TesiraFORTÉ X network port modes

Network port modes FW 4.0 and 4.1

In its initial releases (firmware 4.0.x, 4.1.x) TesiraFORTÉ X supported a separated network topology only. 

• P1 is dedicated to Tesira control and VoIP.
  • VoIP will share the same MAC address and IP address, subnet, and gateway as the Tesira control port unless VoIP VLAN tagging is enabled and a VoIP VLAN ID is assigned.
  • If a VoIP VLAN tagging is enabled, VoIP will use a unique MAC address, IP address, subnet, and gateway. (Note: the VoIP gateway will be the default gateway of the device and should also be applied to the control port interface in devices using FW 4.0 and 4.1).
• P2-5 are dedicated to media (AVB or Dante). 
  • Media connections to 3rd party switches will be either AVB capable or Dante capable but not both. The presence of AVB MSRP packets is used to determine the port role. 
• P2-5 support PoE+

TesiraFORTÉ X does not support Tesira's "single-cable" network topologies in FW releases 4.0.x or 4.1.x. While it may function in single-cable operation when connected only via P2-5 there can be inconsistencies in behavior in this topology which can cause the device to become undiscoverable or have unpredictable media network behaviors.

Updating to FW 4.2 or later and selecting Converged Control, VoIP and Media network mode for the device is the resolution to this behavior. 

TesiraFORTÉ X (FW 4.0 and 4.1) uses the device's AVB MAC address for LLDP and RSTP negotiations, as well as IGMP, traffic from the AVB MAC address will be seen on all ports. 

In FW 4.1.2.9 firmware there is a bug which will report the Dante MAC in the media_avb_2 interface in Tesira Device Maintenance. The correct MAC for media_avb_2 MAC is active and can be seen in the AVB Settings tab. The MACs as seen on P1 in a Wireshark trace will be sequential, with control using the lowest number, media_avb_2 as the next, media_voip_3 as the next. An example of MAC addresses seen from a Wireshark > Statistics > Endpoints window is shown here.

Network port modes FW 4.2 and later

Tesira software version 4.2 or higher must be used with devices running firmware 4.2 or higher. 

In Tesira firmware (FW) 4.2.x and later TesiraFORTÉ X supports 3 different network port modes. These modes align as closely as possible to behaviors of other Tesira products.

Port behaviors unique to TesiraFORTÉ X include a shared interface for control+VoIP or control+VoIP+AVB as well as the common media network which converges AVB and Dante. 

It is always safe to connect to P1 for Tesira device discovery, as long the PC and the device are in a common IP address range.

The default network port mode remains the same. Control and VoIP are on port 1; Media (AVB & Dante) is on ports 2-5.

New 4.2 behavior:

• 4.2 introduces a new converged port mode which is equivalent to single-cable mode in Server-IO or TesiraFORTÉ AVB. The single-cable connection carries Control, VoIP, AVB, and Dante on a single uplink.
• 4.2 introduces a new dedicated port mode with port 1 dedicated to Control and port 2 dedicated to VoIP. This is similar to Server-IO or TesiraFORTÉ VI/VT with the dedicated VoIP interface.
  • Systems requiring a dedicated VoIP interface and single-cable mode for control and media are supported by setting the device to Dedicated Control, VoIP and Media network mode, then leaving P1 disconnected. Control and discovery are supported on the media ports (P3-5) and VoIP is allocated to P2. 
• TesiraFORTÉ X media port connections to 3rd party switches allow both AVB and Dante on a shared port.
• A TC-5D may be used to host additional Dante IO with a TesiraFORTÉ X in converged network port mode. 
  • In the TC-5D, media connections to 3rd party switches will be either AVB capable or Dante capable but not both. The presence of AVB MSRP packets is used to determine the port role. A TC-5D connected via its P1 to a TesiraFORTÉ X passes both AVB and Dante on a shared link, but the TC-5D will apply media filter rules to 3rd party switches. TC-5D should not have media traffic filtering enabled on port 1 when it is connected to TesiraFORTÉ X. 
  • If stand-alone Dante and AVB networks are linked by connections through a TesiraFORTÉ X or TC-5D, the networks become bridged. 
• 4.2 improves the default behavior by blocking layer 2 network queries that were originating from the AVB MAC address across all interfaces. Those queries are restricted to the media interfaces now.

TesiraFORTÉ X achieves the different port modes via rules imposed on the internal switch.

Switching between port modes is allowed while configured, however, if DHCP addresses have been acquired by the device's interfaces and the port modes are re-arranged and new DHCP servers do not present the device with new IP information then it may take up to 10 minutes for the device to release the old DHCP addresses and fall back to link local.

When changing switch port modes only P1 should be left connected when the new mode is selected, this will prevent unwanted traffic between network ports and odd DHCP behaviors. Reboot the device after changing port modes. Connect the remaining ports as appropriate for the new port mode. 

When TesiraFORTÉ X is manually configured, access to the network settings is available via Tesira software, for Launch-enabled TesiraFORTÉ X they are also available via the web UI.

It is still important to keep each separate network in a unique IP address subnet range to prevent accidental misrouting of traffic to dead ends.

The AVB MAC address is the origination MAC for layer 2 LLDP, RSTP and IGMP discovery traffic. The AVB MAC is used as the source because it is the one MAC that is guaranteed to be used by the device in all modes. LLDP and RSTP queries are restricted to the media interfaces in firmware 4.2 and higher.

• TesiraFORTÉ X acts as both a querier and responder for LLDP.
• RSTP is enabled only on media ports.
• If enabled, IGMP is used on all ports and uses the AVB MAC as its querier. 

Gateway, domain, and DNS server set

Control, VoIP, and Media all share a common IP stack inside the device, which means there can be only one gateway, one domain, and one DNS server set.

Tesira software allows users to specify different gateway and DNS addresses per interface, in firmware releases 4.2.x and later if multiple interfaces present valid gateway or DNS addresses then we select one based on a fixed prioritization scheme:

1. VoIP
   • (when VoIP VLAN is enabled or Separated Control, VoIP, and Media ports is selected and VoIP line settings are populated)
2. Control (control shares the AVB interface in Converged Control, VoIP, and Media port mode)
3. Media (Dante)

IP address, net mask (subnet range), gateway, and DNS settings may be assigned to each interface as a static setting or be provided to each interface by DHCP.

A network interface state will be up or down (cable disconnected or connected), this state determines whether it is considered in the prioritization scheme. 

When a device gateway is applied, a text indication next to the "Current Default Gateway" field of each interface will indicate "(Active)". The currently selected gateway IP for the device is shown across all network interfaces. We refer to this as the "default" gateway.

If 802.1x authentication is used it is critical that routing to the authentication server using the device's default gateway is possible.

If multiple interfaces present valid DNS settings then we first follow the same prioritization scheme as for the gateway, but, if a DNS set has been manually configured it is preferred over one acquired from a DHCP server. We assume a manual DNS entry is the preferred target defined by the knowledgeable device administrator. 

Tesira follows the Windows network settings model where DNS and gateway can be specified per-interface but rather than using a metric to define priority we use our heirarchy of VoIP, Control, or Media(Dante).

Note: In FW releases 4.0.x and 4.1.x this hierarchy was not rigorously applied. If the Control subnet had a different gateway than VoIP then VoIP responses would be erroneously routed using the Control gateway, leading the packets to being dropped. If there is a required VoIP gateway, an obvious workaround, if feasible, is to replace the Control network gateway with the one needed by VoIP, on the assumption that the Control network probably doesn’t really need to route but VoIP does. Updating to FW versions 4.2.x or higher resolves this issue. 

In separate control, VoIP, and media mode if a VoIP gateway does not seem to take priority, and DHCP is being used by both the control and VoIP interfaces, try setting the control interface to a static IP address and netmask, and leave the control gateway unpopulated. Alternately the VoIP settings can be set to static, including IP address, netmask, and gateway, as well as DNS servers if the VoIP DNS should be preferred. 

Port settings

Device Logs

The device logs will show most of the network configuration information. Here is an example 

2021-12-27 15:40:23.4 DevioSCX04303078         NOTICE   Current network configuration:
2021-12-27 15:40:23.4 DevioSCX04303078         NOTICE   DNS: avahi is active.
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   domain: no DNS domain name set
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   nameserver1: 0.0.0.0
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   nameserver2: 0.0.0.0
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   ---- if name: control
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE     if enabled: true
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   dhcp enabled: true
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE        MAC addr: 78:45:01:0a:63:e0
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   ---- if name: media_avb_2
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE    if enabled: true
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   dhcp enabled: true
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE       MAC addr: 78:45:01:0a:63:e1
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   ---- if name: media_voip_3
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE     if enabled: true
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE   dhcp enabled: false
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE        ip addr: 192.168.43.44
2021-12-27 15:40:23.5 DevioSCX04303078         NOTICE        netmask: 255.255.255.0
2021-12-27 15:40:23.6 DevioSCX04303078         NOTICE        gateway: 192.168.43.1 configured metric 10
2021-12-27 15:40:23.6 DevioSCX04303078         NOTICE       MAC addr: 78:45:01:0a:63:e2
2021-12-27 15:40:23.6 DevioSCX04303078         NOTICE host name is DevioSCX04303078
2021-12-27 15:40:23.6 DevioSCX04303078         NOTICE SwitchPortMode 'SWITCH_PORT_MODE_CONTROL_AND_VOIP_AND_MEDIA'
2021-12-27 15:40:23.6 DevioSCX04303078         NOTICE Updating network configuration...
2021-12-27 15:40:44.5 DevioSCX04303078         NOTICE choosing *user-supplied* DNS source 'VoIPNG': domain '', nameservers '208.67.222.222' '208.67.220.220'
2021-12-27 15:40:52.0 DevioSCX04303078         NOTICE RSTP port state(s) changed to:  P1=Forwarding P2=Forwarding P3=Discarding P4=Forwarding P5=Forwarding control=Forwarding
2021-12-27 15:40:52.6 DevioSCX04303078         NOTICE RSTP port state(s) changed to:  P1=Forwarding P2=Forwarding P3=Discarding P4=Forwarding P5=Forwarding control=Forwarding
2021-12-27 15:40:53.3 DevioSCX04303078         NOTICE ip route shows 2 default gateway(s)
2021-12-27 15:40:53.4 DevioSCX04303078         NOTICE    'default via 192.168.43.1 dev eth2.13 metric 100 '
2021-12-27 15:40:53.4 DevioSCX04303078         NOTICE    'default via 172.30.41.1 dev eth2.4000 proto dhcp src 172.30.41.54 metric 300 '
2021-12-27 15:40:53.7 DevioSCX04303078         NOTICE main operating environment version 4.3.2.0
2021-12-27 15:40:53.7 DevioSCX04303078         NOTICE recovery operating environment version 4.3.2.0
2021-12-27 15:40:53.8 DevioSCX04303078         NOTICE Starting power-up configuration sequence
2021-12-27 15:40:55.1 DevioSCX04303078         NOTICE creating pilot talker stream 'BiampTesiraPilotStreamFromDevioSCX04303078': ID suffix 0xFFFE (65534), primary MAC 78:45:01:0a:63:e1, secondary 78:45:01:0a:63:e1
2021-12-27 15:40:58.3 DevioSCX04303078         NOTICE Starting media for partition 1
2021-12-27 15:40:58.3 DevioSCX04303078         NOTICE Finished power-up configuration sequence
2021-12-27 15:41:21.6 DevioSCX04303078         NOTICE media_avb_2 link status change. was: 'LINK_NONE', now: 'LINK_1_GB'
2021-12-27 15:41:21.6 DevioSCX04303078         NOTICE interface media_avb_2 IP address is 169.254.245.80
2021-12-27 15:41:22.6 DevioSCX04303078         NOTICE choosing *user-supplied* DNS source 'VoIPNG': domain '', nameservers '208.67.222.222' '208.67.220.220'
2021-12-27 15:41:25.7 DevioSCX04303078         NOTICE ip route shows 2 default gateway(s)
2021-12-27 15:41:25.7 DevioSCX04303078         NOTICE    'default via 192.168.43.1 dev eth2.13 metric 100 '
2021-12-27 15:41:25.7 DevioSCX04303078         NOTICE    'default via 172.30.41.1 dev eth2.4000 proto dhcp src 172.30.41.54 metric 300 '

SwitchPortMode will show the mode the device was in:

1. NOTICE     SwitchPortMode 'SWITCH_PORT_MODE_CONTROL_AND_MEDIA'
2. NOTICE     SwitchPortMode 'SWITCH_PORT_MODE_CONTROL_AND_VOIP_AND_MEDIA'
3. NOTICE     SwitchPortMode  'SWITCH_PORT_MODE_ALL_MEDIA'

Network interfaces indicate link-up or down state changes and IP addresses

NOTICE    media_dante_1 link status change. was: 'LINK_NONE', now: 'LINK_1_GB'
NOTICE    interface media_dante_1 IP address is 169.254.186.42

DNS source and nameservers either in use or not in use, the source interface and whether defined manually or by DHCP

NOTICE    choosing *user-supplied* DNS source 'VoIPNG': domain '', nameservers '208.67.222.222' '208.67.220.220'

or

NOTICE    choosing *DHCP-served* DNS source 'control': domain '', nameservers '8.8.8.8' '8.8.4.4'

or

NOTICE    neither manual nor DHCP-served DNS found on any interface

Default gateway

NOTICE    ip route shows 1 default gateway(s)
NOTICE    'default via 172.30.41.1 dev eth2.4000 proto dhcp src 172.30.41.53 metric 100 '

From that, you can get a pretty good picture of the network topology and see unsupported topologies.

MAC addresses

Each TesiraFORTÉ X has (5) device MAC addresses. These are shown in the device's Event Logs in the boot sequence. They may be seen in the Equipment Table while offline, and in Device Maintenance under each network interface's advanced details, in the AVB Settings tab, and in the MAC Addresses tab while online. 

TesiraFORTÉ X port scans reveal up to (4) of the MAC addresses are used. The behavior is specific to the port role.

The MAC addresses will be sequential, appearing as shown here: 

1. Control (control)
2. AVB (media_avb_2)
3. VoIP (media_voip_3)
4. Dante (DAN Primary[Slot 2])
5. (not implemented)

When different port mode settings are assigned to the TesiraFORTÉ X, the MAC addresses which are discoverable per port will change.

Each active MAC address receives an IP address. IP addresses must be in unique logical subnets for proper behavior.

TesiraFORTÉ X uses the device's AVB MAC address for LLDP and RSTP negotiations on the media ports in all modes. 

TesiraFORTÉ X uses the device's AVB MAC address for IGMP negotiations on all ports in all modes, when IGMP is enabled. This is expected behavior. 

During its boot sequence the TesiraFORTÉ X may show all MAC addresses on all ports for a short time before the port rules are put in place and traffic is properly routed.

Web interface

The web UI is simultaneously accessible at any of the device's IP addresses using a valid port. The Control IP address, the AVB IP address, AVB/control IP address, Dante IP address, and/or the VoIP IP address all allow access to the web UI via their respective ports, depending on port mode.

The set of webpages available in the web UI vary depending whether the device is Launch-capable/configured or if it has been manually configured. A smaller set of webpages is available when manually configured. The hidden pages are features specific to Launch-capable/configured devices.

Network settings are available from the web UI on Launch-capable/configured devices. Network settings are available using Tesira software when manually configured. 

TTP communication 

TTP communication is simultaneously accessible at any of the device's IP addresses using a valid port.

The Control IP address, the AVB IP address, AVB/control IP address, Dante IP address, and/or the VoIP IP address all allow communication via TTP command over their respective ports, depending on port mode.

TTP is available using SSH by default (SSH may be disabled, if desired). Telnet is disabled by default and can be enabled across all interfaces. 

3rd party control systems can interact with TesiraFORTÉ X on any of its connected networks.

LLDP

Link Layer Discovery Protocol (LLDP) is enabled on the media ports. LLDP queries are seen originating from the AVB MAC address. TesiraFORTÉ X acts as both a querier and responder for LLDP. 

RSTP 

Rapid Spanning Tree Protocol (RSTP) is enabled by default on TesiraFORTÉ X. It can be disabled in the port mode settings. The setting applies to all media ports. RSTP queries are seen originating from the AVB MAC address. RSTP is intended for use with other Biamp devices to prevent broadcast storms if a network loop is accidentally or intentionally created. RSTP will interrupt network traffic for up to 60 seconds when a network change is sensed, while the port roles are being negotiated and applied. RSTP must be enabled on all network devices to work properly. 

In some cases a connected switch with BPDU guard enabled may determine that the RSTP queries from Tesira are not allowable traffic and will block the port. Disable RTSP in the Biamp Tesira device to resolve this issue. It will likely be necessary to set the Tesira RSTP state while it is not connected to the other switch. 

IGMP

Internet Group Management Protocol (IGMP) is disabled by default on TesiraFORTÉ X. It can be enabled in the port mode settings. The setting applies to all ports. IGMP (v2) is used to manage multicast traffic in large networks with numerous multicast talkers.

When IGMP is enabled TesiraFORTÉ X will act as an IGMP querier, using its interface address as its querier address. When IGMP is disabled TesiraFORTÉ X will respond to IGMP multicast group requests but will not act as a querier. 

If IGMP is used at least one IGMP querier IP address must be specified in the connected network, this is used to manage how multicast traffic is passed between switches. Every switch can be enabled as a querier, the switch with the lowest querier IP address should be elected as the preferred querier for the network.

IGMP queries and responses may be seen originating from any of the device's MAC addresses, depending on network topology.

DHCP / IP address behavior

TesiraFORTÉ X port settings allow for multiple interfaces to be part of a common physical network. In dedicated network modes, each network segment (control / VoIP / media) is expected to have a unique logical subnet for its IP addressing. In the converged mode all interfaces are in a common network.

• Dedicated Control and Media (Default) Control and VoIP on P1; AVB and Dante on P2-P5.
• Dedicated Control, VoIP and Media Control on P1; VoIP on P2; AVB and Dante on P3-P5.
• Converged Control, VoIP and Media AVB/control/VoIP and Dante or AVB/control and Dante on P1-P5.

Device interconnections

Biamp TesiraFORTÉ X devices are primarily intended for use in limited scope systems such as conference rooms and combinable rooms. When used in conjunction with TC-5 and/or TC-5D up to four devices can be used within a single media network cluster.

Any time TesiraFORTÉ X, TC-5, or TC-5D are connected to one another it is critical that the unpowered port #1 (P1) of one device is used to connect to the second device.

NOTE: To avoid malfunctions and potential damage to this product, it is important to understand the correct way to connect the network ports of a TesiraCONNECT TC-5, TesiraCONNECT TC-5D, and TesiraFORTÉ X to other network devices. Please read and follow these instructions carefully before connecting these products to a network:

1. When linking together multiple TC-5, TC-5D, or TesiraFORTÉ X together over a network, always connect port 1 (P1) of one device to ports 2-5 (P2-P5) of another device. Never connect P2-P5 of one device to P2-P5 of another device. Internal damage to the Biamp hardware may occur if this restriction is not observed. 
2. When connecting a TC-5, TC-5D, or TesiraFORTÉ X to a third-party network switch, always use port 1 (P1) of the device for this purpose. If connecting devices via P2-5, only non-PoE-capable network switches can be connected to TesiraFORTÉ X P2-5 (disabling PoE on a PoE-capable switch is not sufficient). Internal damage to the Biamp hardware may occur if this restriction is not observed. 
3. Biamp recommends only using unshielded (UTP) network cabling. If shielded (STP) cabling must be used, an unshielded inline RJ45 coupler must be used to lift the shield connection between devices. It can be installed at either end of the cable with a short jumper between the coupler and the endpoint. Internal damage to the Biamp hardware may occur if this restriction is not observed. 

STP or UTP cable

The use of shielded twisted pair (STP) cable is not permitted with TesiraFORTÉ X due to the additional paths to ground available on analog inputs and outputs, USB, and GPIO.

If STP wiring must be used Biamp strongly recommends the use of an unshielded inline RJ45 coupler to lift the shield connection between devices. It can be placed at either end of the link with a short jumper between the coupler and the endpoint. Internal damage to the Biamp hardware may occur if this restriction is not observed. 

PoE+

TesiraFORTÉ X is a network appliances with (5) 1GB ethernet ports. (4) of the ports can supply PoE+ to connected peripherals. The powered ports are numbered 2-5 and labeled "PoE+".

When linking TesiraFORTÉ X together with one or more TC-5 or TC-5D, always connect port 1 (P1) of one device to ports 2-5 (P2-P5) of another device. Never connect P2-P5 of one device to P2-P5 of another device. Internal damage to the Biamp hardware may occur if this restriction is not observed. 

When connecting a TC-5, TC-5D, or FORTE X to a third-party network switch, always use port 1 (P1) of the Biamp device for this purpose. If connecting devices via P2-5, only non-PoE-capable network switches can be connected to TesiraFORTÉ X P2-5 (disabling PoE on a PoE-capable switch is not sufficient). Internal damage to the Biamp hardware may occur if this restriction is not observed. 

If a PoE-capable 3rd party switch is required on P2-5 for media connections please contact support@biamp.com with your network topology requirements.

Downgrading firmware

IMPORTANT: If a TesiraFORTÉ X is running FW 4.2 or later and the device firmware is downgraded to 4.0 or 4.1 while the device is in any network port mode other than the default (Dedicated Control and Media) mode then a pinhole reset followed by a hard power cycle will be required to recover the device to a discoverable state. This is because the alternate port modes did not exist in the 4.0 and 4.1 FW code and the downgrade procedure will leave the ports in an invalid condition until reset and rebooted. You can avoid this condition either by setting port modes to the default prior to downgrading firmware, or by not downgrading firmware.