AXIS T8504-E Outdoor PoE Switch

AXIS T8504–E is an outdoor PoE switch. The major benefits of this product is its outdoor capabilities and the capability to extend the maximum reach of the network by an additional 100 meters, to a total of 200 meters, between the switch and the powered devices, while providing up to 2x60 W and 2x30 W to its network-powered PoE devices.

This user manual provides information on how to manage AXIS T8504–E through AXIS IPv4/IPv6, VLAN, RADIUS, TACACS+, web interface, SNMP and SSH.

This user manual is intended for network administrators, supervisors and installation technicians with knowledge about:

• Basic concepts and terminology of networking

• Network topology including VLAN

• Network protocols

• User authentication protocols including RADIUS and TACACS+

For additional information, see the following documentation:

• Product installation guide

• RFC3621 SNMP MIB and private MIB

• Creating certificate for T8504–E secured web server

A number of features are provided through system network management.

• Easy software update during runtime without affecting active PoE ports

• Configuration and real-time monitoring using graphical representation of the remote device

• System status display

• SysLog reporting on PoE events, invalid remote user access, initial DHCPv4/v6 address etc.

• SNMP traps reporting on various PoE events such as PoE powered device insertion or removal

• Four weather sealed RJ45 Ethernet ports capable of 10 Mbit, 100 Mbit, 1000 Mbit half-duplex and 1000 Mbit full-duplex Ethernet speed

• Single weather sealed SFP Ethernet port

• 8K internal MAC address lookup engine

• VLAN — Access, Trunk and Filtered trunk

• Auto MDIX

• 10KB jumbo frames

The following PoE options are available:

• Two 4Pair PoE ports which deliver up to 60 W per port

• Two IEEE 802.3at PoE ports which deliver up to 30 W per port

• PoE enable/disable to enable or disable PoE ports power output. Ethernet data is always enabled.

• Remote device reset to reset attached powered device. The device is temporarily powered off and then turned back on.

The following network protocols are supported:

• IPv4 – 32–bit long IP address (static/DHCPv4)

• IPv6 – 128–bit long IP address (static/DHCPv6)

• VLAN – Access, Trunk and Filtered trunk

You can access the unit through different interfaces:

• Web interface via a web browser – to view the unit PoE status, network status, unit configuration and unit production information

  HTTP is a web-based friendly configuration interface.

  HTTPS-TLS is a secured web-based friendly configuration interface.

• SNMP via an SNMP manager application – to monitor the unit over the network (MIB-II RFC1213) and to monitor or configure the unit PoE capabilities (RFC3621)

  SNMPv2c for non-secured SNMP management

  SNMPv3 for secured and encrypted management

  RFC1213 MIB-II for network statistics

  RFC3621 for PoE SNMP MIBs

  Private MIB extension for RFC3621 PoE MIB

  Various infrastructure and network MIBs such as IP-MIB, TCP-MIB, UDP-MIB etc.

• SSH via an SSH client – to view the unit PoE power report, network status, unit configuration and production information; to update software, enable or disable PoE functionality and to ping remote network devices for connectivity tests

User access can be managed in the following ways:

• Local – Username and password is managed locally by the device

• RADIUS – Username and password is authenticated by RADIUS server over the network

• TACACS+ – Username and password is authenticated by TACACS+ server over the network

Web HTTP and HTTPS, SNMPv2, SNMPv3 and SSH, used for accessing the unit, offer different levels of security strength. Also RADIUS and TACACS+, used for remote user authentication, offer different security levels.

SNMPv1 and SNMPv2 use community string for Get/Set/Trap authentication. SNMPv1 and SNMPv2 are considered as unsecured protocol since the community string password can easily be intercepted by any network sniffing device.

SNMPv3 resolves SNMPv1/v2 security issues by adding authentication and encryption layer on top of SNMP packets.

The unit is shipped with the following factory default usernames and passwords:

Unit default IPv4 address
IP = 192.168.0.254
Mask = 255.255.255.0

Web HTTP/HTTPS and SSH
Username = root
Password = Find the default password on the label on your device

SNMPv2
GET community string = public
SET community string = write
Read community = public
Write community = write
Trap community = public

SNMPv3
Username = admin
Authentication password (MD5) = password
Privacy password (DES) = password
Authentication and encryption mode = MD5+DES

SNMPv3 notification
Username = trap
Authentication password = password
Privacy password = password
Authentication and encryption mode = None

For information about how to recover username and password, see Recover username and password.

1. Disconnect all PoE ports from the unit except for one Ethernet cable. Only one single Ethernet port should be active.

2. Turn off the firewall or enable UDP port 514. Then run IPv4 capable SysLog Server on your computer.

3. Turn off the unit. Wait 10 seconds, then turn the unit back on.

4. A SysLog message appears after approximately 15 seconds. Identify the unit Link-local IPv6 address. A Link-local IPv6 address always starts with FE80.

5. Open a command window on your computer.

6. • For Windows 7, go to Start and type cmd.

   • For Windows 8, press the Windows key and the R key, then type cmd.

7. Type ipconfig to identify the virtual interface index of Link-local IPv6 address. The virtual interface index is indicated by a number after %. Example: fe80::9c39:db8b:62de:7bv4%17

8. Prepare the SSH connection by typing Telnet [unit Local-link IPv6 address][%virtual interface number] 2525, but don’t press Enter. Example: Telnet fe80::9c39:db8b:62de:7bv4%17 2525

9. Turn off the unit. Wait 10 seconds, then turn the unit back on.

10. Wait 30 seconds, then press Enter to start the Telnet session on TCP port 2525.

11. Type axispasswordrecovery as username and axispasswordrecovery as password. A recovery option to restore the entire unit to complete factory default including unit network configuration is presented.

12. Press Y to restore the unit. The unit restarts with default IPv4 192.168.0.254, type root as username and use the default password printed on the label on your device.

When configuring the unit for the first time, follow the steps below:

1. Configure your PC Ethernet network interface to the following IPv4 parameters:

   PC IPv4 address: 192.168.0.40

   PC IPv4 mask: 255.255.255.0

2. Connect your PC Ethernet network interface to any of the unit’s Ethernet ports.

3. Open a web browser and type 192.168.0.254 in the address field.

4. Log in with the default username and password. See Default unit IP, username and password.

5. Configure the unit. It is recommended to change the usernames and passwords to other than the default values.

To locate the unit over the IP network, the unit sends IPv4 SysLog message #0 in broadcast format 255.255.255.255 upon power-up. Any SysLog server connected over LAN receives this SysLog message. The same SysLog message is also sent to the optional SysLog servers 1 and 2, if they are configured.

The unit sends the message twice. This is to ensure that the SysLog message is received by the SysLog servers, regardless of network configuration. The message is first sent before VLAN configuration is made and later again after VLAN configuration is done.

SysLog message #0 contains all the information which is required to be able to provide access to the unit over the network.

Example: MsgID#000 - System UP. APP:v3.51.06 BOOT:v3.16 RST:Power-On BOOT:0=[APP OK] Host:axis-00055A034B49 MAC:00:05:5a:03:4b:49 VLAN:YES VLAN_MNGR:5 VLAN_UPLINK_PORT:3 VLAN_UPLINK_MODE:TRUNK DHCPv4:No IP1v4:192.168.0.254/24 DHCPv6:No IP1v6:2345::205:5AFF:FE03:4B49/64 IP2v6:FE80::205:5AFF:FE03:4B49/64

Go to Status to view the unit status. The page is updated automatically every few seconds.

Parameter	Description
	Blue symbol — PoE power is provided Gray symbol — No PoE power
	Blue symbol — PoE port is enabled Gray symbol — PoE port is disabled
	Blue symbol — Ethernet link is on Gray symbol — No Ethernet link
	Blue symbol — SFP module is inserted into the uplink port Gray symbol — Uplink port has no SFP module inserted
Network	Reports the Ethernet link speed (10/100/1000 MB) and if the network connection is up or down
Status	Reports the PoE port status, if it is enabled, disabled, delivering power, etc.
Power usage	Reports the actual power consumption and the maximum power it can deliver
PoE reset	Click Reset to turn off the PoE port power and restore the PoE power back on. Note A PoE port which is disabled by SSH or SNMP will be enabled after a PoE reset.
Total power usage	Reports the aggregated power consumed by all PoE ports and the percentage of the consumed power relative to the internal power supply power capabilities.

Go to Basic to view basic information about the product.

IP address in use

Go to IP address in use to view information about IPv4 and IPv6 addresses, masks, default gateways and Domain Name Servers (DNS).

Product information

Go to Product information to view general product information such as product name, serial number, software version and PoE firmware version, and SFP module information such as SFP type, vendor, part number and serial number.

Network configuration

Go to Network configuration to enable or disable DHCP, configure IPv4, IPv6 and network hostname. Hostname is used by both IPv4 and IPv6 to register the unit name in DHCPv4/v6 server. Note that IPv6 uses the FQDN terminology as hostname.

Network services IPv4/IPv6

Go to Network services IPv4/IPv6 to configure DNS and SysLog servers.

PoE configuration

Go to PoE configuration to configure PoE port power. Four PoE power schemes offer different power distributions between the four PoE ports. All four options comply with the unit maximum power capacities.

• 60 W: Deliver power over four pairs inside the Ethernet cable. Each pair delivers up to 30 W.

• 30 W: Deliver power over two out of four pairs inside the Ethernet cable

• 15.4 W: Deliver power over two out of four pairs inside the Ethernet cable

• – –: No PoE power. Ethernet port is enabled and functional, but PoE is disabled.

Go to Security configuration to configure the unit username and password for remote web or SSH access.

Go to HTTPS to configure whether HTTP or HTTPS (secured web) should be used. When HTTPS is enabled, TLSv1.2 is used to encrypt web network traffic.

RADIUS/TACACS+ enables remote user authentication when user accesses the unit over web or SSH. Username and password are then authenticated by the RADIUS/TACACS+ server.

The advantages with RADIUS/TACACS+ is that username and password are easy to update, especially if many network devices are to be managed.

The disadvantage with RADIUS/TACACS+ is that the unit is not accessible if both RADIUS/TACACS+ servers are down. It is possible to enable Local login fallback which allows the unit to use its local username and password whenever there is no reply from RADIUS/TACACS+ servers.

Go to Test RADIUS/TACACS+ to verify the RADIUS/TACACS+ configuration before activating it.

1. Configure all RADIUS/TACACS+ parameters, leaving the Enable authentication disabled.

2. Save the configuration. If not, the parameters will be restored to saved values after each test, erasing any unsaved value.

3. Type the username and password.

4. Click Test configuration. A waiting message will appear, followed by either OK or FAIL.

5. If needed, change and save the configuration and test again.

6. When the test result is OK, set Enable authentication to enabled. Save the configuration, which activates the RADIUS/TACACS+ configuration.

VLAN configuration sanity check is done upon unit power-up and when a VLAN configuration change is requested over the web. The sanity check is to make sure that the unit remains manageable over the network after VLAN configuration is applied. In case the new VLAN configuration may cause the unit to become unmanageable, an error message appears on the webpage for requests over the web. When a problem is detected upon power-up, the unit configuration will be restored to factory default.

Go to SNMP configuration to configure parameters applicable to SNMPv2c and SNMPv3.

Reset

There are four different reset options:

• Do a safe restart without losing PoE power resets the internal network manager and the internal Ethernet switch (network will be down for a few seconds), leaving the PoE power unchanged. Powered devices continue normal operations as if no reset is done.

• Do a safe restart resets the internal network manager, internal PoE controller and internal Ethernet switch.

• Restore the factory values but keep the IP settings resets unit configuration to factory default, leaving IPv4/IPv6 network configuration unchanged. VLAN and RADIUS/TACACS+ is disabled. The option to access the unit over the network as before is maintained.

• Restore all factory values restores the unit to full default factory setting. Unit IP is set to 192.168.0.254 and VLAN is disabled.

Firmware upgrade

A firmware upgrade upgrades only the internal network manager. PoE firmware is unchanged. The upgrade can take up to 10 minutes. During this time network switching functionality remains uninterrupted, but the unit is unmanageable. PoE functionality remains active, but network traffic may be interrupted for several seconds.

Product configuration

Go to Product configuration to download or upload a product configuration file. This functionality can be used to backup unit configuration, modify unit configuration offline or to create a master configuration file to easily configure several units.

The SSH interface is designed for various maintenance tasks such as PoE firmware update etc. It is designed to provide an easy and convenient interface for IT managers who are familiar with SSH. To simplify SSH usage, the SSH interface is menu-driven.

SSH is password protected and shares the same username and password as for web access.

SSH supports RADIUS and TACACS+ username and password authentication.

To easily identify the accessed unit, the unit hostname string is shown to the right of the Main menu title. This is especially useful when the user has multiple units.

View menu provides information on PoE ports status, network parameters and unit information.

Go to Configuration and maintenance menu to configure or reset the unit or to update software.

Go to Ping remote host to test network connectivity issues.

Multiple units can be monitored and managed by using third-party standard network management tools such as HP Openview, IBM Tivoli, SNMPc etc.

The network manager interface supports SNMPv1, SNMPv2 and SNMPv3. The unit accepts and replies to SNMPv1 packets, but since SNMPv1 is obsolete, SNMP traps and notifications are sent in SNMPv2, SNMPv3 or both.

To enable SNMP:

• Go to Security > SNMMP configuration and enable SNMPv2 or SNMPv3.

• Make sure that SNMPv2 community strings match your SNMP manager configuration.

• Make sure SNMPv3 username, authentication password, privacy password and encryption methods match your SNMP manager configuration.

To enable traps:

• Go to Remote IPv4/IPv6 SNMP trap managers and configure the remote manager IP address.

• Make sure SNMPv3 notification username, authentication password, privacy password and encryption methods match your SNMP trap manager configuration.

• Go to PoE MIB and enable PoE notifications to get notifications about changes in PoE port status, unit power consumption exceeds or falls below a certain level etc.

Several MIBs are supported by the SNMP manager.

Network MIBs

Various network MIBs, such as RFC1213 MIB-II, can be used for providing network statistics. Note that these MIBs are not intended to be used for network configuration over SNMP.

RFC3621

Power over Ethernet (PoE) MIB which provides various PoE capabilities. See RFC3621 PoE MIB.

Private MIB

Enhances PoE functionality beyond RFC3621 PoE MIB. See Private MIB.

RFC3621 PoE MIB is located under the 1.3.6.1.2.1.105 SNMP MIB tree. The MIB is divided into three sections.

Port parameters

The first section handles PoE ports and provides functionality such as enable and disable ports, read port status, class, etc. Each OiD is accessed as a two-dimensional array table.

Main PSE parameters

The second section handles the power source that provides power to a group of PoE ports. It enables reading the total power consumption, power supply status, etc.

PoE traps

The third section enables and disables PoE traps to be sent to remote SNMP managers.

The following SNMP OiDs are supported by the SNMP private MIB:

The unit sends various event reports to an external IPv4/IPv6 host running a SysLog daemon application. The IPv4/IPv6 host logs the events for future use. Configure SysLog server IP address by browsing to the unit configuration web page if SysLog events are to be sent.

There are three categories of log events:

Broadcast IPv4 SysLog events

These log events are to be intercepted by any SysLog server on the LAN regardless of unit SysLog configuration. This facilitates locating of unit IP on the network and reporting of major events such as unit recovery from power failure, etc.

RFC3621 PoE traps

RFC3621 PoE traps are also sent as SysLog messages, which simplifies the readability of such events for the remote user.

Proprietary SysLog events

These log events include potential failures or potential security breaches as when a remote user tries to access with incorrect username over web/SSH, etc.

SysLog message types

The following troubleshooting table guides you through the most common problems. If you cannot find the information you are looking for, contact your local dealer for further assistance.

Should you require any technical assistance, please contact your Axis reseller. If your questions cannot be answered immediately, your reseller will forward your queries through the appropriate channels to ensure a rapid response. If you are connected to the Internet, you can:

• visit axiscompanion.com/manuals for a complete set of product specific user manuals and system installation guides

• download user documentation and software updates

• find answers to resolved problems in the FAQ database, search by product, category, or phrase

• report problems to Axis support staff by logging in to your private support area

• chat with Axis support staff

• visit Axis Support at axis.com/support

Should you require any technical assistance, please contact appropriate channels according to your AVHS license agreement to ensure a rapid response.

Should you require any technical assistance, please contact ADP Helpdesk to ensure a rapid response.

Visit Axis learning center axis.com/learning for useful trainings, webinars, tutorials and guides.