DrayTek VigorSwitch — P, G, Q and PQ series

Configuration example for preparing a DrayTek VigorSwitch so that it works with PrivateLAN. Register the switch in PrivateLAN with type DrayTek-VigorSwitch.

The driver covers the VigorSwitch models with the Cisco-like command line of firmware 2.x. You recognise it by the prompt (PQ2200xb#) and by the first line of show running-config: DRAYTEK SYSTEM CONFIG FILE ::= BEGIN. PrivateLAN was tested against a VigorSwitch PQ2200xb on firmware 2.9.12 (sixteen 2.5 Gbit/s PoE ports and four 10 Gbit/s SFP+ ports). Older VigorSwitch models that are managed only through the web interface are not covered.

What PrivateLAN does on these switches, and what it does not:

Everything in this guide is entered once, before you add the switch to PrivateLAN. Individual switch port configuration is not part of it: PrivateLAN programs access ports itself from the device group templates, and anything you configure on a port by hand is overwritten the next time that port is programmed.

Values used in this guide

The appliance only accepts syslog, RADIUS and time (NTP) traffic on eth0, and only from RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). A switch with a public management address cannot reach those services, whatever you configure on the switch itself.

How this CLI differs

Read this before you start if you know Cisco IOS: these are the differences PrivateLAN takes care of, and the ones you will run into yourself.

• The login happens inside the session. The SSH server lets every client in and then asks Username: and Password: itself. PrivateLAN answers those questions with the user name and password you register; you do not need to set anything for it.
• configure, not configure terminal. configure terminal is an unknown command. show commands do not work in configuration mode; use end first (or do show ...).
• Port names. Ports are 2.5gi1 to 2.5gi16 and 10gi1 to 10gi4 on the PQ2200xb, gi1 on 1 Gbit/s models, and lag1 for a link aggregation. Commands and tables use these short names; log messages spell them out (2.5GigabitEthernet2 link up). A range is written as 2.5gi1-16,10gi1-4.
• restore-defaults interfaces 2.5gi5 returns one port to its factory settings — the equivalent of Cisco's default interface. Every PrivateLAN template starts with it.
• Descriptions and VLAN names are at most 32 characters. The switch refuses a longer description completely; PrivateLAN shortens a host name to 32 characters before it sends it.
• A port that is shut down reads down in show interfaces status, just like a port without a cable. show interfaces 2.5gi1-16 status shows disable for it.
• reboot restarts at once, without asking for confirmation.

1. First access and host name

Connect to the console port (115200 baud, 8 data bits, no parity, 1 stop bit) or over SSH to the factory address. The factory account is admin with password admin.

configure
hostname SW-FLOOR1-01

2. Accounts

username admin privilege 15 secret ExampleAdminPassword
username privatelan privilege 15 secret ExampleSwitchPassword

Change the factory password of admin first. The PrivateLAN account must have privilege 15: PrivateLAN enters configuration mode and saves the configuration. secret stores the password as a hash in the running configuration (secret encrypted $6$...).

3. SSH

PrivateLAN connects over SSH only. SSH is on in the factory configuration; turn Telnet off:

ip ssh
no ip telnet

You do not need to turn off paging: PrivateLAN sends terminal length 0 itself on every session.

SSH with a key instead of a password

Optional, and recommended. PrivateLAN can authenticate with an SSH private key instead of a password; it was tested on firmware 2.9.12 with an RSA key of 3072 bits. Three things to know first:

• The public key is entered in the web interface, per user account. The command line has no command to enter a key; ip ssh auth key only deletes the key of the account you are logged in with. Put the key on the switch before you turn off the web interface (section 11).
• ip ssh auth makes SSH key-only. Once it is on, the switch no longer asks for a user name and password in the SSH session, for any account: only a key gets in. The console keeps asking for the password. Enter it last, after PrivateLAN has a working key.
• A key login lands straight at the prompt (SW-FLOOR1-01#), without the Username: question.

The order:

1. Under Switches > Add (or Edit), choose SSH key as authentication and paste the private key; after saving, PrivateLAN shows the public key that belongs to it.
2. Put that public key on the switch, in the web interface, for the privatelan account.
3. Turn key authentication on:

ip ssh auth

Check that PrivateLAN still reads the switch (the status under Switches is refreshed). If it does not, no ip ssh auth on the console brings the password login back.

4. Management VLAN and IP address

The switch has one management address, in the management VLAN. PrivateLAN reaches the switch on this address, and it is also the address you register as a RADIUS client. Make this change on the console: the SSH session runs over the address you are changing.

vlan 10,20
vlan 10
 name "MGMT"
exit
vlan 20
 name "DATA"
exit
management-vlan vlan 10
no ip dhcp
ip address 192.168.10.21 mask 255.255.255.0
ip default-gateway 192.168.10.1

vlan 10,20 creates both VLANs; vlan 10 then opens one of them to give it a name. The address takes mask before the subnet mask.

The uplink has to carry the management VLAN. A factory port is already a trunk with native VLAN 1; add the VLANs it carries tagged:

interface 10gi1
 description "UPLINK"
 switchport mode trunk
 switchport trunk allowed vlan add 10,20
 lldp tx
 lldp rx
exit

lldp tx and lldp rx are the default on every port; they are written out here because a port that was a device port before keeps the no lldp tx of its template. On a link between two switches LLDP has to run in both directions: Reports > Interconnects draws the links between your switches from the LLDP neighbours of the ports tagged [TRUNK].

Use switchport trunk native vlan <id> if the other side of the uplink has a different native VLAN. Tag the uplink [TRUNK] in PrivateLAN so the appliance adds each VLAN it programs to it.

PrivateLAN never removes the management VLAN from a switch. Programming VLANs removes the VLANs on the switch that its switch group does not list, but it keeps VLAN 1, the VLAN the switch's own management address is on, and every VLAN marked as Management VLAN in PrivateLAN. Add the management VLAN in PrivateLAN and mark it, so it is also kept on a switch whose configuration PrivateLAN has not read yet. Assign it to the switch group only if PrivateLAN should program it like any other VLAN, for example add it to new [TRUNK] ports.

Enter the interface list in PrivateLAN in the form the switch prints, for example for a PQ2200xb: [P8] 2.5gi1-4, [P4] 2.5gi5-16, [ND][TRUNK][SFP] 10gi1-4. Ports 1 to 4 of the PQ2200xb deliver up to 90 W (802.3bt, class 8), ports 5 to 16 up to 30 W (802.3at, class 4).

5. Time and time zone

clock timezone CET +1
clock summer-time CEST recurring eu
clock source sntp
sntp host 192.168.10.5

Point the switch at the appliance's own address. The PrivateLAN appliance passes on the time it gets from the time server under System > Networking (an NTP relay), so the switch needs neither internet nor DNS, and its log times line up with the appliance's. The appliance answers only on eth0, only to RFC 1918 addresses, and limits how often one address may ask; a switch asks far less often than that. An appliance that has no time itself says so, and the switch waits instead of taking a wrong time.

The factory configuration points at pool.ntp.org, which only works when the switch has a DNS server. Use an IP address. A switch without time keeps its build date — a date months off in show clock and in every log line is the sign.

Inspection > Compliance checks the sntp host line and accepts either the appliance's own addresses or the time server the appliance is configured with.

6. Sending syslog to the appliance

logging host 192.168.10.5 severity 6

Severity 6 (informational) matches what the appliance's syslog view expects; the factory level (notice) leaves out part of it. Lower it to 4 (warnings) if a switch is noisy — the appliance rate-limits syslog per sending device, and more than roughly 200 UDP messages per second from one source are dropped. A switch being limited shows up on the dashboard's syslog flood protection tile.

With the SOC license option, syslog also makes the port alarms of the SOC live view faster: when the switch logs a link change (2.5GigabitEthernet2 link down), the appliance reads the switch again straight away.

Verify with show logging. Inspection > Compliance reports this line as Logging host, and only counts it as a match when it points at this appliance.

7. RADIUS and 802.1X

This is what makes PEAP and EAP-TLS devices work. The switch has to be registered as a RADIUS client in PrivateLAN as well, under 802.1x / RADIUS, with the same management IP address and the same shared secret.

radius host 192.168.10.5 auth-port 1812 acct-port 1813 key ExampleSharedSecret
authentication dot1x
authentication mac
authentication mac radius mac-case lower
authentication mac radius mac-delimiter none

• authentication dot1x and authentication mac switch the methods on for the switch. PrivateLAN turns them on and off per port when it programs a device.
• The two mac-case and mac-delimiter lines make the switch send a MAC address as twelve lowercase hexadecimal characters without separators (00155d5a6500), the form PrivateLAN stores. Check with show authentication: Mac-auth Radius User ID Format must read xxxxxxxxxxxx.
• A VLAN in the RADIUS reply is applied: VLAN Assign Mode static (the factory setting, see show authentication interfaces 2.5gi2) uses the VLAN from the reply when there is one and the port's own VLAN otherwise.

The shared secret is readable on the switch. This firmware has no service password-encryption: the key appears in clear text in show running-config and show radius. Limit who can log in to the switch. When a switch configuration leaves the appliance — for example through a QR Support report — PrivateLAN strips RADIUS keys, SNMP community strings and similar credential lines first.

MAC authentication (MAB) does not work on firmware 2.9.12

The switch sends a MAC authentication request without the Message-Authenticator attribute. The appliance requires that attribute on every request from every switch: it protects against forged RADIUS answers (the Blast-RADIUS attack, CVE-2024-3596). The appliance therefore discards these requests, and a device with the MAB profile is not let onto the network. The user name the switch sends is correct, and 802.1X requests (PEAP, EAP-TLS) do carry the attribute.

Use EAP-TLS or PEAP for devices that support 802.1X, and the Secure MAC profile for devices that do not. PrivateLAN keeps the MAB template for these switches, so it works without a change once DrayTek firmware sends the attribute.

Port configuration is pushed by PrivateLAN

You do not configure 802.1X on individual ports. PrivateLAN writes it when it programs a device onto a port, from the templates under Devices > Device groups. An EAP-TLS port ends up looking like this:

interface 2.5gi2
 switchport mode access
 switchport access vlan 30
 authentication dot1x
 authentication port-control auto
 authentication host-mode single-host
 spanning-tree edge
 spanning-tree bpdu-guard
 description "CAMERA-01"
 lldp rx
 no lldp tx

single-host admits one device per port, as in the Cisco templates.

Secure MAC: a MAC access list per port

The Secure MAC profile lets only the device's own MAC address(es) onto the port. On these switches PrivateLAN does that with a MAC access list named after the port, bound to it:

mac acl "PL-2.5gi4"
 sequence 1 permit 00:15:5D:5A:65:00/FF:FF:FF:FF:FF:FF any
!
interface 2.5gi4
 mac acl "PL-2.5gi4"
 ...

Every other source address is dropped. PrivateLAN does not use the switch's port security for this: on firmware 2.9.12 the per-port port security setting is not saved and is off again after a restart, and statically entered MAC addresses do not count towards its limit. A bound access list cannot be changed, so every template first returns the port to its factory settings, which releases the list, and removes it.

The other switch types do this with their own port security (Cisco switchport port-security, Aruba port-security); the access list is the DrayTek equivalent, chosen because of the firmware fault above. The effect is the same: only the MAC addresses registered for the device get onto the port.

Names starting with PL- belong to PrivateLAN. PL stands for PrivateLAN; the rest of the name is the port (PL-2.5gi4 for port 2.5gi4). Every template for a port removes the list PL-<port> before it does anything else, whatever profile the port gets. Do not give an access list of your own a name that starts with PL-: it disappears the next time PrivateLAN programs that port. Lists with any other name are left alone.

After programming a device, Inspection > Compliance shows what PrivateLAN intended against what the switch actually has, including the MAC addresses in the access list.

8. Spanning tree

Spanning tree is on in the factory configuration, in RSTP mode: after a factory reset show spanning-tree says Spanning tree enabled mode RSTP (firmware 2.9.12). Leave it on. If no spanning-tree is in the running configuration, someone turned it off; turn it on again, with the mode written down explicitly:

spanning-tree
spanning-tree mode rstp

The device templates set spanning-tree edge and spanning-tree bpdu-guard per port, the equivalent of Cisco's PortFast and BPDU guard: when a switch is connected to a device port, the switch shuts down only that port. Check with show spanning-tree. spanning-tree bpdu-guard is the command DrayTek documents for its VigorSwitches; it has not been tried on the PQ2200xb yet. If your switch refuses it, it is listed under The switch refused after programming. Do not use spanning-tree bpdu-filter on a device port: the port then ignores BPDUs, and spanning tree no longer sees anything there.

9. LLDP

LLDP is on in the factory configuration; show lldp shows State: Enabled. PrivateLAN reads show lldp neighbor to fill the LLDP neighbour column on the interface overview. The port templates set no lldp tx and lldp rx on device ports, so the switch still learns what is connected but does not advertise itself to end devices.

10. Layer 3 — routing between VLANs

The switch can route between its VLANs. On this CLI, routing is switched on with ip route, the counterpart of Cisco's ip routing: once globally, and again inside each VLAN interface before its address:

configure
ip route
interface vlan 20
 ip route
 ip address 192.168.20.1 mask 255.255.255.0
 description "Data"

PrivateLAN writes this itself when you choose the switch as the router of a VLAN under VLANs, so you do not enter it here. Keep in mind:

• Routing mode SVI only. The switch has no VRRP or HSRP. With either of those modes chosen, the appliance reports an error for the DrayTek instead of half configuring the gateway.
• Not on the management VLAN. The switch's own address (section 4) lives in its management VLAN. PrivateLAN does not put a routed interface next to it, and reports an error when this switch is chosen as the router of that VLAN. It never touches the management address.
• The order matters if you configure it by hand. An address entered before ip route is refused with /bin/sh: can't create /proc/sys/net/ipv4/conf/vlan20/forwarding. Without the global ip route, the VLAN interface answers but forwards nothing.
• no ip route inside the VLAN interface removes the address as well; no ip address does not exist on this CLI.
• The running configuration shows these lines as _conf_ip route, interface VLAN20, _vintf_ip route and _vintf_ip address .... That is how the firmware writes them down; they survive save and a restart (verified on firmware 2.9.12).
• The switch's own default route stays the ip default-gateway of section 4.

11. Turning off the web interface and unused services

PrivateLAN manages the switch entirely over SSH. Everything else that listens on the switch is attack surface you do not need:

no ip http
no ip https
no ip telnet
no snmp community public

Remove the factory SNMP community. The factory configuration contains snmp community "public" rw: anyone who can reach the switch can change its configuration over SNMP. PrivateLAN does not use SNMP. If you monitor the switch over SNMP, use a read-only community with a long random name, or SNMPv3.

Turning the web interface off is the recommendation; the console and SSH remain. If you want to keep it for occasional manual work, allow management only from the management network with a management access list, and do not change ports there that PrivateLAN manages:

management access-list MGMT
 permit ip 192.168.10.0/255.255.255.0 interfaces 2.5gi1-16,10gi1-4 service all
exit
management access-class MGMT

Enter a management access list on the console. From the moment management access-class takes effect, the switch only accepts management from the networks in the list — including SSH from PrivateLAN. Make sure the appliance's address (192.168.10.5 here) falls inside a permit line. The syntax was checked on firmware 2.9.12; the list itself was not applied there.

12. Save and register in PrivateLAN

end
save

save answers Success. Then, in the appliance:

• Switches > Add — host name, management IP address 192.168.10.21, SSH port 22, type DrayTek-VigorSwitch, user name privatelan and the switch password. Leave the enable password empty. Choose the switch group and enter the interface ranges in 2.5gi1-16 form.
• 802.1x / RADIUS > Clients — add the same switch with IP address 192.168.10.21, its netmask, and the shared secret ExampleSharedSecret.
• Inspection > Compliance — run it once the first poll has completed, and confirm the logging host and time server rows both come back as a match.

DHCP snooping (optional)

PrivateLAN reads the switch's DHCP snooping table to find out the address of any device you registered with a Dynamic address instead of a fixed one. Without snooping those devices simply report that no address is known — nothing else stops working, so enable it only if you use that.

interface 10gi1
 ip dhcp snooping trust
exit
ip dhcp snooping vlan 10,20
ip dhcp snooping

• Every port towards your DHCP server must be trusted — the uplink, and any port towards another switch on the way to the server. Trust the uplink before you enable snooping, or the switch drops the DHCP answers in the meantime.
• Snooping must be enabled on the VLANs the devices are in.

Check the result with show ip dhcp snooping and show ip dhcp snooping binding; a device that took an address shows up with its port, VLAN, MAC address, IP address and remaining lease.

Complete example configuration

Everything above in one block, for an access switch with in-band management. Change every value from the table at the top. Enter it on the console: section 4 changes the management address.

configure
hostname SW-FLOOR1-01
!
username admin privilege 15 secret ExampleAdminPassword
username privatelan privilege 15 secret ExampleSwitchPassword
!
ip ssh
no ip telnet
!
vlan 10,20
vlan 10
 name "MGMT"
exit
vlan 20
 name "DATA"
exit
management-vlan vlan 10
no ip dhcp
ip address 192.168.10.21 mask 255.255.255.0
ip default-gateway 192.168.10.1
!
interface 10gi1
 description "UPLINK"
 switchport mode trunk
 switchport trunk allowed vlan add 10,20
 lldp tx
 lldp rx
exit
!
clock timezone CET +1
clock summer-time CEST recurring eu
clock source sntp
sntp host 192.168.10.5
!
logging host 192.168.10.5 severity 6
!
radius host 192.168.10.5 auth-port 1812 acct-port 1813 key ExampleSharedSecret
authentication dot1x
authentication mac
authentication mac radius mac-case lower
authentication mac radius mac-delimiter none
!
spanning-tree
spanning-tree mode rstp
!
no ip http
no ip https
no snmp community public
!
end
save

Troubleshooting

Related documentation

• Switch Management — registering the switch, groups, interface tags and stacks
• 802.1x / RADIUS — RADIUS clients and certificates
• VLANs — creating VLANs and choosing the routing mode
• Device Deployment — how ports are programmed from device group templates