• Full non-blocking wirespeed switching
• Large Unicast FDB for Layer 2 unicast forwarding
• Forwarding Database works based on SVL or IVL
• Port Isolation
• Jumbo frame support - 10218 bytes

• RSTP support

• Supports 802.3ad LACP groups
• Supports static link aggregation groups
• Up to 16 link aggregation groups
• Up to 8 member ports per a group
• Hardware automatic failover and load balancing

• IGMP Snooping support
• Unknown Multicast Filtering

• Port-based mirroring

• Fully compatible with IEEE802.1Q
• 出口VLAN
• Up to 250 VLAN entries (limited by SwOS)
• VLAN filtering

• Port Lock
• Broadcast Storm Control
• DHCP & PPPoE Snooping

• Ingress traffic limiting

• Ingress ACL tables
• Up to 32 ACL rules (limited by SwOS)
• Classification based on ports, L2, L3, L4 protocol header fields
• ACL actions include filtering, forwarding, and modifying the protocol header fields

CSS326-24G-2S+

• DHCP with fallback- switch is trying to request an IP address from a DHCP server. If the requests are unsuccessful, then the switch can be accessed using aStatic IP Addressvalue
• static- address is set as aStatic IP Addressvalue
• DHCP only- switch uses DHCP client to acquire address

Enables or disables DHCP Option-82 information. When enabled, the Option-82 information (Agent Remote ID and Circuit ID) is added for DHCP packets received from untrusted ports. Can be used together with Option-82 capable DHCP server to assign IP addresses and implement policies.

For Agent Remote ID, SwOS uses interface name where DHCP client resides. For Agent Circuit ID, SwOS uses identity of the SwOS device, internally used port ID and VLAN ID. For example:

Agent Remote ID - Port1

Agent Circuit ID - MikroTik eth 0/1:100

Specifies PoE-Out state:

• auto——董事会将尝试检测能力applied to the port. For powering there should be resistance in the range from 3kΩ to 26.5kΩ
• on- detection range is removed. As a result power over Ethernet will be always on
• off- all detection and power is turned off for this port

Highest priority is 1, lowest priority is 8. If there are 2 or more ports with the same priority then port with the smallest port number will have a higher priority. For example, if ether2 and ether3 have the same priority and over-current is detected then PoE-Out on ether3 will be turned off.

功能,允许手动切换太瓦o voltage outputs on PoE-Out ports. Will take effect only on PSE with switchable voltage modes (CRS328-24P-4S+RM,netPower 16P,CRS354-48P-4S+2Q+RM).

Shows current PoE-Out status on port:

• powered on- power is applied to the port, and PoE-Out is operating normally,
• waiting for load- PSE attempts to detect if power can be applied to the port. For powering there should be resistance in the range from 3kΩ to 26.5kΩ,
• short circuit- short-circuit is detected on PoE-Out port, power is switched off, the only detection with low voltage takes place,
• overload- the PoE-Out current limit is exceeded, power is switched off on PoE-Out port. For port limits see each model specifications,
• disabled- all detection and power is turned off for this port,
• voltage too low- PD can not be powered with the voltage provided from PSE,
• current too low- means that PD draws too low current (<10mA) than normal PoE-Out device should, the reason for this can be:

The delivered voltage at PD is too low for normal powering (for example Vmin =>30V, but provided 24V);

PD uses a second power source which has a higher voltage than PSE, so all current is taken from the second DC source, not PSE PoE-Out port.

• Passive: Places port in listening state, use LACP only when its contrary port uses active LACP mode
• Active: Prefers to start LACP regardless of contrary port mode
• Static: Sets port in a Static LAG mode, it requires to set the sameGroupsetting for all ports that need to be included in the same static LAG

• Port Lock- Enables or disables MAC address learning on this port. When the option is enabled, it will restrict MAC address learning and static MAC addresses should be configured. Any received frames with unknown source MAC address will be dropped
• Lock On First- Allows to learn source MAC address from the first received frame, this property should be used together withPort Lock. Learning of the first MAC address will reset every time an interface status changes

• Mirror Ingress- Whether traffic entering this port must be copied and forwarded to the mirroring target port
• Mirror Egress- Whether traffic leaving this port must be copied and forwarded to the mirroring target port
• Mirror To- Mirroring target port

• Storm Rate (%)- Limit the number of broadcast packets transmitted by an interface. The rate is measured in percents of the link speed.
• Include Unknown Unicast- Include unicast packets without an entry in the host table inStorm Ratelimitation

• Flood Unknown Multicast- Changes the multicast flood option on a switch port, only controls the egress traffic. When enabled, the bridge allows flooding multicast packets to the specified switch port, but when disabled, it restricts multicast traffic from being flooded. The setting affects all multicast traffic, this includes non-IP, IPv4, IPv6 and the link-local multicast ranges (e.g. 224.0.0.0/24 and ff02::1).

• Ingress Rate- Limit traffic entering this port (bps)

• short: 40G - 1; 10G - 2; 1G - 4; 100M - 10; 10M - 100
• long: 40G - 500; 10G - 2000; 1G - 20000; 100M - 200000; 10M - 2000000

• RSTP
• STP

• root- port that is facing towards the root bridge and will be used to forward traffic from/to the root bridge
• alternate- port that is facing towards root bridge, but is not going to forward traffic (a backup for root port)
• backup- port that is facing away from the root bridge, but is not going to forward traffic (a backup for non-root port)
• designated- port that is facing away from the root bridge and is going to forward traffic
• disabled- port that is not strictly part of STP (RSTP functionality is disabled)

• edge- ports that are not supposed to receive any BPDUs, should be connected to the end station (read-only)
• point-to-point- ports that operate in full-duplex links, can be part of STP and operate in a forwarding state (read-only)

• forwarding- port participates in traffic forwarding and is learning MAC addresses, is receiving BPDUs
• discarding- port does not participate in traffic forwarding and is not learning MAC addresses, is receiving BPDU
• learning- port does not participate in traffic forwarding but is learning MAC addresses

• disabled- VLAN table is not used. The switch discards packets with a VLAN tag on egress ports. If the packet has a VLAN tag and the VLAN ID matchesDefault VLAN IDon egress ports, then withVLAN Receive=anythe switch will remove the VLAN tag and forward the packet.
• optional- Disabled VLAN filtering. Handle packets with VLAN tag ID that is not present in the VLAN table just like packets without VLAN tag.
• enabled- Enabled VLAN filtering. Drop packets with VLAN tag ID that is not present in the VLAN table. Default VLAN ID must be specified for access ports since it will be used to tag ingress traffic and untag egress traffic for a certain port.
• strict- Enabled VLAN filtering with additional ingress filtering, which checks if the ingress port is a member of the received VLAN ID in the VLAN table. Received packets on the ingress port with a VLAN ID that does not match with the VLAN table will be dropped. Default VLAN ID must be specified for access ports since it will be used to tag ingress traffic and untag egress traffic for a certain port.

• any- allows tagged and untagged packets on a certain port
• only tagged- allows only packets with a VLAN tag. The "Default VLAN ID" will not work, because it only applies for untagged traffic
• only untagged- Allows only packets without a VLAN tag

VLAN header presence:

• any
• present
• not present

• PSU state, eitherfailedorok(for CRS328-20S-4C-4S+, CRS317-1G-16S+, CRS312-4C+8XG, CRS326-24S+2Q+)
• PSU voltage and consumed miliamperes by PoE-out connected devices (CRS328-24P-4S+, CRS318-16P-2S+)