Purpose

09 — Siemens Scalance XR326-2C PoE Switch Configuration

Last updated: 2026-09-05 | Status: ✅ Analyzed and documented
Model: Siemens Scalance XR326-2C (Scalance X Series)
Hostname: Siemens PoE Switch
Location: Study (per config comment)
Config source: RunningCLI(1).txt

Purpose

Documentation of the Siemens Scalance XR326-2C edge switch that provides access layer connectivity for LAN, IoT, and guest devices. This switch works in combination with the Aruba JL253A (documented in 02-switch-configuration.md) to provide comprehensive network coverage.

Switch Identity

VLAN Configuration

Port-to-VLAN Mapping (per-port configuration)

Port-by-Port VLAN Membership

Uplink Configuration

The Siemens switch uses a redundant uplink configuration:

Primary Uplinks (to Clarks router/firewall)

Uplinks to Aruba Switch (Ring Redundancy)

Ring Redundancy (Ring topology for resilience)

The switch is configured for MRP (Media Redundancy Protocol) ring redundancy:

ring ports extreme-ethernet 0/25 extreme-ethernet 0/26
standby wait-for-partner
no standby force-master

This creates a resilient ring topology where if one uplink fails, traffic automatically reroutes through the other path. The SFP+ links (0/25, 0/26) provide high-speed failover to the Aruba switch.

NTP/Time Configuration

Security Configuration

SSH & Web Access

SNMP Configuration

Brute Force Prevention

PoE Status

[!note] This switch relies on external PoE injectors or a separate PoE switch for APs and other powered devices. The configuration explicitly disables poem active on all ports.

DHCP Snooping & IGMP

Link Flapping Protection

Unknown Items Requiring Investigation ⚠️

1. Port 26 Alias “Aruba Switch” — Need Physical Verification 🔍

Current config: alias Aruba Switch on ext-e 0/26 Connected to: Aruba JL253A switch (per 02-switch-configuration.md)

Investigation needed:

• Verify physical connection - what’s actually plugged into port ge 0/26?
• Confirm ring redundancy is active and MRP is operational
• Check if this is intentional or a legacy name from previous topology

Risk: Low — just naming confusion unless misconfigured for wrong device.

2. Port omada OC200 Alias on ge 0/1 — TP-Link Integration? 🔍

Current config: alias Omada OC200 VLAN assignment: PVID 28 (Management) + tagged in DMZ/VLAN 31

Possible explanation:

• Connected TP-Link Omada controller (common for managing multiple APs)
• Or a specific model of TP-Link AP named “OC200”
• Port configuration suggests it handles both management and VLAN-tagged traffic

Investigation needed:

• Identify exact device model connected to port ge 0/1
• Determine if Omada controller is running locally or on another host
• Verify if this is intentional TP-Link integration

Risk: Low — but needs documentation for future reference.

3. Unused Ports 0/19–0/22 — Available but Not Configured 🔍

Current config: All disabled, VLAN 30 native Status: No specific alias or purpose documented

Possible explanations:

• Spare ports for future expansion
• Previously connected devices that were disconnected
• Intentionally unused for security (least privilege)

Recommendation: Document intended use or consider disabling VLAN membership if truly not needed.

4. DHCP Snooping Disabled ⚠️

no dhcp snooping

Security concern: Without DHCP snooping, rogue DHCP servers could inject addresses on the network.

Recommended actions:

1. Enable DHCP snooping: ip dhcp snooping
2. Configure trusted ports (uplinks to router/firewall)
3. Restrict which ports can serve DHCP leases

Risk: Medium — vulnerable to DHCP spoofing attacks if not enabled.

5. SNMP Community Strings Need Rotation 🔒

Current community strings: public (read-only) Recommended: Replace with strong, unique secrets stored in password manager.

6. Event Notifications Email — Need Valid Addresses 📧

event config cold-warmstart email
event config linkchange email
...

Many event configurations specify “email” but no actual addresses are configured. This may:

• Be a placeholder that was never populated
• Rely on a syslog/email relay that’s not shown in config
• Need actual email addresses for notifications

Investigation needed: Verify which events should trigger alerts and configure valid SMTP settings if needed.

7. Ring Redundancy Configuration Status 🔁

ring ports extreme-ethernet 0/25 extreme-ethernet 0/26
standby wait-for-partner
no standby force-master

The ring is configured but the config shows no ring-redundancy (disabled) and no mrp-interconnection.

Clarification needed:

• Is ring redundancy actively enabled or just configured?
• What is the actual operational state (active/standby)?
• Verify MRP protocol is running between SFP+ ports

8. QoS Configuration — Trust Mode Applied ⚡

All ports configured with qos-trust-mode ... cos-dscp Interpretation: Trusts incoming DSCP markings for QoS treatment. This is appropriate if upstream devices (router, APs) properly mark traffic classes.

Summary of Known vs Unknown Items

Recommendations Summary

1. Enable DHCP snooping to prevent rogue DHCP attacks
2. Rotate SNMP community strings for security hardening
3. Verify ring redundancy operational state (active vs configured but disabled)
4. Document device on port ge 0/1 (TP-Link integration?)
5. Consider enabling PoE if APs need power (currently no PoE active)

Related

• 01 — Architecture - Core switch entry
• 02 — Switch Configuration - Aruba JL253A config
• 04 — IP Addressing - Subnet assignments

Change log

Source Disclaimer

• AI Generated
• Human Generated
• AI Edited
• Human Edited