb connections to servers
@LodeRunner @jzeus @klui and anyone else who had to clear their ICX7150/7250 NAND due to bad blocks or otherwise, and because of that had constant errors regarding "Device Key or Cert file is not available" -
I think I found a much cleaner way of working around it. I had to recover a dev 7150 for someone and of course that meant his NAND never had the keys to begin with, so he got the same error. It seems just disabling smartzone (which is on by default, and the only thing that uses those keys) completely stops the error messages and issues it causes. just run `sz disable` at the conf t level and write mem / reload. You'll get the error once during boot and never again, at least that's what happens on his
apologies if one of you already found this and posted it, I remember one of you found some way to make it kind of shut up and I don't remember what it was
edit: OK yeah @jzeus posted that this command stopped his errors too several pages ago, oops. my memory is top notch
I think I found a much cleaner way of working around it. I had to recover a dev 7150 for someone and of course that meant his NAND never had the keys to begin with, so he got the same error. It seems just disabling smartzone (which is on by default, and the only thing that uses those keys) completely stops the error messages and issues it causes. just run `sz disable` at the conf t level and write mem / reload. You'll get the error once during boot and never again, at least that's what happens on his
apologies if one of you already found this and posted it, I remember one of you found some way to make it kind of shut up and I don't remember what it was
edit: OK yeah @jzeus posted that this command stopped his errors too several pages ago, oops. my memory is top notch
For these switches, I’m assuming it’s possible to block all mac addresses by default except for whitelisted ones? Based on THIS, he details how to block specific vendor’s mac address and allow everything else. But adapting it to my situation, would these commands be fitting?
Is there an easier way to block all devices on my network by default other than using this switch? My environment is currently using a ICX 6610 switch, pfsense, win server 2012 for DHCP and DNS server, and a couple ubiquiti unif APs.
Code:
mac filter 1 deny any any
mac filter 2 permit 1a2b.3c4d.5e6f ffff.ffff.ffff anyOn your firmware page, for 7250; you still show 08080e from Oct 2019. That is your "approved" firmware version.
As I am a total noob, I've never updated past that version. Question: is that still your suggested firmware version for the 7250.
Thank you
What you need to do is get a 48U server rack completely full of Switches.....
made the mistake of gathering all the units I could find while organizing the basement (not including switches out on loan or units in use). I may have a problem
Normal convention of FW rules, ACLs, etc. will stop evaluation when the first rule meets the criteria. So your rules as they are defined will block everything because the first rule will match (any MACs). Imagine the inefficiency of the engine evaluating all rules every time a rule has to be invoked.
Follow Terry's video and have deny any any defined as the maximum filter id.
Ah I see. So I just had the order wrong? So have all mac address block as the last filter rule, and preceding filter rules are "allow" for each mac address?
Is there a more efficient way to do this than to manually make a new allow filter rule for each mac address?
Are you concerned with manually entering every MAC address to your filter list? Yeah, that will be a hassle but it's your use case.
You can inspect all MACs on your network and figure out their common OUIs (first 3) and maybe some of their remainder octets and use a wildcard or forgo filtering it in this way and use rules from your firewall/DHCP server instead. You may have more flexibility with not using MAC filters as in the video that device only supports 64, but I assume you can reconfigure a global setting to have more.
This is for small business and we have a new policy to block all devices by default and only allow a couple hundred company computers to be on our network. I thought about doing it via DHCP server, but that only prevents users from pulling an IP address. It doesn't stop them from setting up a static IP on their device. I'll look into firewall rules first.
I think Terry said there is a max of 512 mac filters, but that's for the ICX 7000 switches (hoping this ICX 6610 has the same max)
dhcp snooping + ip source guard IP Source Guard
How involved is it to implement 802.1x? Whenever I read supplicant and stuff like that it tells me I need to have an key infrastructure or else the set and forget will bite when certificates expire.Hmmm... 802.1x enters the chat.
Yep! We've been using it for our wifi (WPA2-enterprise) with unifi APs. About to switch over to ruckus R750s for this. I'm going to implement 802.1x for stuff physically plugged it now. I'm still learning this swich, so I may visit this thread for help if needed
We're using Active Directory and RADIUS server. Then just point the RADIUS server to anything that uses authentication, like APs or this switch. And of course, clients that can read 802.1x. It wasn't too hard to setup.
TY! I'll look into this feature