Alcatel Lucent OmniSwitch 6850 Stacking and Security Configuration Guide

Alcatel Lucent OmniSwitch 6850 Series Stacking and Secure Access Configuration Guide

The Alcatel Lucent OmniSwitch 6850 series, with its fixed configuration of Gigabit/10G ports, PoE power supply, virtual stack architecture, and rich IPv4/IPv6 routing and security features, has become a cost-effective multi service access platform in the park network access layer, branch offices, and metropolitan Ethernet edge. This series includes standard gigabit models, PoE models, and "L" models (software upgradable to gigabit 100Mbps models), and provides redundant power supplies and hot swappable modules to ensure network resilience. However, to truly unleash its potential, engineers need to have a deep understanding of building stacked clusters, deploying security policies, optimizing QoS, and quickly locating common faults. This article is based on the technical specifications of OmniSwitch 6850 product, systematically sorting out the troubleshooting process from hardware selection, stacking configuration, high availability design, security access control to typical abnormal scenarios in daily operation and maintenance, providing a practical operation manual for park network engineers.

Product Family Overview and Selection Decision

The OmniSwitch 6850 series offers a wide range of fixed configuration models, with key differentiation dimensions including port count (24/48), PoE support, upstream speed (X model with two built-in 10G stacking/upstream ports), and "L" - shaped 100Mbps upgradable models.

Non PoE models:

OS6850-24/24X: 20 RJ-45 Gigabit ports+4 combo ports (24X includes 2 10G uplink ports).

OS6850-48/48X: 44/48 RJ-45 Gigabit ports+4/0 combo ports (48X without combo, direct 48 ports+2 10G ports).

OS6850-U24X: 22 SFP fiber ports+2 combo+2 10G, suitable for all fiber access.

PoE model (OS6850-P24/P24X/P48/P48X): Corresponding to the above port configuration, it supports IEEE 802.3af, with a maximum of 15.4W per port. The total power supply capacity depends on the selected power supply (360W or 510W, see Table 2 for details).

The "L" type 100Mbps model (OS6850-24L/48L and corresponding PoE versions P24L/P48L): initially has a 10/100 Mbps port, but can be upgraded to gigabit speed by purchasing a software license (OS6850-24L-UPGD or 48L-UPGD) without the need for hardware replacement. This design is highly investment protective and suitable for scenarios with limited budgets but future acceleration needs.

Core considerations for selection:

If gigabit access is needed in the future, avoid purchasing L-shaped models and choose the standard gigabit model directly; If the current 100Mbps is sufficient and the budget is tight, you can choose L-type and upgrade later.

PoE power supply budget: 360W power supply can provide about 230W PoE, 510W power supply can provide about 380W. Depending on the number of powered devices (IP phones AP、 If the total power of the camera exceeds 230W, a 510W power supply (OS6850-BP-PH) must be selected.

Stacking requirements: All models support circular stacking through two dedicated 10G stacking ports, with a maximum of 7 units (actual stacking IDs 1-7). The stacking bandwidth is 40 Gb/s per unit, and the maximum stacking speed is 320 Gb/s.

Stacked cluster construction and virtual chassis management

The stacking technology of OmniSwitch 6850 adopts a "virtual chassis" design, where multiple devices are connected through dedicated stacking ports to logically form a switch for unified management and configuration, and supports cross device link aggregation.

Stacking connections and ID allocation:

Use dedicated stacking cables (or SFP+fiber optic modules) to connect the stacking ports of each unit in a circular topology (circular is recommended and redundancy is provided).

After power on, the system automatically selects the primary unit, and the stacked IDs (1-7) can be observed through the seven segment digital tube on the front panel. If you need to manually specify the ID, execute the stack set ID<1-7>in the CLI.

Adjust the primary priority: stack set priority<value>, the higher the value, the higher the priority.

Stacking redundancy and split protection:

When the primary unit fails, the backup unit automatically takes over, and all ports and configurations remain unchanged, with a switching time in milliseconds.

If the stacking link breaks, the system will split into two independent stacks, and RSTP/MSTP or G.8032 ring network protection needs to be enabled to avoid loops. Show stack topology can be used to monitor link status in real-time.

Configuration synchronization: After the stack is established, the configuration file of the primary unit is automatically synchronized to all members. When making changes, only the operation on the primary unit is required, and the system automatically distributes them.

Common stacking faults:

Members cannot join: Check if the software version is consistent (show version), if the stack port negotiation rate matches (must be both 10G).

Stacking repeated restarts: Check if the power supply is insufficient, especially when PoE is fully loaded, the stacking unit may repeatedly restart due to unstable power supply.

Initial configuration and automated deployment

OmniSwitch 6850 supports multiple zero touch deployment methods, simplifying the opening process:

Automatic configuration download: Obtain IP and configuration files through DHCP (Option 60/66/67), and automatically pull boot.cfg from TFTP/FTP server after device startup.

USB local import: Save the configuration file to a USB drive, insert it into the device's USB port, and then execute copy USB-Flash0:/boot.cfg running config.

WebView graphic management: Built in web management interface, suitable for quick configuration on a single machine.

CLI script: Supports ASCII readable configuration files, can be edited offline and distributed in batches.

Initial security configuration: Change default password, set management VLAN, enable SSHv2 and SNPv3, and disable unnecessary Telnet/HTTP services.

High availability and link redundancy mechanism

OmniSwitch 6850 provides multi-level redundancy to ensure stable access layer network:

Power redundancy: All models support dual power hot swapping. Non PoE models can be equipped with 126W AC or 120W DC; PoE models require 360W or 510W AC. The backup power supply can be remotely installed (via the included extension cable) and is suitable for depth limited cabinets.

Link Aggregation (LACP): Supports static or dynamic LAG across stacked members, up to 8 member links, providing bandwidth expansion and link redundancy.

Ring network protection: Supports ITU-T G.8032 Ethernet ring network protection (convergence<50 ms) and RRSTP (ring network fast spanning tree,<100 ms). Prioritize the use of G.8032 in ring topology.

VRRP: Supports virtual routing redundancy protocol and provides device level backup for gateways.

BFD: Bidirectional forwarding detection, linked with routing protocols to achieve millisecond level fault detection.

Configuration suggestion: When deploying at the access layer, enable BPDU blocking (preventing user ports from participating in STP), Root Guard, and Layer-2 loopback detection to effectively avoid network paralysis caused by user misconnection.

Deep deployment of security policies

The OmniSwitch 6850 is equipped with the Alcatel Lucent Access Guardian framework, which provides user identity based policy control and enables BYOD secure access without the need for additional hardware.

Core components:

802.1X+MAC authentication: Supports 802.1X with multiple clients and VLANs, and is compatible with non 802.1X terminals (MAC authentication or Captive Portal redirection).

User Network Profile (UNP): The Radius server returns the UNP name, and the switch dynamically issues VLAN, ACL, bandwidth, and HIC (Endpoint Compliance) policies to enable policy compliance when users move.

DHCP Snooping+ARP Protection: Enable IP DHCP Snooping and IP ARP Inspection to prevent IP/MAC spoofing.

Traffic Anomaly Detection (TAD): The built-in engine monitors typical traffic patterns of worm viruses and can automatically close ports or alert network administrators.

BPDU blocking and Root Guard: Enable span tree BPDU filter and span tree root guard on the access port to prevent network loopback caused by users connecting to the switch privately.

Deployment Steps Example (802.1X):

Enable AAA (aaa authentication dot1x default radius) globally.

Configure the Radius Server (radius server host<ip>key<shared>).

Enable 802.1X on the port (interface gig 1/1/1 → dot1x port control auto).

Configure Guest VLAN and Authentication Failure VLAN (optional).

Maintenance points: Regularly test the reachability of the radius server and audit the TACACS+command authorization logs.

PoE power management and fault location

PoE models (P24/P48, etc.) support IEEE 802.3af, with a maximum of 15.4W per port. The total power budget depends on the power supply (360W provides approximately 230W, 510W provides approximately 380W). Dynamic PoE allocation can adjust power supply according to the actual needs of powered devices, reducing power consumption.

Common problems and solutions:

Port not powered: Check show poe port<ifidex>to see the power status and power. If prompted with 'insufficient power', adjust the port priority or upgrade to a 510W power supply.

Frequent device restarts: It may be due to excessive cable impedance causing voltage drop. Try replacing high-quality Cat5e/Cat6 cables or reducing the maximum power limit (poe max power) of the port.

Overall power exceeding limit: When the total demand exceeds the budget, the system cuts off low priority ports according to port priority (critical/high/low). It is recommended to prioritize key equipment (such as APs) in advance.

Diagnostic tool: Use show poe device to view the type and power consumption of all powered devices, and combine Syslog to capture overload alarms.

Key points for routing and multicast configuration

OmniSwitch 6850 supports line speed IPv4/IPv6 routing (RIP, OSPF, IS-IS, BGP) and multicast (IGMP snooping, PIM-SM/DM).

IPv6 Transition: Supports IPv6 tunneling (GRE, IPv6 over IPv4) and dual stack operation, facilitating gradual migration.

Multicast optimization: IGMP snooping can suppress multicast flooding, and IP multicast VLAN (IPMVLAN) can replicate multicast streams at the edge, saving core bandwidth.

Configuration Example (OSPF):

text

router ospf 1

area 0.0.0.0

interface vlan 10

ip ospf area 0.0.0.0

Troubleshooting:

OSPF neighbor cannot be established: check interface network type, hello/dead interval, authentication configuration.

Multicast not working: Check if IGMP snooping is enabled and if PIM mode matches.

Systematic positioning of common fault scenarios

8.1 Port unable to UP (copper/fiber optic)

Copper cable: First check the auto negotiation (default enabled), use TDR (Time Domain Reflectometry) to locate the cable breakpoint or short circuit point: TDR cable diagnostics interface gi 1/1/1, the system will return the distance and fault type (open circuit, short circuit, impedance abnormality).

Fiber optic: Check the recognition status of SFP module (show sfp), read DDM data (show sfp ddm), and check whether the optical power, temperature, and bias current exceed the limit. If the light attenuation is too large, clean the fiber optic connector or replace the module.

Protocol layer: If the port is err disable due to BPDU protection or loop detection, use errdisable recovery or manually shut down/no shutdown for recovery.

8.2 Stacking Splitting or Offline Members

Check the status of the stack link (show stack link). If a link is down, try unplugging the cable or replacing the SFP+module.

If there are two Primary members in the stack, you can manually specify the primary unit and restart the backup member to force the merge.

Check if there is a 'stack topology change' event in the system log (show log).

8.3 Abnormal PoE power supply

Check the total power usage (show poe), and if it exceeds the budget, the high priority port will automatically power off. Adjust port priority or add power modules.

If a single port is not powered, check if the port is configured with POE disable or if the powered device exceeds the maximum power of the port (default 15.4W).

Use LLDP to negotiate power requirements with devices.

8.4 Routing Protocol Neighbor Loss (OSPF/BGP)

Firstly, verify the physical link and IP connectivity (ping neighbors).

Check the VRF configuration (if multiple VRFs are enabled) and confirm that the interface belongs to the correct VRF.

For BGP, check the show BGP summary and if the neighbor status is Idle or Active, check if TCP port 179 is blocked by ACL.

Utilize BFD to quickly detect link faults.

8.5 Software upgrade failure or startup crash

The device flash stores dual images (primary/backup) and dual configuration files. If the new image cannot start, enter boot system backup rollback at the boot prompt.

If the device enters miniboot, the image can be reloaded through XMODEM or USB.

Before upgrading, be sure to back up the current configuration (copy running config) tftp://... ）And read the version release notes.

Characteristics of Metropolitan Ethernet

OmniSwitch 6850 supports IEEE 802.1ad (QinQ), ITU-T Y.1731 performance measurement, G.8032 ring network protection, and MAC Forced Forwarding (RFC 4562). It has been certified by MEF 9/14 and is suitable for operator access and metropolitan Ethernet services. During configuration, VLAN stacking and Service VLAN (SVLAN) mapping should be enabled, and DHCP Option 82 should be used to transmit user location information.