TP-Link Omada — SG2000, SG3000 and SX3000

Configuration example for preparing a TP-Link Omada switch so that it works with PrivateLAN. Register the switch in PrivateLAN with type TP-Link-Omada.

One driver covers the Omada switch line and the JetStream switches that share its command line:

PrivateLAN was tested against an SG2428P (hardware 5.20, firmware 5.20.2). The commands below follow TP-Link's CLI Reference Guide for managed switches, which covers every model of the line and marks the commands only some models have. Omada Pro (the S-series) has a different CLI and is not covered.

The switch must be managed on its own, not by an Omada controller. An Omada controller — cloud, OC200/OC300 or software — that has adopted the switch pushes its own configuration and overwrites whatever PrivateLAN sets. Factory-reset an adopted switch, or forget it in the controller, before you add it to PrivateLAN.

Everything in this guide is entered once, before you add the switch to PrivateLAN. Individual switch port configuration is not part of it: PrivateLAN programs access ports itself from the device group templates, and anything you configure on a port by hand is overwritten the next time that port is programmed.

Values used in this guide

The appliance only accepts syslog and RADIUS traffic on eth0, and only from RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). A switch with a public management address cannot reach those services, whatever you configure on the switch itself.

How this CLI differs

Read this before you start if you know Cisco IOS: these are the differences PrivateLAN takes care of, and the ones you will run into yourself.

• No access or trunk mode. A port is a member of a VLAN, tagged or untagged, and has a separate PVID: switchport general allowed vlan 20 untagged plus switchport pvid 20. Every port is an untagged member of VLAN 1 until you remove it with no switchport general allowed vlan 1.
• No default interface. A port keeps its old VLANs until they are removed one by one. When PrivateLAN gives a port a new VLAN, it reads the port's current configuration and removes every VLAN the template does not give it, so a port moved from the default VLAN to a device VLAN does not end up in both.
• Port names. The tables print Gi1/0/1, but commands only accept gigabitEthernet 1/0/1. PrivateLAN uses the short form everywhere in the appliance and translates it for the switch.
• VLAN names are at most 16 characters, from letters, digits, spaces and -@_:/. only. PrivateLAN shortens a longer name and replaces any other character with -.

1. First access and host name

Models with a console port take the CLI there; on the others, enable SSH once in the switch's web interface and continue over SSH. Log in with the account set on first start — a factory-default switch asks for a new password on its first login.

enable
configure
hostname "SW-FLOOR1-01"

2. The PrivateLAN account

user name privatelan privilege admin secret 0 ExampleSwitchPassword

The account must have the admin privilege. PrivateLAN enters configuration mode and saves the configuration (copy running-config startup-config), and only admin and operator may save; admin is the safe choice.

secret stores the password hashed in the running configuration, password reversibly encrypted. Use secret.

After login the switch is in user EXEC mode (SW-FLOOR1-01>), and PrivateLAN sends enable. An admin account needs no enable password. If you set one, enter it in the Enable password field when you register the switch:

enable secret 0 ExampleEnablePassword

3. SSH

PrivateLAN connects over SSH only.

ip ssh server
telnet disable

You do not need to turn off paging: PrivateLAN sends terminal length 0 itself on every session.

Logging in takes several seconds on the smaller models — the key exchange runs on the switch's own CPU. That is normal and well within PrivateLAN's time-outs.

Check show ip ssh. Factory firmware can leave SSH version 1 and older ciphers (3DES, CBC, HMAC-MD5) enabled. PrivateLAN does not need them. Turn them off with the ip ssh commands your firmware offers (ip ssh ?) or in the switch's web interface.

SSH with a key instead of a password

Optional. PrivateLAN can authenticate with an SSH private key instead of a password. TP-Link does not take a public key typed into the configuration: it is downloaded from a TFTP server.

ip ssh download v2 privatelan.pub ip-address 192.168.10.9

Password authentication is the straightforward path on these switches. Keep the local password configured in any case: it stays available on the console.

4. Management VLAN and IP address

PrivateLAN reaches the switch on this address, and this is also the address you register as a RADIUS client.

vlan 10
 name "MGMT"
exit
vlan 20
 name "DATA"
exit
interface vlan 10
 ip address 192.168.10.21 255.255.255.0
 description "Management"
exit
ip route 0.0.0.0 0.0.0.0 192.168.10.1

The address takes a dotted subnet mask, as on Cisco.

The uplink has to carry the management VLAN:

interface gigabitEthernet 1/0/28
 description "UPLINK"
 switchport general allowed vlan 10,20 tagged
exit

Tag the uplink [TRUNK] in PrivateLAN so the appliance adds each VLAN it programs to it.

Keep the management VLAN out of any VLAN set that PrivateLAN programs onto this switch unless you mean to manage it there. VLAN programming removes the VLANs on the switch that are not in the appliance — including, if you have configured it that way, the VLAN its own management session is running over.

Enter the interface list in PrivateLAN in the form the switch prints in show interface status, for example Gi1/0/1-24. The same tags apply as for other switches, for example [P4] Gi1/0/1-24, [ND][TRUNK][SFP] Gi1/0/25-28.

5. Passwords in the running configuration

service password-encryption

With secret (section 2) the account password is stored as a hash. service password-encryption also encrypts the passwords that have to stay readable for the switch, such as the RADIUS shared secret, so they do not appear in clear text in show running-config.

When a switch configuration leaves the appliance — for example through a QR Support report — PrivateLAN strips RADIUS keys, SNMP community strings and similar credential lines before it is encoded, so those never travel with the report.

6. Time and time zone

system-time ntp UTC+01:00 192.168.10.1 192.168.10.1 12
system-time dst predefined Europe

The arguments are the time zone, a primary and a backup server, and how often (in hours) the switch fetches the time.

Point the switch at the same time server the appliance uses, not at the appliance. The PrivateLAN appliance is an NTP client; it does not run an NTP server. You can see which server it uses under System > Networking.

The factory configuration points at public time servers. A switch that cannot reach them keeps its factory clock — a year like 2006 in show system-time and in every log line is the sign.

Inspection > Compliance checks the primary server of the system-time ntp line and accepts either the appliance's own addresses or the time server the appliance is configured with.

7. Sending syslog to the appliance

logging host index 1 192.168.10.5 protocol udp level 6

Older firmware takes the short form logging host index 1 192.168.10.5 6. Level 6 (informational) matches what the appliance's syslog view expects. Raise it to 4 (warnings) if a switch is noisy — the appliance rate-limits syslog per sending device, and more than roughly 200 UDP messages per second from one source are dropped. A switch being limited shows up on the dashboard's syslog flood protection tile.

With the SOC license option, syslog also makes the port alarms of the SOC live view faster: when the switch logs a link change (Gi1/0/2 changed state to down), the appliance reads the switch again straight away. These messages have level 5, so they still arrive at level 5 and above.

Verify with show logging loghost. Inspection > Compliance reports this line as Logging host, and only counts it as a match when it points at this appliance.

8. RADIUS and 802.1X

This is what makes MAB, PEAP and EAP-TLS devices work. The switch has to be registered as a RADIUS client in PrivateLAN as well, under 802.1x / RADIUS, with the same management IP address and the same shared secret.

radius-server host 192.168.10.5 auth-port 1812 key 0 ExampleSharedSecret
aaa group radius PRIVATELAN
 server 192.168.10.5
exit
aaa authentication dot1x default PRIVATELAN
dot1x system-auth-control
dot1x vlan-assignment

Older firmware needs aaa enable before the other aaa lines; firmware where AAA is always on answers it with Error: Bad command, which you can ignore.

• dot1x system-auth-control enables 802.1X on the switch. PrivateLAN turns it on and off per port when it programs a device.
• dot1x vlan-assignment makes the switch apply the VLAN in the RADIUS reply (Tunnel-Private-Group-ID). Without it the device is authenticated but stays in the port's own VLAN.

MAC address format for MAC authentication

PrivateLAN stores a MAB device's RADIUS username and password as the MAC address in twelve lowercase hexadecimal characters with no separators — 00155d5a6500. The switch shows its MAB format per port in show dot1x interface (column MAB Format, factory default lowercase).

Check what actually arrives under 802.1x / RADIUS on the appliance, where recent authentication events show the user name the switch sent. If it carries separators, the format is set per port with dot1x mabFmt; since PrivateLAN writes the port configuration, add that line to the device group template rather than to the port.

Port configuration is pushed by PrivateLAN

You do not configure 802.1X on individual ports. PrivateLAN writes it when it programs a device onto a port, from the templates under Devices > Device groups. A MAB port ends up looking like this:

interface gigabitEthernet 1/0/12
  description "PRINTER-01"
  switchport general allowed vlan 20 untagged
  switchport pvid 20
  no switchport general allowed vlan 1
  dot1x
  dot1x mab
  spanning-tree common-config portfast enable

  no lldp transmit
#

dot1x port-method mac-based and dot1x port-control auto are in the template but not in the configuration: they are the switch's defaults, which it does not write out.

Port security and 802.1X exclude each other on these switches. The MAC-address template turns 802.1X off before it sets port security; if you write your own template, keep that order, or the switch answers Operation failed. Port Security cannot be enabled when 802.1X function is enabled.

After programming a device, Inspection > Compliance shows what PrivateLAN intended against what the switch actually has.

9. Spanning tree

spanning-tree
spanning-tree mode rstp

Recent firmware enables spanning tree out of the box; older firmware does not. Confirm with show spanning-tree active — it should answer Spanning tree is enabled.

The device templates set spanning-tree common-config portfast enable per port, the TP-Link equivalent of Cisco's PortFast.

10. LLDP

lldp

LLDP can be switched off globally — check show lldp. PrivateLAN reads show lldp neighbor-information interface to fill the LLDP neighbour column on the interface overview, so this needs to be on. The port templates set no lldp transmit on device ports, so the switch still learns what is connected but does not advertise itself to end devices.

11. Layer 3 — routing and VLAN interfaces

PrivateLAN writes the VLAN interface itself when you program a VLAN:

interface vlan 20
 description "Data"
 ip address 192.168.20.1 255.255.255.0

Set PrivateLAN's routing mode to SVI for TP-Link switches. HSRP does not exist on TP-Link. VRRP is only available on some L3 models, and only for a VLAN ID up to 255, because the switch takes a virtual router ID of 1 to 255 and PrivateLAN uses the VLAN ID as that number. PrivateLAN refuses HSRP, and VRRP on a higher VLAN, rather than half configuring the gateway.

12. Turning off the web interface and the controller link

PrivateLAN manages the switch entirely over SSH.

no controller cloud-based
no ip http server
no ip http secure-server

no controller cloud-based stops the switch from contacting the Omada cloud. Turning off the web interface is optional; if you keep it for occasional manual work, it does no harm as long as you do not change ports there that PrivateLAN manages.

13. Save and register in PrivateLAN

end
copy running-config startup-config

Then, in the appliance:

• Switches > Add — host name, management IP address 192.168.10.21, SSH port 22, type TP-Link-Omada, user name privatelan and the switch password, and the enable password if you set one. Choose the switch group and enter the interface ranges in Gi1/0/1-28 form.
• 802.1x / RADIUS > Clients — add the same switch with IP address 192.168.10.21, its netmask, and the shared secret ExampleSharedSecret.
• Inspection > Compliance — run it once the first poll has completed, and confirm the logging host and time server rows both come back as a match.

DHCP snooping (optional)

PrivateLAN reads the switch's DHCP snooping table to find out the address of any device you registered with a Dynamic address instead of a fixed one, and to find the address of wireless clients behind an access point. Without snooping those devices simply report that no address is known — nothing else stops working, so enable it only if you use that.

ip dhcp snooping
ip dhcp snooping vlan 10,20
interface gigabitEthernet 1/0/28
 ip dhcp snooping trust
exit

• Every port towards your DHCP server must be trusted — the uplink, and any port towards another switch on the way to the server. Set the trusted ports in the same change that enables snooping.
• Snooping must be enabled on the VLANs the devices are in.

Check the result with show ip dhcp snooping and show ip source binding.

Complete example configuration

Everything above in one block, for an access switch with in-band management. Change every value from the table at the top.

enable
configure
hostname "SW-FLOOR1-01"
!
user name privatelan privilege admin secret 0 ExampleSwitchPassword
service password-encryption
!
ip ssh server
telnet disable
!
vlan 10
 name "MGMT"
exit
vlan 20
 name "DATA"
exit
interface vlan 10
 ip address 192.168.10.21 255.255.255.0
 description "Management"
exit
ip route 0.0.0.0 0.0.0.0 192.168.10.1
!
interface gigabitEthernet 1/0/28
 description "UPLINK"
 switchport general allowed vlan 10,20 tagged
exit
!
system-time ntp UTC+01:00 192.168.10.1 192.168.10.1 12
system-time dst predefined Europe
!
logging host index 1 192.168.10.5 protocol udp level 6
!
radius-server host 192.168.10.5 auth-port 1812 key 0 ExampleSharedSecret
aaa group radius PRIVATELAN
 server 192.168.10.5
exit
aaa authentication dot1x default PRIVATELAN
dot1x system-auth-control
dot1x vlan-assignment
!
spanning-tree
spanning-tree mode rstp
lldp
!
no controller cloud-based
no ip http server
no ip http secure-server
!
end
copy running-config startup-config

Troubleshooting

Related documentation

• Switch Management — registering the switch, groups, interface tags and stacks
• 802.1x / RADIUS — RADIUS clients and certificates
• VLANs — creating VLANs and choosing the routing mode
• Device Deployment — how ports are programmed from device group templates