Port 300 safety switch

Similar Questions

• The 300 series switches are compatible with detection of PoE before standard in old phones Cisco?

  The 300 series switches are compatible with detection of PoE before standard in old phones Cisco? They don't seem to be (7902G don't turn on when it is connected to a SF302-08MP with firmware version 1.1). What no need special configuration on the switch to enable this detection?

  Please note that the switches of the series 200 and 300 are now supported POE Legacy Cisco from September 2011, to provide power to 7960, 7940 and other phones standard pre and APs. Details on the following link:

  https://supportforums.Cisco.com/docs/doc-18337

• CCNP 300 - 206 (SENSS) safety switch

  Hi all

  Currently, I am studying for CCNP security 300-206 (SENSS).

  I came across the following doubts. If they seem to be stupid & funny, I can't go to my car without posting here.

  1 > what will happen if we give "Maximum authorized MAC 5" and 'Sticky MAC address' orders together under the same Interface?

  2 > does DHCP Snooping Database table stores the NON-DHCP Clients(Lets say static) MAC & IP addresses?

  3 > mechanisms made DHCP Snooping and dynamic ARP Inspection will work under the plain layer 2 only choose?

  4 > can "Source Guard" stop rough APR, as the dynamic ARP Inspection packages?

  5 > private VLAN interfaces can communicate with the primary VIRTUAL local Network Interfaces?

  It may need little explanation - here's the scenario:

  Suppose we have 100 primary VLAN, VLAN 300 community VLAN 200 and isolated.  And here's the interface assignment:

  GI Gi0/2, 0 / 1--> VLAN 100 primary

  GI Gi0/4, 0 / 3--> community VLAN 200

  GI 0/5, Gi0 / 6--> VLAN isolated 300

  But we have converted only Gi0/1 in the Promiscuous Port and mapped VLAN 200 and 300 of VLAN.

  Can Gi 0/3, Gi0/4, Gi 0/5 & Gi0/6 contact GI 0/2?

  Could someone please help?

  Thanks in advance,

  Prasanna Kumar deully

  (1) port-security allows a single MAC by default. Post-it adds the learned address to the config and 'fixed' this address. If you change portsecurity to allow five addresses, then all these up to five addresses are added to the configuration.

  (2) No, if you use this table for other functions such as DAI or IPSG, you will need to define exceptions of static for systems without DHCP. Before you implement these features, I make sure that ideally all systems use DHCP. Cameras, printers, multifunction devices and so on. Many of them get bookings on the DHCP server, but they must use the DHCP protocol to do functions such as DAI and IPSG very.

  (3) what is a "simple layer 2 switch' for you? Today, the definition of Layer2 or Layer 3 defines how the device it is transmission. A Catalyst 2960 is generally used with Layer2 forwarding. But this does not mean that there is no function to look in the payload and to inspect the traffic up to the application layer. These functions are also available on the older Catalyst 2950 (initially there wasn't no DAI, but DHCP Snooping) and are now available on all switches access (catalyst).

  (4) function no, each has its own security function. DAI is to inspect the ARP-payload, IPSG is to inspect the source addresses.

  (5) don't know what you mean...

  If Gi0/3-Gi0/6 are configured for private VLANs as shown, then they can communicate directly with Gi0/2. If they are not yet configured (I guess that's what you mean by "converts"), as they are probably members of a VLAN different and can communicate with Gi0/2 through a Layer 3 device.

  Some links to Guides-Config with more information:

  • Port-security
  • DHCP Snooping
  • DAI
  • IPSG
  • Private VLAN

• The security design: DMZ ports on internal switch - bad idea?

  Hi all

  I'm looking for a compelling - or he said is not serious - why a customer should not creator of DMZ VLAN on a cat internal-6509.

  Basic topology is a 6509 in a controller area and 2 x ASA - 5510 to active / standby. They finally agreed to start using the DMZ for different services, but because they have no other switch on the domain controller, they are happy to have these DMZ on VLANS separated on the 6509.

  Is this a security risk? (They do NOT use the 6509 as an 'outside' switch so it's something that I guess)

  How the risk can be mitigated?

  How their environments could be compromised?

  Any suggestion is appreciated. Thanks in advance,

  Mike

  I don't see a problem with this setup as:

  (1) External / DMZ is LAYER2 ONLY! Use a safety device to manage all Layer 3 (Firewall, FWSM, etc...)

  (2) you turn off the proxy arp on ALL layer 3 interfaces on the switch.

  (3) you don't give anyone access the switch unless they know what they do (understand the implications of having mixed traffic on the switch)

  (4) configure you a vlan fake, make sure that everyone knows what it is (put a name in it and it document) and make the vlan by default for your switchports.

  (5) you turn off the trunk negotiation (all ports must be configured "switchport mode trunk" or switchport mode access and also "switchport nonegotiate". If you use 802. 1 q (or isl - ugh), explicitly set the VLANs that are allowed to pass "trunk allowed vlan switchport x, y.

  (6) use VTP transparent and not trunk VLAN external to other switches, unless you know what you're doing.

  The most important is probably #3. A layer interface moved 3 or IVR and game over, you filled just Internet to your internal network. I can't emphasize enough that, if this is possible and safe if done correctly, it is VERY dangerous if you don't know what you're doing. Some consider too high of a risk to take and to believe in the physical separation to eliminate the risk. I agree, however, I understand that not all of us can afford to purchase several 6500 s.

  Another thing to consider, did you think to use VRF-Lite?

• Cisco SG 300-20 switch connects to the router

  Hello

  I try to install my new switch Cisco SG300-20 in my local network, but I'm not succeed.

  The SG 300-20 fails to connect to my router.

  When the router is directly connected to the SG 300-20 I fails to obtain the DHCP configuration. Any port I try fails.

  When I add a former switch between the router and the SG 300-20, SG 300 - 20 manages to get the DHCP configuration.

  When I use a static IP on the SG 300-20 and the router is directly connected, it is not an operational bridge in the IPv4 configuration.

  Where I'm looking for a solution?

  The SG 300-20 is maybe defective and I would stay there?

  A. van Egmond

  A few things you can check are:

  See if the system is blinking. If it is the default ip address. If it is solid the IP address has changed due to a static assignment or DHCP.

  If no link light is on or the system flashes, the reason why could not tear out DHCP is due to a shift of port negotiation. Try setting the port on the router or the full 100 MB switch or what ever you like just to see if that helps.

  Make sure that you are also on the latest firmware.

  Try factory default of the switch with the button of reset for 45 seconds.

  Cisco Small Business Support Center

  Randy Manthey

  CCNA, CCNA - security

• Questions about my SG-300-10MP switch Setup

  Hello world

  Thank you very much for your help in advance. I was never in this town before.

  I just got the new SG - 300 switches. My manager has ordered for me. I didn't know how it works so far... not a based IOS. I don't really know how to set it up.

  In any case, I have a switch configured 3750 already in a new site. It has two VLANs, a vlan 11 for PC, and one is for vlan VOIP 320. It has automatic qos works as well. I have installation just a trunk for the new SG - 300 switch.

  Now on the new small switch 300 SG... I have a few questions:

  (1.) I also created two VLAN, it is VLAN11 (for PC), and a 320 VLAN. For this one, I go to the Web-GUI and assign the 320 to the VOICE Vlan. I also changed the CoS at 5 (of 6). Are these ok?

  2.) on port number 9, it's the default trunk, so I add two 11 and 320 to the trunk and leave the other default settings. It's too well ok?

  3.) on a #1 access port, which will be an IP phone, attached with a PC to connect. What I did is to change the mode to Interface Vlan on "GENERAL." Is this fair? I also 'SEE' the box belonging to a VLAN auto voice. And let the Voice VLAN QoS mode such as telephone company Source MAC ADDRESS. I did all these right?

  4.) Finally, for the part of the QoS... Let them default all untouchables - which is the default QoS of Basic... I don't know if it will be fine. I know that the company switch can assign an Auto-QOS command and that he would do all the config itself. Or maybe you mind if you would share your QoS configuration settings?

  I'm more concerned about the parameters in QoS here. Hope you can help.

  Thank you very much.

  Takami Chiro

  Hello

  In the case of the Cisco 7961 (and other phones that support LLDP-MED), you can assign VIRTUAL local network for the phone settings using the LLDP-MED on the switch.

  You have to

  -allow to the vlan VoIP

  -Add MAC YES

  -set the port on vlan automatic voice

  -activate LLDP-MED in the world

  -create a network policy to assign VLAN320

  -assign this policy network on port, the phone is connected to

  Hope this helps,

  Kind regards

  Nico

• Config port / VLAN on switch MXL

  I'm not a network engineer, but I try to set a port to my MXL switch to a VLAN that will route traffic on virtual machines on a local network of calculation.

  This is the port Te 0/52 on the back of the MXL and I am running ESXi on servers in my m1000e.  In fact, I have two MXLs in the tissue A of the m1000e configured with VLT via the interfaces of the FourtyGig.  This part has been implemented by people of Dell Tech Services, making the installation.

  Here's what looked like the config to start:

  dsa1 #show vlan

  Codes: *-Default VLAN - VLAN, GVRP, R - G remote control Port Mirroring VLAN, P - primary, C - community, I - isolated
  O Openflow
  Q: U - no identified, the T - tag
  x - unidentified Dot1x, X - Dot1x tag
  o - unidentified OpenFlow, O - OpenFlow tag
  G - GVRP tag, M - Vlan-stack, H - VSN tagged
  i unidentified intern, I - labeled internal, untagged, V v - VLT - VLT tag

  Ports Status Description Q NUM
  * 1 U active Po33 (0/33.37 Fo)
  U Po41 (Te 0/41-44)
  Te U 0/1-32
  115 active Mgmt T Po41(Te 0/41-44)
  V Po33 (0/33.37 Fo)
  Te T 0/1-32
  486 active VMGuest T Po41(Te 0/41-44)
  V Po33 (0/33.37 Fo)
  Te T 0/1-32
  Te U 0/49-50

  And I wanted to add VLAN 1000 to calculate, so I did the following:

  dsa1 #conf

  dsa1 (conf) #interface Te 0/52
  dsa1 (conf-if-you-0/52) #show config
  !
  interface TenGigabitEthernet 0/52
  no ip address
  MTU 12000
  hybrid portmode
  switchport
  FlowControl rx tx off
  spanning tree rstp edge port bpduguard stop-on-violation
  no downtime

  dsa1 vlan (conf) #interface 1000
  dsa1 (conf-if-vl-1000) #show config
  !
  interface Vlan 1000
  Description information
  name computer
  no ip address
  Tagged TenGigabitEthernet 0/1-32
  Unmarked TenGigabitEthernet 0/52
  no downtime

  VLAN now looks like:

  dsa1 #show vlan

  Codes: *-Default VLAN - VLAN, GVRP, R - G remote control Port Mirroring VLAN, P - primary, C - community, I - isolated
  O Openflow
  Q: U - no identified, the T - tag
  x - unidentified Dot1x, X - Dot1x tag
  o - unidentified OpenFlow, O - OpenFlow tag
  G - GVRP tag, M - Vlan-stack, H - VSN tagged
  i unidentified intern, I - labeled internal, untagged, V v - VLT - VLT tag

  Ports Status Description Q NUM
  * 1 U active Po33 (0/33.37 Fo)
  U Po41 (Te 0/41-44)
  Te U 0/1-32
  115 active Mgmt T Po41(Te 0/41-44)
  V Po33 (0/33.37 Fo)
  Te T 0/1-32
  486 active VMGuest T Po41(Te 0/41-44)
  V Po33 (0/33.37 Fo)
  Te T 0/1-32
  Te U 0/49-50
  1000 active Compute T Te 0/1-32
  Te U 0/52

  But I wanted to add THAT VLT Po33 tag to the new VLAN because there is in others, not because I really understand what it does.  In my view, it is used for load balancing?  If I label it with the command 'tag Po33' in the config of vlan, out with the status "T" instead of "V".

  Here are the details of the VLT:

  dsa1 #show vlt detail
  Local LAG Id counterpart LAG Id status Local Peer status Active VLAN
  ------------  -----------  ------------  -----------  -------------
  41 41 UP UP 1, 115, 486
  dsa1 #show brief vlt
  VLT area in brief
  ------------------
  Domain ID: 100
  Role: secondary
  Primary role: 4096
  ICL Link Status: to the top
  Status of heart rate: upward
  VLT Peer status: to the top
  The local unit ID: 0
  Version: 6 (4)
  Local system MAC address: f8:b1:56:09:70:b1
  MAC address of the remote system: f8:b1:56:09:70:fd
  Configured the system MAC address: 00:01:00:01:00:01
  Version of the remote system: 6 (4)
  Restore delay timer: 90 seconds
  Delay-restore Abort threshold: 60 seconds
  Routing peer: disabled
  By the peer-routing-Timeout timer: 0 seconds
  Multicast peer-routing timeout: 150 seconds

  So my questions are, I'm on the right track?  It will do what I want it to do is send traffic on port 0/52 Te which is labeled in ESXi with 1000 VLAN?  Should I worry the VLT marking stuff and if yes, how should I do the VLT marking rather than normal marking?

  The connection only 1 port of MXL 1 to a device, this device is considered a switch/host an orphan. A VLT connection will have 1 port each MXL placed in a port channel and connected to a device.

  Here is a good article that covers the VLT in use with different Topologies.

  http://Dell.to/1wfDl3n

  And the User Guide is a good source to have as well.

  http://Dell.to/1Hy70bb

• Errors of battery port (PowerConnect 6248 switch)

  Please see the logs below. What is that saying? The question is on the network or physical problem on the cable/port?

  Log buffer:

  Errors detected on the Port of pile 1/xg1 (oldRxErrors = 3001 = currentRxErrors 3003 oldTxErrors = 0 currentTxErrors = 0). Use BRCM_escape_apos; See the battery-port diagBRCM_escape_apos; Watch detailed statistics.

  See the battery port diag:

  1 - xg1:
  RBYT:3e5cfaaa RPKT:9a4ba4b TBYT:e4c25325 TPKT:7d81423d
  RFCs:BC0 RFRG:0 RJBR:0 RUND:0 ROVR:0
  TFCS:0 TERR. : 0

  1 - xg2:
  RBYT:c2277bb1 RPKT:6b2c0473 TBYT:ea7e75d3 TPKT:4b0cf8ae
  RFCS:0 RFRG:0 RJBR:0 RUND:0 ROVR:0
  TFCS:0 TERR. : 0

  2 - xg1:
  RBYT:32f4ae8 RPKT:17590db0 TBYT:dcc05da9 TPKT:330ea6d7
  RFCS:1 RFRG:0 RJBR:0 RUND:0 ROVR:0
  -Other - or ITU (q)
  TFCS:0 TERR. : 0

  2 - xg2:
  RBYT:1e243193 RPKT:7ca8563e TBYT:dce26ec1 TPKT:4bb4d53
  RFCS:15 RFRG:0 RJBR:0 RUND:0 ROVR:0
  TFCS:0 TERR. : 0

  3 - xg1:
  RBYT:670d9fbf RPKT:8553d2af TBYT:82112954 TPKT:b6b0d342
  RFCS:0 RFRG:0 RJBR:0 RUND:0 ROVR:0
  TFCS:0 TERR. : 0

  3 - xg2:
  RBYT:fae703cb RPKT:d9fe988e TBYT:79ddb35 TPKT:b0647900
  RFCS:0 RFRG:0 RJBR:0 RUND:0 ROVR:0
  TFCS:0 TERR. : 0

  4 - xg1:
  RBYT:25865503 RPKT:4f3df21b TBYT:27359088 TPKT:6e8f38a5
  RFCS:0 RFRG:0 RJBR:0 RUND:0 ROVR:0
  TFCS:0 TERR. : 0

  4 - xg2:
  -Other - or ITU (q)
  RBYT:8210be41 RPKT:b6b0d2dc TBYT:670cbb4d TPKT:8553d1cd
  RFCS:0 RFRG:0 RJBR:0 RUND:0 ROVR:0
  TFCS:0 TERR. : 0

  Thank you

  Ok. Finally I found the downtime. We had to add a new switch of the battery.

  I took 1/xg1 cable and put it in the 4\xg1 port to connect to the new switch.

  Also updated to the latest firmware.

  Result:

  -There was no errors for 2 the first 2 days.

  -first 8 mistakes happened today on port 4/xg1

  ------------TX-------------- ------------RX--------------

  Data error data error

  Rate rate rate rate Total

  Interface Unit (MB/s) (errors/s) errors (MB/s) (errors/s) errors

  ---- ---------------- ------ ---------- ---------- ------ ---------- ----------

  1    xg1              554    0          0          288    0          0

  1    xg2              820    0          0          972    0          0

  1    xg3              0      0          0          0      0          0

  1    xg4              0      0          0          0      0          0

  2    xg1              428    0          0          298    0          0

  2    xg2              291    0          0          549    0          0

  2    xg3              0      0          0          0      0          0

  2    xg4              0      0          0          0      0          0

  3    xg1              53     0          0          17     0          0

  3    xg2              295    0          0          435    0          0

  3    xg3              0      0          0          0      0          0

  3    xg4              0      0          0          0      0          0

  4    xg1              971    0          0          821    0          8

  4    xg2              18     0          0          52     0          0

  4    xg3              0      0          0          0      0          0

  4    xg4              0      0          0          0      0          0

  5    xg1              973    0          0          818    0          0

  5    xg2              818    0          0          973    0          0

  ------------TX-------------- ------------RX--------------

  Data error data error

  Rate rate rate rate Total

  Interface Unit (MB/s) (errors/s) errors (MB/s) (errors/s) errors

  ---- ---------------- ------ ---------- ---------- ------ ---------- ----------

  5    xg3              0      0          0          0      0          0

  5    xg4              0      0          0          0      0          0

  It's the fault of physical cable. I have to replace the cable.

  Thank you all for help in the investigation.

• SVI press SG 300 series switches

  Hi people:

  my client has 6 sg 300 switches a switch is connected with the firewall a firewall d a dhcp on a network server, they want to do another vlan to another network, if the 300 series sg takes care of the SVI I can do two IVS on my a switch.i think that they do not support other than default.can svi you help me on this problem...

  Hi Khurram switch supports VLAN for layer 3 interfaces.

  You can connect to the CLI and use the command

  router adjustment system mode

  Once you do, it will be by default the Chooser after reloading.

  Once the switch is back to the top, make sure that the first thing we do is to book a static IP address on the vlan 1 can do your VLAN additional and IPS on VLANs

  -Tom
  Please mark replied messages useful

• 6120 UCS connect to the Brocade 300 FC switch

  We buy a UCS with 6120's and will connect the CF modules to our 8 GB Brocade 300 switches.  My questions are:

  1 are there problems with the connection of the 6120's to the 300?

  2. can I have two separate fabrics?

  3. are there potential loop or latency problems as I go to my EMC CX4 of 6120's by the 300?

  Basically, any comment is welcome :-)

  Thank you!!

  1. Brocade switches will work very well connected to the 6120. The main requirement is that they support NPIV.
  2. Yes you can, and indeed, what would be the recommended path. Fabric Interconnect will connect to A Brocade, while the fabric interconnect B connects to the Brocade B. The interconnections of fabric or the brocades are interconnected, leaving you with two different fabrics. In each UCS Manager Service profile, you can then set up a vHBA for each fabric.
  3. No loops exist, although the fabric of the interconnections will be set up a small amount of latency, as shown in this link. Tiny enough to be negligible if and as the link explains the fabric is lossless.

  http://www.Cisco.com/en/us/prod/collateral/ps10265/ps10276/data_sheet_c78-524724.html

• 300 series Switch configuration of VLAN

  Hello

  I'm Setup VLANS on switch sf 302 and been unsuccessful. My idea is to have 2 separate networks and both connect to internet

  Game 192.168.2.0/24 network

  Network 192.168.3.0/24

  Router (Linkys) connected to the switch - 192.168.4.1 8 port

  I joined the serial cable and made the following changes

  Creation of VLANS

  Created 20 VLANs for the network game

  #config t

  #vlan database vlan 20

  output

  30 of VLANs created for the work

  #config t

  # vlan database vlan 30

  #exit

  Asigned ports to VLANS

  #config t

  # int fa2

  switchport mode access #.

  # switchport access vlan 20

  #exit

  #config t

  Fa3 #int

  switchport mode access #.

  # switchport access vlan 30

  #exit

  IP address assignment to the VLAN

  #conf t

  #int vlan 20

  # address ip 192.168.2.1 255.255.255.0

  #end

  #conf t

  VLAN #int 30

  # address 192.168.3.1 ip 255.255.255.0

  #end

  I'm stuck after that. Now I connect vlan 20 and vlan 30 on router attached to port8 on the switch for the computers on the two VLANs can access the internet. The IP address of the router is

  192.168.4.1.

  Please explain what it takes to do this.

  Thank you

  Maakri

  Hello Maakri,

  Looks like you are using the layer 3 switch. It is important to remember that the traffic is not one-way. When you send pings to the router to 192.168.4.2, the switch will pass on, but how the router knows how to get back?

  If you do not have many VLANS on the router, you will need to add static routes. Here is an example of the roads, you will need-

  network 192.168.2.0/24 goto 192.168.4.1 hop 2

  network 192.168.3.0/24 goto 192.168.4.1 hop 2

  Hope this helps

• Port of the switch for LAP

  Hello

  I have a potentially ridiculous question.

  I work with a WLC 5508.

  He'll be there 2 separate WLAN on their own VIRTUAL local area network.

  The WLC connects to the Southwest over a trunk link, which seems logical.

  However, ym question lies in the connection with the TOWER to the switch... should be a trunk as well?  If each SSID is on a VLAN respective, then TURN to pass wouldn't be a trunk as well?  Example: I have my tricks on vlan 9 (192.168.9.0/24) and I want my personal WLAN on VLAN 6 (192.168.6.0/24) and I want that my guest WLAN on vVLAN 8 (can you guess the IP address?)

  I read that the link between the KNEES and the SW needs to be an access port (so it would ' Switchport access vlan 9 "on the port which connects the LAP... but how would the traffic / VLAN 6 and 8, considered then?)

  FYI - DHCP for all devices (APs and hosts for each WLAN) is going to be the closest crossing the WLC, the DHCP for the APs will opt 43 defined pool so that APs can find the WLC...

  I'm getting confused about how the traffic is separated, can someone enlighten me?

  I still have to set up the JUMP with IAS and other, buit I must get DHCP and WLC communications up to b4, I even worry about security...

  However, ym question lies in the connection to the LAP to the switch...does that need to be a trunk as well?
  

  No. an access port.

• The Port of the switch to ESX host configuration

  I have a switch that connects to a physical server used in

  virtualization.  This means that virtual machines with IP addresses on

  several subnets will send layer 2 frames to this switch.

  However, in an attempt to reduce the number of network adapters on the server

  It is.   If there is only one card NETWORK in this physics

  Server connected to a physical switch port - it is possible to

  with a port on the handful of physical switch frames that come

  all virtual machines running on the physical server - when these VMs have IPs

  different subnets?  Or each separate subnet property intellectual logic requires a

  switch port separated to manage its images and its own on physical NETWORK card

  the server used for virtualization?

  Thanks for your comments

  Yes, you need to configure the physical switch port as a trunk and then configure the VLAN tagging on your Exchange Configuration-> Networking.

  If you have found this helpful at all prices please points using the correct or useful!  Thank you!

• Security ports SG 300 - 52-2 Mac addresses on Port 1

  Hello

  I have a 300-52 52-Port Gigabit Managed Switch Cisco SG. On the switch, I have two ports that are connected to the vlan comments.

  Now, I want to activate the safety of port on both ports. Is it possible to allow two addresses on a port?

  This is because there are two users who use this two ports. But the organizers can't users use the same all the time.

  Thank you and best regards,

  Dominique

  Hi Dominique, to add to the post of Christopher, if you wait 2 addresses on a port, but these 2 connections can connect to a different port, you can configure security of the static ports or dynamic for these ports.

  Here are 2 documents to help you.

  https://supportforums.Cisco.com/docs/doc-27720

  https://supportforums.Cisco.com/docs/doc-27753

  If you choose to use static MAC entries you can duplicate entries for the different interfaces.

  In addition, as an alternative, if you know the IP address and MAC address you can use dynamic arp inspection and achieve similar results much more strictly.

  -Tom
  Please mark replied messages useful

• The WAN Port is communicating with the Ethernet switch?

  I have a Comcast gateway that the router is disabled in so it acts only as a modem. This is related to an Airport Extreme, which serves as my router via the WAN on the AE port. I created a different WAP with a Capsule temporal from the airport, located downstairs with an Ethernet cable from one of the Ethernet ports on the AE to the WAN on the TC port. I think it's what we call a 'roaming network.

  My question is, can I connect my switch Gigabit 8 ports in one of the Ethernet ports on the TC to complete connections wired to all devices connected on it, or should I first connect EI to the switch 8 ports and then connect the switch to the port WAN TC to complete my network "roaming"? In other words, plug it into the port WAN AE or TC still allows you to use other Ethernet ports as a switch?

  Thank you!

  can I plug my Gigabit 8 ports switch in one of the ports Ethernet on the TC to complete wired connections to all devices connected on it

  Yes, assuming that the TC has been configured to run in Bridge Mode, which would be normal.

  or should I first connect EI to the switch 8 ports and then connect the switch to the TC WAN port to complete my network "roaming"?

  It would be considered preferable to wiring, if it is convenient to do so.  For example, in the configuration of the wiring in the previous example just above... If there is a problem with the time Capsule, then all devices connected to the switch to the time Capsule would have a problem as well.

  If the switch is connected to the AirPort Extreme, and the TC is then connected to the switch... If the TC has a problem, the other devices connected to the switch of will not be affected.