---
title: "09 — Siemens Scalance XR326-2C PoE Switch Configuration"
description: "## Purpose"
section: nanda
raw: "09-siemens-switch.md"
source: ai-generated
tags: network, aruba, siemens, vlan
last-updated: 2026-09-15
---

# 09 — Siemens Scalance XR326-2C PoE Switch Configuration

> **Last updated:** 2026-09-05 | **Status:** ✅ Analyzed and documented  
> **Model:** Siemens Scalance XR326-2C (Scalance X Series)  
> **Hostname:** `Siemens PoE Switch`  
> **Location:** Study (per config comment)  
> **Config source:** `RunningCLI(1).txt`

## Purpose

Documentation of the Siemens Scalance XR326-2C edge switch that provides access layer connectivity for LAN, IoT, and guest devices. This switch works in combination with the Aruba JL253A (documented in 02-switch-configuration.md) to provide comprehensive network coverage.

## Switch Identity

| Property | Value |
|----------|-------|
| Model | Siemens Scalance XR326-2C |
| Family | Scalance X Series (managed edge switch) |
| Hostname | `Siemens PoE Switch` |
| Contact Person | Adrian |
| Location | Study (per system config) |
| Management IP | 192.168.28.241/24 (VLAN 28) |

## VLAN Configuration

| VLAN ID | Name | Native Ports | Trunked on Uplinks | Purpose |
|---------|------|---------------|--------------------|---------|
| 1 | DEFAULT_VLAN | Port 6 only | — | Edge VLAN, DHCP client on router |
| 27 | Guest | Ports 2-4, 13-18 | 0/25, 0/26 | Guest WiFi clients |
| 29 | HASS (Home Automation) | Ports 2-4, 7, 13-18, 23-24 | 0/25, 0/26 | IoT devices, smart home |
| 30 | LAN (User Traffic) | Ports 2-5, 7-24 | 0/13, 0/23, 0/25, 0/26 | Main user network |
| 31 | DMZ | Port 13 only | 0/13 (only) | External services, AdGuard |
| 101 | Edge VLAN | Ports 6 | — | Management loopback interface |
| 28 | Management | Ports 1-5, 7, 13-19, 23-24 | 0/25, 0/26 | Switch/firewall management |

## Port-to-VLAN Mapping (per-port configuration)

### Port-by-Port VLAN Membership

| Port | Alias | PVID (Native) | Allowed VLANs | Notes |
|------|-------|----------------|---------------|-------|
| ge 0/1 | Omada OC200 | 28 | All + port-specific tags | AP management, tagged in DMZ/VLAN 31 |
| ge 0/2–5 | — | 30 | VLANs 27, 29, 30 | User access ports |
| ge 0/6 | — | 101 (self) | VLANs 28, 101 only | Edge VLAN interface for management |
| **ge 0/13** | **Clacks** | 30 | All VLANs + tagged | **Uplink to Clarks router** - primary uplink |
| ge 0/14 | Errol (Passage) | 30 | VLANs 29, 30 | Passage lighting control |
| ge 0/15 | Laolith (Music Room) | 30 | VLANs 29, 30, tagged | Music room - LIFX devices |
| ge 0/16 | Asphalt (Family Room AP) | 30 | All VLANs | Additional AP connection |
| ge 0/17 | Ninereeds (Media Room) | 30 | VLANs 29, 30, tagged | Media room devices |
| ge 0/18 | Death | 30 | VLANs 27, 29, 30 | User device or spare |
| ge 0/19–22 | — | 30 | All VLANs | Available for expansion |
| **ge 0/23** | **Leonard** | 30 | All VLANs + tagged | **Router uplink port 2** - secondary connection |
| **ge 0/24** | **Ruby** | 30 | VLANs 27, 29, 30 | Ruby device (AdGuard?) |
| ext-e 0/25 | — | 28 | All VLANs + trunked | Uplink 1 (SFP+), redundancy link to router/firewall |
| **ext-e 0/26** | **Aruba Switch** | 28 | All VLANs + trunked | **Connected to Aruba JL253A switch** - ring redundancy uplink |

## Uplink Configuration

The Siemens switch uses a redundant uplink configuration:

### Primary Uplinks (to Clarks router/firewall)

| Port | Purpose | Speed | Notes |
|------|---------|-------|-------|
| ge 0/13 (`Clacks`) | Primary LAN uplink | 1Gbps | VLAN-aware trunk to all zones |
| ge 0/23 (`Leonard`) | Secondary/router port 2 | 1Gbps | Alternative uplink, redundant path |

### Uplinks to Aruba Switch (Ring Redundancy)

| Port | Purpose | Speed | Notes |
|------|---------|-------|-------|
| ext-e 0/25 | SFP+ Redundant uplink | 10Gbps | Ring redundancy link 1 |
| ext-e 0/26 (`Aruba Switch`) | Uplink to Aruba JL253A | 10Gbps | Ring redundancy link 2, VLAN trunk |

### Ring Redundancy (Ring topology for resilience)

The switch is configured for **MRP (Media Redundancy Protocol)** ring redundancy:

```text
ring ports extreme-ethernet 0/25 extreme-ethernet 0/26
standby wait-for-partner
no standby force-master
```

This creates a resilient ring topology where if one uplink fails, traffic automatically reroutes through the other path. The SFP+ links (0/25, 0/26) provide high-speed failover to the Aruba switch.

## NTP/Time Configuration

| Setting | Value | Notes |
|---------|-------|-------|
| System timezone | UTC +08:00 (Australia Perth) | Matches router timezone |
| NTP Server | 192.168.28.1 | Internal management server |
| SNTP Client | Broadcast mode | Listening on VLAN interface |
| Sinec offset | +00:00 | Additional timezone adjustment |

## Security Configuration

### SSH & Web Access

| Service | Status | Port | Notes |
|---------|--------|------|-------|
| SSH Server | Enabled | 22 | Disabled and re-enabled (password protected) |
| HTTPS Server | Enabled | 443 | TLS v1.2 minimum required |
| HTTP Server | Enabled | 80 | Unencrypted web access for config mgmt |
| Telnet | Disabled | — | Legacy protocol disabled |
| TFTP Server | Enabled (IPv4) | 69 | Config/package backup/restore |
| SFTP Server | Enabled (IPv4) | 22 | Secure config transfer |

### SNMP Configuration

| Setting | Value | Notes |
|---------|-------|-------|
| Agent version | All (v1, v2c, v3) | Legacy and secure access supported |
| V1/V2c security | Read-only for read community | V2c has no encryption |
| SNMPv3 users | templateMD5, templateSHA | MD5/SHA auth available |
| Communities | SIMATICNETRD (public/read), public (readonly) | Needs rotation! |
| Groups | SIMATICNETRD, SIMATICNETWR | Read/write access groups |

### Brute Force Prevention

| Setting | Value | Notes |
|---------|-------|-------|
| User-specific attempts | 12 | Lock after 12 failed logins |
| IP-specific attempts | 10 | Additional IP-based protection |
| Trigger interval | 5 seconds | Monitor frequency |
| Auto-reset timer | 12 minutes | Unlock period before relock |

### PoE Status

| Port | PoE Status | Notes |
|------|------------|-------|
| All ports (ge 0/1–24) | **No PoE Active** | Passive PoE injector required for some devices |
| ext-e 0/25 | No PoE | SFP+ uplink to router/firewall |
| ext-e 0/26 (`Aruba Switch`) | No PoE | Connects to Aruba JL253A (PoE handled by that switch) |

> [!note]
> This switch relies on external PoE injectors or a separate PoE switch for APs and other powered devices.
> The configuration explicitly disables `poem active` on all ports.

### DHCP Snooping & IGMP

| Setting | Value | Notes |
|---------|-------|-------|
| DHCP Snooping | **Disabled** (`no dhcp snooping`) | May need enabling for security |
| IGMP Snooping | Enabled v3 | `no ip igmp vlan-snooping` removed |
| IGMP Port Purge | 300 seconds | Clear stale multicast entries |
| IGMP Version | v3 | Querier disabled (edge switch) |

### Link Flapping Protection

| Setting | Value | Notes |
|---------|-------|-------|
| Flap Count | 15 times | Before triggering action |
| Flap Interval | 60 seconds | Window for counting flaps |
| Reaction | Notify via email | Alert on link flap detection |

## Unknown Items Requiring Investigation ⚠️

### 1. Port 26 Alias "Aruba Switch" — Need Physical Verification 🔍

**Current config:** `alias Aruba Switch` on ext-e 0/26
**Connected to:** Aruba JL253A switch (per [02-switch-configuration.md](/nanda/02-switch-configuration/))

**Investigation needed:**

- Verify physical connection - what's actually plugged into port ge 0/26?
- Confirm ring redundancy is active and MRP is operational
- Check if this is intentional or a legacy name from previous topology

**Risk:** Low — just naming confusion unless misconfigured for wrong device.

### 2. Port omada OC200 Alias on ge 0/1 — TP-Link Integration? 🔍

**Current config:** `alias Omada OC200`
**VLAN assignment:** PVID 28 (Management) + tagged in DMZ/VLAN 31

**Possible explanation:**

- Connected TP-Link Omada controller (common for managing multiple APs)
- Or a specific model of TP-Link AP named "OC200"
- Port configuration suggests it handles both management and VLAN-tagged traffic

**Investigation needed:**

- Identify exact device model connected to port ge 0/1
- Determine if Omada controller is running locally or on another host
- Verify if this is intentional TP-Link integration

**Risk:** Low — but needs documentation for future reference.

### 3. Unused Ports 0/19–0/22 — Available but Not Configured 🔍

**Current config:** All disabled, VLAN 30 native
**Status:** No specific alias or purpose documented

**Possible explanations:**

- Spare ports for future expansion
- Previously connected devices that were disconnected
- Intentionally unused for security (least privilege)

**Recommendation:** Document intended use or consider disabling VLAN membership if truly not needed.

### 4. DHCP Snooping Disabled ⚠️

```text
no dhcp snooping
```

**Security concern:** Without DHCP snooping, rogue DHCP servers could inject addresses on the network.

**Recommended actions:**

1. Enable DHCP snooping: `ip dhcp snooping`
2. Configure trusted ports (uplinks to router/firewall)
3. Restrict which ports can serve DHCP leases

**Risk:** Medium — vulnerable to DHCP spoofing attacks if not enabled.

### 5. SNMP Community Strings Need Rotation 🔒

**Current community strings:** `public` (read-only)
**Recommended:** Replace with strong, unique secrets stored in password manager.

### 6. Event Notifications Email — Need Valid Addresses 📧

```text
event config cold-warmstart email
event config linkchange email
...
```

Many event configurations specify "email" but no actual addresses are configured. This may:

- Be a placeholder that was never populated
- Rely on a syslog/email relay that's not shown in config
- Need actual email addresses for notifications

**Investigation needed:** Verify which events should trigger alerts and configure valid SMTP settings if needed.

### 7. Ring Redundancy Configuration Status 🔁

```text
ring ports extreme-ethernet 0/25 extreme-ethernet 0/26
standby wait-for-partner
no standby force-master
```

The ring is configured but the config shows `no ring-redundancy` (disabled) and `no mrp-interconnection`.

**Clarification needed:**

- Is ring redundancy actively enabled or just configured?
- What is the actual operational state (active/standby)?
- Verify MRP protocol is running between SFP+ ports

### 8. QoS Configuration — Trust Mode Applied ⚡

All ports configured with `qos-trust-mode ... cos-dscp`
**Interpretation:** Trusts incoming DSCP markings for QoS treatment. This is appropriate if upstream devices (router, APs) properly mark traffic classes.

### Summary of Known vs Unknown Items

| Item | Status | Investigation Priority |
|------|--------|-----------------------|
| Port ge 0/1 (`Omada OC200`) | ✅ Known device alias | Verify TP-Link integration |
| Port ext-e 0/26 (`Aruba Switch`) | ✅ Connected to JL253A | Confirm ring redundancy state |
| Ports ge 0/19–22 | ⚠️ Unused spares | Low priority - optional cleanup |
| DHCP snooping | ⚠️ Disabled | Medium priority - security concern |
| SNMP communities | ⚠️ Weak strings | Medium priority - rotate soon |
| Event email config | ⚠️ Placeholders | Low priority - verify/complete |

## Recommendations Summary

1. **Enable DHCP snooping** to prevent rogue DHCP attacks
2. **Rotate SNMP community strings** for security hardening
3. **Verify ring redundancy operational state** (active vs configured but disabled)
4. **Document device on port ge 0/1** (TP-Link integration?)
5. **Consider enabling PoE** if APs need power (currently no PoE active)

## Related

- [01 — Architecture](/nanda/01-architecture/) - Core switch entry  
- [02 — Switch Configuration](/nanda/02-switch-configuration/) - Aruba JL253A config
- [04 — IP Addressing](/nanda/04-ip-addressing/) - Subnet assignments

## Change log

---

## Source Disclaimer

- [x] AI Generated
- [ ] Human Generated
- [ ] AI Edited
- [ ] Human Edited