Web Interface: http://192.168.0.250

http://www.zyxel.com/us/en/products_services/xgs1910_gs1910_series.shtml?t=p

Support Notes: ftp://ftp2.zyxel.com/GS1910-24HP/support_note/GS1910-24HP_V1.00.zip

CLI Reference: ftp://ftp.zyxel.com/XS3900-48F/cli_reference_guide/XS3900-48F_1.pdf

You must, apparently, install firmware updates in order.

Access ports:

Trunk ports:

http://www.manualslib.com/manual/200632/Zyxel-Communications-Es-2024-Series.html?page=85#manual

http://www.bogus.net/~torh/files/zyxel-vlan.txt

ftp://ftp.eyenetworks.no/ZyXEL/GS-2200-8/UserGuide/final/4-2_VLAN-port-based-4%200.pdf

Display current VLAN information:

Set the CLI to configuration mode and define VLAN:

The Zyxel GS1910 has seven priority queues.

Higher numbered queues are higher priority.

The default priority queue is zero (0).

Web Interface → Monitor → QoS Statistics

See the Zyxel QoS support note for VLAN and port-based QoS.

Web Interface → Configure → QoS → DSCP-Based QoS

Select the DSCP classifications you want to support and set the priority queues they are to be mapped to.

Here are some common selections:

Web Interface → Configure → QoS → DSCP Classification

Set the reverse mapping of priority queues to DSCP classifications.

Something like:

Web Interface → Configure → QoS → QoS Control List

Create QoS Control List Entries (QCEs) to actuate the QoS classifications:

1. We have created a port-based VLAN on switch ports 1-6 to use a section of the switch as a DMZ.
2. We have a primary Internet connection via cable modem connected to port 1.
3. We have a server's IPMI interface configured with a static public address connected to port 2.
4. We have a router's WAN interface configured with a static public address connected to port 3.
5. For security reasons, we need to limit access to the server's IPMI (remote management) interface to the support provider's public Internet interface.

Here we create a policy that consists of two Access Control Entries (ACEs) and we apply the ACL policy to the port connected to the server's IPMI interface.

The order of the ACEs is important.

1. The first ACE permits traffic from the IPMI device to the support providers external Internet address/subnet.
   1. Set the 'Policy Filter' to 'Specific'
   2. Use a 'Policy Value' of 1 or another unused ID number (just not '0' zero).
   3. Set the 'Frame Type' to 'IPv4'
   4. Set the destination IP address or subnet as the IPMI support provider's external IP address.
   5. Set the 'Action' to 'Permit'.
2. The second ACE denies all other traffic from the IPMI device.
   1. Set the 'Policy Filter' to 'Specific'
   2. Use the same 'Policy Value' as in ACE #1.
   3. Set the 'Frame Type' to 'IPv4'
   4. Change the 'Action' to 'Deny'.

Configuration → Security → Network → ACL → Access Control List → Add

We apply the ACL policy to the port with the IPMI device.

We deny all other traffic on that port using an ACE (above), not by changing the 'Action' on the Ports page. That doesn't seem to work as desired.

Configuration → Security → Network → ACL → Ports

1. Enter the ID of the ACL policy you just created in the Policy ID field of the port with the IPMI device.
2. Leave the 'Action' as 'Permit'.

In this example, we have a client switch configured for the client's two VLANs (Data on 210 and Voice on 211). The Data VLAN is untagged and the Voice VLAN is tagged.

The uplink port 24 (trunk), in essence, carries only tagged traffic.

If you are configuring remotely and you misconfigure the uplink (trunk) port, you will lose access to the switch for further configuration.

Next we show the switch management IP configuration for our example: