IEEE 802.1Q VLAN Tagging

Create independent VLAN IDs (e.g., VLAN 10 for IT, VLAN 20 for OT). Configure the interface as a Trunk Port and tag the frame with an 802.1Q tag; configure the connection port on the device as an Access Port and untagged it to logically block broadcast domains from different subnets.

Port-based VLAN (PVID)

Assign the specific port to the target VLAN and configure the corresponding PVID (Port VLAN ID). All untagged traffic from this device will be automatically tagged with the PVID and sent to the specific network domain when it enters the switch.

Subnetting

To effectively contain ARP broadcasts, it is highly recommended to implement VLAN (Virtual Local Area Network) subnetting across the network infrastructure. This approach logically segments the factory's network into multiple smaller broadcast domains, preventing excessive ARP traffic from flooding the entire system. Furthermore, assigning isolated VLANs to different departments or areas not only conserves bandwidth but also significantly enhances overall network security and stability

ERPS (ITU-T G.8032 v2) or RSTP (IEEE 802.1w)

Industrial networks often employ physical loops to prevent single points of failure. Broadcast storms can occur if backup protocols are not enabled by default. Antaira supports ITU-T G.8032 ERPS, automatically blocking RPLs (Ring Protection Links) to prevent loops when the ring network is functioning normally; and completing switching within 50ms when a line is interrupted, ensuring minimal downtime.

RSTP (Rapid Spanning Tree Protocol)

For cross-brand compatibility, it is recommended to use the standard IEEE 802.1w RSTP. The core switch's Bridge Priority should be set to the lowest value (e.g., 4096) and designated as the Root Bridge. All nodes should have consistent Spanning Tree parameters such as Hello Time and Forward Delay for seamless compatibility.

ERPS Sub-Ring without Virtual Channel

Antaira supports Multi-Ring / Sub-Ring architecture. Sub-rings are connected to two switches (Interconnection Nodes) of the Major Ring. Sub-rings have independent RPLs and Control VLANs, providing hierarchical isolation and tiered redundancy without occupying the main ring channel.

Loop Protection (Loopback Detection)

Enable Loop Protection on the Access Port. The switch will periodically send detection packets to the port. Once the packet is received by the same port, an external loop is detected. The system will automatically Error-disable the port and send an alarm via Relay to prevent the storm from spreading to the backbone.

Storm Control

Enable Broadcast/Multicast/Unicast Storm Control on the connection port and set a threshold value. Once the threshold is exceeded, the chip will directly discard the excess signal frame.

LACP Hash Algorithm (Load Balancing Algorithm)

LACP load balancing allocates packets based on hash calculations (such as SA/DA MAC or Source/Destination IP). A single session (single source and destination) will always fall on the same physical link to ensure that packets are not out of order. Therefore, a single flow cannot exceed the single port limit, and the aggregation effect can only be realized when multiple traffic flows concurrently.

Dual Redundant Power Inputs

The device has built-in dual DC power terminals (PWR 1 & PWR 2) to support wide voltage input (such as 12~48VDC) and diode isolation (ORing Diode). When one main power supply fails, the hardware seamlessly switches to backup power.

IEEE 802.3x Flow Control (Full-duplex Flow Control)

Enable 802.3x Flow Control in a full-duplex environment. When the switch port buffer approaches its critical value, it sends a PAUSE frame to the upstream device, requesting a brief pause in transmission until the queue is cleared, effectively reducing packet loss caused by buffer overflow.

Auto-Negotiation

Auto-Negotiation is enabled by default, which can dynamically detect the speed and duplex mode of the connected device.

Port Security (MAC Limiting & Sticky MAC)

Enable Port Security and bind the device's MAC address (Sticky MAC), and set the maximum allowed number of MAC addresses to 1. Once an unauthorized MAC address is detected, the switch hardware can immediately be configured to either shut down the port or drop the packet (Restrict/Protect).

DHCP Snooping

Enable DHCP Snooping on the switch. Set the upper-layer legitimate DHCP server port as a Trusted Port, and set all other terminal ports as Untrusted Ports. DHCP Offer/ACK packets will be discarded directly on Untrusted Ports, preventing Rogue DHCP interference.

DAI (Dynamic ARP Inspection)

The IP-MAC Binding Table established in conjunction with DHCP Snooping enables DAI. The switch will intercept and verify all ARP Requests and Replies, and if the IP and MAC mapping is invalid, the spoofed ARP packet will be blocked directly.

ACL (Access Control List - L2/L3/L4)

Configure hardware ACL rules. For example, compare the source IP, destination IP, protocol (TCP/UDP), and destination port (e.g., Deny TCP Port 502 Modbus traffic), and have the ASIC filter and block traffic in real time at the hardware wire-speed stage.

802.1X/RADIUS/TACACS+ Authentication

Enable AAA (Authentication, Authorization, Accounting). When an administrator logs into the Switch Web/CLI, the authentication request will be forwarded to the backend enterprise-grade Identity Server. Alternatively, IEEE 802.1X can be enabled at the jack to authenticate physical network-connected devices.

IP Source Guard (IPSG)

Combined with the static IP source binding table, the switch filters out unauthorized IP/MAC source traffic. When a static IP packet that is not on the whitelist appears on the port, the switch blocks it directly at the ingress end.

IGMP Snooping and IGMP Querier

EtherNet/IP I/O data primarily uses UDP multicast. Without IGMP Snooping enabled, L2 switches treat multicast as broadcast flooding. With it enabled, the switch only forwards multicast to ports that have joined the group. If there are no L3 routers in the architecture, the core switch must enable IGMP Querier to proactively initiate membership queries.

MVR (Multicast VLAN Registration)

Without configuring complex PIM routing protocols, MVR can transmit images in a dedicated multicast VLAN on the backbone and multicast them across network segments to clients located in different User VLANs, significantly saving core bandwidth and CPU load.

QoS (802.1p CoS / DSCP) Priority Mapping

PROFINET RT packets come with 802.1p Priority 6 by default. Configure the QoS policy in the switch to set Queue 6/7 to Strict Priority (SP) to ensure that high-priority real-time control frames are always queued and forwarded first, while low-priority file transmissions use the WRR (Weighted Round Robin) mechanism.

SNTP / NTP

Configure the NTP/SNTP Client to point the clock source to the factory's NTP server (such as a GPS time clock), and correctly set the time zone (such as GMT+8) and daylight saving time (DST) to ensure that the Syslog timestamp has identifiable consistency.

IEEE 1588v2 PTP (Precision Time Protocol)

SNTP/NTP accuracy is only at the millisecond (ms) level, which cannot meet the synchronization requirements of servo motors. Certain Antaira models support IEEE 1588v2 PTP hardware timestamping, providing End-to-End (E2E) or Peer-to-Peer (P2P) Transparent Clock (TC) to eliminate packet jitter and achieve time synchronization accuracy down to sub-microseconds.

QoS Queue Scheduling (SP, DWRR)

Strict Priority ensures that control packets (such as emergency stop safety signals) are transmitted first, but may cause low-priority packets to "starve." DWRR, on the other hand, allocates the transmission ratio according to weight. Generally, industrial control topologies recommend using a hybrid mode: the most urgent control packets are queued in SP, and other image and file transmissions use DWRR.

Modbus TCP Support 

The Antaira Switch has a built-in Modbus TCP Server function. The device maps its internal operating parameters to standard Modbus corresponding registers (holding registers), allowing SCADA to directly collect data via polling without the need for SNMP MIB. 

Port Mirroring (N:1)

Configure Port Mirroring to completely copy the traffic of the target machine's physical ports (Source Port / RX & TX) and output it to the connection port (Monitor / Analyzer Port) of the engineer's laptop without affecting the original communication lines.

DDM (Digital Diagnostic Monitoring / SFP DOM)

The SFP has the DDM function of the SFF-8472 standard. By accessing the network management page, you can read the current TX/RX optical power (dBm), internal operating temperature, bias current and voltage of the optical transceiver in real time, and compare it with the optical fiber power budget.

SNMP v2c/v3 and MIB

Enable the SNMP service and import it into the Antaira Private MIB and the standard MIB-II (RFC 1213). NMS can then periodically poll the device's CPU utilization and interface packet loss/discard count through OID.

SNMP Traps and Syslog Server

Configure the SNMP Trap Destination and Syslog Remote Server IP. When the switch restarts, the ring network topology changes, or the interface link goes down, actively send asynchronous event notifications.

Fault Relay Output (Digital Relay Dry Contact Alarm)

Antaira industrial switches feature hardware relay dry contacts. Trigger conditions (such as Power Fail or Port 1~4 Link Down) can be configured via the web. Once the condition is met, the relay open circuit closes, driving the field tri-color warning lights, alarm buzzers, or inputting to the PLC digital input (DI).

LLDP (802.1ab / Link Layer Discovery Protocol)

Enable LLDP. The switch will periodically broadcast its Chassis ID, Port ID, System Name, and Management IP downstream. Third-party industrial topology software can automatically scan and draw the physical wiring diagram.

RMON (Remote Monitoring / RFC 2819)

RMON provides historical data statistics groups (Statistics, History, Alarm, Event). The switch can collect fine-grained short-period statistics locally (such as 60-second Drop Events, Oversize Packets, Collision statistics).

Save Configuration (Running to Startup-Config)

Industrial switches employ a discrete memory architecture. Real-time configuration is written to volatile RAM (Running-Config), which is lost upon power failure. After modification, a manual "Save" command must be executed to write it to Non-Volatile Flash (Startup-Config) for the changes to take effect upon the next power-on.

Local Console Interface (RS-232)

Connect via the included Console cable to an RJ45/USB port using serial terminal software (such as PuTTY or Tera Term, parameters 115200, 8, N, 1). This allows for emergency repairs even in the event of a complete network outage, IP conflict, or all ports being error-disabled.