GWN780x Pro Managed Switches – User Manual

INTRODUCTION

The GWN780x Pro Series is a Layer 2++ managed network switch designed for small-to-medium enterprises that require scalable, secure, and high-performance networks with simplified management.

Each model delivers high-speed Gigabit Ethernet connectivity with SFP or SFP+ uplink ports, providing switching capacities up to 216 Gbps to meet demanding business needs.

The series supports advanced features such as:

• VLAN configuration for flexible traffic segmentation
• QoS for precise traffic prioritization
• IGMP/MLD Snooping to optimize multicast performance
• Comprehensive security functions, including ARP inspection, IP source guard, and DoS protection

PoE-capable models offer intelligent dynamic PoE/PoE+/PoE++ power allocation, supplying power to IP phones, cameras, access points, and other network devices.

Management is versatile and free to use, with options including:

• Embedded Web UI controller
• GDMS Networking (cloud)
• GWN Manager (on-premise software)
• GWN Series Routers
• Command-Line Interface (CLI)

Combining enterprise-class performance, robust security, and flexible management, the GWN780x Pro Series delivers a complete switching solution ideal for modern business environments.

PRODUCT OVERVIEW

Technical Specifications

INSTALLATION

Before deploying and configuring the switches, the device needs to be properly powered up and connected to the network. This section describes detailed information on the installation, connection, and warranty policy of the GWN780x Pro switches.

Package Content

The package content that comes with the GWN780x Pro product contains the following elements.

GWN780x Pro Package Content

Fan Ventilation

The GWN780x Pro series features a dedicated ventilation system designed to keep the device cool in deployments where it delivers significant power to connected devices. This power delivery increases the device’s workload and internal temperature. Depending on the model, the cooling mechanism and number of fans can vary. The illustration below highlights these differences:

Install on the Desktop

1. Place the bottom of the switch on a sufficiently large and stable table.
2. Peel off the rubber protective paper of the four footpads one by one, and stick them in the corresponding circular grooves at the four corners of the bottom of the case.
3. Flip the switch over and place it smoothly on the table.

Install on a 19″ Standard Rack

1. Check the grounding and stability of the rack.
2. Install the two L-shaped rack-mounting accessories on both sides of the switch, and fix them with the screws provided (KM 3*6).
3. Place the switch in a proper position in the rack and support it with the bracket.
4. Fix the L-shaped rack mounting to the guide grooves at both ends of the rack with screws(prepared by yourself) to ensure that the switch is stably and horizontally installed on the rack.

Powering and Connecting GWN780x Pro

Connect the power cable and the switch first, then connect the power cable to the power supply system of the equipment room.

To protect the power supply from accidental disconnection, it’s recommended to purchase a power cord anti-trip for installation:

1. Place the smooth side of the fixing strap towards the power outlet and insert it into the hole on the side of it.
2. After plugging the power cord into the power outlet, slide the protector over the remaining strap until it slides over the end of the power cord.
3. Wrap the strap of the protective cord around the power cord and lock it tightly. Fasten the straps until the power cord is securely fastened.
4. Connect the RPS for the following models: GWN7803 Pro, GWN7803PH, GWN7806 Pro, GWN7806PL, GWN7806PH Pro

Connect the Grounding cable by following the steps below:

1. Remove the ground screw from the back of the switch, and connect one end of the ground cable to the wiring terminal of the switch.
2. Put the ground screw back into the screw hole, and tighten it with a screwdriver.
3. Connect the other end of the ground cable to another device that has been grounded or directly to the terminal of the ground bar in the equipment room.

Connect to Console Port

1. Connect the RJ45 end of the console cable to the console port of the switch.
2. Connect the other end of the console cable to the DB9 male connector or the USB port on the PC.

GETTING STARTED

LED Indicators

The front panel of the GWN780x Pro has LED indicators for power and interface activities. The table below describes the LED indicators’ status.

LED Indicators

Access & Configure

Login Using the Console Port

1. Use the console cable to connect the console port of the switch and the serial port of the PC.
2. Open the terminal emulation program of PC (e.g., SecureCRT), enter the default username and password to log in. (The default administrator username is “admin” and the default random password can be found on the sticker on the GWN780x Pro switch).

Login Remotely Using SSH

1. Enter “cmd” in PC/Start.
2. Enter ssh <gwn780x Pro_IP> in the cmd window.
3. Enter the default username and password to log in. (The default administrator username is “admin” and the default random password can be found on the sticker on the GWN780x Pro switch).

Web CLI

Web CLI provides access to the switch command-line interface directly from the Web UI, without opening a separate terminal application. Use it to run supported commands for configuration, status checks, and troubleshooting.

Click the CLI Console icon in the upper-right toolbar to open the console panel, then click Connect to start a CLI session.

When the status changes to Connected, enter a supported CLI command at the prompt and press Enter. Command output appears in the console. For command syntax and available operations, see the GWN78xx CLI User Guide.

Use the controls on the right side of the console header to Disconnect the session, Clear the screen, switch to Full-screen Display, or Minimize the panel. Disconnect when you have finished using the CLI.

Configure Using GDMS Networking

Sign in to GDMS Networking and add the switch to the trusted account. From the Devices page, the Remote Access operation opens the switch Web UI through GDMS. The same passwordless remote-access workflow is available through GWN Manager. Enable it on the switch under System → Access Control → Passwordless Remote Access; management-platform access remains restricted to authorized platform users.

Login Using the Web UI

The GWN780x Pro embedded Web server responds to HTTPS GET/POST requests. Embedded HTML pages allow users to configure the device through a Web browser such as Microsoft Edge, Mozilla Firefox, or Google Chrome.

1. A PC uses a network cable to correctly connect any RJ45 port of the switch.
2. Set the Ethernet (or local connection) IP address of the PC to 192.168.0.x (“x” is any value between 1-253), and the subnet mask to 255.255.255.0, so that it is in the same network segment as the switch IP address. If DHCP is used, this step could be skipped.
3. Type the switch’s default management IP address https://<GWN780x Pro_IP> in the browser, and enter the username and password to log in. (The default administrator username is “admin” and the default random password can be found on the sticker on the GWN780x Pro switch.)

CLI Access

The GWN780x Pro series supports local, SSH, and Web CLI access. CLI output can be filtered with the pipe (|) operator. For the command reference, refer to the GWN78xx CLI User Guide.

Web GUI Languages

The GWN780x Pro web GUI supports many languages, including English, Simplified Chinese, Spanish, French, etc.

To change the default language, select the displayed language at the bottom of the web GUI either before or after logging in.

Search

In case it’s hard to go through every single section, GWN780x Pro Switches have search functionality to help the user find the right configuration, settings, or parameters, etc.

At the top of the page, there is a search icon. The user can click on it and then enter the keyword relevant to their search, and then they will get all the possible locations of that keyword.

It’s also possible to search through menus and sub-menus, and once the user clicks on the search result, they will jump directly to the specified page. Please see the figure below:

OVERVIEW

Overview is the first section that displays System information in the first page, “System Info”, and Port status on the second page, “Port Info”. This section provides the user with a general and global view of the GWN780x Pro system and port status for easy monitoring.

System Info

System Info is the first page after a successful login to the GWN780x Pro Web Interface. It provides an overall view of the GWN780x Pro Switch information presented in a Dashboard style for easy monitoring, including basic info, Resource Status, PoE Status, and System Events.

To name the device, please click on , then enter the desired name.

System Info page

Port Info

This page on the GWN switches provides comprehensive port statistics, PoE power supply information, and detailed port and neighbor information. It helps users monitor network performance and manage connected devices efficiently.

• Port Info

The “Port Info” section visually displays the status and speed of each port, using different colors for speeds and states. Users can quickly identify active, inactive, or problematic ports and their PoE power status.

• Basic Info and Neighbor Info

The “Basic Info” section shows specific details for a selected port, including its status and settings. The “Neighbor Info” section provides information about the device connected to the port, such as hostname and current traffic rates.

• Statistics

The “Statistics” section offers detailed metrics on network traffic through the switch. It includes data on octets, packets, and discards, which is crucial for monitoring performance and troubleshooting.

• PoE Power Supply / Fiber Info

If the selected port is PoE-capable, the “PoE Power Supply” section shows power supply status and usage. If the port is SFP, the “Fiber Info” section displays details like signal loss, temperature, RX, and TX power.

The following table explains the color mode and the symbols used:

Port Info

Note: a PoE symbol and color code combination is also possible. Ex: in this case, the port is using 1000 Mbps speed and also using PoE at the same time.

Icons Description:

• Basic Info: The edit icon forwards users to the Port Basic Settings page, where they can modify the port settings, such as Description, Speed, Duplex Mode, and Flow Control, or enable/disable the port.
• Neighbor Info: The details icon forwards users to the LLDP/LLDP-MED Neighbor Info page. Here, users can view additional information about the connected devices, including chassis ID, port ID, device name, system description, and survival time.
• PoE Power Supply / Fiber Info: The details icon forwards users to the respective detailed pages. For PoE, it forwards to the PoE Interface page, showing detailed information about PoE settings for each port. For Fiber, it forwards to the Fiber Module page, displaying comprehensive fiber details such as signal loss, temperature, RX, and TX power.
• Statistics: The clear icon clears the displayed statistics.

SWITCHING

The switching section is used to configure port settings, link Aggregation, VLAN, Spanning Tree, etc.

Port Basic Settings

Use Switching → Port Basic Settings to enable or disable a port, add a description, select its speed and duplex mode, configure jumbo frames and flow control, or apply an enable schedule. Copper and optical ports can be filtered and managed separately.

To configure a port, please navigate to Web UI → Switching → Port Basic Settings.

To configure a port, click on the “Edit” icon under the operation column.

Users can define schedules for specific ports, this is to enables precise control over when configurations are applied. These schedules dictate the exact times during which port settings will take effect.

For SFP+ ports that support a selectable operating mode, choose the 2.5 Gbps/10 Gbps mode, save the configuration, and reboot the switch before selecting the corresponding speed on an individual optical port.

Port Group

The port group feature allows administrators to logically bundle specific ports together under one group with a corresponding group ID. This can be useful when classifying the switch ports for identifying the usage of each set of ports, for example, ports 1 to 4 and LAG 1 and 2 can be set with ID 20, which will be the ports connecting Security devices.

Port group settings can facilitate quick batch settings for port group ports.

Once the Port Group is created, it can ease the process of selecting and tagging/untagging VLAN ports individually. Under Switching → VLAN, select the port group to be used for your VLAN

In addition, users can disable/enable specific ports based on the port group created, instead of going through each port selection separately:

Port Statistics

Port Statistics displays Tx and Rx rate, utilization, bytes, packets, error packets, and queue-dropped packets in real time. Select a refresh interval, clear all counters, or open the operation control for a specific port.

To view even more details, like Etherlike (SNMP), RMON, and port Private MIB information.

Loopback Detection

By enabling the loop detection function of the interface, the interface periodically sends detection packets to check whether the packets are returned to the device, and then determines whether there is a loop in the device. If a loop is detected, the port is automatically shut down to eliminate the loop and ensure the normal operation of the network environment.

Port Auto Recovery

Port Auto Recovery helps recover a port after a specific delay that can be specified by the user. When the following functions of the port trigger the port down, the port automatically returns to the up state after the delay time:

Examples:

• ARP packet detection: If the ARP rate in DAI exceeds the set value, the current port will be shut down.
• STP BPDU Guard: In the spanning tree, the port enables BPDU Guard. When this function is triggered, the port will be shut down.
• Port Loop: When the port is self-looping and the spanning tree is enabled, the port will be shut down.
• ACL: When the ACL rule is matched and the action is shutdown, the port will be shut down.
• Port Security: When the number of port MAC addresses exceeds the set number, the port will be shut down.

Link Aggregation

LAG means Link Aggregation Group, which groups some physical ports to make a single high-bandwidth data path. Thus, it can implement traffic load sharing among the member ports in a group to enhance the connection reliability.

Link Aggregation Group

There are two load balance modes on the GWN780x Pro Switches: either based on the MAC Address or based on the IP–MAC Address. And in terms of the type of LAG, there are either the static option or to use the LACP7 or Link Aggregation Control Protocol, both are supported.

Link Aggregation Port

LAG Port Settings

On this page, the user can enable the Link Aggregation Group and add a Description as well as specify the speed and the flow control for LAG.

Link Aggregation Settings

LACP

LACP or Link Aggregation Control Protocol is based on the priority, and the user can enable a system priority or even specify the priority for each port individually.

Link Aggregation – LACP

MAC Address Table

The MAC Address Table maps learned MAC addresses to VLANs and ports. Use its tabs to view dynamic, static, blackhole, and port-security entries.

The entries in the MAC address table are divided into Dynamic Address, Static MAC Address, Black Hole Address, and Port Security Address.

Dynamic Address

When a frame arrives, the switch learns its source MAC address and associates it with the ingress port and VLAN. Receiving another frame from the same source refreshes the dynamic entry’s aging timer.

MAC Address Hashing Algorithm: Determines how the switch combines the VLAN ID and MAC address to place a learned entry in its internal Layer 2 forwarding table. It changes only the internal table distribution; it does not modify the MAC address, select a forwarding port, or control link-aggregation load balancing. The modes are alternative hash profiles rather than increasing performance levels.

Sequential and randomized describe how the switch combines address bits to calculate an internal table location; neither method changes the displayed MAC address. Leave the current mode unchanged unless a different distribution is required while troubleshooting MAC-learning or table-collision behavior. After selecting a different mode, click OK, save the configuration, and reboot the switch for the new mode to take effect.

Aging Time: Sets how long an inactive dynamic MAC entry remains in the table. Enter 0 to disable aging, or a value from 60 to 1,000,000 seconds. Traffic received from the learned source before the timer expires refreshes the entry.

Click Refresh to update the list. Select one or more dynamic entries, then use Solidify to convert them to static entries, Block to add them to the blackhole list, or Delete to remove them. Delete All removes every dynamic entry.

Static MAC Address

This section allows the user to manually assign a MAC address to the MAC table. The configuration result will be displayed in the table listed on the lower side of this web page.

Static MAC Address

Black Hole Address

If a MAC address is not trusted or insecure, the user can block the traffic of certain MAC Addresses and discard them by adding them to the Black Hole Address Table.

Click on the “Add” button, then enter the MAC Address and the VLAN.

Port Security Address

After enabling port security in Security → Port Security, the addresses will be displayed in the MAC Address Table → Port Security Address synchronously.
The list shows the interface name, VLAN, and MAC address.

MAC Address Migration Record

The MAC Address Migration Record tracks instances in which the switch learns the same MAC address through a different port. A single migration can be expected after a device is reconnected or a wireless client roams between access points. Repeated migrations can help identify MAC flapping caused by a Layer 2 loop, unstable links, or an incorrect network topology.

Each record identifies the MAC Address and VLAN, the Start Time and End Time of the observed migration period, the original Source Port, the Migration Ports where the address was subsequently learned, and the total Migration Count. Use these details to determine where the address was first learned and how frequently it moved.

Click Refresh to reload the records. Click Clear All to delete all MAC address migration records.

VLAN

A virtual local area network, virtual LAN or VLAN, is a group of hosts with a common set of requirements that communicate as if they were attached to the same broadcast domain, regardless of their physical location. A VLAN has the same attributes as a physical local area network (LAN), but it allows for end stations to be grouped even if they are not located on the same network switch. VLAN membership can be configured through software instead of physically relocating devices or connections.

A user can click on the “Add” button to add a new VLAN. It is possible to create many VLANs at the same time by specifying a range, for example, (7-9) will create VLANs 7,8, and 9, or create different separated VLANs, for example, (11,89) will create VLANs 11 and 89.

If the VLAN is already created, there is also the option to modify it by clicking on the modify button for more options and settings like Description, Tagged and Untagged ports, and LAGs.

Edit VLAN

Please refer to the table below for more details about Tagged and Untagged Ports.

VLAN Tagged and Untagged

VLAN Port Settings

The Port Settings tab configures VLAN behavior for each port or LAG, including the link type (Hybrid, Access, Trunk, or Dot1q-tunnel), PVID, ingress filtering, accepted frame type, VLAN translation, and protocol template.

VLAN Port Members

On this page, the user can define both Tagged and Untagged VLANs (members) for each port individually.

Trunk Allowed VLANs allow the configuration of VLANs that do not yet exist on the switch and are only effective for configured VLANs.

Voice VLAN

A voice VLAN (virtual local area network) is a dedicated VLAN specifically designed to carry voice traffic, such as IP phone calls. By isolating voice traffic from other types of network traffic, voice VLANs help ensure that voice calls are prioritized and experience minimal latency or jitter. This is critical to maintaining clear and uninterrupted voice communications.

Voice VLAN advantages:

• Improved voice quality: By isolating voice traffic from other types of network traffic, voice VLANs help reduce the latency and jitter that can cause choppy or distorted audio during voice calls.
• Reduced congestion: By prioritizing voice traffic, voice VLANs help prevent other types of network traffic from interfering with voice calls, even during periods of heavy network usage.
• Simplified network management: Voice VLANs can simplify network management by making it easier to troubleshoot and resolve voice-related issues.

For example, when an IP phone is connected to a GWN780x Pro switch port, the switch prioritizes traffic in the voice VLAN, ensuring that voice packets are forwarded before other types of packets.

The user can select more than one way to set up the voice VLAN:

• Auto Voice VLAN using LLDP
• Tagged OUI using LLDP
• Tagged OUI using VLAN Tag
• Untagged OUI

For more details, please visit this guide: GWN78xx(P) – Voice VLAN Guide.

To configure Voice VLAN, please navigate to Web UI → Switching → VLAN page → Voice VLAN tab.

Voice VLAN

OUI

An OUI address is a unique identifier assigned by IEEE (Institute of Electrical and Electronics Engineers) to a device vendor. It comprises the first 24 bits of a MAC address. You can recognize which vendor a device belongs to according to the OUI address. The following table shows the OUI addresses of several manufacturers. There is also the option to add a custom one based on user needs.

MAC VLAN

MAC VLAN is a networking technique where each VLAN is based on the source MAC address of incoming frames. Devices with the same MAC address share a VLAN. This segmentation enables isolated communication between devices within the same VLAN based on MAC addresses.

VLANs are divided according to the source MAC address of the data frame. Through the configured MAC address and VLAN mapping table, when the switch receives an untagged frame, it adds the specified VLAN Tag to the data frame based on the mapping table.

To add a MAC address to VLAN mapping, click on the “Add” button, then specify the MAC Address, Mask Length, VLAN, and the priority (802.1p).

Protocol VLAN

VLANs are divided according to the protocol (family) type and encapsulation format to which the data frame belongs. Through the configured protocol domain and VLAN mapping table in the Ethernet frame, when the switch receives an untagged frame, it adds the specified VLAN Tag based on the mapping table.

Spanning Tree

Spanning Tree Protocol (STP) prevents network loops by automatically detecting redundant links and blocking unnecessary ones. Without it, switches could forward packets in circles, causing broadcast storms and major outages.

This switch supports multiple versions of STP, each with different speed, complexity, and use cases:

• STP (Spanning Tree Protocol): The original standard. It prevents loops but takes 30+ seconds to recover from topology changes. Use only if required by old devices.
• RSTP (Rapid Spanning Tree Protocol): A faster, modern version of STP with sub-second failover. Ideal for most networks that don’t require per-VLAN control.
• MSTP (Multiple Spanning Tree Protocol): Groups multiple VLANs into one spanning tree instance, reducing overhead. Best for large networks with many VLANs and structured VLAN planning.
• PVST(+) (Per-VLAN Spanning Tree Plus): Runs a separate spanning tree for each VLAN. Allows detailed control but increases CPU/memory usage. Good when VLAN isolation and per-VLAN optimization are required.
• RPVST(+) (Rapid PVST Plus): Adds fast convergence to PVST(+). Ideal for modern, VLAN-heavy networks needing both speed and per-VLAN flexibility.

Choosing a Mode:

• Use RSTP if you’re not sure. It’s fast and widely compatible.
• Choose RPVST(+) for VLAN-specific loop prevention with quick failover.
• Go with MSTP if you want scalable performance across many VLANs.
• STP is maintained for backward compatibility with legacy devices. It is not recommended for modern networks due to its slower convergence time.

STP Global Settings

STP Port Settings

To configure STP on each port and LAG, then navigate to WEB UI → Spanning Tree → Port Settings, then click on the “Edit” button.

For each port or LAG, the user can enable STP and specify the priority, Path Cost, Edge port, BPDU Guard, and Filter and Point-To-Point.

STP Port Settings

Multiple Spanning Tree Instances

MST or Multiple Spanning Tree Instance allows traffic of different VLANs to be mapped into different MST Instances. GWN780x Pro Switch supports up to 16 independent MST instances (0~15), where each instance can be associated with many VLANs.

MST Port Settings is used to configure the GE port / LAG group settings for each MST instance.
The table displays the MST parameters for each port.

Click on the “Edit” button to edit the MST Port Settings for each Port/LAG individually, and the user can even specify the Path Cost and Priority per Port/LAG as well.

PVST VLAN Settings

When the Per VLAN Spanning Tree protocol is selected as the STP protocol to be used, then the VLAN settings can be defined.

The following parameters are to be configured:

PVST Port Settings

The PVST Port settings define the priority and path cost for each port of the switch, for each VLAN.

It also displays, for each port, its role, designated Bridge ID, designated Port ID, and designated Path Cost.

The parameters to be defined are

ERPS

Ethernet Ring Protection Switching (ERPS) provides a backup path for switches connected in an Ethernet ring. It prevents loops during normal operation and switches traffic to the protection path when a ring link fails, helping keep services available.

Navigate to Switching → ERPS and enable ERPS. Configure the ring settings, select the two ports connecting this switch to the ring, and assign each port its role according to the ring design.

ERPS Configuration

Control VLAN	VLAN used to carry ERPS control messages.
MEL	Maintenance entity group level used by the ring protection protocol.
WTR Timer (min)	Wait-to-Restore interval before reverting to the normal ring path after a failure clears.
Guard Timer (ms)	Interval that prevents outdated ring-protection messages from affecting a recovery transition.
Holdoff Timer (ms)	Delay before a detected link failure triggers ring protection switching.
Port 1 / Port 2	Select the two local interfaces that connect this switch to the Ethernet ring.
Role	Select RPL Owner Port for the port assigned to own the Ring Protection Link, or Normal Port for a normal ring port, according to the ring design.

IP

VLAN IP Interface

IPv4/IPv6 Interface

GWN7806PH Pro and GWN7806PL Pro support up to 512 VLAN IP interfaces. For the other Pro models, refer to the model-specific limits in Technical Specifications.

To add an IP Interface, please click on the “Add” button, refer to the figure below:

Use the “refresh icon” to request a new IP address from the DHCP server. This action will prompt a confirmation dialog; clicking “OK” will obtain a new IP address, which may change upon successful retrieval.

Address Type:

• If DHCP is selected: hosts will obtain IP addresses automatically from the DHCP server pool is configured (a router, for example).

Gateway Priority: valid range from 2 [very important] to 255 [least important],

MTU (Maximum Transmission Unit): valid range is 1280-9216.

• If Static IP is selected: the user can specify the IPv4 or IPv6 manually.

IPv6 Router Advertisements

IPv6 Router Advertisements (RAs) are messages sent by routers to provide information to devices on the network, such as the default gateway, DNS servers, and network prefixes. These advertisements help devices configure their IP addresses and routing automatically without the need for manual configuration. In the VLAN IP Interface section, you can configure RAs for each VLAN to manage IPv6 network settings.

In the Edit IPv6 Router Advertisements screen, you can customize settings for a specific VLAN. This includes enabling or disabling the interface, setting route information, and configuring timeouts and lifetimes for the advertisements. You can also define IPv6 addresses and prefixes, adjust flags for additional configurations, and set the priority of the default route. This allows for fine-tuning the behavior of the advertisements to suit your network requirements.

MGMT VLAN

When you assign an IP address to the management VLAN interface, the system synchronizes this IP configuration with the corresponding VLAN interface in the device’s Layer 3 IP interface configuration. This ensures that the IP address used for managing the device is consistent with the VLAN’s routing and switching setup.

For example, if you configure the management VLAN with an IP address 192.168.2.100 on VLAN 2, this IP will also be reflected in the IP interface configuration for VLAN 2, ensuring both management and routing functions are aligned.

The management IP interface supports a configurable Class of Service (CoS) value so management traffic can receive the required Layer 2 priority.

Hosts in different VLANs cannot communicate directly and need to be forwarded through routers or layer 3 switching protocols.

A VLAN interface is a virtual interface in Layer 3 mode and is mainly used to implement Layer 3 communication between VLANs; it does not exist on the device as a physical entity. Each VLAN corresponds to an interface by configuring an IP address for it; it can be used as the gateway address of each port in the VLAN, so that packets between different VLANs can be forwarded to each other on Layer 3 routing through the VLAN interfaces. GWN switches support IPv4 interfaces as well as IPv6.

DHCP Server

A static VLAN IP interface can provide DHCP service to connected clients. Configure the service from IP → DHCP Server. Address pools can be enabled or disabled individually, and the global pool settings include a gateway and DHCP options.

Please navigate to the Web UI → IP → DHCP Server page.

Step 1: Enable the DHCP Server.

Step 2: In the Address Pool Settings section, click on the “Add” button to add a new address pool.

Add a pool range for the DHCP Server, then select the interface (VLAN).

In this section, the user can configure DHCP Options like the type, Service (for option 43), and option content. It’s also possible to add more DHCP Options by clicking on the “Add” icon, as shown below:

For each DHCP pool, select whether the pool is enabled, define its gateway and address range, and add the required DHCP options.

The address table will display the hosts (devices) MAC Addresses and the IP addresses when using the DHCP Server. Also, it’s possible to make an entry a static one by clicking on the “Add as Static Binding IP” button.

DHCP Relay

DHCP relay on the GWN780x Pro switch helps a network device pass DHCP messages between clients and servers that are on completely different networks. When you have a DHCP server that needs to serve clients on different subnets (or VLANs). A DHCP relay agent is a network device that can route between the client’s subnet and the server’s subnet. The relay agent gets the broadcast request from the client and sends it to the server, putting its own interface address as the gateway address (giaddr) field in the packet. This way, the server can tell which subnet the client is on and assign a suitable IP address. The server then sends the reply back to the relay agent, which passes it to the client.

DHCP Relay

ARP Table

The ARP Table separates configured entries from effective learned entries, making it easier to manage static mappings and verify the mappings currently used for forwarding.

• ARP Table: Displays dynamically learned ARP entries. You can configure the aging time and enable Strict ARP Learning, which limits ARP entries to only those required for actual traffic forwarding.

Note: On models such as GWN7801P Pro, GWN7802P Pro, and GWN7803PL/PH Pro, ARP capacity is limited to 64 entries. To prevent the table from filling with unnecessary data, enable Strict ARP Learning under Web UI → IP → ARP Table. When enabled, it is also recommended to go to Web UI → Routing → Routing Table and set the Forwarding Mode to Manual for consistent forwarding behavior.

• Static ARP: Allows administrators to define permanent IP-to-MAC address mappings that cannot be overwritten or aged out. This is typically used to ensure reliable communication with critical devices and to prevent spoofing.

To configure the ARP Table, please navigate to Web UI → IP → ARP Table.

Aging time (seconds): Set the aging time of dynamic ARP entries. After the aging time expires, dynamic ARP entries are automatically deleted. The value range is an integer from 60 to 21600, and the default is 1200 seconds.

Click on the “Link” icon to make the dynamic entry a static entry.

Static ARP

The Static ARP tab allows administrators to manually configure fixed IP-to-MAC address mappings. These entries do not expire and cannot be overwritten by dynamic ARP learning, making them ideal for securing communication with critical network devices.

To improve network stability and security, especially in environments vulnerable to spoofing or with limited ARP table size, static entries ensure the device only uses predefined address pairs for specific peers.

Click “Add Manually” to create a new entry by specifying:

• VLAN – Select the VLAN interface the entry applies to
• IP Address – Must be in a valid IPv4 format
• MAC Address – Must be a unicast MAC address

Alternatively, click “Add Quickly” to select one or more existing dynamic ARP entries and convert them into static entries in bulk.

Access this tab via Web UI → IP → ARP Table → Static ARP

Neighbor Discovery

Neighbor Discovery Protocol (NDP) provides IPv6 address resolution, neighbor reachability detection, duplicate-address detection, router discovery, redirects, and neighbor proxy functions. The interface separates configured entries from the effective neighbor table.

IPv6 address auto-configuration and router discovery rely on two kinds of ICMPv6 messages: RS (Router Solicitation) and RA (Router Advertisement). Hosts send RS messages to ask routers on the same link to send RA messages right away. Routers send RA messages to let hosts know they are there and give them information like IPv6 prefixes, hop limit, MTU, and configuration flags.

To configure ND please navigate to Web UI → IP → Neighbor Discovery.

Neighbor Table

Aging time (seconds): Set the aging time of dynamic neighbor entries. After the aging time expires, the dynamic neighbor entry is automatically deleted. The value range is an integer from 60 to 21600, and the default is 1200 seconds.

Click on the “Refresh” button to refresh the list for dynamic entries.

Static Neighbor

Click on the “Add” button to add a static entry, refer to the figure below:

Select the VLAN from the drop-down list, then enter the unicast IPv6 address and MAC address then click on the “OK” button.

DNS

Domain Name System DNS provides translation services between domain names and IP addresses. GWN780x Pro Switches act as a DNS client. When users perform certain applications on the device (such as Telnet to a device or host), they can directly use a memorable and meaningful domain name, and resolve the domain name to the correct address through the domain name system.

DNS domain name resolution is divided into static domain name resolution and dynamic domain name resolution, which can be used together when parsing domain names. If the static domain name resolution is unsuccessful, then dynamic domain name resolution will be used, since dynamic domain name resolution may take a certain amount of time and requires the cooperation of the domain name server. Some commonly used domain names can be put into the static domain name resolution table, which can greatly improve the effect of domain name resolution.

DNS Global Settings

On this page, the user can designate the switch as a DNS client to resolve DNS names to IP addresses through one or more configured DNS servers. It’s enabled by default.

To configure DNS on GWN780x Pro switches, navigate to Web UI → IP → DNS, then click on the Global Settings tab.

Up to 8 Domain Suffixes and 8 DNS Servers can be added. To add a Domain Suffix or DNS Server, click on the “+” icon, and to delete, click on the “–” icon.

Domain Mapping Table

To add a static DNS or to view the Dynamic ones, click on the Domain Mapping Table tab.

Click on “Add” button to add a new static DNS entry.

The user can also select the dynamic domains and then click on the “Add as a static domain” button or icon to make them static ones.

MULTICAST

IP multicast is a technique for one-to-many communication over an IP infrastructure in a network. To avoid the incoming data broadcasting to all GE/LAG ports, multicast is useful to transfer the data/message to specified GE/LAG ports for IGMP snooping or MLD Snooping. When the Switch receives a message “subscribed” by the client, it must decide to transfer the data to the specified GE/LAG ports according to the location of the client (subscribed member).

IGMP Snooping

As an IPv4 Layer 2 multicast protocol, IGMP snooping is the process of listening to Internet Group Management Protocol (IGMP) network traffic. The feature allows a network switch to listen in on the IGMP conversation between hosts and routers. By listening to these conversations, the switch maintains a map of which links need which IP multicast streams. Multicasts may be filtered from the links that do not need them, and thus control which ports receive specific multicast traffic.

IGMP Snooping Global Settings

This page allows the user to enable/disable the IGMP Snooping function, select snooping version, and enable/disable snooping report suppression, also select the Multicast Forward Mode, and what to do with Unknown Multicast Packet.

IGMP Snooping Global Settings

The user can also Enable/Disable IGMP Snooping and IGMP Snooping Querier per VLAN, and much more.

IGMP Snooping Edit VLAN

IGMP Snooping Router Port

This page shows the IGMP querier router known to this switch. Click on “Add” to add another one, or click on the “Edit” icon to modify an already created one.

IGMP Snooping Multicast Address

Dynamic multicast addresses will be listed here, and the user can also add static multicast address entries based on VLAN by clicking on “Add” button or clicking “Edit” icon to edit.

IGMP Snooping Multicast Policy

In this page, the user can add a Multicast Policy up to 128 Policy IDs to Allow or Reject a range of Multicast Addresses.

IGMP Snooping Multicast Port

Once the Multicast Policy is created, the user is able to apply this policy to a port.

MLD Snooping

MLD Snooping Global Settings

As an IPv6 Layer 2 multicast protocol, MLD Snooping maintains the outgoing port information of multicast packets by listening to the multicast protocol packets sent between Layer 3 multicast devices and user hosts, so as to manage and control multicast data. Forwarding of packets at the data link layer. When an MLD protocol packet transmitted between a host and an upstream Layer 3 device passes through a Layer 2 device, MLD Snooping analyzes the information carried in the packet, establishes and maintains a Layer 2 multicast forwarding table based on the information, and guides multicast data in the data stream.

Enable MLD Snooping globally, choose the multicast forwarding mode, and configure settings per VLAN.

Supported Models: Matching Domain is available on GWN7801P Pro, GWN7802P Pro, and GWN7803 Pro.

MLD Snooping Global Settings

Once Global MLD Snooping is enabled, the user can enable more settings per VLAN.

MLD Snooping – Edit VLAN

MLD Snooping Router Port

 If the router port is statically configured, the Layer 2 device will also forward the MLD report and leave message to the static router port. If a static member port is configured, the interface will be added as the outgoing interface in the forwarding table. After a Layer 2 multicast forwarding table entry is established on a Layer 2 device, when the Layer 2 device receives a multicast data packet, it searches for the forwarding table according to the VLAN to which the packet belongs and the destination address of the packet (that is, the IPv6 multicast group address). Whether the item has the corresponding “outbound interface information”. If it exists, the packet is sent to all multicast group member ports; if it does not exist, the packet is discarded or broadcast in the VLAN.

MLD Snooping Multicast Address

GWN780x Pro Switches also support adding static multicast addresses by specifying the VLAN and member port.

MLD Snooping Multicast Policy

Multicast Policy can be created in this page to allow or reject a range of IPv6 Multicast Addresses. Up to 128 policies can be created.

MLD Snooping Multicast Port

The multicast policy can be applied to the Gigabit Ethernet/LAG port. The user can also set the maximum number of multicast groups that the port is allowed to join and set the action when the port multicast exceeds the limit; the default is rejected.

AV Control

Pro AV

Pro AV (Professional Audio/Video) is a feature set designed to simplify the deployment of networks that carry professional AV traffic. It provides a template-based workflow to create an AV-focused configuration, assign it to specific ports or link aggregation groups (LAGs), and apply a dedicated VLAN for the AV deployment. Depending on the network design, a configured profile can also enable VLAN routing and provide DHCP service for the AV VLAN.

In the Web UI, navigate to AV Control → Pro AV. The Pro AV page includes two tabs: Configuration and Template.

Pro AV is built around two pieces:

1. A Template represents an AV scenario (for example AES67, Dante, or NDI). Templates also include optional feature flags such as Multicast and E2E TC (IEEE 1588v2 End-to-End Transparent Clock support). Templates are intended to be reusable.

2. A Configured Profile is where the template is actually deployed. A profile selects a template, assigns a VLAN ID, and applies the profile to specific ports and/or LAGs using Tagged or Untagged membership. Profiles can additionally enable VLAN Routing (create a routed interface for the VLAN) and, if needed, enable the switch’s DHCP Server for that VLAN.

Template

Open the Template tab to view the built-in AV templates and any custom templates you create.

Built-in templates provide ready-to-use scenarios (for example Audio AES67, Audio Dante, Video NDI4, and mixed video/audio templates).

To add a custom template, click Add on the Template page. Enter a template name and a description that clearly identifies the intended AV use case. If the deployment relies on multicast traffic, enable Multicast. If the AV environment requires timing synchronization support, enable E2E TC (IEEE 1588v2 End-to-End Transparent Clock). Click OK to save the template.

Add a Template

Configuration

Open the Configuration tab to create, apply, and manage configured profiles. This page provides a visual map of ports and LAGs and a table listing existing profiles.

Configured profiles are displayed with key details such as the selected template, VLAN ID, and (when VLAN routing is enabled) the VLAN interface IP address. The color indicator helps you visually identify which ports belong to a profile in the port map.

To create a new profile, click Add under Configured Profiles on the Configuration tab. The profile creation process includes two parts: selecting members (ports/LAGs) and defining profile settings.

First, assign member interfaces. You can click ports (and LAG members) to set their membership type. Membership type determines how the VLAN is presented on that interface:

• Tagged membership is typically used for uplinks or trunks where VLAN tags must be carried.

• Untagged membership is typically used for endpoint devices that do not tag VLANs (common for many AV endpoints).

If you are adding many ports at once, use the Member Type drop-down to apply bulk changes (for example set all selected ports to Tagged or Untagged, or remove all assignments).

Next, configure the profile settings in the Add Configured Profile page. Complete the required fields, then enable optional features such as VLAN Routing and DHCP Server if they are needed for the AV VLAN. The purpose of each field is described in Table below. Click OK to save the profile and apply the configuration to the selected ports/LAGs.

Pro AV – configure the profile settings

Click OK to save the profile. After creating the profile, the selected ports/LAGs are associated with the profile and the profile appears in the configured profile list.

Once applied, the configured profile provides a consistent deployment method: ports are placed into the specified VLAN (tagged/untagged as configured), and optional services (VLAN routing and DHCP) are applied if enabled. This lets you build an AV segment quickly and keep the configuration consistent across all ports used for AV devices.

ROUTING

Routing is a process in which the router selects the optimal path according to the destination address of the received data packet and forwards it to the next network node leading to the target network, and the last routing node under this path forwards the data to the target host. (Router refers to both a router in the traditional sense and an Ethernet switch running a routing protocol).

GWN780x Pro supports IPv4 and IPv6 static routing.

Routing Table

The Routing Table page displays the routes used by the switch to forward packets between networks or VLANs. Routing enables the switch to function as a Layer 3 device, allowing it to make packet forwarding decisions based on destination IP addresses.

GWN780x Pro switches support both IPv4 and IPv6 static routing. This section includes options for viewing current routes and configuring the Forwarding Mode.

Forwarding Mode
Choose between Traditional and Manual.

• Traditional → automatic ARP/neighbor learning for routing between VLANs.
• Manual → disables that automation; forwarding depends only on static routes and static ARP entries.

Notes:

• If the number of hosts on VLAN interfaces exceeds 64 (as with models like GWN7801P Pro, GWN7802P Pro, or GWN7803PL/PH Pro), it is recommended to use Manual mode to ensure proper routing behavior and compatibility with Strict ARP Learning.
• When Strict ARP Learning is enabled under Web UI → IP → ARP Table, the Forwarding Mode should be manually set here to ensure stable communication and avoid exceeding ARP limits.

To view and manage routes:
Go to Web UI → Routing → Routing Table.

IPv4 Routing Table

In the IPv4 Routing Table tab, users can view and manage all IPv4 routing entries. Each entry defines how packets should be forwarded based on their destination IP address and subnet mask.

The table displays the following details for each entry:

• Destination IP Address
• Protocol Type (Static, DHCP, or Direct)
• Priority
• Cost
• Next Hop
• Outgoing Interface
• Flags

Forwarding Mode

The Forwarding Mode option defines how the switch handles routing and neighbor table behavior.

• Traditional: Direct routes and neighbor tables take effect normally.
• Manual: Direct routes become invalid, and only static entries in the neighbor table are used.

Tip: When the number of hosts on VLAN interfaces exceeds 64, it is recommended to use Manual mode for improved stability and performance.

IPv6 Routing Table

The IPv6 Routing Table tab allows configuration and monitoring of IPv6 routes. It provides the same functional options as the IPv4 table but applies to IPv6 addressing and neighbor discovery mechanisms.

Static Routes

Static routes are manually configured forwarding entries. They remain in effect until they are edited or deleted and do not automatically adapt when the network topology changes.

Navigate to Routing → Static Routes. Use the IPv4 Static Routes and IPv6 Static Routes tabs to manage each address family.

Configure Static Route Capacity

Use Number of IPv4 Static Routes or Number of IPv6 Static Routes to set the static-route capacity for that address family within the range displayed by the switch. Routing Resources shows the current allocation and available capacity.

Add a Static Route

1. Select IPv4 Static Routes or IPv6 Static Routes, then click Add.
2. Enter the destination address and its Mask Length or Prefix Length.
3. For IPv4, select Next Hop or Outgoing Interface under Gateway. For IPv6, enter the next hop, select the outgoing interface, or configure both as required.
4. Set the Priority. Lower values have higher priority.
5. Click OK, then click Save to apply the pending configuration.

Policy Route

Policy Route forwards IPv4 or IPv6 traffic that matches a selected ACL rule to a specified next hop. Use the separate IPv4 and IPv6 tabs to manage policies for each address family.

Navigate to Routing → Policy Route.

Add a Policy Route

A policy route references an existing ACL rule to identify the traffic that the switch forwards to the configured next hop.

1. Select IPv4 Policy Route or IPv6 Policy Route, then click Add.
2. Enter a policy Name.
3. Select the ACL Name and the matching Rule ID. Click View rules when you need to review the selected ACL.
4. Enter the Next Hop. For an IPv6 link-local next hop, also select the Outgoing Interface.
5. Click OK, then click Save to apply the pending configuration.

POE

Power Over Ethernet (PoE) refers to supplying power over an Ethernet network, also known as a local area network-based power supply system PoL or Active Ethernet.

Usually, the terminal devices of the access point need to use a DC power supply, but due to insufficient wiring, these devices need unified power management. At this time, the switch interface provides the power supply function, which can solve the above problems and realize the precise control of the port PoE power supply.

Global

This page displays PoE power-supply information, including the number of PoE ports, total and remaining PoE power, and supply voltage. The GWN7801P Pro provides a total PoE budget of 130 W.

Click on the “PoE Reboot” button to soft-restart the PoE module function.

PoE Reserved power

PoE Reserved power(W): specify the total reserved power of the PoE power supply; the default is 20 W.

Application scenarios:

The device will dynamically allocate power to each interface according to the power consumed by each interface. During the running process of each PD device, its power consumption will continue to change, and the system will periodically calculate the total power required by all currently connected PDs. Whether the upper limit of the available PoE power is exceeded, if it exceeds, the system will automatically power off the PD device on the interface with lower priority to ensure the normal operation of other devices. However, sometimes there will be a sudden surge in power consumption, the remaining available power of the system cannot support this surge in demand, and the system has not yet had time to calculate the total power consumption exceeding the limit, to disconnect the power supply of the interface with lower priority. When the PoE power supply is overloaded, the overload protection will be powered off, and all PD devices will be powered off. Use the PoE power-reserved command to reasonably set the reserved power of the system. In the event of a sudden surge in power demand, the reserve power of the system can support the sudden demand and ensure that the system has time to power off the devices on the interfaces with low priority. method to ensure the stable operation of other equipment.

Interface PoE configuration

Select the switch interface that supports the PoE power supply to be configured. Multiple choices are possible.

Click on the “Edit” button or icon to change the configuration per port, including Power Supply Standard, Power Mode, Power Limit Mode, and Power Supply Priority.

QoS

The popularity of the network and the diversification of services have led to a surge in Internet traffic, resulting in network congestion, increased forwarding delay, and even packet loss in severe cases, resulting in reduced service quality or even unavailability. Therefore, to carry out these real-time services on the network, it is necessary to solve the problem of network congestion. The best way is to increase the bandwidth of the network, but considering the cost of operation and maintenance, this is not realistic. The most effective solution is to apply a ” Guaranteed ” policy that governs network traffic. QoS technology is developed under this background. QoS is quality of service, and its purpose is to provide end-to-end service quality assurance for various business needs. QoS is a tool for effectively utilizing network resources. It allows different traffic flows to compete for network resources unequally. Voice, video, and important data applications can be prioritized in network equipment.

Port Priority

On this page, the user can enable/disable port priority for each interface (port/LAG), supported modes are (CoS, DSCP, CoS-DSCP, or IP-Precedence).

Please navigate to Web UI → QoS → Port Priority page.

Then the user can click on the “Edit” button for further configuration per Port/LAG.

QoS Port Priority

Priority Mapping

Priority mapping is used to realize the conversion between the QoS priority carried in the packet and the internal priority of the device ( also known as the local priority, which is the priority used by the device to differentiate the service level of the packet ) so that the device provides the Differentiated QoS service quality. Users can use different QoS priority fields in different networks according to network planning.

• CoS Mapping

Shows the mapping relationship between queues and CoS remarking priorities.

• DSCP Mapping

Shows the mapping relationship between DSCP values and queue priorities.

• IP Mapping

Shows the mapping relationship between IP priority and queue.

Queue Scheduling

When congestion occurs in the network, the device will determine the processing order of forwarding packets according to the specified scheduling policy, so that high-priority packets are preferentially scheduled.

Queue scheduling algorithm: queue scheduling according to the switch interface.

• Strict priority (SP, Strict Priority) scheduling: The flow with the highest priority is served first, and the flow with the second highest priority is served until there is no flow at that priority. Each interface of the switch supports 8 queues ( queues 0-7 ), queue 7 is the highest priority queue, and queue 0 is the lowest priority queue. Disadvantage: When congestion occurs, if there are packets in the high-priority queue for a long time, the packets in the low-priority queue cannot be scheduled, and data cannot be transmitted.
• Weighted Round Robin (WRR, Weighted Round Robin) scheduling: each priority queue is allocated a certain bandwidth, and provides services for each priority queue according to the priority from high to low. When the high-priority queue has used up all the allocated bandwidth, it is automatically switched to the next priority queue to serve it.
• Weighted Fair Queuing (WFQ): Based on ensuring fairness ( bandwidth, delay) as much as possible, priority considerations are added, so that high-priority packets have more opportunities for priority scheduling than low-priority packets. WFQ can automatically classify flows by their “session” information (protocol type, source and destination IP addresses, source and destination TCP or UDP ports, priority bits in the ToS field, etc.) Place each flow evenly into different queues, thus balancing the latency of the individual flows as a whole. When dequeuing, WFQ allocates the bandwidth that each flow should occupy at the egress according to the flow priority (Precedence). The smaller the priority value is, the less bandwidth is obtained; otherwise, the more bandwidth is obtained.
• SP-WRR: the switch schedules packets in the SP scheduling group preferentially, and when the SP scheduling group is empty, schedules the packets in the WRR scheduling group. Queues in the SP scheduling group are scheduled with the SP queue scheduling algorithm. Queues in the WRR scheduling group are scheduled with WRR.
• SP-WFQ: the switch schedules packets of queues in the WFQ group based on their minimum guaranteed bandwidth settings, then uses SP queuing to schedule the queues in the SP scheduling group, then uses WFQ to schedule the queues in the WFQ scheduling group in a round robin fashion according to their weights.

Queue Shaping

When the packet sending rate is higher than the receiving rate, or the interface rate of the downstream device is lower than the interface rate of the upstream device, network congestion may occur. If the size of the service traffic sent by users is not limited, the continuous burst of service data from a large number of users will make the network more congested. To make the limited network resources serve users more effectively, it is necessary to restrict the service flow of users.

To configure a port, click on the “Edit” icon under the operation column.

Maximum Rate/CIR (Kbps): Configures the maximum rate of shaping. The value must be an integer between 16-1000000 Kbps and must be multiple of 16. By default, it’s the port rate.

Rate Limit

The interface rate limit controls the total traffic sent or received on a port through a token bucket. When the configured rate is non-zero, excess packets can be dropped and the dropped-packet counter can be reviewed in Statistics. When the rate is set to zero, select whether matching traffic is dropped or the port enters an err-disabled state.

To configure Rate Limit, please navigate to Web UI → QoS → Rate Limit.

To configure a port, click on the “Edit” icon under the operation column, then set the CIR and CBS for both Ingress and Egress.

CIR (Committed Information Rate): the guaranteed average transmission rate or the minimum guaranteed traffic delivered in the network.

CBS (Committed Burst Size): the average volume of burst traffic that can pass through an interface.

SECURITY

GWN780x Pro Switches series supports many tools and features to enhance the security of the device against misconfiguration or attacks.

Storm Control

Traffic suppression can limit the rate of broadcast, unknown multicast, unknown unicast, known multicast, and known unicast packets by configuring thresholds, preventing broadcast, unknown multicast packets, and unknown unicast packets from generating broadcast storms. Large traffic impact of known multicast packets and known unicast packets.

Storm control can block the traffic of broadcast, unknown multicast, and unknown unicast packets by blocking packets or shutting down ports. The device supports storm control for the above three types of packets on the interface according to the packet rate, byte rate, and percentage. During a detection interval, the device monitors the average rate of three types of packets received on the interface and compares it with the configured maximum threshold. When the packet rate is greater than the configured maximum threshold, the device performs storm control on the interface and executes the configured storm control actions. Storm control actions include dropping packets or shutting down interfaces.

• If packets are blocked, when the average rate of receiving packets on the interface is less than the specified minimum threshold, storm control will release the blocking of the packets on the interface.
• If the action is to shut down / shutdown the interface, you need to manually run the command to bring up the interface, or enable the interface state to automatically return to UP. It’s also possible to use the Auto Recovery function to bring up the interface automatically.

Storm Control

Port Security

By converting the MAC address learned by the interface into secure MAC addresses (including secure dynamic MAC addresses, secure static MAC addresses, and Sticky MAC), port security prevents illegal users from communicating with the switch through this interface, thereby enhancing the security of the device.

Security MAC addresses are divided into: Secure Dynamic MAC, Secure Static MAC, and Sticky MAC.

Secure MAC Address Types

Port Isolation

Port Isolation separates interfaces within the same VLAN. Select Layer 2 isolated, Layer 3 communication to block Layer 2 forwarding while retaining Layer 3 communication, or select Both Layer 2 and Layer 3 are isolated. For each interface, Unidirectional Isolation prevents it from sending to the selected isolated interface, while Bidirectional Isolation prevents either interface from sending to the other.

ACL

An Access Control List (ACL) contains packet-matching rules and the actions applied when those rules match. ACL advanced statistics include the current statistics rate and manual refresh, while CLI output also reports ACL resource utilization.

IPv4/IPv6 ACL

To add an IPv4 or IPv6 ACL rule, navigate to Security → ACL → IPv4 tab or IPv6 tab, then click on the “Add” button to add an IPv4/IPv6-based ACL rule.

The rules action can be defined in one of the four ways below:

• Drop: This action denies or blocks traffic that matches the specified ACL rule, which prevents the packet from being forwarded through the network.
• Allow: This action permits traffic that matches the ACL rule, allowing the packet to pass through and continue to its destination.
• Shut Down: This action disables the interface or port that the traffic is passing through if the ACL rule is triggered, effectively stopping all traffic on that interface.
• Redirect to Interface: This action forwards the traffic matching the ACL rule to a different interface than it was originally destined for, often used for traffic monitoring, load balancing, or security purposes.

Configuring an ACL-based RSPAN

To perform an ACL-based RSPAN, please follow the steps below:

• Select an image group in ACL Image

• Then, under ACL →VLAN Binding ACL, select the corresponding port/VLAN binding ACL.

• Then go to Diagnostics → Mirroring → Setup Mirroring Group. If you select RSPAN, you can only use it as a source switch, and you need to set the output port and remote VLAN.

MAC ACL

To add an ACL based on the MAC address, on the MAC ACL tab, click on the “Add” button to add an ACL rule, then configure the Source MAC Address and the Destination MAC Address accordingly. Please refer to the figure below:

Port Binding to ACL

ACL Binding lets the user bind a MAC ACL or an IP ACL to certain GE/LAG ports.

To apply IP/MAC ACL rules on multiple ports, select the ports first, then click on the “Edit” button, and then select the IP and MAC ACL rule from the drop-down list.

To apply the ACL rule on a specific port, click on the “Edit icon” on the right side of the page, as shown below:

VLAN Binding to ACL

On this page, the users can bind the IP/MAC ACL rule to a VLAN(s), to apply the ACL rules to multiple VLANs. First, check the VLANs from the list, then click on the “Edit” button, select the ACL rule from the drop-down list under IP/MAC ACL.

For example, if the IP/MAC ACL rule is configured with a rate limit and then bound to a VLAN, the bandwidth limit will be applied to the specified VLAN.

Refer to the figure below:

Rate Limit Settings

ACL Rate Limit Settings provides 128 reusable rate-limit groups. For each group, select a packet- or byte-based Rate Limit Type, then configure the Burst Threshold and Rate Threshold. The group is referenced by the applicable ACL rule; this page defines the thresholds rather than a separate drop or error-disable action.

The users can configure up to 128 groups by clicking on the “Edit icon” under the operation column.

• Click on the “Edit icon” under the Operation column to configure a group.
• Select the Rate Limit Type to determine if the limit will be by packet or byte.
• Specify the Burst Packet/Byte, which sets the maximum number of packets or bytes allowed to be sent in a burst.
• Set the Rate Threshold, which defines the maximum rate of packets or bytes per second.

IP Source Guard

IP source guard is a source IP address filtering technology based on the Layer 2 interface. It can prevent malicious hosts from forging IP addresses of legitimate hosts to impersonate legitimate hosts, and also ensure that unauthorized hosts cannot access by specifying their IP addresses. network or attack the network. IPSG uses the binding table (source IP address, source MAC address, VLAN to which it belongs, and the binding of the inbound interface ) to match and check the IP packets received on the Layer 2 interface. Only the packets matching the binding table are allowed to pass through.

To enable IP Source Guard, first navigate to the Security → IP Source Guard page, then select the port and click on “Edit” to configure the port.

Then, select the Verification Type where either the verification will be based on IP addresses or both IP and MAC addresses. Max Entries limits the number of IP/MAC addresses (e.g., devices), where 0 indicates no limit.

This page displays the dynamic binding (port, IP, MAC, VLAN) generated when DHCP Snooping is enabled on the GWN780x Pro switches. Also, the user can add static binding by clicking on the “Add” button, as shown below:

To import or export the list, click on the import or export button, respectively.

The binding requires specifying the port, IP Address and its mask, MAC address and its mask, and the VLAN ID. This information will be used to verify the traffic and ensure that all the traffic is generated by legitimate users.

IPv6 Source Guard

IPv6 Source Guard is similar to IP Source Guard (based on IPv4); the only difference is that IPv6 Source Guard filters IPv6 addresses.

To enable IPv6 Source Guard on a port, select the port and click on the “Edit” button under the operation column, then select the Verification Type and specify the Max Entries.

On this tab, the user can see the list of bindings, both static and dynamic (DHCP Snooping must be enabled).

To add a static entry, click on the “Add” button. It’s also possible to import or export the list as shown below:

Specify the binding (port, IP address, MAC Address, and VLAN), then click on the “OK” button to save.

Anti Attack

In the network, there are a large number of malicious attack packets targeting the CPU and various types of packets that need to be normally sent to the CPU. Malicious attack packets targeting the CPU will cause the CPU to be busy processing attack packets for a long time, thereby causing interruption of other services or even system interruption; a large number of normal packets will also lead to high CPU usage and performance degradation, thus affecting normal business.

In order to protect the CPU and ensure that the CPU can process and respond to normal services, the switch provides a local attack defense function, which is aimed at the packets sent to the CPU. It operates normally to avoid the mutual influence of various services when the device is attacked.

Attack defense is an important network security feature. It analyzes the content and behavior of the packets sent to the CPU for processing, determines whether the packets have attack characteristics, and configures certain preventive measures against the packets with attack characteristics. Defense attacks are mainly divided into malformed packet attack defense, fragmented packet attack defense, and flood attack defense.

Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) helps protect a Layer 2 network from forged ARP messages. For ARP traffic on VLANs where DAI is enabled, the switch compares the packet’s IP address, MAC address, receiving interface, and VLAN information with the binding table. Packets that pass the configured checks are forwarded; packets that fail are discarded and counted in DAI Statistics.

DAI Settings

Navigate to Security → DAI. On the DAI tab, enable the feature and enter the VLANs that require inspection. The example below demonstrates individual VLAN 100 and VLAN range 200–202 and shows the current per-port inspection status.

DAI Port Settings

Select one or more interfaces and click Edit, or use the edit icon under Operation for a single interface. Configure trust mode, the required MAC and IP checks, and an optional inspection rate. Enabling IP Address Verification also displays the All-Zero Address policy. The example below shows all three verification checks enabled, all-zero addresses forbidden, and a 10 pps rate with the Drop action.

DAI Statistics

The Statistics tab reports forwarded packets, each verification-failure category, IP-to-MAC binding failures, and packets dropped by the configured rate limit for every physical or LAG interface. Click Refresh to retrieve the current counters. Select one or more interfaces and click Clear, or use the per-row operation, to reset the applicable counters.

RADIUS

RADIUS centralizes authentication, authorization, and accounting. A named server group can contain multiple authentication servers and multiple accounting servers, allowing the group to be reused by AAA or Identity Authentication Management.

Under Security → RADIUS, click Add and name the group. Add the required entries on the Authentication Server and Accounting Server tabs. Use Add within either tab for additional servers, then select the group in the service that will use it.

RADIUS Server Group Settings

Field	Description
Name	Identifies the server group. Use a descriptive name so it can be recognized when selected in AAA or Identity Authentication Management.
RADIUS Authentication Server / RADIUS Accounting Server	Specifies the server address for the selected tab. Configure authentication and accounting destinations separately.
Port	Sets the destination UDP port. The initial values are 1812 for authentication and 1813 for accounting.
Priority	Sets the server’s configured priority within its group. Use the intended priority consistently across the servers.
Shared Key	Enter the secret configured for this switch on the RADIUS server. The values must match; keep the secret confidential.
Maximum Transmission Count	Sets the transmission limit for a request. Range: 1–5; initial value: 3.
Timeout (s)	Sets the wait for a server response. Range: 1–120 seconds; initial value: 5.

TACACS+

TACACS+ centralizes management authentication, authorization, and accounting. Configure named server groups under Security → TACACS+, then reference the required groups in AAA methods.

Click Add, name the group, and enter its server settings. Use Add inside the group to define additional servers before confirming the group.

TACACS+ Server Group Settings

Field	Description
Name	Identifies the server group when selecting it in AAA.
TACACS+ Server Address	Specifies the server that processes the TACACS+ requests.
Port	Sets the destination TCP port. The initial value is 49.
Priority	Sets the server’s configured priority within the group.
Shared Key	Enter the secret configured for this switch on the TACACS+ server. Keep the secret confidential.
Timeout (s)	Sets the wait for a server response. Range: 1–30 seconds; initial value: 5.

For command syntax and CLI-only credential formats, refer to the GWN78xx CLI User Guide.

AAA

Authentication, Authorization, and Accounting (AAA) controls who can sign in, which actions they may perform, and how their activity is recorded. Configure RADIUS or TACACS+ server groups first when using external servers, then create the corresponding AAA methods under Security → AAA.

Use the Login Authentication, Session Authorization, and Session Accounting tabs for the respective service. Add a named method, configure its ordered Method 1 through Method 4 entries, and assign the method to the required management access type.

Warning: An unreachable server or an incorrect authorization method can prevent management access. Verify the server settings and preserve a working recovery access method before applying AAA changes. The UI specifically warns that methods other than Local and None may make the device inaccessible.

AAA Method and Service Settings

Field	Description
Name	Identifies the method list used for a management access type.
Method 1–4	Defines the ordered methods. Choose the supported local option or a configured RADIUS/TACACS+ group. Empty leaves a subsequent position unused. None means the corresponding check or accounting service is not performed; it is not equivalent to local authentication.
Console / Telnet / SSH / HTTPS	Assigns the method for each access type. HTTPS appears for login authentication and session authorization, not session accounting.
Accounting Mode	For session accounting, select Start&End, End Only, or None according to the records required by the accounting server.
Real-time Accounting Interval (s)	Controls periodic session-accounting updates. A value of 0 disables periodic updates; it does not select the session start/end accounting mode.

AAA Support by Management Access Type

Access type	Login authentication	Session authorization	Command authorization	Session accounting	Command accounting
Console / Telnet / SSH	Yes	Yes	Yes	Yes	Yes
HTTPS	Yes	Yes	No	No	No

Command authorization and command accounting apply to command-line management sessions. Refer to the GWN78xx CLI User Guide for the general command reference. Command authorization and accounting configuration should follow the commands supported by the installed firmware.

Identity Authentication Management

The Identity Authentication Management feature on Grandstream GWN switches provides a robust method for securing network access through 802.1X and MAC-based authentication. It allows administrators to configure and manage user authentication settings, ensuring only authorized devices can connect to the network, thereby enhancing overall network security and control.

The 802.1X protocol is a port-based network access control protocol. Port-based network access control refers to verifying user identities and controlling their access rights at the port level of LAN access devices. The 802.1X protocol is a Layer 2 protocol and does not need to reach Layer 3. It does not require high overall performance of the access device, which can effectively reduce network construction costs. Authentication packets and data packets are separated by logical interfaces to improve security.

Port Mode

To enable 802.1x and MAC authentication, please navigate to Security → Identity Authentication Management, then Toggle on “802.1X Authentication” and “MAC Authentication“, and click on the “OK” button to save.

On this page, you can specify a user ID format for MAC-based and enable a Guest VLAN. This ensures these devices remain isolated from the main network while still maintaining limited network connectivity through the Guest VLAN. The Guest VLAN ID directs unauthenticated users to a designated network segment, providing controlled and secure access.

To enable it on a port, select port(s) from the list, then click on the “Edit” button or click on the “Edit icon” on the right side under the operation column.

Note: a RADIUS server must first be added under Security → RADIUS.

Port Mode – Edit port

Port

On this tab, the users can enable on which ports the authentication will take effect, select the port(s), and then click on the “Edit” button or icon to configure the port(s) as shown below:

To enable the authentication on the port(s), under Port Control (Disable, Force authentication, Force unauthentication, Auto) select Auto or Force authentication and then save the configuration.

Example of 802.1X configuration on GXV3480 IP Video phone.

Authentication Sessions

On this tab, the authenticated devices will be listed here with more details. Please refer to the figures below:

There are three status (Authorized, Locked, Guest):

Local User of a MAC-based

Local User of MAC-based manages devices by MAC address for local MAC authentication. Click Add to enter a unicast MAC address, an optional Name, the required port-control mode, VLAN, reauthentication time, and inactive time. Click Import to add entries in bulk.

DHCP Snooping

DHCP snooping ensures that DHCP clients obtain IP addresses from legitimate DHCP servers and records the correspondence between IP addresses and MAC addresses of DHCP clients to prevent DHCP attacks on the network.

In order to ensure the security of network communication services, the DHCP Snooping technology is introduced, and a firewall is established between the DHCP Client and the DHCP Server to defend against various attacks against DHCP in the network.

When the device reboots, the dynamic binding table for the IP source guard is automatically restored.

Note: Associated with the “Entries Fixed for DHCPv6 Snooping” option of DHCPv6 Snooping.

Users can configure fixed entries for DHCP Snooping, ensuring that when the device reboots, the dynamic binding table for IP source guard is automatically restored after a fixed duration defined in seconds. Note that this is linked to the ‘Entries Fixed for DHCPv6 Snooping’ option in DHCPv6 Snooping.

To enable the DHCP Snooping feature on GWN780x Pro switches, navigate to Security → DHCP Snooping, then enable DHCP Snooping. To enable DHCP snooping on a VLAN, specify the VLANs or a VLAN range, for example, 5-8 means VLANs from 5 to 8, and click the “OK” button to save. Please refer to the figure below:

DHCP Snooping Option 82

Option 82 is called the relay agent information option and is inserted by the DHCP relay agent when forwarding client-originated DHCP packets to a DHCP server.

To identify the device accessed by the client, the user specifies the Remote ID. The format can be either Normal (standard) or Private:

• Normal Format: is generally used when interoperability between different vendors’ equipment is required. For GWN780x Pro switches, by default, the MAC Address of the switch will be used, but any other characters in the range of 1-63 can be used.
• Private Format: is specific to the vendor’s ecosystem and may not be compatible with other vendors’ equipment (check the vendor-specific format).

Option 82 is used to identify both the Circuit ID and Remote ID of the specific port. This can be used to identify the VLAN, interface, and other information where the client is located. To define this information, go to DHCP Snooping → Option 82, choose a specific port:

Then, select a port, VLAN, and Format, and specify the Circuit ID and Remote ID:

DHCP Snooping Port Settings

On this page, the user can configure the trusted port(s) that will allow DHCP messages; all other ports that are not trusted will discard the DHCP messages. This way, GWN780x Pro will protect users from rogue DHCP servers that are plugged into untrusted ports.

To configure a port(s), either select the port(s) and click on the “Edit” button or click on the “Edit icon” under the operation column, as seen below:

To make a port trusted, Toggle ON Trust Mode. More security parameters can be enabled, too, like Chaddr Verification, Rate (pps = packet per seconds) to limit the number of DHCP packets, and enable Option 82 for this port with three modes (keep, drop, replace). Please refer to the figure below:

DHCP Snooping Statistics

This page displays all statistics recorded by the DHCP snooping function, including Forwarding packets, Untrusted Port Drops, etc.

To clear the statistics, select the ports and click on the “Clear” button as shown below:

DHCPv6 Snooping

DHCPv6 snooping is a security feature in IPv6 networks that safeguards against unauthorized DHCPv6 server messages and controls IPv6 address assignments, similar to how DHCPv4 snooping operates in IPv4 networks.

To enable the DHCPv6 Snooping feature on GWN780x Pro switches, navigate to Security → DHCPv6 Snooping, then enable DHCPv6 Snooping. To make the DHCPv6 snooping enabled on a VLAN, specify the VLANs or a VLAN range, for example, 5-8, which means VLANs from 5 to 8, and click the “OK” button to save. Please refer to the figure below:

DHCPv6 Snooping Option 18

On this page, the user can configure the Remote ID (Option 37). By default, GWN780x Pro switches use the GWN780x Pro switches’ MAC Address.

The DHCPv6 Relay-Option, encompassing Option 18 and Option 37, enables a DHCPv6 relay agent to embed circuit-specific and remote information as a TLV (type-length-value) within the relay message sent to the DHCPv6 server. In this scenario, the managed device functions as a DHCPv6 relay agent.

To add option 18 for a port, click on the “Add” button as shown below:

Then, select the port, Format (Standard, Extended). When the Standard format is selected, the user can select the VLAN, and if the Extended Format is selected, the user can interface ID (3~63 characters), click on “OK” to save.

DHCPv6 Snooping Port Settings

On this page, the user can configure the trusted port(s) that will allow DHCP messages; all other ports that are not trusted will discard the DHCP messages. This way, GWN780x Pro will protect users from rogue DHCP servers that are plugged into untrusted ports.

To configure a port(s), either select the port(s) and click on the “Edit” button or click on the “Edit icon” under the operation column, as seen below:

To make a port trusted, Toggle ON Trust Mode. More security parameters can be enabled too, like Rate (pps = packets per second) to limit the number of DHCPv6 packets, and enable Option 18 and 37 for this port with three modes (keep, drop, replace). Please refer to the figure below:

DHCPv6 Snooping Statistics

This page displays all statistics recorded by the DHCPv6 snooping function, including Forwarding packets, Untrusted Port Drops, etc.

To clear the statistics, select the ports and click on the “Clear” button as shown below:

ND Snooping

ND Snooping validates IPv6 Neighbor Discovery traffic and builds legitimate IPv6 address-to-port bindings. These bindings can be used by IPv6 Source Guard and related inspection functions to reduce address spoofing and gateway impersonation. Navigate to Security → ND Snooping.

ND Snooping Global Settings

Enable ND Snooping, select the Global Unicast Address and/or Link-Local Address type, and specify the VLANs to inspect. Scheduled Detection adds configurable detection-count and detection-interval controls; the waiting interval and lifetime are configured independently.

ND Snooping Port Settings

To configure a physical or LAG interface, select the port and click Edit, or use its edit icon under Operation. Enable Trust Mode only on controlled upstream links that legitimately carry trusted Neighbor Discovery traffic. When validation is required, enable Validation Check and select the applicable NA (Neighbor Advertisement), NS (Neighbor Solicitation), and/or RS (Router Solicitation) packet types.

Prefix Management

Click Add to create a static prefix entry, then enter its IPv6 address, prefix length from 1 to 128, and VLAN ID from 1 to 4094. Learned entries appear as Dynamic; select a dynamic entry and click Solidify to convert it to Static. Static entries can be edited, while dynamic entries must be solidified first.

ND Snooping Statistics

Statistics show each port’s total received Neighbor Discovery packets; received NS, NA, RS, RA, and other packets; transmitted NS packets; and discarded packets. Click Refresh to update the counters, or select the required ports and click Clear to reset their statistics.

MAINTENANCE

Upgrade

GWN780x Pro Switches support manual upload firmware upgrade via a BIN file that can be downloaded from the Grandstream Firmware page: https://www.grandstream.com/support/firmware.

Upgrading via network is also possible using 5 of these protocols:

• TFTP
• HTTP
• HTTPS
• FTP
• Explicit FTPS

Once the protocol is selected, the user needs to specify the firmware Server Path (For example: firmware.grandstream.com).

Diagnostics

Diagnostics includes Logs, Ping, Ping Watchdog, Traceroute, Mirroring, Fiber Module, Copper Test, One-click Debugging, Capture, Remote Support, and management-platform connection diagnostics.

Logs

This page lists all the generated Logs with the details level and the generated time, also an option to export the list is available.

Adding a Log Server Address to the logs to be sent to is also supported on the GWN780x Pro Switches.

Users can configure the following elements in the logs settings:

• Minimum log level: This defines the lowest severity of events that will be logged. “Debug” means all messages, including detailed diagnostic information, will be recorded. Other log levels (e.g., Info, Warning, Error) would filter out lower-priority messages.
• Log Aggregation: This option allows you to merge multiple logs from various sources or components into a centralized location for easier monitoring, analysis, and management.
• Timeout: This setting defines the time, in seconds, before the logging operation times out. In the example shown, the timeout is set to 60 seconds. The valid range for the timeout is between 15 and 3600 seconds.

Ping

The user on this page can enter the IP Address or Hostname, then click “Start”, and the results of the ping command will be shown below.

Ping Watchdog

Ping Watchdog is a feature designed to monitor the connectivity of a device by continuously pinging a specified IP address. If the device becomes unresponsive to pings, then corrective actions can be triggered based on the configuration settings.

Port: Specifies the port on the device that will be monitored or managed by Ping Watchdog.

Enable: Toggles the Ping Watchdog feature on or off for the selected port.

IP Address: The target IP address to which the device will send ping requests.

Packet Sending Interval (s): Defines how frequently (in seconds) ping packets are sent to the specified IP address.

Delay Time (s): This sets a delay before the Ping Watchdog starts monitoring the device after it’s enabled or after a reboot.

Retry Times: Specifies how many failed ping attempts are allowed before the watchdog takes action.

Shutdown Interval (s): The time period (in seconds) for which the monitored PoE port will remain shut down after failing the ping test and triggering the shutdown action.

Traceroute

Another tool is Traceroute, which shows the number of hops, and GWN780x Pro Switches enable the user to run Traceroute commands right from the Switches’ WEB UI.

Mirroring

Mirroring refers to copying the packets from the specified source to the destination port. The specified source is called the mirroring source, the destination port is called the observing port, and the copied packet is called the mirroring packet.

Mirroring can make a copy of the original packet without affecting the normal processing of the original packet by the device, and send it to the monitoring device through the observation port to determine whether the service running on the network is normal.

The GWN780x Pro switches support two modes of Port Mirroring: SPAN and RSPAN:

• SPAN (Local): Traffic is mirrored locally within the same switch.
• RSPAN (Remote): Traffic is mirrored remotely across a network using a Remote VLAN.

SPAN

The traffic mirroring occurs locally within the same switch. SPAN allows you to capture traffic from one or more ports and send a copy of it to another port, typically connected to a network analyzer or monitoring tool.

• Ingress Mirroring: Captures incoming traffic on the source port(s).
• Egress Mirroring: Captures outgoing traffic from the source port(s).
• Source Port: Where the traffic originates (the port being monitored).
• Tx/Rx Regular Data Messages: defines what type of traffic (transmit, receive, or both) is monitored on the destination switch.

RSPAN

RSPAN (Remote Switched Port Analyzer) allows traffic to be mirrored from one switch to another over a network. Unlike SPAN, which is limited to mirroring traffic locally within the same switch, RSPAN uses a Remote VLAN to transport mirrored traffic across multiple switches, enabling centralized monitoring.

Source Switch Role (RSPAN)

• Ingress Mirroring: This captures incoming traffic on the specified source port(s). It mirrors the packets received by the port before they are processed by the switch, forwarding them to the designated destination for monitoring or analysis.
• Egress Mirroring: This captures outgoing traffic from the specified source port(s). It mirrors the packets leaving the port after the switch processes them, forwarding these packets to the monitoring destination.
• Output Port: This is the port on the source switch where the mirrored traffic is sent. In SPAN, it’s usually a local port that connects to the monitoring device, but in RSPAN, this traffic is forwarded across a network using the Remote VLAN to the destination switch.
• Remote VLAN: This is the VLAN used to transport mirrored traffic between the source switch and the destination switch in an RSPAN configuration. The source switch forwards mirrored traffic to this VLAN, which allows it to be sent across the network to the destination switch for analysis.

Destination Switch Role (RSPAN)

• Source Port: This is the remote VLAN where the mirrored traffic from the source switch arrives. The destination switch receives the mirrored packets via this VLAN and forwards them to the appropriate monitoring port.
• Monitor Port TX/RX: This defines what type of traffic (transmit, receive, or both) is monitored on the destination switch.
• Remote VLAN: The VLAN used to receive mirrored traffic from the source switch. It’s the same VLAN that the source switch uses to forward the mirrored traffic over the network to the destination switch.

Fiber Module

This page provides the user with information about the fiber module for each Port that supports it. Select the port from the drop-down list and click the refresh icon.

Note: The information displayed on the optical module of each manufacturer is different.

Copper Test

Copper test can detect whether the cable connected to the switch is faulty and the location of the fault. Using this function can assist in the daily engineering installation diagnosis .

Please navigate to Web UI → Maintenance → Diagnostics page → Copper Test Tab.

To perform the test simply click on the port, please refer to the figure below:

After the detection, the cable detection result is displayed as follows:

Cable Status: OK (normal), Open (open circuit), Short (short circuit ), Crosstalk (crosstalk), Unknown (unknown).

Cable Length:

• When there is a fault, it is the length from the port to the fault location.
• When there is no fault, it is the actual length of the cable.

One-click Debugging

On GWN780x Pro switches, the One-click debugging feature can help administrators or tech support to quickly and easily get debugging information about the GWN switch in a matter of a few minutes.

Please navigate to Web UI → Maintenance → Diagnostics page → One-click Debugging tab, then click on the “Debug” button to start the debugging process.

It’s also possible to delete the generated file or download it locally to share it with tech support for example. The folder contains many log files and even a tech-support file that contains valuable information like the switch configuration, etc.

Capture

Capture records packets that match the selected criteria. Choose Local PC or a TFTP server as the destination, set the capture duration, select the PCAP or TAR output, and optionally filter by VLAN, source or destination MAC address, and the selected switch port.

Remote Support

Remote Support temporarily authorizes Grandstream to access diagnostic data, logs, and configuration information for troubleshooting. Open Maintenance → Diagnostics → Remote Support, enter the administrator password, and use Remote Support only when working with an authorized support engineer.

Security: Remote sessions are encrypted. The feature automatically disables 48 hours after enablement. Enable it only for a support session that you have authorized.

Management Platform Connection Diagnostics

This page shows the current connection state for the selected configured management platform.

Navigate to Maintenance → Diagnostics → Management Platform Connection Diagnostics. Select the available Management Platform, check its Connected Status, and click View Log to inspect the connection log.

sFlow

sFlow samples traffic and exports flow and counter records to a collector for real-time visibility and performance analysis.

sFlow Global Settings

Use Global Settings to connect the switch to an sFlow collector. The switch acts as the sFlow agent: it identifies itself with an agent address and exports sampled traffic and counter data to the collector, where monitoring software stores and analyzes the information. Configure which ports provide samples separately under Interface Settings.

Interface Settings

Use Interface Settings to choose which ports contribute monitoring data. Flow Sampling exports samples of packet headers from ingress traffic, egress traffic, or both directions. Counter Sampling periodically exports interface counters. Enable either sampling method independently according to the information required by the collector.

Backup and Restore

Backup & Restore supports manual backup and restore, factory reset, and automatic backup of the running configuration. Enable Scheduled Backup and set the Backup Time for recurring backups. In the backup list, enable Restore Configuration on Reboot for the configuration file that the switch should load during the next reboot.

SNMP

Simple Network Management Protocol (SNMP) lets a network management system monitor the switch, retrieve operational data, and receive event notifications. The switch is the managed device, its SNMP agent exposes management information, and the network management station (NMS) queries that information and receives traps.

Navigate to Maintenance → SNMP, enable the service, and select the SNMP versions required by the NMS. Configure the engine IDs, then define the views, access groups, communities or SNMPv3 users, notification destinations, and trap events required by the monitoring design.

Field	Description
SNMP	Enables or disables the switch’s SNMP agent.
SNMP Version	Selects SNMPv1/SNMPv2c, SNMPv3, or both according to the versions supported by the NMS.
Local Engine ID	Identifies the switch’s local SNMP engine. The displayed fixed prefix is followed by an editable suffix of 2–56 hexadecimal characters; the suffix must contain an even number of characters. Use Reset to restore the initial value.
Remote Engine ID	Identifies the remote SNMP engine associated with the server. Enter 10–64 hexadecimal characters with an even number of characters.
Server Address	Specifies the server associated with the remote engine ID.

View Management

A view defines which parts of the Management Information Base (MIB) a manager can access. Click Add, name the view, and configure a Type and OID Subtree pair. Use Add within Type & OID Subtree to include multiple pairs in the same view; each pair includes or excludes the specified subtree. Assign the view to the appropriate access group or community.

Group Management

This page allows the network administrator to group SNMP users and assign different authorization and access privileges.

Community Management

This page allows a user to add/remove multiple communities of SNMP.

SNMP User Management

SNMP User Management configures SNMPv3 identities. Select the user’s group and configure authentication and privacy to match the network management system. For a group using authentication and privacy (AuthPri), choose the authentication mode and password, then select DES or AES under Encryption Mode and enter the encryption password. SNMPv3 must be enabled in Global Settings.

Notification Management

This page allows a user to configure a host to receive SNMPv1/v2/v3 notifications.

Trap Event

Trap Event selects the conditions reported to an SNMP manager. Enable only the events required by the monitoring system.

• Authentication Failed: reports an unauthorized login attempt.
• Port Up/Down: reports a port link-state change.
• Cold Start/Warm Start: reports a restart.
• STP Bridge and CPU: report the corresponding spanning-tree and CPU events.
• Monitor: reports configured monitor events.
• Port ErrDisable: reports a port entering an error-disabled state.
• MAC Address Notification: reports configured MAC-address events.
• Port Security: reports Port Security events.
• PoE Power Supply: reports PoE power events.
• Logs: reports configured log events.
• VLAN Creation/Deletion: reports VLAN configuration changes.
• Configuration Distribution: reports configuration-distribution events.
• ARP Notification: reports configured ARP events.
• Fiber Module Alert: reports optical-module threshold events.

RMON

RMON (Remote Monitoring), based on the SNMP (Simple Network Management Protocol) architecture, functions to monitor the network. RMON is currently a commonly used network management standard defined by the Internet Engineering Task Force (IETF), which is mainly used to monitor the data traffic across a network segment or even the entire network to enable the network administrator to take protective measures in time to avoid any network malfunction. In addition, RMON MIB records network statistics information on network performance and malfunction periodically, based on which the management station can monitor the network at any time effectively. RMON is helpful for network administrators to manage large-scale networks since it reduces the communication traffic between the management station and the managed agent.

RMON Statistics

Ethernet statistics function ( corresponding to the statistics group in the RMON MIB): The system collects basic statistics of each network being monitored. The system will continuously count the traffic of a certain network segment and the distribution of various types of packets, the number of error frames of various types, the number of collisions, etc. The number of data packets, the number of broadcast and multicast packets, the number of received bytes, the number of received packets, etc.

RMON History

The system will periodically collect statistics on various traffic information, including bandwidth utilization, number of error packets, and total number of packets based on the History ID.

Click on the “Add” button to create a History ID specifying the Port as well.

RMON Event

The event group controls the events and prompts from the device and provides all events generated by the RMON Agent. When an event occurs, it can record logs or send a Trap to the network management station.

RMON Alarm

The system monitors the specified alarm variable. After pre-defining a set of thresholds and sampling time for the specified alarm, the system will obtain the value of the specified alarm variable according to the defined time period. When the value of the alarm variable is greater than or equal to the upper threshold, an upper alarm event will be triggered. When the value of the alarm variable is less than or equal to the lower threshold, a lower alarm event is triggered.

LLDP/LLDP MED

LLDP/LLDP MED is a one-way protocol; there are no request/response sequences. Information is
advertised by stations implementing the transmit function, and is received and processed by
stations implementing the receive function.

LLDP MED is an enhancement to LLDP that provides additional functionality to support media devices. LLDP MED features include: enabling network policy advertisement and discovery for real-time applications (such as voice and/or video);

LLDP Global Settings

This page allows a user to set general settings for LLDP, including enabling LLDP and other parameters.

More configurations can be adjusted per port (GE1 to GE10).

LLDP MED Network Policy

This page allows the network administrator to set the MED (Media Endpoint Discovery) network
policy. Click on the “Add” button to add a Network Policy or toggle ON Auto Voice Network Policy (Voice VLAN has to be configured as well).

To add a Network Policy, click on the “Add” button or click on the “Edit” icon under the Operation column to edit.

LLDP MED Port Settings

The user can configure LLDP MED Settings for each port on this page.

LLDP Device Info

This page displays information for the LLDP Local Device connected to each port. Click on the port to view related LLDP information about that port. The information includes: Basic Info, IEEE 802.1 TLVs information, IEEE 802.3 TLVs (802.3 bt) information, MED Details, Network Policy…

Neighbor Info

This page lists the neighbors obtained on the switch ports. Click on the “Refresh” button to update the list.

LLDP Statistics

View the LLDP statistics of the local device through this feature. Click on “Refresh” to update the list.

Energy Efficient Ethernet

EEE or Energy Efficient Ethernet helps in reducing the power consumption on interfaces like GWN780x Pro switches Ethernet port, it achieves this by using power only during data transmission.

Navigate to Maintenance → Energy Saving Management, select a port to edit, then enable 802.3 EEE.

• Configuration Status: shows if the configuration is enabled.
• Status: if a supported device is connected to the GWN780x Pro switch, it will show if it’s enabled or not.

To enable EEE on a port, select a port, then click on the “Edit” button, then toggle ON 802.3 EEE as shown below:

Alert

Alert settings monitor hardware and service conditions such as CPU and memory usage, PoE power, MAC-address limits, temperature, fan and PoE-chip faults, ARP-limit conditions, and fiber-module events.

Alert Settings

For each supported condition, enable or disable monitoring, select the log level, and configure the alert and recovery thresholds and their waiting times where available.

Use ARP Limit Exceeded to monitor ARP-table usage. Configure its alert threshold and waiting time, along with the restore threshold and waiting time, to control when an alert is raised and when recovery is reported.

Fiber Module Alert

Fiber Module Alert monitors each optical port for high or low temperature, voltage, transmit power, receive power, and laser bias current. Select the port and click Edit to enable the required alert types and configure their reporting and recovery settings.

Fiber Module Alert Settings

Field	Description
Alert Status / Log Level	Enables each alert type and selects the severity used when reporting it.
Alert Difference / Recovery Difference	Configures the alert and recovery differences for the selected measurement. The displayed unit follows the measurement: °C, V, dBm, or mA.
Alert Waiting Time (s)	Sets how long the alert condition must persist before it is reported.
Restore Waiting Time (s)	Sets how long the recovery condition must persist before restoration is reported.

Alert Statistics

Alert Statistics shows the current status of monitored hardware and services together with the most recent alert and restore times.

SYSTEM

Basic Settings

The basic settings page is split into three categories:

• Basic Info: first section, the user can specify a name for the GWN780x Pro switch with a system location and contact.
• Time Settings: In this section, the users can configure the time either manually or using an NTP Server. It’s also possible to configure Daylight Saving (DST) Mode according to the location or recurrence.
• Scheduled Reboot: The users can enable scheduled reboot by adding a schedule under the Time Policy.

Please navigate to the System → Basic Settings page.

Basic Settings

Access Control

In this section, the user can configure access to GWN780x Pro switches.

Please navigate to System → Access Control.

Web Service Management

On the first tab, the user can configure the following:

• Inactive Session Timeout: sets how long an inactive Web UI session remains signed in.
• HTTPS Port: sets the Web UI service port. Minimum TLS Version and Maximum TLS Version define the permitted TLS range. Select compatible limits for the browsers and management clients that must connect.
• Telnet: enables or disables Telnet and selects its service port. Telnet is disabled by default; SSH is recommended.
• SSH: enables or disables SSH and selects its service port (22 by default).

Passwordless Remote Access

Passwordless Remote Access allows GDMS Networking or GWN Manager to open the managed switch’s Web UI without requesting a separate switch username and password. Configure the switch’s management platform first, then enable Passwordless Remote Access under System → Access Control when this workflow is required.

Security: Enable this only for a trusted management platform and restrict the platform accounts permitted to manage the switch.

Management Platform Settings

The Manager Settings tab allows users to configure GWN Manager or GWN Router access parameters (Server address and port). It’s also possible to allow DHCP option 43, and if it’s enabled If enabled, the server address assigned by DHCP Option 43 will be preferred.

Management ACL of Hardware-based

On a GWN780x Pro switch, the hardware management Access Control List (ACL) is designed to optimize resource efficiency by filtering traffic directly at the hardware level before it reaches the CPU. This pre-processing step ensures that only traffic matching the defined security rules is forwarded for further handling, effectively reducing unnecessary CPU load and enhancing overall performance. By offloading the initial traffic validation to the switch hardware, the GWN780x Pro improves both network efficiency and security.

Management ACL of Software-based

On the GWN780x Pro switch, the software-based Management ACL uses firewall-like rules to control who can access the network and its management features. This means it sets up restrictions to make sure that only authorized users and devices can access important parts of the switch, helping to keep the network secure and well-managed.

User Management

There are three levels of users, namely administrator, operator, and monitor. The administrator authenticates and authorizes users who log in to the switch according to management needs, where each user has different permissions and passwords.

1. Administrator

• Each device has one and only one administrator.
• The highest privileges can execute any command.
• The username admin cannot be changed; only the password can be changed.
• Support adding and deleting operators and monitors.

2. Operator

• Added by an administrator, there can be multiple accounts as Operators.
• The second-highest authority can execute all commands except the administrator’s key operations and important mandatory commands
• Can’t change the username, only the password.
• Support adding and deleting Monitor users.

3. Monitor

• Multiple Monitors are possible with the permission of an Administrator or Operator.
• The lowest authority can only view switch status and statistics without any execution or configuration authority.
• Can’t change the username, only the password.

Click Add to create an Operator or Monitor account. To configure key-based SSH access, use the SSH public-key operation for the required account in the user list, paste its public key, and confirm the change. Sign in using the corresponding private key, which must remain on the SSH client. SSH must also be enabled under System → Access Control → Web Service Management.

Time Policy

The time policy page helps to create schedules, for example, Office working hours, Upgrade schedules, or reboot schedules.

To create a schedule, Please navigate to Web UI → System → Time Policy page, then click on “Create Policy” button, there are weekly schedules or absolute Date/Time schedules, for weekly schedules please select from the table the hours and days and as for absolute Date/Time select the days from the drop-down calendars and times from the drop-down menu. Please refer to the figure below.

1588v2 TC

EEE 1588v2, also known as Precision Time Protocol (PTP), is used to synchronize time across devices in a network.

Transparent Clock (TC) is a PTP switch operation mode where the switch measures the time a PTP message spends transiting the switch and updates the correction information accordingly. This helps endpoint devices (PTP master and slave clocks) maintain accurate time synchronization.

In End-to-End Transparent Clock (E2E TC) mode, delay is measured across the path between the master and slave clocks, while the switch contributes its measured residence time to the PTP correction field.

How to configure IEEE 1588v2 TC

1. Go to Settings → 1588v2 TC.
2. Enable 1588v2 TC globally.
3. Set Device Class to E2E TC.
4. Under Port Settings, enable 1588v2 TC on the required ports (per-port configuration).

Note: This feature is currently in Beta. The Web UI supports E2E TC only.

STACK

Stacking allows supported switches to operate as one logical unit.

Supported Models: GWN7806PL Pro and GWN7806PH Pro.

To access this feature, navigate to: Web UI → Stack → Stack Settings

For full configuration examples, topology use cases, and best practices, please refer to the GWN78xx Stacking Feature Guide.

Stack Settings

Use Stack Settings to assign the device ID and election priority that will apply after the next reboot, and select the two physical stack ports. Once the stack is formed, its controller can manage multicast, SNMP, RMON, Identity Authentication Management, and ACL functions across the stack.

Field	Description
Device ID for Next Boot	Assigns the member’s unique stack ID after reboot. Valid range: 1–8.
Priority for Next Boot	Sets the member’s election priority after reboot. Valid range: 1–255; a higher value gives the member a higher priority.
Stack Port 1 / Stack Port 2	Selects the two 10 Gbps optical ports used to cross-connect the stack members.

Warning: Save the settings and reboot the switch for the next-boot values to take effect. Use switches of the same model and firmware version. Set eligible SFP+ stacking ports to 10 Gbps and shut down the physical ports before assigning them to a stack. Cross-connect Stack Port 1 to Stack Port 2 on the neighboring member. Power on the preconfigured primary switch first when possible.

Stack Info

Stack Info displays the stack topology, roles, device IDs, priorities, and port mappings. To configure an individual member, open Stack → Stack Settings and edit that member’s row.

• If no data appears, ensure stack settings are properly configured and devices are connected.
• All stacked switches must be running the same firmware version.

CHANGE LOG

This section documents significant changes from previous versions of the GWN780x Pro switches’ user manuals. Only major new features or major document updates are listed here. Minor updates for corrections or editing are not documented here.

Version 1.0.17.11

Product Name: GWN7801P Pro / GWN7802P Pro / GWN7803 Pro / GWN7803PL Pro / GWN7803PH Pro / GWN7806PH Pro / GWN7806PL Pro

• Added [ ERPS ].
• Added multiple RADIUS server groups and RADIUS authorization/accounting in [ RADIUS ] and [ AAA ].
• Added multiple TACACS+ server groups and TACACS+ authorization/accounting in [ TACACS+ ] and [ AAA ].
• Replaced SSH Remote Access with [ Remote Support ] under Diagnostics.
• Added [ Web CLI ].
• Added HTTPS TLS-version settings under [ Web Service Management ].
• Updated the GWN7801P Pro total PoE power to 130 W in [ Technical Specifications ].

Version 1.0.17.6

Product Name: GWN7801P Pro / GWN7802P Pro / GWN7803 Pro / GWN7803PL Pro / GWN7803PH Pro / GWN7806PH Pro / GWN7806PL Pro

• Added 2.5 Gbps SFP+ support in [ Port Basic Settings ].
• Added queue-dropped packet counters in [ Port Statistics ].
• Expanded Grandstream OUI support for [ Voice VLAN ].
• Added two selectable MAC-table hashing profiles for GWN7801P Pro, GWN7802P Pro, GWN7803 Pro, GWN7803PL Pro, and GWN7803PH Pro in [ MAC Address Table ].
• Added MAC address migration records for GWN7806PH Pro and GWN7806PL Pro in [ MAC Address Migration Record ].
• Extended VLAN Stacking support to all GWN780x Pro models in [ VLAN Port Settings ].
• Added Class of Service to the [ management IP interface ].
• Optimized [ DHCP Server ] address pools and [ ARP/NDP ].
• Added [ Policy Route ] for GWN7806PH/PL Pro and custom route specifications for [ Static Routes ].
• Added MLD Matching Domain for GWN7801P Pro, GWN7802P Pro, and GWN7803 Pro under [ MLD Snooping ].
• Optimized [ Port Security ], [ Port Isolation ], ACL statistics, and ACL utilization reporting.
• Updated nonzero rate-limit actions and dropped-packet counters under [ Dynamic ARP Inspection (DAI) ].
• Optimized [ Identity Authentication Management ] and added [ ND Snooping ].
• Added automatic backup and boot-configuration selection under [ Backup & Restore ].
• Expanded [ Capture ] to all Pro models and optimized [ management-platform diagnostics ].
• Added [ sFlow ] support.
• Optimized [ SNMP ].
• Added more [ alerts ].
• Added Telnet port configuration under [ Web Service Management ].
• Added SSH public-key support for users under [ User Management ].
• Added [ Passwordless Remote Access ] through GDMS Networking and GWN Manager.
• Expanded [ Stack ] management.
• Increased the maximum allowed MAC-address limit to 2000 under [ Port Security ].
• Added pipe filtering under [ CLI Access ].

Version 1.0.17.5

Product Name: GWN7806PH Pro / GWN7806PL Pro

• Added selectable 2.5 Gbps/10 Gbps SFP+ speed modes under [ Port Basic Settings ].
• Added the Queue Dropped Packets column in [ Port Statistics ].
• Expanded the built-in Grandstream entries under [ Voice VLAN OUI ].
• Added four selectable MAC-table hashing profiles in [ MAC Address Table ].
• Added the [ MAC Address Migration Record ].
• Added VLAN Stacking in [ VLAN Port Settings ].
• Added Class of Service to the [ management IP interface ].
• Expanded [ DHCP Server ] address-pool controls with per-pool enable/disable, a global-pool gateway, and DHCP options.
• Reorganized [ ARP Table ] and [ Neighbor Discovery ] into learned/dynamic and static-entry views.
• Added [ Policy Route ].
• Added user-configurable route specifications in [ Static Routes ].
• Expanded [ Port Isolation ] with Layer 2/Layer 3 isolation modes and unidirectional or bidirectional interface isolation.
• Expanded advanced statistics and utilization reporting under [ ACL ].
• Added a Drop action for nonzero DAI rate limits and corresponding dropped-packet statistics under [ Dynamic ARP Inspection (DAI) ].
• Expanded local MAC authentication with Import and Name under [ Identity Authentication Management ].
• Added [ ND Snooping ].
• Added Scheduled Backup under [ Backup and Restore ].
• Added per-file Restore Configuration on Reboot under [ Backup and Restore ].
• Added [ Capture ].
• Expanded [ Management Platform Connection Diagnostics ] with platform selection, connected status, and connection-log access.
• Added [ sFlow ].
• Expanded [ SNMP ] with version selection, view/group/OID management, AES privacy, and additional trap information.
• Added ARP and fiber-module events under [ Alert ].
• Added Telnet port configuration under [ Web Service Management ].
• Added SSH public-key management under [ User Management ].
• Added passwordless remote access through [ GDMS Networking and GWN Manager ].
• Expanded [ Stack ] management for multicast, SNMP, RMON, Identity Authentication Management, and ACL.
• Added member-specific controls under [ Stack Settings ].
• Increased the Maximum MAC Number to 2000 under [ Port Security ].
• Added pipe filtering under [ CLI Access ].
• Increased the supported VLAN IP interfaces to 512 under [ IPv4/IPv6 Interface ].

Version 1.0.15.219

Product Name: GWN7801P Pro / GWN7802P Pro / GWN7803 Pro / GWN7803PL Pro / GWN7803PH Pro / GWN7806PL Pro / GWN7806PH Pro

• Added support for [ Pro AV ].
• Added support for [ IEEE 1588 PTP ].

Version 1.0.15.211

Product Name: GWN7801P Pro / GWN7802P Pro / GWN7803 Pro / GWN7803PL Pro / GWN7803PH Pro / GWN7806PL Pro / GWN7806PH Pro

• This is the initial version.