Implementing IBM System Networking 10Gb Ethernet Switches

Chapter 2. IBM System Networking Switch 10Gb Ethernet switch features 89

򐂰 The preferred stacking topology is a bidirectional ring (Figure 2-20). To achieve this

topology, two external 10Gb Ethernet ports on each switch must be reserved for stacking.

By default, the first two 10Gb Ethernet ports are used.

Figure 2-20 Stacking connection

򐂰 The cables used for connecting the switches in a stack carry low-level, inter-switch

communications and cross-stack data traffic critical to shared switching functions. Always

maintain the stability of stack links in order to avoid internal stack reconfiguration.

2.8 Security

This section presents various security features and protocols available on IBM System

Networking switches.

2.8.1 Private VLANs

Private VLANs (see 2.1, “Virtual Local Area Networks” on page 52) provide Layer 2 isolation

between the ports within the same broadcast domain. Private VLANs can control traffic within

a VLAN domain, and provide port-based security for host servers.

Use Private VLANs to partition a VLAN domain into subdomains. Each subdomain is

composed of one primary VLAN and one secondary VLAN, as follows:

򐂰 Primary VLAN: Carries unidirectional traffic downstream from promiscuous ports. Each

Private VLAN has only one primary VLAN. All ports in the Private VLAN are members of

the primary VLAN.

򐂰 Secondary VLAN: Secondary VLANs are internal to a private VLAN domain, and are

defined as follows:

– Isolated VLAN: Carries unidirectional traffic upstream from the host servers toward

ports in the primary VLAN and the gateway. Each Private VLAN can contain only one

Isolated VLAN.

– Community VLAN: Carries upstream traffic from ports in the community VLAN to other

ports in the same community, and to ports in the primary VLAN and the gateway. Each.

Private VLAN can contain multiple community VLANs.

After you define the primary VLAN and one or more secondary VLANs, you map the

secondary VLANs to the primary VLAN.