3Com WX3000 Series Unified Switches Switching Engine Operation Manual Manual Version: 6W100 www.3com.
Copyright © 2009, 3Com Corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from 3Com Corporation. 3Com Corporation reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of 3Com Corporation to provide notification of such revision or change.
About This Manual Organization 3Com WX3000 Series Unified Switches consists of three models: the WX3024 , the WX3010 and the WX3008. 3Com WX3000 Series Unified Switches Switching Engine Operation Manual is organized as follows: Part Contents 1 CLI Introduces the command hierarchy, command view and CLI features of the WX3000 Series Unified Switches Switching Engine. 2 Login Introduces the ways to log into an WX3000 Series Unified Switches Switching Engine.
Part Contents 24 SNMP-RMON Introduces the configuration for network management through SNMP and RMON 25 Multicast Introduces IGMP snooping and the related configuration. 26 NTP Introduces NTP and the related configuration. 27 SSH Introduces SSH2.0 and the related configuration. 28 File System Management Introduces basic configuration for file system management. 29 FTP-SFTP-TFTP Introduces basic configuration for FTP, SFTP and TFTP, and the applications.
Convention Description &<1-n> The argument(s) before the ampersand (&) sign can be entered 1 to n times. # A line starting with the # sign is comments. GUI conventions Convention Description Boldface Window names, button names, field names, and menu items are in Boldface. For example, the New User window appears; click OK. > Multi-level menus are separated by angle brackets. For example, File > Create > Folder. Symbols Convention Description Means reader be extremely careful.
Manual 3Com WX3000 Series Unified Switches Web-Based Configuration Manual Description Introduces the Web-based functions of the access control engine of WX3000 series unified switches access controller engines. Obtaining Documentation You can access the most up-to-date 3Com product documentation on the World Wide Web at this URL: http://www.3com.com.
Table of Contents 1 CLI Configuration ······································································································································1-1 Introduction to the CLI·····························································································································1-1 Command Hierarchy ·······························································································································1-1 Switching User Levels ·············
1 CLI Configuration The sample output information in this manual was created on the WX3024. The output information on your device may vary. Introduction to the CLI A command line interface (CLI) is a user interface to interact with a device. Through the CLI on a device, a user can enter commands to configure the device and check output information to verify the configuration.
z Manage level (level 3): Commands at this level are associated with the basic operation modules and support modules of the system. These commands provide support for services. Commands concerning file system, FTP/TFTP/XModem downloading, user management, and level setting are at this level. Users logged into the device fall into four user levels, which correspond to the four command levels respectively. Users at a specific level can only use the commands at the same level or lower levels.
Configuration example After a general user telnets to the device, his/her user level is 0. Now, the network administrator wants to allow general users to switch to level 3, so that they are able to configure the device. # A level 3 user sets a switching password for user level 3. system-view [device] super password level 3 simple 123 # A general user telnets to the device, and then uses the set password to switch to user level 3.
# Change the tftp get command in user view (shell) from level 3 to level 0. (Originally, only level 3 users can change the level of a command.) system-view [device] command-privilege level 0 view shell tftp [device] command-privilege level 0 view shell tftp 192.168.0.1 [device] command-privilege level 0 view shell tftp 192.168.0.1 get [device] command-privilege level 0 view shell tftp 192.168.0.1 get bootrom.
View Available operation Prompt example 1000 Mbps Ethernet port view: Ethernet port view Configure Ethernet port parameters [device-GigabitEth ernet1/0/1] 10 Gigabit Ethernet port view: [device-TenGigabit Ethernet1/1/1] Enter method Execute the interface gigabitethernet command in system view. Execute the interface tengigabitethernet command in system view. VLAN view Configure VLAN parameters [device-vlan1] Execute the vlan command in system view.
Available operation Prompt example Edit the RSA public key for SSH users [device-rsa-key-co de] Edit the RSA or DSA public key for SSH users [device-peer-key-c ode] Basic ACL view Define rules for a basic ACL (with ID ranging from 2000 to 2999) [device-acl-basic-2 000] Execute the acl number command in system view. Advanced ACL view Define rules for an advanced ACL (with ID ranging from 3000 to 3999) [device-acl-adv-30 00] Execute the acl number command in system view.
Available operation View QinQ view Configure QinQ parameters Prompt example [device-GigabitEth ernet1/0/1-vid-20] Enter method Execute the vlan-vpn vid command in Ethernet port view. The vlan-vpn enable command should be first executed. Quit method Execute the quit command to return to Ethernet port view. Execute the return command to return to user view. The shortcut key combination Ctrl+Z is equivalent to the return command.
timezone Configure time zone If the question mark (?) is at an argument position in the command, the description of the argument will be displayed on your terminal. [device] interface vlan-interface ? <1-4094> VLAN interface number If only is displayed after you enter a question mark (?), it means no parameter is available at the ? position, and you can enter and execute the command directly.
By default, the CLI can store up to 10 latest executed commands for each user. You can view the command history by performing the operations listed in Table 1-3. Table 1-3 View history commands Purpose z Operation Remarks Display the latest executed history commands Execute the display history-command command This command displays the command history. Recall the previous history command Press the up arrow key or Ctrl+P This operation recalls the previous history command (if available).
Table 1-5 Edit operations Press… To… A common key Insert the corresponding character at the cursor position and move the cursor one character to the right if the command is shorter than 254 characters. Backspace key Delete the character on the left of the cursor and move the cursor one character to the left. Left arrow key or Ctrl+B Move the cursor one character to the left. Right arrow key or Ctrl+F Move the cursor one character to the right.
Table of Contents 1 Logging In to the Switching Engine ········································································································1-1 Logging In to the Switching Engine·········································································································1-1 Introduction to the User Interface············································································································1-1 Supported User Interfaces ··································
Configuring Source IP Address for Telnet Service Packets ···································································6-1 Displaying Source IP Address Configuration··························································································6-2 7 User Control ···············································································································································7-1 Introduction ·········································································
1 Logging In to the Switching Engine The sample output information in this manual was created on the WX3024. The output information on your device may vary.
User Interface Index Two kinds of user interface index exist: absolute user interface index and relative user interface index. 1) The absolute user interface indexes are as follows: z The absolute AUX user interfaces is numbered 0. z VTY user interface indexes follow AUX user interface indexes. The first absolute VTY user interface is numbered 1, the second is 2, and so on. 2) A relative user interface index can be obtained by appending a number to the identifier of a user interface type.
To do… Use the command… Display the information about the current user interface/all user interfaces display users [ all ] Display the physical attributes and configuration of the current/a specified user interface display user-interface [ type number | number ] Display the information about the current web users display web users Remarks Optional 1-3 You can execute the display command in any view.
2 Logging In Through OAP OAP Overview As an open software and hardware system, Open Application Architecture (OAA) provides a set of complete standard software and hardware interfaces. The third party vendors can develop products with special functions. These products can be compatible with each other as long as they conform to the OAA interface standards. Therefore the functions of single network product can be expanded and the users can get more benefits.
Therefore, when you use the NMS to manage the access control engine and the switching engine on the same interface, you must first obtain the management IP addresses of the two SNMP agents and obtain the link relationship between them, and then you can access the two agents. By default, the management IP address of an OAP module is not configured.
Resetting the OAP Software System If the operating system works abnormally or is under other anomalies, you can reset the OAP software system. Follow these steps to reset the OAP software system: To do… Reset the OAP software system Use the command… oap reboot slot 0 Remarks Required Available in user view The reset operation may cause data loss and service interruption.
3 Logging In Through Telnet Introduction The device supports Telnet. You can manage and maintain the switching engine remotely by Telnetting to the switching engine. To log in to the switching engine through Telnet, the corresponding configuration is required on both the switching engine and the Telnet terminal. You can also log in to the switching engine through SSH. SSH is a secure shell added to Telnet. Refer to the SSH Operation for related information.
Configuration Description Optional Make terminal services available VTY terminal configuration Set the maximum number of lines the screen can contain By default, terminal services are available in all user interfaces Optional By default, the screen can contain up to 24 lines. Optional Set history command buffer size By default, the history command buffer can contain up to 10 commands. Set the timeout time of a user interface Optional The default timeout time is 10 minutes.
To improve security and prevent attacks to the unused Sockets, TCP 23 and TCP 22, ports for Telnet and SSH services respectively, will be enabled or disabled after corresponding configurations. z If the authentication mode is none, TCP 23 will be enabled, and TCP 22 will be disabled. z If the authentication mode is password, and the corresponding password has been set, TCP 23 will be enabled, and TCP 22 will be disabled.
To do… Use the command… Remarks Optional Set the history command buffer size history-command max-size value The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default. Optional The default timeout time of a user interface is 10 minutes.
# Specify commands of level 2 are available to users logging in through VTY 0. [device-ui-vty0] user privilege level 2 # Configure Telnet protocol is supported. [device-ui-vty0] protocol inbound telnet # Set the maximum number of lines the screen can contain to 30. [device-ui-vty0] screen-length 30 # Set the maximum number of commands the history command buffer can store to 20. [device-ui-vty0] history-command max-size 20 # Set the timeout time to 6 minutes.
To do… Use the command… Remarks Optional Set the history command buffer size history-command max-size value The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default. Optional The default timeout time of a user interface is 10 minutes.
[device-ui-vty0] authentication-mode password # Set the local password to 123456 (in plain text). [device-ui-vty0] set authentication password simple 123456 # Specify commands of level 2 are available to users logging in to VTY 0. [device-ui-vty0] user privilege level 2 # Configure Telnet protocol is supported. [device-ui-vty0] protocol inbound telnet # Set the maximum number of lines the screen can contain to 30.
To do… Enter one or more VTY user interface views Use the command… user-interface vty first-number [ last-number ] Remarks — Required Configure to authenticate users locally or remotely authentication-mode scheme [ commandauthorization ] The specified AAA scheme determines whether to authenticate users locally or remotely. Users are authenticated locally by default.
Table 3-4 Determine the command level when users logging in to the switching engine are authenticated in the scheme mode Scenario Authentication mode User type VTY users that are AAA/RADIUS authenticated or locally authenticated Command Command level The user privilege level level command is not executed, and the service-type command does not specify the available command level.
Refer to AAA Operation and SSH Operation of this manual for information about AAA, RADIUS, and SSH. Configuration Example Network requirements As shown in Figure 3-3, assume a current user logs in using the oap connect slot 0 command and the user level is set to the manage level (level 3). Perform the following configurations for users logging in to VTY 0 using Telnet. z Configure the local user name as guest. z Set the authentication password of the local user to 123456 (in plain text).
[device-ui-vty0] protocol inbound telnet # Set the maximum number of lines the screen can contain to 30. [device-ui-vty0] screen-length 30 # Set the maximum number of commands the history command buffer can store to 20. [device-ui-vty0] history-command max-size 20 # Set the timeout time to 6 minutes.
z Perform the following operations in the terminal window to assign IP address 202.38.160.90/24 to VLAN–interface 1 of the access control engine. system-view [device] interface Vlan-interface 1 [device-Vlan-interface1] ip address 202.38.160.90 255.255.255.0 z Log in to the switching engine of the device using the oap connect slot 0 command. oap connect slot 0 Connected to OAP! z Configure the IP address of VLAN-interface 1 of the switching engine of the device as 202.38.160.92/24.
Figure 3-7 Launch Telnet 5) If the password authentication mode is specified, enter the password when the Telnet window displays “Login authentication” and prompts for login password. The CLI prompt (such as ) appears if the password is correct.
1) Perform Telnet-related configuration on the switching engine operating as the Telnet server. For details, refer to Telnet Configuration with Authentication Mode Being None, Telnet Configuration with Authentication Mode Being Password, and Telnet Configuration with Authentication Mode Being Scheme. 2) Telnet to the access control engine as the Telnet client.
4 Logging In from the Web-Based Network Management System When logging in from the Web-based network management system, go to these sections for information you are interested in: z Introduction z Setting Up a Web Configuration Environment z Configuring the Login Banner z Enabling/Disabling the WEB Server Introduction The device has a Web server built in.
Setting Up a Web Configuration Environment Your WX series access controller products were delivered with a factory default configuration. This configuration allows you to log into the built-in Web-based management system of the access controller product from a Web browser on a PC by inputting http://192.168.0.101 in the address bar of the browser. The default login username and password are both admin. After selecting your desired language, you can log in to the Web interface to make configuration.
Figure 4-1 Web interface of the access controller engine 3) Set up a Web configuration environment, as shown in Figure 4-2. Figure 4-2 Set up a Web configuration environment 4) Log in to the switching engine through IE. Launch IE on the Web-based network management terminal (your PC) and enter http://192.168.0.101 in the address bar. (Make sure a route is available between the Web-based network management terminal and the switching engine.
configured by the header command, a user logging in through Web directly enters the user login authentication page. Follow these steps to configure the login banner: To do… Enter system view Configure the banner to be displayed when a user logs in through Web Use the command… system-view Remarks — Required header login text By default, no login banner is configured. Configuration Example Network requirements As shown in Figure 4-4, z A user logs in to the switching engine through Web.
Figure 4-5 Banner page displayed when a user logs in to the switching engine through Web Click Continue to enter user login authentication page. You will enter the main page of the Web-based network management system if the authentication succeeds.
5 Logging In from NMS Introduction You can also log in to the switching engine from a network management station (NMS), and then configure and manage the switching engine through the agent module on the switch. Simple network management protocol (SNMP) is applied between the NMS and the agent. Refer to the SNMP-RMON part for related information. To log in to the switching engine from an NMS, you need to perform related configuration on both the NMS and the switching engine.
6 Configuring Source IP Address for Telnet Service Packets Overview You can configure source IP address or source interface for the Telnet server and Telnet client. This provides a way to manage services and enhances security. The source IP address specified for Telnet service packets is the IP address of a Loopback interface or VLAN interface.
To do… Specify a source interface for Telnet client Use the command… Remarks telnet source-interface interface-type interface-number Optional When configuring a source IP address for Telnet packets, ensure that: z The source IP address must be one on the local device. z The source interface must already exist. z A reachable route is available between the source IP address (or the source interface) specified for the Telnet server or client and the Telnet client or server.
7 User Control Refer to the ACL part for information about ACL. Introduction The switching engine provides ways to control different types of login users, as listed in Table 7-1. Table 7-1 Ways to control different types of login users Login mode Telnet SNMP Control method Implementation Reference By source IP address Through basic ACLs Controlling Telnet Users by Source IP Addresses.
To do… Use the command… Remarks Enter system view system-view — Create a basic ACL or enter basic ACL view acl number acl-number [ match-order { config | auto } ] As for the acl number command, the config keyword is specified by default.
Controlling Telnet Users by Source MAC Addresses Controlling Telnet users by source MAC addresses is achieved by applying Layer 2 ACLs, which are numbered from 4000 to 4999.
Controlling Network Management Users by Source IP Addresses You can manage the device through network management software. Network management users can access switching engines through SNMP. You need to perform the following two operations to control network management users by source IP addresses.
You can specify different ACLs while configuring the SNMP community name, SNMP group name, and SNMP user name. As SNMP community name is a feature of SNMPv1 and SNMPv2c, the specified ACLs in the command that configures SNMP community names (the snmp-agent community command) take effect in the network management systems that adopt SNMPv1 or SNMPv2c.
z Applying the ACL to control Web users Prerequisites The controlling policy against Web users is determined, including the source IP addresses to be controlled and the controlling actions (permitting or denying). Controlling Web Users by Source IP Addresses Controlling Web users by source IP addresses is achieved by applying basic ACLs, which are numbered from 2000 to 2999.
Configuration procedure # Define a basic ACL. system-view [device] acl number 2030 [device-acl-basic-2030] rule 1 permit source 10.110.100.52 0 [device-acl-basic-2030] quit # Apply ACL 2030 to only permit the Web users sourced from the IP address of 10.110.100.52 to access the switching engine.
Table of Contents 1 Configuration File Management···············································································································1-1 Introduction to Configuration File ············································································································1-1 Management of Configuration File··········································································································1-2 Saving the Current Configuration ··························
1 Configuration File Management The sample output information in this manual was created on the WX3024. The output information on your device may vary. Introduction to Configuration File A configuration file records and stores user configurations performed to the device. It also enables users to check device configurations easily. Types of configuration The configuration of a device falls into two types: z Saved configuration, a configuration file used for initialization.
can configure a file to have both main and backup attribute, but only one file of either main or backup attribute is allowed on a device. The following three situations are concerned with the main/backup attributes: When saving the current configuration, you can specify the file to be a main or backup or normal z configuration file. When removing a configuration file from a device, you can specify to remove the main or backup z configuration file.
z Safe mode. This is the mode when you use the save command with the safely keyword. The mode saves the file slower but can retain the original configuration file in the device even if the device reboots or the power fails during the process. The configuration file to be used for next startup may be lost if the device reboots or the power fails during the configuration file saving process. In this case, the device reboots without loading any configuration file.
To do… Erase the startup configuration file from the storage device Use the command… reset saved-configuration [ backup | main ] Remarks Required Available in user view You may need to erase the configuration file for one of these reasons: z After you upgrade software, the old configuration file does not match the new software. z The startup configuration file is corrupted or not the one you needed.
The configuration file must use “.cfg” as its extension name and the startup configuration file must be saved at the root directory of the device.
Table of Contents 1 VLAN Overview ··········································································································································1-1 VLAN Overview·······································································································································1-1 Introduction to VLAN ·······················································································································1-1 Advantages of VLANs ····················
1 VLAN Overview z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. VLAN Overview Introduction to VLAN The traditional Ethernet is a broadcast network, where all hosts are in the same broadcast domain and connected with each other through hubs or switches.
of network layer devices, such as routers and Layer 3 switches. Figure 1-1 illustrates a VLAN implementation. Figure 1-1 A VLAN implementation Router Switch VLAN A Switch VLANB VLAN A VLAN A VLANB VLAN B Advantages of VLANs Compared with the traditional Ethernet, VLAN enjoys the following advantages. z Broadcasts are confined to VLANs. This decreases bandwidth consumption and improves network performance. z Network security is improved.
Figure 1-2 Encapsulation format of traditional Ethernet frames DA&SA Type Data In Figure 1-2 DA refers to the destination MAC address, SA refers to the source MAC address, and Type refers to the upper layer protocol type of the packet. IEEE 802.1Q protocol defines that a 4-byte VLAN tag is encapsulated after the destination MAC address and source MAC address to show the information about VLAN.
After VLANs are configured on a switch, the MAC address learning of the switch has the following two modes. z Shared VLAN learning (SVL): the switch records all the MAC address entries learnt by ports in all VLANs to a shared MAC address forwarding table. Packets received on any port of any VLAN are forwarded according to this table. z Independent VLAN learning (IVL): the switch maintains an independent MAC address forwarding table for each VLAN.
The link type of a port on the device can be one of the following: access, trunk, and hybrid. For the three types of ports, the process of being added into a VLAN and the way of forwarding packets are different. For details, refer to the “Port Basic Configuration” part of the manual. Port-based VLANs are easy to implement and manage and applicable to hosts with relatively fixed positions.
The switch identifies whether a packet is an Ethernet II packet or an 802.2/802.3 packet according to the ranges of the two fields. Extended encapsulation formats of 802.2/802.3 packets 802.2/802.3 packets have the following three extended encapsulation formats: z 802.3 raw encapsulation: only the length field is encapsulated after the source and destination address field, followed by the upper layer data. No other fields are included. Figure 1-6 802.
Procedure for the Switch to Judge Packet Protocol Figure 1-9 Procedure for the switch to judge packet protocol Receive packets Ethernet II encapsulation 0x0600 to 0xFFFF Type(Length) field 0x05DD to 0x05FF Invalid packets that cannot be matched 0 to 0x05DC Match the type value 802.2/802.3 encapsulation Control field Invalid packets that cannot be matched Value is not 3 Value is 3 802.3 raw encapsulation Both are FF dsap/ssap value Both are AA 802.2 SNAP encapsulation Other values 802.
The protocol template is the standard to determine the protocol to which a packet belongs. Protocol templates include standard templates and user-defined templates: z The standard template adopts the RFC-defined packet encapsulation formats and values of some specific fields as the matching criteria. z The user-defined template adopts the user-defined encapsulation formats and values of some specific fields as the matching criteria.
2 VLAN Configuration VLAN Configuration Configuration Task List Complete the following tasks to configure VLAN: Task Remarks Basic VLAN Configuration Required Basic VLAN Interface Configuration Optional Displaying and Maintaining VLAN Optional Basic VLAN Configuration Follow these steps to make basic VLAN configuration: To do… Use the command… Remarks Enter system view system-view — Create multiple VLANs in batch vlan { vlan-id1 to vlan-id2 | all } Optional Create a VLAN and enter VLAN vi
Basic VLAN Interface Configuration Configuration prerequisites Before configuring a VLAN interface, create the corresponding VLAN. Configuration procedure Follow these steps to make basic VLAN interface configuration: To do… Use the command… Enter system view system-view Create a VLAN interface and enter VLAN interface view interface Vlan-interface vlan-id Remarks — Required By default, there is no VLAN interface on a switch.
Configuring a Port-Based VLAN Configuring a Port-Based VLAN Configuration prerequisites Create a VLAN before configuring a port-based VLAN. Configuration procedure Follow these steps to configure a port-based VLAN: To do… Use the command… Remarks Enter system view system-view — Enter VLAN view vlan vlan-id — Add Ethernet ports to the specific VLAN Required port interface-list By default, all the ports belong to the default VLAN (VLAN 1). The commands above are effective for access ports only.
Configuration procedure z Configure Switch A. # Create VLAN 101, specify its descriptive string as “DMZ”, and add GigabitEthernet 1/0/1 to VLAN 101. system-view [SwitchA] vlan 101 [SwitchA-vlan101] description DMZ [SwitchA-vlan101] port GigabitEthernet 1/0/1 [SwitchA-vlan101] quit # Create VLAN 201, and add GigabitEthernet 1/0/2 to VLAN 201. [SwitchA] vlan 201 [SwitchA-vlan201] port GigabitEthernet 1/0/2 [SwitchA-vlan201] quit z Configure Switch B.
For the command of configuring a port link type (port link-type) and the command of allowing packets of certain VLANs to pass through a port (port trunk permit), refer to the section of configuring Ethernet ports in the “Port Basic Configuration” part of this document.
z Because the IP protocol is closely associated with the ARP protocol, you are recommended to configure the ARP protocol type when configuring the IP protocol type and associate the two protocol types with the same port to avoid that ARP packets and IP packets are not assigned to the same VLAN, which will cause IP address resolution failure.
For the operation of adding a hybrid port to a VLAN in the untagged way (when forwarding a packet, the port removes the VLAN tag of the packet), refer to the section of configuring Ethernet ports in the “Port Basic Configuration” part of this manual.
Configuration procedure # Create VLAN 100 and VLAN 200, and add GigabitEthernet 1/0/11 and GigabitEthernet 1/0/12 to VLAN 100 and VLAN 200 respectively. system-view [device] vlan 100 [device-vlan100] port GigabitEthernet 1/0/11 [device-vlan100] quit [device] vlan 200 [device-vlan200] port GigabitEthernet 1/0/12 # Configure protocol templates for VLAN 200 and VLAN 100, matching AppleTalk protocol and IP protocol respectively.
VLAN ID Protocol-Index Protocol-Type 100 0 ip 100 1 ethernetii etype 0x0806 200 0 at The above output information indicates that GigabitEthernet 1/0/10 has already been associated with the corresponding protocol templates of VLAN 100 and VLAN 200.
Table of Contents 1 Auto Detect Configuration························································································································1-1 Introduction to the Auto Detect Function·································································································1-1 Auto Detect Configuration·······················································································································1-2 Auto Detect Basic Configuration ······················
1 Auto Detect Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary.
Auto Detect Configuration Complete the following tasks to configure auto detect: Task Remarks Auto Detect Basic Configuration Required Auto Detect Implementation in Static Routing Optional Auto Detect Implementation in VLAN Interface Backup Optional Auto Detect Basic Configuration Follow these steps to configure the auto detect function: To do… Use the command… Remarks Enter system view system-view — Create a detected group and enter detected group view detect-group group-number Required Ad
Auto Detect Implementation in Static Routing You can bind a static route with a detected group. The Auto Detect function will then detect the reachability of the static route through the path specified in the detected group. z The static route is valid if the detected group is reachable. z The static route is invalid if the detected group is unreachable. You need to create the detected group before performing the following operations.
To do… Use the command… Remarks Enter system view system-view — Enter VLAN interface view interface Vlan-interface vlan-id — Enable the auto detect function to implement VLAN interface backup Required standby detect-group group-number This operation is only needed on the secondary VLAN interface.
system-view # Configure a static route to Switch A. [SwitchC] ip route-static 192.168.1.1 24 10.1.1.3 Configuration Example for Auto Detect Implementation in VLAN Interface Backup Network requirements z As shown in Figure 1-2, make sure the routes between Switch A, Switch B, and Switch C, and between Switch A, Switch D, and Switch C are reachable. z Create detected group 10 on Switch A to detect the connectivity between Switch B and Switch C.
Table of Contents 1 Voice VLAN Configuration························································································································1-1 Voice VLAN Overview·····························································································································1-1 How an IP Phone Works ·················································································································1-1 How the Device Identifies Voice Traffic··················
1 Voice VLAN Configuration The sample output information in this manual was created on the WX3024. The output information on your device may vary. Voice VLAN Overview Voice VLANs are VLANs configured specially for voice traffic. By adding the ports connected with voice devices to voice VLANs, you can have voice traffic transmitted within voice VLANs and perform QoS-related configuration for voice traffic as required, thus ensuring the transmission priority of voice traffic and voice quality.
Figure 1-1 Network diagram for IP phones DHCP Server2 ② DHCP Server1 ③ Call agent ① IP Phone As shown in Figure 1-1, the IP phone needs to work in conjunction with the DHCP server and the NCP to establish a path for voice data transmission. An IP phone goes through the following three phases to become capable of transmitting voice data.
3) After the IP phone acquires the IP address assigned by DHCP Server2, the IP phone establishes a connection to the NCP specified by DHCP Server1 and downloads corresponding software. After that, the IP phone can communicate properly. z An untagged packet carries no VLAN tag. z A tagged packet carries the tag of a VLAN. How the Device Identifies Voice Traffic The device determines whether a received packet is a voice packet by checking its source MAC address.
Processing mode of untagged packets sent by IP voice devices z Automatic mode. A WX3000 device automatically adds a port connecting an IP voice device to the voice VLAN by learning the source MAC address in the untagged packet sent by the IP voice device when it is powered on. The voice VLAN uses the aging mechanism to maintain the number of ports in the voice VLAN.
Table 1-2 Matching relationship between port types and voice traffic types Port voice VLAN mode Voice traffic type Port type Access Supported or not Not supported Supported Trunk Tagged voice traffic Automatic mode Supported Hybrid Access Untagged voice traffic Make sure the default VLAN of the port exists and is not a voice VLAN. And the access port permits the traffic of the default VLAN. Trunk Hybrid Access Make sure the default VLAN of the port exists and is not a voice VLAN.
Voice VLAN Configuration Configuration Prerequisites z Create the corresponding VLAN before configuring a voice VLAN. z VLAN 1 (the default VLAN) cannot be configured as a voice VLAN.
When the voice VLAN is working normally, if the device restarts, in order to make the established voice connections work normally, the system does not need to be triggered by the voice traffic to add the port in automatic mode to the local devices of the voice VLAN but does so immediately after the restart.
To do… Access port Add a port in manual mode to the voice VLAN Trunk or Hybrid port Use the command… Enter VLAN view vlan vlan-id Add the port to the VLAN port interface-list Enter port view interface interface-type interface-num Add the port to the VLAN Configure the voice VLAN to be the default VLAN of the port Remarks Required By default, all the ports belong to VLAN 1.
Displaying and Maintaining Voice VLAN To do… Use the command… Display the information about ports on which voice VLAN configuration fails display voice vlan error-info Display the voice VLAN configuration status display voice vlan status Display the currently valid OUI addresses display voice vlan oui Display the ports operating in the current voice VLAN display vlan vlan-id Remarks You can execute the display command in any view.
[DeviceA] voice vlan aging 100 # Add a user-defined OUI address 0011-2200-000 and set the description string to “test”. [DeviceA] voice vlan mac-address 0011-2200-0000 mask ffff-ff00-0000 description test # Enable the voice VLAN function globally. [DeviceA] voice vlan 2 enable # Configure the vocie VLAN to operate in automatic mode on GigabitEthernet 1/0/1. This operation is optional. By default, a voice VLAN operates in automatic mode on a port.
system-view [DeviceA] voice vlan security enable # Add a user-defined OUI address 0011-2200-000 and set the description string to “test”. [DeviceA] voice vlan mac-address 0011-2200-0000 mask ffff-ff00-0000 description test # Create VLAN 2 and configure it as a voice VLAN. [DeviceA] vlan 2 [DeviceA-vlan2] quit [DeviceA] voice vlan 2 enable # Configure GigabitEthernet 1/0/1 to operate in manual mode.
Table of Contents 1 GVRP Configuration ··································································································································1-1 Introduction to GVRP ······························································································································1-1 GARP···············································································································································1-1 GVRP·································
1 GVRP Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Introduction to GVRP GARP VLAN registration protocol (GVRP) is an implementation of generic attribute registration protocol (GARP). GARP is introduced as follows.
Leave messages, LeaveAll messages, together with Join messages ensure attribute information can be deregistered and re-registered. Through message exchange, all the attribute information to be registered can be propagated to all the GARP-enabled switches in the same LAN. 2) GARP timers Timers determine the intervals of sending different types of GARP messages. GARP defines four timers to control the period of sending GARP messages.
Figure 1-1 Format of GARP packets DA DA length 1 DSAP SSAP Ctrl N 3 Protocol ID Message 1 1 ... 2 Attribute Type Ethernet Frame PDU Message N GARP PDU structure End Mark N Message structure Attribute List 1 N Attribute 1 ... Attribute N Attribute List structure End Mark 1 2 3 N Attribute Length Attribute Event Attribute Vlaue Attribute structure The following table describes the fields of a GARP packet.
GVRP As an implementation of GARP, GARP VLAN registration protocol (GVRP) maintains dynamic VLAN registration information and propagates the information to the other devices through GARP. With GVRP enabled on a device, the VLAN registration information received by the device from other devices is used to dynamically update the local VLAN registration information, including the information about the VLAN members, the ports through which the VLAN members can be reached, and so on.
Configuration procedure Follow these steps to enable GVRP on an Ethernet port: To do… Use the command… Enter system view system-view Enable GVRP globally gvrp Enter Ethernet port view interface interface-type interface-number Enable GVRP on the port gvrp Remarks — Required By default, GVRP is disabled globally. — Required By default, GVRP is disabled on the port. After you enable GVRP on a trunk port, you cannot change the port to a different type.
Table 1-2 Relations between the timers Timer Lower threshold Upper threshold Hold 10 centiseconds This upper threshold is less than or equal to one-half of the timeout time of the Join timer. You can change the threshold by changing the timeout time of the Join timer. Join This lower threshold is greater than or equal to twice the timeout time of the Hold timer. You can change the threshold by changing the timeout time of the Hold timer.
GVRP Configuration Example GVRP Configuration Example Network requirements z Enable GVRP on all the switches in the network so that the VLAN configurations on Switch C and Switch E can be applied to all switches in the network, thus implementing dynamic VLAN information registration and refresh, as shown in Figure 1-2. z By configuring the GVRP registration modes of specific Ethernet ports, you can enable the corresponding VLANs in the switched network to communicate with each other.
[SwitchA-GigabitEthernet1/0/3] port trunk permit vlan all # Enable GVRP on GigabitEthernet 1/0/3. [SwitchA-GigabitEthernet1/0/3] gvrp [SwitchA-GigabitEthernet1/0/3] quit 2) Configure Switch B # The configuration procedure of Switch B is similar to that of Switch A and is thus omitted. 3) Configure Switch C # Enable GVRP on Switch C, which is similar to that of Switch A and is thus omitted. # Create VLAN 5.
[SwitchE-GigabitEthernet1/0/1] gvrp registration fixed # Display the VLAN information dynamically registered on Switch A. [SwitchA] display vlan dynamic Total 3 dynamic VLAN exist(s). The following dynamic VLANs exist: 5, 7, 8, # Display the VLAN information dynamically registered on Switch B. [SwitchB] display vlan dynamic Total 3 dynamic VLAN exist(s). The following dynamic VLANs exist: 5, 7, 8, # Display the VLAN information dynamically registered on Switch E.
Table of Contents 1 Basic Port Configuration ··························································································································1-1 Ethernet Port Overview ···························································································································1-1 Types and Numbers of Ethernet Ports ····························································································1-1 Combo Ports Mapping Relations······························
1 Basic Port Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Ethernet Port Overview Types and Numbers of Ethernet Ports Table 1-1 lists the types and numbers of the Ethernet ports available on the WX3000 series devices.
Link Types of Ethernet Ports An Ethernet port of the device can operate in one of the following three link types: z Access: An access port can belong to only one VLAN, and is generally used to connect user PCs. z Trunk: A trunk port can belong to more than one VLAN. It can receive/send packets from/to multiple VLANs, and is generally used to connect another device. z Hybrid: A hybrid port can belong to more than one VLAN.
Table 1-3 Processing of incoming/outgoing packets Processing of an incoming packet Port type If the packet does not carry a VLAN tag If the packet carries a VLAN tag z Access Processing of an outgoing packet z If the VLAN default VLAN packet. If the VLAN default VLAN packet. ID is just the ID, receive the ID is not the ID, discard the Deprive the tag from the packet and send the packet. z z Trunk Receive the packet and add the default tag to the packet.
To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — By default, the port is enabled. Enable the Ethernet port undo shutdown Set the description of the Ethernet port description text By default, no description is defined for an Ethernet port. Set the duplex mode of the Ethernet port duplex { auto | full | half } The port defaults to auto (autonegotiation) mode.
To do… Configure the available auto-negotiation speed(s) for the port z Use the command… Remarks Optional speed auto [ 10 | 100 | 1000 ]* By default, the port speed is auto-negotiated. Only ports on the front panel of the device support the auto-negotiation speed configuration feature. And ports on the extended interface card do not support this feature currently.
To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Enable flow control on the Ethernet port Required flow-control By default, flow control is not enabled on a port.
To do… Use the command… Remarks Enter system view System-view — Enter Ethernet port view interface interface-type interface-number — Set the link type for the port as trunk port link-type trunk Required Optional Set the default VLAN ID for the trunk port port trunk pvid vlan vlan-id Add the current trunk port into the specified VLAN port trunk permit vlan { vlan-id-list | all } By default, the VLAN of a trunk port is VLAN 1.
system-view [device] interface GigabitEthernet 1/0/1 [device-GigabitEthernet1/0/1] shutdown [device-GigabitEthernet1/0/1] %Apr 2 08:11:14:220 2000 device L2INF/5/PORT LINK STATUS CHANGE:- 1 - GigabitEthernet1/0/1 is DOWN [device-GigabitEthernet1/0/1] undo shutdown [device-GigabitEthernet1/0/1] %Apr 2 08:11:32:253 2000 device L2INF/5/PORT LINK STATUS CHANGE:- 1 - GigabitEthernet1/0/1 is UP # Disable GigabitEthernet 1/0/1 from outputting Up/Down log information, execute the shutdown command or t
configuration command once on one port and that configuration will apply to all ports in the port group. This effectively reduces redundant configurations. A Port group could be manually created by users. Multiple Ethernet ports can be added to the same port group but one Ethernet port can only be added to one port group.
To do… Configure the system to run loopback detection on all VLANs for the trunk and hybrid ports z Use the command… Remarks Optional loopback-detection per-vlan enable By default, the system runs loopback detection only on the default VLAN for the trunk and hybrid ports. To enable loopback detection on a specific port, you must use the loopback-detection enable command in both system view and the specific port view.
Enabling the System to Test Connected Cable You can enable the system to test the cable connected to a specific port. The test result will be returned in five minutes. The system can test these attributes of the cable: Receive and transmit directions (RX and TX), short circuit/open circuit or not, the length of the faulty cable.
Displaying and Maintaining Ethernet Ports To do… Use the command… Display port configuration information display interface [ interface-type | interface-type interface-number ] Display information for a specified port group display port-group group-id Display port loopback detection state display loopback-detection Display brief configuration information about one or all ports display brief interface [ interface-type [ interface-number ] ] [ | { begin | include | exclude } regular-expression ] Disp
[device] vlan 100 # Configure the default VLAN ID of GigabitEthernet 1/0/1 as 100. [device-GigabitEthernet1/0/1] port trunk pvid vlan 100 Troubleshooting Ethernet Port Configuration Symptom: Default VLAN ID configuration failed. Solution: Take the following steps. z Use the display interface or display port command to check if the port is a trunk port or a hybrid port. If not, configure it as a trunk port or a hybrid port. z Configure the default VLAN ID.
Table of Contents 1 Link Aggregation Configuration ··············································································································1-1 Overview ·················································································································································1-1 Introduction to Link Aggregation······································································································1-1 Introduction to LACP ······························
1 Link Aggregation Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary.
Operation Key An operation key of an aggregation port is a configuration combination generated by system depending on the configurations of the port (rate, duplex mode, other basic configuration, and management key) when the port is aggregated. 1) The selected ports in a manual/static aggregation group have the same operation key. 2) The management key of an LACP-enabled static aggregation port is equal to its aggregation group ID.
For an aggregation group: z When the rate or duplex mode of a port in the aggregation group changes, packet loss may occur on this port; z When the rate of a port decreases, if the port belongs to a manual or static LACP aggregation group, the port will be switched to the unselected state; if the port belongs to a dynamic LACP aggregation group, deaggregation will occur on the port.
Dynamic LACP Aggregation Group Introduction to dynamic LACP aggregation group A dynamic LACP aggregation group is automatically created and removed by the system. Users cannot add/remove ports to/from it. A port can participate in dynamic link aggregation only when it is LACP-enabled. Ports can be aggregated into a dynamic aggregation group only when they are connected to the same peer device and have the same basic configuration (such as rate and duplex mode).
Changing the system priority of a device may change the preferred device between the two parties, and may further change the states (selected or unselected) of the member ports of dynamic aggregation groups. Configuring port priority LACP determines the selected and unselected states of the dynamic aggregation group members according to the port IDs on the device with the preferred device ID.
A load-sharing aggregation group contains at least two selected ports, but a non-load-sharing aggregation group can only have one selected port at most, while others are unselected ports. Link Aggregation Configuration z The commands of link aggregation cannot be configured with the commands of port loopback detection feature at the same time. z The ports where the mac-address max-mac-count command is configured cannot be added to an aggregation group.
To do… Use the command… Remarks Optional Configure a description for the aggregation group link-aggregation group agg-id description agg-name Enter Ethernet port view interface interface-type interface-number — Add the Ethernet port to the aggregation group port link-aggregation group agg-id Required By default, an aggregation group has no description.
To do… Use the command… Remarks Configure a description for the aggregation group link-aggregation group agg-id description agg-name Enter Ethernet port view interface interface-type interface-number — Add the port to the aggregation group port link-aggregation group agg-id Required Optional By default, an aggregation group has no description.
To do… Use the command… Remarks Required Enable LACP on the port lacp enable By default, LACP is disabled on a port. Optional Configure the port priority lacp port-priority port-priority By default, the port priority is 32,768.
Figure 1-1 Network diagram for link aggregation configuration Switch A Link aggregation Switch B Configuration procedure 1) Adopting manual aggregation mode # Create manual aggregation group 1. system-view [device] link-aggregation group 1 mode manual # Add GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to aggregation group 1.
Note that, the three LACP-enabled ports can be aggregated into a dynamic aggregation group to implement load sharing only when they have the same basic configuration (such as rate and duplex mode and so on).
Table of Contents 1 Port Isolation Configuration ·····················································································································1-1 Port Isolation Overview ···························································································································1-1 Introduction to Port Isolation············································································································1-1 Port Isolation Configuration·····················
1 Port Isolation Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary.
z When a member port of an aggregation group is added to an isolation group, the other ports in the same aggregation group are added to the isolation group automatically. z When a member port of an aggregation group is deleted from an isolation group, the other ports in the same aggregation group are deleted from the isolation group automatically. Displaying and Maintaining Port Isolation To do… Use the command… Display the information about the Ethernet ports added to the isolation group.
system-view System View: return to User View with Ctrl+Z. [device] interface GigabitEthernet1/0/2 [device-GigabitEthernet1/0/2] port isolate [device-GigabitEthernet1/0/2] quit [device] interface GigabitEthernet1/0/3 [device-GigabitEthernet1/0/3] port isolate [device-GigabitEthernet1/0/3] quit [device] interface GigabitEthernet1/0/4 [device-GigabitEthernet1/0/4] port isolate [device-GigabitEthernet1/0/4] quit [device] # Display the information about the ports in the isolation group.
Table of Contents 1 Port Security Configuration······················································································································1-1 Port Security Overview····························································································································1-1 Introduction······································································································································1-1 Port Security Features·····················
1 Port Security Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Port Security Overview Introduction Port security is a security mechanism for network access control. It is an expansion to the current 802.1x and MAC address authentication.
Port Security Modes Table 1-1 describes the available port security modes. Table 1-1 Description of port security modes Security mode noRestriction Description Port security is disabled on the port and access to the port is not restricted. Feature In this mode, neither the NTK nor the intrusion protection feature is triggered. In this mode, a port can learn a specified number of MAC addresses and save those addresses as secure MAC addresses.
Security mode Description userLoginSecure In this mode, a port performs 802.1x authentication of users and services only one user passing 802.1x authentication at a time. userLoginSecure Ext In this mode, a port performs 802.1x authentication of users and services users passing 802.1x authentication. Feature Similar to the userLoginSecure mode, a port in this mode performs 802.1x authentication of users and services only one user passing 802.1x authentication.
Port Security Configuration Complete the following tasks to configure port security: Task Remarks Enabling Port Security Required Setting the Maximum Number of MAC Addresses Allowed on a Port Optional Setting the Port Security Mode Required Configuring Port Security Features Configuring the NTK feature Configuring intrusion protection Configuring the Trap feature Optional Choose one or more features as required.
Setting the Maximum Number of MAC Addresses Allowed on a Port Port security allows more than one user to be authenticated on a port. The number of authenticated users allowed, however, cannot exceed the configured upper limit.
To do… z Use the command… Enter Ethernet port view interface interface-type interface-number Set the port security mode port-security port-mode { autolearn | mac-and-userlogin-secure | mac-and-userlogin-secure-e xt | mac-authentication | mac-else-userlogin-secure | mac-else-userlogin-secure-e xt | secure | userlogin | userlogin-secure | userlogin-secure-ext | userlogin-secure-or-mac | userlogin-secure-or-mac-ext | userlogin-withoui } Remarks — Required By default, a port operates in noRestriction mo
The WX3000 series devices do not support the ntkonly NTK feature.
To do… Use the command… Enter system view system-view Enable sending traps for the specified type of event port-security trap { addresslearned | intrusion | dot1xlogon | dot1xlogoff | dot1xlogfailure | ralmlogon | ralmlogoff | ralmlogfailure } Remarks — Required By default, no trap is sent. Ignoring the Authorization Information from the RADIUS Server After an 802.
The security MAC addresses manually configured are written to the configuration file; they will not get lost when the port is up or down. As long as the configuration file is saved, the security MAC addresses can be restored after the device reboots. Configuration prerequisites z Port security is enabled. z The maximum number of security MAC addresses allowed on the port is set. z The security mode of the port is set to autolearn.
z To ensure that Host can access the network, add the MAC address 0001-0002-0003 of Host as a security MAC address to the port in VLAN 1. z After the number of security MAC addresses reaches 80, the port stops learning MAC addresses. If any frame with an unknown MAC address arrives, intrusion protection is triggered and the port will be disabled and stay silent for 30 seconds.
2 Port Binding Configuration Port Binding Overview Introduction Port binding enables the network administrator to bind the MAC address and IP address of a user to a specific port. After the binding, the switch forwards only the packets received on the port whose MAC address and IP address are identical with the bound MAC address and IP address. This improves network security and enhances security monitoring.
Port Binding Configuration Example Network requirements As shown in Figure 2-1, it is required to bind the MAC and IP addresses of Host 1 to GigabitEthernet 1/0/1 on switch A, so as to prevent malicious users from using the IP address they steal from Host 1 to access the network. Figure 2-1 Network diagram for port binding configuration Switch B Switch A GE1/0/1 Host 2 Host 1 MAC: 0001- 0002-0003 IP Address: 10.12.1.1 Configuration procedure Configure switch A as follows: # Enter system view.
Table of Contents 1 DLDP Configuration ··································································································································1-1 DLDP Overview·······································································································································1-1 DLDP Fundamentals ·······················································································································1-2 Precautions During DLDP Configuration·········
1 DLDP Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. DLDP Overview You may have encountered unidirectional links in networking, as shown in Figure 1-1 and Figure 1-2.
Figure 1-2 Fiber correct connection/disconnection in one direction GE1/0/10 SwitchA GE1/0/11 GE1/0/10 SwitchB GE1/0/11 PC DLDP provides the following features: z As a link layer protocol, it works together with the physical layer protocols to monitor the link status of a device. While the auto-negotiation mechanism on the physical layer detects physical signals and faults; DLDP identifies peer devices and unidirectional links, and disables unreachable ports.
Status Description Probe DHCP sends packets to check if it is a unidirectional link. It enables the probe sending timer and an echo waiting timer for each target neighbor. Disable DLDP detects a unidirectional link, or finds (in enhanced mode) that a neighbor disappears. In this case, DLDP does not receive or send DLDP packets.
Timer Description In enhanced mode, if no packet is received from the neighbor when the entry aging timer expires, DLDP enables the enhanced timer for the neighbor. The timeout time for the enhanced timer is 10 seconds. The enhanced timer then sends one probe packets every one second and totally eight packets continuously to the neighbor.
Table 1-4 Types of packets sent by DLDP DLDP status Packet types Active Advertisement packets, including those with or without RSY tags Advertisement Advertisement packets Probe Probe packets 2) DLDP analyzes and processes received packets as follows: z In authentication mode, DLDP authenticates the packets, and discards those do not pass the authentication. DLDP processes the received DLDP packets.
DLDP neighbor state A DLDP neighbor can be in one of these two states: two way and unknown. You can check the state of a DLDP neighbor by using the display dldp command. Table 1-7 Description on the two DLDP neighbor states DLDP neighbor state Description two way The link to the neighbor operates properly. unknown The device is detecting the neighbor and the neighbor state is unknown. Precautions During DLDP Configuration z DLDP works only when the link is up.
To do… Use the command… Remarks Optional z By default, the delaydown timer expires after 1 second it is triggered. Set the delaydown timer dldp delaydown-timer delaydown-time Set the DLDP handling mode when an unidirectional link is detected dldp unidirectional-shutdown { auto | manual } Optional. By default, the handling mode is auto. Set the DLDP operating mode dldp work-mode { enhance | normal } Optional. By default, DLDP works in normal mode.
To do… Use the command… Enter system view system-view Reset the DLDP status of the system dldp reset Enter Ethernet port view interface interface-type interface-number Reset the DLDP status of a port dldp reset Remarks Optional This command only applies to the ports in DLDP down status. DLDP Network Example Network requirements As shown in Figure 1-3: z Switch A and Switch B are connected through two pairs of fibers.
[SwitchA-GigabitEthernet1/0/11] duplex full [SwitchA-GigabitEthernet1/0/11] speed 1000 [SwitchA-GigabitEthernet1/0/11] quit # Enable DLDP globally [SwitchA] dldp enable DLDP is enabled on all fiber ports except fabric ports.
Table of Contents 1 MAC Address Table Management············································································································1-1 Overview ·················································································································································1-1 Introduction to MAC Address Table ································································································1-1 Introduction to MAC Address Learning ·······················
1 MAC Address Table Management z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. z This chapter describes the management of static, dynamic, and blackhole MAC address entries.
1) As shown in Figure 1-1, User A and User B are both in VLAN 1. When User A communicates with User B, the packet from User A needs to be transmitted to GigabitEthernet 1/0/1. At this time, the device records the source MAC address of the packet, that is, the address “MAC-A” of User A to the MAC address table of the switch, forming an entry shown in Figure 1-2.
Figure 1-4 MAC address learning diagram (3) User C User B Geth 1/0/4 Geth 1/0/3 Geth 1/0/1 User A 4) At this time, the MAC address table of the device includes two forwarding entries shown in Figure 1-5. When forwarding the response packet, the device unicasts the packet instead of broadcasting it to User A through GigabitEthernet 1/0/1, because MAC-A is already in the MAC address table.
Aging timer only takes effect on dynamic MAC address entries. Entries in a MAC address table Entries in a MAC address table fall into the following categories according to their characteristics and configuration methods: z Static MAC address entry: Also known as permanent MAC address entry. This type of MAC address entries are added/removed manually and can not age out by themselves.
Configuring a MAC Address Entry You can add, modify, or remove a MAC address entry, remove all MAC address entries concerning a specific port, or remove specific type of MAC address entries (dynamic or static MAC address entries). You can add a MAC address entry in either system view or Ethernet port view.
Setting the Aging Time of MAC Address Entries Setting aging time properly helps effective utilization of MAC address aging. The aging time that is too long or too short affects the performance of the device. z If the aging time is too long, excessive invalid MAC address entries maintained by the device may fill up the MAC address table. This prevents the MAC address table from being updated with network changes in time. z If the aging time is too short, the device may remove valid MAC address entries.
To do… Set the maximum number of MAC addresses the port can learn Use the command… Remarks Required mac-address max-mac-count count By default, the number of the MAC addresses a port can learn is not limited. Specifying the maximum number of MAC addresses a port can learn disables centralized MAC address authentication and port security on the port.
Displaying and Maintaining MAC Address Table To do… Use the command… Display information about the MAC address table Display the aging time of the dynamic MAC address entries in the MAC address table Remarks display mac-address [ display-option ] display mac-address aging-time The display command can be executed in any view. Configuration Example Adding a Static MAC Address Entry Manually Network requirements The server connects to the device through GigabitEthernet 1/0/2.
Table of Contents 1 MSTP Configuration ··································································································································1-1 STP Overview ·········································································································································1-1 STP Overview··································································································································1-1 MSTP Overview ·························
Configuring Root Guard·················································································································1-37 Configuring Loop Guard ················································································································1-38 Configuring TC-BPDU Attack Guard ·····························································································1-38 Configuring BPDU Dropping ···········································································
1 MSTP Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. STP Overview STP Overview Functions of STP Spanning tree protocol (STP) is a protocol conforming to IEEE 802.1d. It aims to eliminate loops on data link layer in a local area network (LAN).
Upon network convergence, the root bridge generates and sends out configuration BPDUs periodically. Other devices just forward the configuration BPDUs received. This mechanism ensures the topological stability. 2) Root port On a non-root bridge device, the root port is the port with the lowest path cost to the root bridge. The root port is used for communicating with the root bridge. A non-root-bridge device has one and only one root port. The root bridge has no root port.
4) Path cost Path cost is a value used for measuring link capacity. By comparing the path costs of different links, STP selects the most robust links and blocks the other links to prune the network into a tree. How STP works STP identifies the network topology by transmitting configuration BPDUs between network devices. Configuration BPDUs contain sufficient information for network devices to complete the spanning tree calculation.
Step Description The device compares the configuration BPDUs of all the ports and chooses the optimum configuration BPDU. 2 Principle for configuration BPDU comparison: z The configuration BPDU that has the lowest root bridge ID has the highest priority. z If all the configuration BPDUs have the same root bridge ID, they will be compared for their root path costs.
When the network topology is stable, only the root port and designated ports forward traffic, while other ports are all in the blocked state – they only receive STP packets but do not forward user traffic. Once the root bridge, the root port on each non-root bridge and designated ports have been successfully elected, the entire tree-shaped topology has been constructed. The following is an example of how the STP algorithm works. The specific network diagram is shown in Figure 1-2.
Table 1-5 Comparison process and result on each device Device Comparison process z z Device A z z z z Device B z z Port AP1 receives the configuration BPDU of Device B {1, 0, 1, BP1}. Device A finds that the configuration BPDU of the local port {0, 0, 0, AP1} is superior to the configuration received message, and discards the received configuration BPDU. Port AP2 receives the configuration BPDU of Device C {2, 0, 2, CP1}.
Device Comparison process z z Port CP1 receives the configuration BPDU of Device A {0, 0, 0, AP2}. Device C finds that the received configuration BPDU is superior to the configuration BPDU of the local port {2, 0, 2, CP1}, and updates the configuration BPDU of CP1. Port CP2 receives the configuration BPDU of port BP2 of Device B {1, 0, 1, BP2} before the message was updated.
Figure 1-3 The final calculated spanning tree Device A With priority 0 AP 1 AP 2 5 BP 1 BP 2 4 Device B With priority 1 CP 2 Device C With priority 2 To facilitate description, the spanning tree calculation process in this example is simplified, while the actual process is more complicated.
For this reason, the protocol uses a state transition mechanism. Namely, a newly elected root port and the designated ports must go through a period, which is twice the forward delay time, before they transit to the forwarding state. The period allows the new configuration BPDUs to be propagated throughout the entire network. z Hello time, the interval for sending hello packets. Hello packets are used to check link state.
z MSTP supports mapping VLANs to MST instances by means of a VLAN-to-instance mapping table. MSTP introduces “instance” (integrates multiple VLANs into a set) and can bind multiple VLANs to an instance, thus saving communication overhead and improving resource utilization. z MSTP divides a switched network into multiple regions, each containing multiple spanning trees that are independent of one another.
MSTI A multiple spanning tree instance (MSTI) refers to a spanning tree in an MST region. Multiple spanning trees can be established in one MST region. These spanning trees are independent of each other. For example, each region in Figure 1-4 contains multiple spanning trees known as MSTIs. Each of these spanning trees corresponds to a VLAN. VLAN mapping table A VLAN mapping table is a property of an MST region. It contains information about how VLANs are mapped to MSTIs.
z A region edge port is located on the edge of an MST region and is used to connect one MST region to another MST region, an STP-enabled region or an RSTP-enabled region z An alternate port is a secondary port of a root port or master port and is used for rapid transition. With the root port or master port being blocked, the alternate port becomes the new root port or master port. z A backup port is the secondary port of a designated port and is used for rapid transition.
z Forwarding state. Ports in this state can forward user packets and receive/send BPDU packets. z Learning state. Ports in this state can receive/send BPDU packets. z Discarding state. Ports in this state can only receive BPDU packets. Port roles and port states are not mutually dependent. Table 1-6 lists possible combinations of port states and port roles.
For MSTP, CIST configuration information is generally expressed as follows: (Root bridge ID, External path cost, Master bridge ID, Internal path cost, Designated bridge ID, ID of sending port, ID of receiving port), so the compared as follows z The smaller the Root bridge ID of the configuration BPDU is, the higher the priority of the configuration BPDU is. z For configuration BPDUs with the same Root bridge IDs, the External path costs are compared.
z BPDU guard z Loop guard z TC-BPDU attack guard z BPDU packet drop STP-related Standards STP-related standards include the following. z IEEE 802.1D: spanning tree protocol z IEEE 802.1w: rapid spanning tree protocol z IEEE 802.
In a network containing devices with both GVRP and MSTP enabled, GVRP packets are forwarded along the CIST. If you want to advertise packets of a specific VLAN through GVRP, be sure to map the VLAN to the CIST when configuring the MSTP VLAN mapping table (the CIST of a network is spanning tree instance 0). Configuration Prerequisites The role (root, branch, or leaf) of each device in each spanning tree instance is determined.
Configuring MST region-related parameters (especially the VLAN mapping table) results in spanning tree recalculation and network topology jitter.
To do… Use the command… Remarks Enter system view system-view — Specify the current device as the root bridge of a spanning tree stp [ instance instance-id ] root primary [ bridge-diameter bridgenumber [ hello-time centi-seconds ] ] Required Specify the current device as the secondary root bridge of a spanning tree Follow these steps to specify the current device as the secondary root bridge of a spanning tree: To do… Use the command… Remarks Enter system view system-view — Specify the curren
z You can configure a device as the root bridges of multiple spanning tree instances. But you cannot configure two or more root bridges for one spanning tree instance. So, do not configure root bridges for the same spanning tree instance on two or more devices using the stp root primary command. z You can configure multiple secondary root bridges for one spanning tree instance.
Configuration example # Set the bridge priority of the current device to 4,096 in spanning tree instance 1. system-view [device] stp instance 1 priority 4096 Configuring the Mode a Port Recognizes and Sends MSTP Packets A port can be configured to recognize and send MSTP packets in the following modes. z Automatic mode. Ports in this mode determine the format of the MSTP packets to be sent according to the format of the received packets. z Legacy mode.
To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Required Configure the mode a port recognizes and sends MSTP packets stp compliance { auto | dot1s | legacy } By default, a port recognizes and sends MSTP packets in the automatic mode. That is, it determines the format of packets to be sent according to the format of the packets received.
Configuration example # Specify the MSTP operation mode as STP-compatible. system-view [device] stp mode stp Configuring the Maximum Hop Count of an MST Region The maximum hop count configured on the region root is also the maximum hops of the MST region. The value of the maximum hop count limits the size of the MST region. A configuration BPDU contains a field that maintains the remaining hops of the configuration BPDU. And the device discards the configuration BPDUs whose remaining hops are 0.
To do… Use the command… Enter system view system-view Configure the network diameter of the switched network stp bridge-diameter bridgenumber Remarks — Required The default network diameter of a network is 7. The network diameter parameter indicates the size of a network. The bigger the network diameter is, the larger the network size is.
z The forward delay parameter and the network diameter are correlated. Normally, a large network diameter corresponds to a large forward delay. A too small forward delay parameter may result in temporary redundant paths. And a too large forward delay parameter may cause a network unable to resume the normal state in time after changes occurred to the network. The default value is recommended.
Configuration procedure Follow these steps to configure the timeout time factor: To do… Use the command… Enter system view system-view Configure the timeout time factor for the device stp timer-factor number Remarks — Required The timeout time factor defaults to 3. For a steady network, the timeout time can be five to seven times of the hello time. Configuration example # Configure the timeout time factor to be 6.
Configuration example # Set the maximum transmitting speed of GigabitEthernet 1/0/1 to 15.
You are recommended to configure the Ethernet ports connected directly to terminals as edge ports and enable the BPDU guard function at the same time. This not only enables these ports to turn to the forwarding state rapidly but also secures your network. Configuration example # Configure GigabitEthernet 1/0/1 as an edge port.
To do… Use the command… Specify whether the link connected to a port is a point-to-point link stp point-to-point { force-true | force-false | auto } Remarks Required The auto keyword is adopted by default. z Among aggregated ports, you can only configure the links of master ports as point-to-point links. z If an auto-negotiating port operates in full duplex mode after negotiation, you can configure the link of the port as a point-to-point link.
To do… Use the command… Enter system view system-view Enable MSTP stp enable Enter Ethernet port view interface interface-type interface-number Remarks — Required MSTP is disabled by default. — Optional By default, MSTP is enabled on all ports after you enable MSTP in system view. Disable MSTP on the port To enable a device to operate more flexibly, you can disable MSTP on specific ports.
Task Remarks Configuring the Mode a Port Recognizes and Sends MSTP Packets Optional Configuring the Timeout Time Factor Optional Configuring the Maximum Transmitting Speed on the Current Port Optional The default value is recommended.
Configuring the Path Cost for a Port The path cost parameter reflects the rate of the link connected to the port. For a port on an MSTP-enabled device, the path cost may be different in different spanning tree instances. You can enable flows of different VLANs to travel along different physical links by configuring appropriate path costs on ports, so that VLAN-based load balancing can be implemented. Path cost of a port can be determined by the device or through manual configuration.
When calculating the path cost of an aggregated link, the 802.1D-1998 standard does not take the number of the ports on the aggregated link into account, whereas the 802.1T standard does. The following formula is used to calculate the path cost of an aggregated link: Path cost = 200,000/ link transmission speed, where ‘link transmission speed” is the sum of the speeds of all the unblocked ports on the aggregated link measured in 100 Kbps.
[device] stp pathcost-standard dot1d-1998 2) Perform this configuration in Ethernet port view system-view [device] interface GigabitEthernet1/0/1 [device-GigabitEthernet1/0/1] undo stp instance 1 cost [device-GigabitEthernet1/0/1] quit [device] stp pathcost-standard dot1d-1998 Configuring Port Priority Port priority is an important criterion on determining the root port. In the same condition, the port with the smallest port priority value becomes the root port.
[device] stp interface GigabitEthernet1/0/1 instance 1 port priority 16 2) Perform this configuration in Ethernet port view system-view [device] interface GigabitEthernet1/0/1 [device-GigabitEthernet1/0/1] stp instance 1 port priority 16 Specifying Whether the Link Connected to a Port Is a Point-to-point Link Refer to Specifying Whether the Link Connected to a Port Is Point-to-point Link. Enabling MSTP Refer to Enabling MSTP.
To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Perform the mCheck operation stp mcheck Required Configuration Example # Perform the mCheck operation on GigabitEthernet 1/0/1.
Loop guard A device maintains the states of the root port and other blocked ports by receiving and processing BPDUs from the upstream device. These BPDUs may get lost because of network congestions or unidirectional link failures. If a device does not receive BPDUs from the upstream device for certain period, the device selects a new root port; the original root port becomes a designated port; and the blocked ports turns to the forwarding state. This may cause loops in the network.
Configuration Prerequisites MSTP runs normally on the device. Configuring BPDU Guard Configuration procedure Follow these steps to configure BPDU guard: To do… Use the command… Enter system view system-view Enable the BPDU guard function stp bpdu-protection Remarks — Required The BPDU guard function is disabled by default. Configuration example # Enable the BPDU guard function.
2) Perform this configuration in Ethernet port view system-view [device] interface GigabitEthernet1/0/1 [device-GigabitEthernet1/0/1] stp root-protection Configuring Loop Guard Configuration procedure Follow these steps to configure loop guard: To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Enable the loop guard function on the current port stp loop-protection Required The loop guard function is disa
# Set the maximum times for the device to remove the MAC address table within 10 seconds to 5. system-view [device] stp tc-protection threshold 5 Configuring BPDU Dropping Follow these steps to configure BPDU dropping: To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-name — Required Enable BPDU dropping bpdu-drop any BPDU dropping is disabled by default. # Enable BPDU dropping on GigabitEthernet 1/0/1.
Configuring Digest Snooping Configure the digest snooping feature on a device to enable it to communicate with other devices adopting proprietary protocols to calculate configuration digests in the same MST region through MSTIs. Configuration prerequisites The device to be configured is connected to a device of another vendor adopting a proprietary spanning tree protocol. MSTP and the network operate normally.
z When the digest snooping feature is enabled on a port, the port state turns to the discarding state. That is, the port will not send BPDU packets. The port is not involved in the STP calculation until it receives BPDU packets from the peer port. z The digest snooping feature is needed only when your device is connected to a device of another vendor adopting proprietary spanning tree protocols.
Figure 1-6 The RSTP rapid transition mechanism Figure 1-7 The MSTP rapid transition mechanism The cooperation between MSTP and RSTP is limited in the process of rapid transition. For example, when the upstream device adopts RSTP, the downstream device adopts MSTP and the downstream device does not support RSTP-compatible mode, the root port on the downstream device receives no agreement packet from the upstream device and thus sends no agreement packets to the upstream device.
Configuring Rapid Transition Configuration prerequisites As shown in Figure 1-8, a WX3000 series device is connected to a device of another vendor. The former operates as the downstream device, and the latter operates as the upstream device. The network operates normally. The upstream device is running a proprietary spanning tree protocol that is similar to RSTP in the way to implement rapid transition on designated ports. Port 1 is the designated port. The downstream device is running MSTP.
z The rapid transition feature can be enabled on only root ports or alternate ports. z If you configure the rapid transition feature on a designated port, the feature does not take effect on the port.
To do… Enter Ethernet port view Enable the VLAN VPN function for the Ethernet port Use the command… Remarks interface interface-type interface-number Make sure that you enter the Ethernet port view of the port for which you want to enable the VLAN-VPN tunnel function. Required vlan-vpn enable By default, the VLAN VPN function is disabled on all ports. z The VLAN-VPN tunnel function can be enabled on STP-enabled devices only.
[device] stp portlog all Enabling Trap Messages Conforming to 802.1d Standard The device sends trap messages conforming to 802.1d standard to the network management device in the following two cases: z The device becomes the root bridge of an instance. z Network topology changes are detected. Configuration procedure Follow these steps to enable trap messages conforming to 802.1d standard: To do… Use the command… Remarks Enter system view system-view — Enable trap messages conforming to 802.
MSTP Configuration Example Network requirements Implement MSTP in the network shown in Figure 1-10 to enable packets of different VLANs to be forwarded along different spanning tree instances. The detailed configurations are as follows: z All switches in the network belong to the same MST region. z Packets of VLAN 10, VLAN 30, VLAN 40, and VLAN 20 are forwarded along spanning tree instance 1, instance 3, instance 4, and instance 0 respectively.
[SwitchA] stp instance 1 root primary 2) Configure Switch B # Enter MST region view. system-view [SwitchB] stp region-configuration # Configure the region name, VLAN-to-MSTI mapping table, and revision level for the MST region. [SwitchB-mst-region] region-name example [SwitchB-mst-region] instance 1 vlan 10 [SwitchB-mst-region] instance 3 vlan 30 [SwitchB-mst-region] instance 4 vlan 40 [SwitchB-mst-region] revision-level 0 # Activate the settings of the MST region manually.
VLAN-VPN tunnel Configuration Example Network requirements As shown in Figure 1-11: z The WX3000 series devices operate as the access devices of the operator’s network, that is, Switch C and Switch D in the network diagram. z Devices of other series operate as the access devices of the user’s network, that is, Switch A and Switch B in the network diagram. z Switch C and Switch D are connected to each other through the configured trunk ports of the switches.
[SwitchC] stp enable # Enable the VLAN-VPN tunnel function. [SwitchC] vlan-vpn tunnel # Add GigabitEthernet 1/0/1 to VLAN 10. [SwitchC] vlan 10 [SwitchC-Vlan10] port GigabitEthernet1/0/1 [SwitchC-Vlan10] quit # Disable STP on GigabitEthernet 1/0/1 and then enable the VLAN VPN function on it.
Table of Contents 1 802.1x Configuration ·································································································································1-1 Introduction to 802.1x······························································································································1-1 Architecture of 802.1x Authentication······························································································1-1 The Mechanism of an 802.
1 802.1x Configuration The sample output information in this manual was created on the WX3024. The output information on your device may vary. Introduction to 802.1x The 802.1x protocol (802.1x for short) was developed by IEEE802 LAN/WAN committee to address security issues of wireless LANs. It was then used in Ethernet as a common access control mechanism for LAN ports to address mainly authentication and security problems. 802.1x is a port-based network access control protocol.
z The authenticator system, residing at the other end of the LAN segment link, is the entity that authenticates the connected supplicant system. The authenticator system is usually an 802.1x-supported network device. It provides ports (physical or logical) for the supplicant system to access the LAN. z The authentication server system is the entity that provides authentication services to the authenticator system.
The Mechanism of an 802.1x Authentication System IEEE 802.1x authentication uses the extensible authentication protocol (EAP) to exchange information between supplicant systems and the authentication servers. To be compatible with 802.1X in a LAN environment, the client program must support the Extensible Authentication Protocol over LAN (EAPoL). Figure 1-2 The mechanism of an 802.
03: Indicates that the packet is an EAPoL-key packet, which carries key information. 04: Indicates that the packet is an EAPoL-encapsulated-ASF-Alert packet, which is used to support the alerting messages of ASF (alerting standards forum). z The Length field indicates the size of the Packet body field. A value of 0 indicates that the Packet Body field does not exist. z The Packet body field differs with the Type field.
Fields added for EAP authentication Two fields, EAP-message and Message-authenticator, are added to a RADIUS protocol packet for EAP authentication. (Refer to the Introduction to RADIUS protocol section in the AAA Operation Manual for information about the format of a RADIUS protocol packet.) The EAP-message field, whose format is shown in Figure 1-6, is used to encapsulate EAP packets. The maximum size of the string field is 253 bytes.
z EAP-TTLS is a kind of extended EAP-TLS. EAP-TLS implements bidirectional authentication between the client and authentication server. EAP-TTLS transmit message using a tunnel established using TLS. z PEAP creates and uses TLS security channels to ensure data integrity and then performs new EAP negotiations to verify supplicant systems. Figure 1-8 describes the basic EAP-MD5 authentication procedure. Figure 1-8 802.
password using a randomly-generated key, and sends the key to the device through an RADIUS access-challenge packet. The device then sends the key to the iNode client. z Upon receiving the key (encapsulated in an EAP-request/MD5 challenge packet) from the device, the client program encrypts the password of the supplicant system with the key and sends the encrypted password (contained in an EAP-response/MD5 challenge packet) to the RADIUS server through the device. (Normally, the encryption is irreversible.
Figure 1-9 802.1x authentication procedure (in EAP terminating mode) Supplicant system PAE EAPOL RADIUS Authenticator system PAE RADIUS server EAPOL- Start EAP- Request /Identity EAP- Response /Identity EAP- Request / MD5 Challenge EAP- Response /MD5 Challenge RADIUS Access-Request ( CHAP- Response /MD5 Challenge) RADIUS Access- Accept ( CHAP - Success ) EAP- Success Port authorized Handshake request [EAP- Request /Identity] Handshake timer Handshake response [EAP- Response /Identity] ......
z RADIUS server timer (server-timeout). This timer sets the server-timeout period. After sending an authentication request packet to the RADIUS server, the device sends another authentication request packet if it does not receive the response from the RADIUS server when this timer times out. z Supplicant system timer (supp-timeout). This timer sets the supp-timeout period and is triggered by the device after the device sends a request/challenge packet to a supplicant system.
This function needs the cooperation of iNode client and a iMC server. z The iNode client needs to capable of detecting multiple network adapters, proxies, and IE proxies. z The iMC server is configured to disable the use of multiple network adapters, proxies, or IE proxies. By default, an iNode client program allows use of multiple network adapters, proxies, and IE proxies.
Refer to AAA Operation Manual for detailed information about the dynamic VLAN delivery function. Enabling 802.1x re-authentication 802.1x re-authentication is timer-triggered or packet-triggered. It re-authenticates users who have passed authentication. With 802.1x re-authentication enabled, the device can monitor the connection status of users periodically. If the device receives no re-authentication response from a user in a period of time, it tears down the connection to the user.
Figure 1-11 802.1x configuration Local authentication authentication 802.1x 802.1x configuration configuration ISP ISPdomain domain configuration configuration AAA AAAscheme scheme RADIUS RADIUS scheme scheme z An 802.1x user uses the domain name to associate with the ISP domain configured on the device. z Configure the AAA scheme (a local authentication scheme, a RADIUS scheme or a HWTACACS scheme) to be adopted in the ISP domain.
To do… Enable 802.1x for specified ports In system view Use the command… Remarks dot1x [ interface interface-list ] Required interface interface-type interface-number In port view dot1x By default, 802.1x is disabled on all ports. quit Set port authorization mode for specified ports dot1x port-control { authorized-force | unauthorized-force | auto } [ interface interface-list ] Optional By default, an 802.1x-enabled port operates in the auto mode.
z 802.1x configurations take effect only after you enable 802.1x both globally and for specified ports. z If you enable 802.1x for a port, you cannot set the maximum number of MAC addresses that can be learnt for the port. Meanwhile, if you set the maximum number of MAC addresses that can be learnt for a port, it is prohibited to enable 802.1x for the port. z If you enable 802.1x for a port, it is not available to add the port to an aggregation group.
To do… Use the command… Remarks Optional Set 802.1x timers dot1x timer { handshake-period handshake-period-value | quiet-period quiet-period-value | server-timeout server-timeout-value | supp-timeout supp-timeout-value | tx-period tx-period-value | ver-period ver-period-value } The settings of 802.1x timers are as follows.
To do… In system view Enable proxy checking for a port/specified ports Use the command… dot1x supp-proxy-check { logoff | trap } [ interface interface-list ] interface interface-type interface-number In port view Remarks dot1x supp-proxy-check { logoff | trap } Required By default, the 802.1x proxy checking is disabled on a port. quit z The proxy checking function needs the cooperation of an iNode client program. z The proxy checking function depends on the online user handshaking function.
As for the dot1x version-user command, if you execute it in system view without specifying the interface-list argument, the command applies to all ports. You can also execute this command in port view. In this case, this command applies to the current port only and the interface-list argument is not needed. Enabling DHCP-triggered Authentication After performing the following configuration, 802.
Configuring 802.1x Re-Authentication Follow these steps to enable 802.1x re-authentication: To do… Enter system view Use the command… system-view Remarks — Required Enable 802.1x globally dot1x By default, 802.1x is disabled globally. Enable 802.1x for specified ports In system view dot1x [ interface interface-list ] Required In port view dot1x By default, 802.1x is disabled on all ports. In system view dot1x re-authenticate [ interface interface-list ] Enable 802.
Follow these steps to configure the re-authentication interval: To do… Enter system view Use the command… system-view Remarks — Optional Configure a re-authentication interval dot1x timer reauth-period reauth-period-value By default, the re-authentication interval is 3,600 seconds. Displaying and Maintaining 802.1x To do… Use the command… Remarks Display the configuration, session, and statistics information about 802.
Figure 1-12 Network diagram for AAA configuration with 802.1x and RADIUS enabled Configuration procedure Following configuration covers the major AAA/RADIUS configuration commands. Refer to AAA Operation Manual for the information about these commands. Configuration on the client and the RADIUS servers is omitted. # Enable 802.1x globally. system-view System View: return to User View with Ctrl+Z. [device] dot1x # Enable 802.1x on GigabitEthernet 1/0/1 port.
[device-radius-radius1] key accounting money # Set the interval and the number of the retries for the switch to send packets to the RADIUS servers. [device-radius-radius1] timer 5 [device-radius-radius1] retry 5 # Set the timer for the switch to send real-time accounting packets to the RADIUS servers. [device-radius-radius1] timer realtime-accounting 15 # Configure to send the user name to the RADIUS server with the domain name truncated.
2 Quick EAD Deployment Configuration Introduction to Quick EAD Deployment Quick EAD Deployment Overview As an integrated solution, an endpoint admission defense (EAD) solution can improve the overall defense power of a network. In real applications, however, deploying EAD clients proves to be time-consuming and inconvenient. The device enables the quick deployment of EAD clients by implementing mandatory EAD client distribution through 802.1x authentication.
Configuration Procedure Configuring a free IP range A free IP range is an IP range that users can access before passing 802.1x authentication. Follow these steps to configure a free IP range: To do… z Use the command… Remarks Enter system view system-view — Configure the URL for HTTP redirection dot1x url url-string Required Configure a free IP range dot1x free-ip ip-address { mask-address | mask-length } Required By default, no free IP range is configured.
Follow these steps to configure the ACL timer: To do… Use the command… Enter system view system-view Set the ACL timer dot1x timer acl-timeout acl-timeout-value Remarks — Required By default, the ACL timeout period is 30 minutes. Displaying and Maintaining Quick EAD Deployment To do… Display configuration information about quick EAD deployment Use the command… display dot1x [ sessions | statistics ] [ interface interface-list ] Remarks Available in any view.
Configuration procedure Before enabling quick EAD deployment, make sure that: z The Web server is configured properly. z The default gateway of the PC is configured as the IP address of the Layer-3 virtual interface of the VLAN to which the port that is directly connected with the PC belongs. # Configure the URL for HTTP redirection. system-view [device] dot1x url http://192.168.0.111 # Configure a free IP range. [device] dot1x free-ip 192.168.0.111 24 # Set the ACL timer to 10 minutes.
3 System-Guard Configuration System-Guard Overview At first, you must determine whether the CPU is under attack to implement system guard for the CPU. You should not determine whether the CPU is under attack just according to whether congestion occurs in a queue. Instead, you must do that in the following ways: z According to the number of packets processed in the CPU in a time range. z Or according to the time for one hundred packets to be processed.
Displaying and Maintaining System-Guard To do… Use the command… Remarks Display the record of detected attacks display system-guard attack-record Available in any view Display the state of the system-guard feature display system-guard state Available in any view 3-2
Table of Contents 1 AAA Overview ············································································································································1-1 Introduction to AAA ·································································································································1-1 Authentication··································································································································1-1 Authorization·····················
Troubleshooting AAA ····························································································································2-30 Troubleshooting RADIUS Configuration························································································2-30 Troubleshooting HWTACACS Configuration ················································································2-30 3 EAD Configuration···························································································
1 AAA Overview The sample output information in this manual was created on the WX3024. The output information on your device may vary. Introduction to AAA AAA is the acronym for the three security functions: authentication, authorization and accounting. It provides a uniform framework for you to configure these three functions to implement network security management.
z Local authorization: Users are authorized according to the related attributes configured for their local accounts on this device. z RADIUS authorization: Users are authorized after they pass RADIUS authentication. In RADIUS protocol, authentication and authorization are combined together, and authorization cannot be performed alone without authentication. z HWTACACS authorization: Users are authorized by a TACACS server.
z The RADIUS server receives user connection requests, authenticates users, and returns all required information to the device. Generally, a RADIUS server maintains the following three databases (see Figure 1-1): z Users: This database stores information about users (such as user name, password, protocol adopted and IP address). z Clients: This database stores information about RADIUS clients (such as shared key).
2) The RADIUS client receives the user name and password, and then sends an authentication request (Access-Request) to the RADIUS server. 3) The RADIUS server compares the received user information with that in the Users database to authenticate the user. If the authentication succeeds, the RADIUS server sends back to the RADIUS client an authentication response (Access-Accept), which contains the user’s authorization information. If the authentication fails, the server returns an Access-Reject response.
Code Message type Message description Direction: server->client. 3 Access-Reject The server transmits this message to the client if any attribute value carried in the Access-Request message is unacceptable (that is, the user fails the authentication). Direction: client->server.
Type field value Attribute type Type field value Attribute type 8 Framed-IP-Address 30 Called-Station-Id 9 Framed-IP-Netmask 31 Calling-Station-Id 10 Framed-Routing 32 NAS-Identifier 11 Filter-ID 33 Proxy-State 12 Framed-MTU 34 Login-LAT-Service 13 Framed-Compression 35 Login-LAT-Node 14 Login-IP-Host 36 Login-LAT-Group 15 Login-Service 37 Framed-AppleTalk-Link 16 Login-TCP-Port 38 Framed-AppleTalk-Network 17 (unassigned) 39 Framed-AppleTalk-Zone 18 Reply-Message
Compared with RADIUS, HWTACACS provides more reliable transmission and encryption, and therefore is more suitable for security control. Table 1-3 lists the primary differences between HWTACACS and RADIUS. Table 1-3 Differences between HWTACACS and RADIUS HWTACACS RADIUS Adopts TCP, providing more reliable network transmission. Adopts UDP. Encrypts the entire message except the HWTACACS header. Encrypts only the password field in authentication message. Separates authentication from authorization.
Figure 1-6 AAA implementation procedure for a telnet user User TACACS client TACACS server Requests to log in Authentication start request Authentication response, requesting username Requests username Enters username Authentication continuous message , carrying username Authentication response, requesting password Requests password Enters password Authentication continuous message , carrying password Authentication success response Authorization request Authorization success response Allows user to log
9) After receiving the response indicating an authorization success, the TACACS client pushes the configuration interface of the device to the user. 10) The TACACS client sends an accounting start request to the TACACS server. 11) The TACACS server returns an accounting response, indicating that it has received the accounting start request. 12) The user logs out; the TACACS client sends an accounting stop request to the TACACS server.
2 AAA Configuration AAA Configuration Task List Configuration Introduction You need to configure AAA to provide network access services for legal users while protecting network devices and preventing unauthorized access and repudiation behavior.
Task Remarks Creating an ISP Domain and Configuring Its Attributes Required Configuring separate AAA schemes Required Required z AAA configuration Configuring an AAA Scheme for an ISP Domain z With separate AAA schemes, you can specify authentication, authorization and accounting schemes respectively. You need to configure RADIUS or HWATACACS before performing RADIUS or HWTACACS authentication.
To do… Use the command… Remarks Optional Set the accounting-optional switch accounting optional Set the messenger function messenger time { enable limit interval | disable } Set the self-service server location function self-service-url { disable | enable url-string } By default, the accounting-optional switch is off. Optional By default, the messenger function is disabled. Optional By default, the self-service server location function is disabled.
this way, you cannot specify different schemes for authentication, authorization and accounting respectively.
You can use an arbitrary combination of the above implementations for your AAA scheme configuration. 2) For FTP users Only authentication is supported for FTP users. Authentication: RADIUS, local, or HWTACACS.
upon receiving an integer ID assigned by the RADIUS authentication server, the device adds the port to the VLAN whose VLAN ID is equal to the assigned integer ID. If no such a VLAN exists, the device first creates a VLAN with the assigned ID, and then adds the port to the newly created VLAN. z String: If the RADIUS authentication server assigns string type of VLAN IDs, you can set the VLAN assignment mode to string on the device.
Follow these steps to configure the attributes of a local user To do… Enter system view Use the command… system-view Remarks — Optional Set the password display mode of all local users local-user password-display-mode { cipher-force | auto } Add a local user and enter local user view local-user user-name Set a password for the local user password { simple | cipher } password By default, the password display mode of all access users is auto, indicating the passwords of access users are displayed in
z The following characters are not allowed in the user-name string: /:*?<>. And you cannot input more than one “@” in the string. z After the local-user password-display-mode cipher-force command is executed, any password will be displayed in cipher mode even though you specify to display a user password in plain text by using the password command.
Complete the following tasks configure RADIUS for the device functioning as a RADIUS client: Task Configuring the RADIUS client Configuring the RADIUS server Remarks Creating a RADIUS Scheme Required Configuring RADIUS Authentication/Authorization Servers Required Configuring RADIUS Accounting Servers Required Configuring Shared Keys for RADIUS Messages Optional Configuring the Maximum Number of RADIUS Request Transmission Attempts Optional Configuring the Type of RADIUS Servers to be Supporte
secondary servers with the same configuration but different IP addresses) in a RADIUS scheme. After creating a new RADIUS scheme, you should configure the IP address and UDP port number of each RADIUS server you want to use in this scheme. These RADIUS servers fall into two types: authentication/authorization, and accounting. And for each type of server, you can configure two servers in a RADIUS scheme: primary server and secondary server.
To do… Use the command… Enter system view system-view Create a RADIUS scheme and enter its view radius scheme radius-scheme-name Remarks — Required By default, a RADIUS scheme named "system" has already been created in the system. Required Set the IP address and port number of the primary RADIUS authentication/authorization server primary authentication ip-address [ port-number ] By default, the IP address and UDP port number of the primary server are 0.0.0.
To do… Use the command… Remarks Optional Set the IP address and port number of the secondary RADIUS accounting server secondary accounting ip-address [ port-number ] Enable stop-accounting request buffering stop-accounting-buffer enable Set the maximum number of transmission attempts of a buffered stop-accounting request. By default, the IP address and UDP port number of the secondary accounting server are 0.0.0.0 and 1813 for a newly created RADIUS scheme.
received from each other by using the shared keys that have been set on them, and can accept and respond to the messages only when both parties have the same shared key.
To do… Use the command… Enter system view system-view Create a RADIUS scheme and enter its view radius scheme radius-scheme-name Configure the type of RADIUS servers to be supported server-type { extended | standard } Remarks — Required By default, a RADIUS scheme named "system" has already been created in the system.
To do… Use the command… Set the status of the primary RADIUS authentication/authorization server state primary authentication { block | active } Set the status of the primary RADIUS accounting server state primary accounting { block | active } Set the status of the secondary RADIUS authentication/authorization server state secondary authentication { block | active } Set the status of the secondary RADIUS accounting server state secondary accounting { block | active } Remarks Optional By default,
z Generally, the access users are named in the userid@isp-name or userid.isp-name format. Here, isp-name after the “@” or “.” character represents the ISP domain name, by which the device determines which ISP domain a user belongs to. However, some old RADIUS servers cannot accept the user names that carry ISP domain names. In this case, it is necessary to remove domain names from user names before sending the user names to RADIUS server.
z If you adopt the local RADIUS authentication server function, the UDP port number of the authentication/authorization server must be 1645, the UDP port number of the accounting server must be 1646, and the IP addresses of the servers must be set to the addresses of this device.
To do… Use the command… Remarks Optional Set the response timeout time of RADIUS servers timer response-timeout seconds By default, the response timeout time of RADIUS servers is three seconds.
online when the user re-logs into the switching engine before the iMC performs online user detection, and the user cannot get authenticated. In this case, the user can access the network again only when the iMC administrator manually removes the user's online information. The user re-authentication at restart function is designed to resolve this problem.
Task Configuring the TACACS client Configuring the TACACS server Remarks Creating a HWTACACS Scheme Required Configuring TACACS Authentication Servers Required Configuring TACACS Authorization Servers Required Configuring TACACS Accounting Servers Optional Configuring Shared Keys for RADIUS Messages Optional Configuring the Attributes of Data to be Sent to TACACS Servers Optional Configuring the Timers Regarding TACACS Servers Optional Refer to the configuration of TACACS servers.
To do… Use the command… Remarks Required Set the IP address and port number of the primary TACACS authentication server primary authentication ip-address [ port ] By default, the IP address of the primary authentication server is 0.0.0.0, and the port number is 0. Optional Set the IP address and port number of the secondary TACACS authentication server z secondary authentication ip-address [ port ] By default, the IP address of the secondary authentication server is 0.0.0.
z You are not allowed to configure the same IP address for both primary and secondary authorization servers. If you do this, the system will prompt that the configuration fails. z You can remove a server only when it is not used by any active TCP connection for sending authorization messages.
The TACACS client and server adopt MD5 algorithm to encrypt HWTACACS messages before they are exchanged between the two parties. The two parties verify the validity of the HWTACACS messages received from each other by using the shared keys that have been set on them, and can accept and respond to the messages only when both parties have the same shared key.
Generally, the access users are named in the userid@isp-name or userid.isp-name format. Where, isp-name after the “@” or “.” character represents the ISP domain name. If the TACACS server does not accept the user names that carry ISP domain names, it is necessary to remove domain names from user names before they are sent to TACACS server.
Displaying and Maintaining AAA Displaying and maintaining AAA information To do… Use the command… Display configuration information about one specific or all ISP domains display domain [ isp-name ] Display information about user connections display connection [ access-type { dot1x | mac-authentication } | domain isp-name | interface interface-type interface-number | ip ip-address | mac mac-address | radius-scheme radius-scheme-name | hwtacacs-scheme hwtacacs-scheme-name | vlan vlan-id | ucibindex ucib-
Displaying and maintaining HWTACACS protocol information To do… Use the command… Display the configuration or statistic information about one specific or all HWTACACS schemes display hwtacacs [ hwtacacs-scheme-name [ statistics ] ] Display buffered non-response stop-accounting requests display stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name Clear HWTACACS message statistics reset hwtacacs statistics { accounting | authentication | authorization | all } Delete buffered non-response stop-a
Figure 2-1 Remote RADIUS authentication of Telnet users Authentication server 10. 110.91. 164 Internet Telnet user Configuration procedure # Enter system view. system-view # Adopt AAA authentication for Telnet users. [device] user-interface vty 0 4 [device-ui-vty0-4] authentication-mode scheme [device-ui-vty0-4] quit # Configure an ISP domain. [device] domain imc [device-isp-imc] access-limit enable 10 [device-isp-imc] quit # Configure a RADIUS scheme.
Local Authentication of FTP/Telnet Users The configuration procedure for local authentication of FTP users is similar to that for Telnet users. The following text only takes Telnet users as example to describe the configuration procedure for local authentication. Network requirements In the network environment shown in Figure 2-2, you are required to configure the device so that the Telnet users logging into the switching engine are authenticated locally.
z Change the server IP address, and the UDP port number of the authentication server to 127.0.0.1, and 1645 respectively in the configuration step "Configure a RADIUS scheme" in Remote RADIUS Authentication of Telnet/SSH Users z Enable the local RADIUS server function, set the IP address and shared key for the network access server to 127.0.0.1 and aabbcc, respectively. z Configure local users.
Troubleshooting AAA Troubleshooting RADIUS Configuration The RADIUS protocol operates at the application layer in the TCP/IP protocol suite. This protocol prescribes how the device and the RADIUS server of the ISP exchange user information with each other. Symptom 1: User authentication/authorization always fails. Possible reasons and solutions: z The user name is not in the userid@isp-name or userid.
3 EAD Configuration Introduction to EAD Endpoint admission defense (EAD) is an attack defense solution. Using this solution, you can enhance the active defense capability of network endpoints, prevents viruses and worms from spreading on the network, and protects the entire network by limiting the access rights of insecure endpoints.
After the client is patched and compliant with the required security standard, the security policy server reissues an ACL to the device, which then assigns access right to the client so that the client can access more network resources. EAD Configuration The EAD configuration includes: z Configuring the attributes of access users (such as user name, user type, and password).
Figure 3-2 EAD configuration Authentication Servers 10 .110 .91.164 GE 1/0 /1 Internet User Security Policy Servers Virus Patch Servers 10.110.91.166 10.110.91.168 Configuration procedure # Configure 802.1x on the device. Refer to the section ”Configuring 802.1x” of 802.1x Configuration. # Configure a domain. system-view [device] domain system [device-isp-system] quit # Configure a RADIUS scheme. [device] radius scheme imc [device-radius-imc] primary authentication 10.110.91.
Table of Contents 1 MAC Authentication Configuration··········································································································1-1 MAC Authentication Overview ················································································································1-1 Performing MAC Authentication on a RADIUS Server····································································1-1 Performing MAC Authentication Locally·················································
1 MAC Authentication Configuration The sample output information in this manual was created on the WX3024. The output information on your device may vary. MAC Authentication Overview MAC authentication provides a way for authenticating users based on ports and MAC addresses, without requiring any client software to be installed on the hosts. Once detecting a new MAC address, it initiates the authentication process. During authentication, the user does not need to enter username or password manually.
included depending on the format configured with the mac-authentication authmode usernameasmacaddress usernameformat command; otherwise, the authentication will fail. z If the username type is fixed username, you need to configure the fixed username and password on the device, which are used by the device to authenticate all users. The service type of a local user needs to be configured as lan-access.
To do… Enable MAC authentication for the specified port(s) or the current port Use the command… In system view In interface view Remarks mac-authentication interface interface-list interface interface-type interface-number Use either method Disabled by default mac-authentication quit Set the username in MAC address mode for MAC authentication Set the username in fixed mode for MAC authentication mac-authentication authmode usernameasmacaddress [ usernameformat { with-hyphen | without-hyphen } { lo
MAC Address Authentication Enhanced Function Configuration MAC Address Authentication Enhanced Function Configuration Tasks Complete the following tasks to configure MAC address authentication enhanced function: Task Remarks Configuring a Guest VLAN Optional Configuring the Maximum Number of MAC Address Authentication Users Allowed to Access a Port Optional Configuring a Guest VLAN Different from Guest VLANs described in the 802.
z Guest VLANs are implemented in the mode of adding a port to a VLAN. For example, when multiple users are connected to a port, if the first user fails in the authentication, the other users can access only the contents of the Guest VLAN. The device will re-authenticate only the first user accessing this port, and the other users cannot be authenticated again. Thus, if more than one client is connected to a port, you cannot configure a Guest VLAN for this port.
z If more than one client is connected to a port, you cannot configure a Guest VLAN for this port. z When a Guest VLAN is configured for a port, only one MAC address authentication user can access the port. Even if you set the limit on the number of MAC address authentication users to more than one, the configuration does not take effect. z The undo vlan command cannot be used to remove the VLAN configured as a Guest VLAN.
z If both the limit on the number of MAC address authentication users and the limit on the number of users configured in the port security function are configured for a port, the smaller value of the two configured limits is adopted as the maximum number of MAC address authentication users allowed to access this port. Refer to the Port Security manual for the description on the port security function.
# Add a local user. z Specify the username and password. [device] local-user 00-0d-88-f6-44-c1 [device-luser-00-0d-88-f6-44-c1] password simple 00-0d-88-f6-44-c1 z Set the service type to “lan-access”. [device-luser-00-0d-88-f6-44-c1] service-type lan-access [device-luser-00-0d-88-f6-44-c1] quit # Add an ISP domain named aabbcc.net. [device] domain aabbcc.net New Domain added. # Specify to perform local authentication. [device-isp-aabbcc.net] scheme local [device-isp-aabbcc.
Table of Contents 1 IP Addressing Configuration····················································································································1-1 IP Addressing Overview··························································································································1-1 IP Address Classes ·························································································································1-1 Special Case IP Addresses····························
z The term switch used throughout this document refers to a switching device in a generic sense or the switching engine of the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. 1 IP Addressing Configuration IP Addressing Overview IP Address Classes IP addressing uses a 32-bit address to identify each host on a network. An example is 01010000100000001000000010000000 in binary.
Table 1-1 IP address classes and ranges Class Address range Remarks Address 0.0.0.0 means this host no this network. This address is used by a host at bootstrap when it does not know its IP address. This address is never a valid destination address. A 0.0.0.0 to 127.255.255.255 B 128.0.0.0 to 191.255.255.255 –– C 192.0.0.0 to 223.255.255.255 –– D 224.0.0.0 to 239.255.255.255 Multicast address. E 240.0.0.0 to 255.255.255.255 Reserved for future use except for the broadcast address 255.255.
adds an additional level, subnet ID, to the two-level hierarchy with IP addressing, IP routing now involves three steps: delivery to the site, delivery to the subnet, and delivery to the host. In the absence of subnetting, some special addresses such as the addresses with the net ID of all zeros and the addresses with the host ID of all ones, are not assignable to hosts. The same is true of subnetting.
z You can assign at most two IP address to an interface, among which one is the primary IP address and another is secondary IP addresses. A newly specified primary IP address overwrites the previous one if there is any. z The primary and secondary IP addresses of an interface cannot reside on the same network segment; the IP address of a VLAN interface must not be on the same network segment as that of a loopback interface on a device.
IP Address Configuration Example II Network requirements As shown in Figure 1-4, VLAN-interface 1 on Switch is connected to a LAN comprising two segments: 172.16.1.0/24 and 172.16.2.0/24. To enable the hosts on the two network segments to communicate with the external network through Switch, and the hosts on the LAN can communicate with each other, do the following: z Assign two IP addresses to VLAN-interface 1 on Switch. z Set Switch as the gateway on all PCs of the two networks.
5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/26/27 ms The output information shows that Switch can communicate with the hosts on the subnet 172.16.1.0/24. # Ping a host on the subnet 172.16.2.0/24 from Switch to check the connectivity. ping 172.16.2.2 PING 172.16.2.2: 56 data bytes, press CTRL_C to break Reply from 172.16.2.2: bytes=56 Sequence=1 ttl=255 time=25 ms Reply from 172.16.2.2: bytes=56 Sequence=2 ttl=255 time=26 ms Reply from 172.16.2.
2 IP Performance Configuration IP Performance Overview Introduction to IP Performance Configuration In some network environments, you need to adjust the IP parameters to achieve best network performance. The IP performance configuration supported by the device includes: z Configuring TCP attributes z Disabling sending of ICMP error packets Introduction to FIB Every device stores a forwarding information base (FIB).
To do… Use the command… Enter system view system-view Configure TCP synwait timer’s timeout value tcp timer syn-timeout time-value Configure TCP finwait timer’s timeout value tcp timer fin-timeout time-value Configure the size of TCP receive/send buffer tcp window window-size Remarks — Optional By default, the timeout value is 75 seconds. Optional By default, the timeout value is 675 seconds. Optional By default, the buffer is 8 kilobytes.
Displaying and Maintaining IP Performance Configuration To do… Use the command… Display TCP connection status display tcp status Display TCP connection statistics display tcp statistics Display UDP traffic statistics display udp statistics Display IP traffic statistics display ip statistics Display ICMP traffic statistics display icmp statistics Display the current socket information of the system display ip socket [ socktype sock-type ] [ task-id socket-id ] Display the forwarding information
Table of Contents 1 DHCP Overview··········································································································································1-1 Introduction to DHCP ······························································································································1-1 DHCP IP Address Assignment ···············································································································1-1 IP Address Assignment Policy ···············
z The term switch used throughout this document refers to a switching device in a generic sense or the switching engine of the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary.
z Manual assignment. The administrator configures static IP-to-MAC bindings for some special clients, such as a WWW server. Then the DHCP server assigns these fixed IP addresses to the clients. z Automatic assignment. The DHCP server assigns IP addresses to DHCP clients. The IP addresses will be occupied by the DHCP clients permanently. z Dynamic assignment. The DHCP server assigns IP addresses to DHCP clients for predetermined period of time.
Updating IP Address Lease After a DHCP server dynamically assigns an IP address to a DHCP client, the IP address keeps valid only within a specified lease time and will be reclaimed by the DHCP server when the lease expires. If the DHCP client wants to use the IP address for a longer time, it must update the IP lease. By default, a DHCP client updates its IP address lease automatically by unicasting a DHCP-REQUEST packet to the DHCP server when half of the lease time elapses.
z siaddr: IP address of the DHCP server. z giaddr: IP address of the first DHCP relay agent that the DHCP client passes after it sent the request packet. z chaddr: Hardware address of the DHCP client. z sname: Name of the DHCP server. z file: Path and name of the boot configuration file that the DHCP server specifies for the DHCP client. z option: Optional variable-length fields, including packet type, valid lease time, IP address of a DNS server, and IP address of the WINS server.
2 DHCP Relay Agent Configuration When configuring the DHCP relay agent, go to these sections for information you are interested in: z Introduction to DHCP Relay Agent z Configuring the DHCP Relay Agent z Displaying and Maintaining DHCP Relay Agent Configuration z DHCP Relay Agent Configuration Example z Troubleshooting DHCP Relay Agent Configuration Currently, the interface-related DHCP relay agent configurations can only be made on VLAN interfaces.
Figure 2-1 Typical DHCP relay agent application In the process of dynamic IP address assignment through the DHCP relay agent, the DHCP client and DHCP server interoperate with each other in a similar way as they do without the DHCP relay agent. The following sections only describe the forwarding process of the DHCP relay agent. For the interaction process of the packets, see Obtaining IP Addresses Dynamically.
Figure 2-2 Padding contents for sub-option 1 of Option 82 Figure 2-3 Padding contents for sub-option 2 of Option 82 Mechanism of Option 82 supported on DHCP relay agent The procedure for a DHCP client to obtain an IP address from a DHCP server through a DHCP relay agent is similar to that for the client to obtain an IP address from a DHCP server directly. The following are the mechanism of Option 82 support on DHCP relay agent.
Configuring the DHCP Relay Agent If a device belongs to an IRF fabric, you need to enable the UDP Helper function on it before configuring it as a DHCP relay agent.
To improve security and avoid malicious attack to the unused SOCKETs, the device provides the following functions: z UDP 67 and UDP 68 ports used by DHCP are enabled only when DHCP is enabled. z UDP 67 and UDP 68 ports are disabled when DHCP is disabled. The corresponding implementation is as follows: z When a VLAN interface is mapped to a DHCP server group with the dhcp-server command, the DHCP relay agent is enabled. At the same time, UDP 67 and UDP 68 ports used by DHCP are enabled.
To do… z Use the command… Remarks Enter system view system-view — Create a static IP-to-MAC binding dhcp-security static ip-address mac-address Optional Enter interface view interface interface-type interface-number — Enable the address checking function address-check enable Not created by default. Required Disabled by default. The address-check enable command is independent of other commands of the DHCP relay agent.
To do… Set the interval at which the DHCP relay agent dynamically updates the client address entries Use the command… Remarks Optional dhcp-security tracker { interval | auto } By default, auto is adopted, that is, the interval is automatically calculated. Enabling unauthorized DHCP server detection If there is an unauthorized DHCP server in the network, when a client applies for an IP address, the unauthorized DHCP server may assign an incorrect IP address to the DHCP client.
To do… z Use the command… Remarks Enter system view system-view — Enable Option 82 support on the DHCP relay agent dhcp relay information enable Required Configure the strategy for the DHCP relay agent to process request packets containing Option 82 dhcp relay information strategy { drop | keep | replace } Optional Disabled by default.
Figure 2-4 Network diagram for DHCP relay agent Configuration procedure # Create DHCP server group 1 and configure an IP address of 10.1.1.1 for it. system-view [SwitchA] dhcp-server 1 ip 10.1.1.1 # Map VLAN-interface 1 to DHCP server group 1. [SwitchA] interface vlan-interface 1 [SwitchA-Vlan-interface1] dhcp-server 1 z You need to perform corresponding configurations on the DHCP server to enable the DHCP clients to obtain IP addresses from the DHCP server.
z Check if an address pool that is on the same network segment with the DHCP clients is configured on the DHCP server. z Check if a reachable route is configured between the DHCP relay agent and the DHCP server. z Check the DHCP relay agent. Check if the correct DHCP server group is configured on the interface connecting the network segment where the DHCP client resides. Check if the IP address of the DHCP server group is correct.
3 DHCP Snooping Configuration After DHCP snooping is enabled on a device, clients connected with the device cannot obtain IP addresses dynamically through BOOTP. DHCP Snooping Overview Function of DHCP Snooping For security, the IP addresses used by online DHCP clients need to be tracked for the administrator to verify the corresponding relationship between the IP addresses the DHCP clients obtained from DHCP servers and the MAC addresses of the DHCP clients.
Figure 3-1 Typical network diagram for DHCP snooping application DHCP Server DHCP Client DHCP Client Internet GE1/0/1 GE1/0/2 Switch B (DHCP Relay) Switch A (DHCP Snooping) DHCP Client DHCP Client DHCP snooping listens the following two types of packets to retrieve the IP addresses the DHCP clients obtain from DHCP servers and the MAC addresses of the DHCP clients: z DHCP-REQUEST packet z DHCP-ACK packet Overview of DHCP Snooping Option 82 Introduction to Option 82 Option 82 is the relay agent
contents). That is, the circuit ID or remote ID sub-option defines the type and length of a circuit ID or remote ID. The remote ID type field and circuit ID type field are determined by the option storage format. They are both set to “0” in the case of HEX format and to “1” in the case of ASCII format.
Table 3-1 Ways of handling a DHCP packet with Option 82 Handling policy Sub-option configuration The DHCP snooping device will… Drop — Drop the packet. Keep — Forward the packet without changing Option 82. Neither of the two sub-options is configured Replace Forward the packet after replacing the original Option 82 with the default content.
z The resources on the server are exhausted, so the server does not respond to other requests. z After receiving such type of packets, a device needs to send them to the CPU for processing. Too many request packets cause high CPU usage rate. As a result, the CPU cannot work normally. The device can filter invalid IP packets through the DHCP-snooping table and IP static binding table. DHCP-snooping table After DHCP snooping is enabled on a device, a DHCP-snooping table is generated.
To do… Use the command… Remarks Required Specify the current port as a trusted port z dhcp-snooping trust By default, after DHCP snooping is enabled, all ports of a device are untrusted ports. You need to specify the ports connected to the valid DHCP servers as trusted to ensure that DHCP clients can obtain valid IP addresses. The trusted port and the port connected to the DHCP client must be in the same VLAN.
To do… Use the command… Enter system view system-view Enable DHCP-snooping Option 82 support dhcp-snooping information enable Remarks — Required By default, DHCP snooping Option 82 support is disabled.
The dhcp-snooping information format command applies only to the default content of the Option 82 field. If you have configured the circuit ID or remote ID sub-option, the format of the sub-option is ASCII, instead of the one specified with the dhcp-snooping information format command.
To do… Enter system view Use the command… Remarks — system-view Optional Configure the remote ID sub-option in system view dhcp-snooping information remote-id { sysname | string string } Enter Ethernet port view interface interface-type interface-number Configure the remote ID sub-option in Ethernet port view dhcp-snooping information [ vlan vlan-id ] remote-id string string By default, the remote ID sub-option is the MAC address of the DHCP snooping device that received the DHCP client’s request.
To do… Use the command… Enable IP filtering ip check source ip-address [ mac-address ] Create an IP static binding entry ip source static binding ip-address ip-address [ mac-address mac-address ] Remarks Required By default, this function is disabled. Optional By default, no static binding entry is created. z Enable DHCP snooping and specify trusted ports on the device before configuring IP filtering. z You are not recommended to configure IP filtering on the ports of an aggregation group.
Configuration procedure # Enable DHCP snooping on Switch. system-view [Switch] dhcp-snooping # Specify GigabitEthernet 1/0/5 as the trusted port. [Switch] interface gigabitethernet 1/0/5 [Switch-GigabitEthernet1/0/5] dhcp-snooping trust [Switch-GigabitEthernet1/0/5] quit # Enable DHCP-snooping Option 82 support. [Switch] dhcp-snooping information enable # Set the remote ID sub-option in Option 82 to the system name (sysname) of the DHCP snooping device.
Figure 3-7 Network diagram for IP filtering configuration DHCP Server GE1/0/1 Switch DHCP Snooping GE1/0/2 GE1/0/4 GE1/0/3 Host A IP:1.1.1.1 MAC:0001-0001-0001 Client B Client C Configuration procedure # Enable DHCP snooping on Switch. system-view [Switch] dhcp-snooping # Specify GigabitEthernet 1/0/1 as the trusted port.
Displaying and Maintaining DHCP Snooping Configuration To do… Use the command… Display the user IP-MAC address mapping entries recorded by the DHCP snooping function display dhcp-snooping [ unit unit-id ] Display the (enabled/disabled) state of the DHCP snooping function and the trusted ports display dhcp-snooping trust Display the IP static binding table display ip source static binding [ vlan vlan-id | interface interface-type interface-number ] 3-13 Remarks Available in any view
4 DHCP/BOOTP Client Configuration Introduction to DHCP Client After you specify a VLAN interface as a DHCP client, the device can use DHCP to obtain parameters such as IP address dynamically from the DHCP server, which facilitates user configuration and management. Refer to Obtaining IP Addresses Dynamically for the process of how a DHCP client dynamically obtains an IP address through DHCP.
To do… Use the command… Configure the VLAN interface to obtain IP address through DHCP or BOOTP Remarks Required ip address { bootp-alloc | dhcp-alloc } By default, no IP address is configured for the VLAN interface. Currently, the device operating as a DHCP client can use an IP address for no more than 24 days; that is, it can obtain a lease with 24 days at most even if the DHCP server assigns a lease with more than 24 days.
Displaying and Maintaining DHCP/BOOTP Client Configuration To do… Use the command… Display related information on a DHCP client display dhcp client [ verbose ] Display related information on a BOOTP client display bootp client [ interface vlan-interface vlan-id ] Remarks Available in any view 4-3
Table of Contents 1 ACL Configuration·····································································································································1-1 ACL Overview ·········································································································································1-1 ACL Matching Order························································································································1-1 Ways to Apply an ACL on a Device ·········
1 ACL Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a WX3000. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. ACL Overview As the network scale and network traffic are increasingly growing, security control and bandwidth assignment play a more and more important role in network management.
z auto: where rules in an ACL are matched in the order determined by the system, namely the “depth-first” rule. For depth-first rule, there are two cases: Depth-first match order for rules of a basic ACL 1) Range of source IP address: The smaller the source IP address range (that is, the more the number of zeros in the wildcard mask), the higher the match priority. 2) Fragment keyword: A rule with the fragment keyword is prior to others.
When applying an ACL in this way, you can specify the order in which the rules in the ACL are matched. The match order cannot be modified once it is determined, unless you delete all the rules in the ACL and define the match order. An ACL can be referenced by upper-layer software: z Referenced by routing policies z Used to control Telnet, SNMP and Web login users z When an ACL is directly applied to hardware for packet filtering, the device will permit packets if the packets do not match the ACL.
Configuration Procedure Follow these steps to configure a time range: To do… Use the command… Remarks Enter system view system-view — Create a time range time-range time-name { start-time to end-time days-of-the-week [ from start-time start-date ] [ to end-time end-date ] | from start-time start-date [ to end-time end-date ] | to end-time end-date } Required Note that: z If only a periodic time section is defined in a time range, the time range is active only when the system time is within the def
Configuring Basic ACL A basic ACL filters packets based on their source IP addresses. A basic ACL can be numbered from 2000 to 2999. Configuration Prerequisites z To configure a time range-based basic ACL rule, you need to create the corresponding time range first. For information about time range configuration, refer to Configuring Time Range. z The source IP addresses based on which the ACL filters packets are determined.
rule 0 deny source 192.168.0.1 0 Configuring Advanced ACL An advanced ACL can filter packets by their source and destination IP addresses, the protocols carried by IP, and protocol-specific features such as TCP/UDP source and destination ports, ICMP message type and message code. An advanced ACL can be numbered from 3000 to 3999. Note that ACL 3998 and ACL 3999 cannot be configured because they are reserved for cluster management.
z If the ACL is created with the auto keyword specified, the newly created rules will be inserted in the existent ones by depth-first principle, but the numbers of the existent rules are unaltered. Configuration Example # Configure ACL 3000 to permit the TCP packets sourced from the network 129.9.0.0/16 and destined for the network 202.38.160.0/24 and with the destination port number being 80. system-view [device] acl number 3000 [device-acl-adv-3000] rule permit tcp source 129.9.0.0 0.0.255.
Note that: z You can modify any existent rule of the Layer 2 ACL and the unmodified part of the ACL remains. z If you do not specify the rule-id argument when creating an ACL rule, the rule will be numbered automatically. If the ACL has no rules, the rule is numbered 0; otherwise, it is the maximum rule number plus one.
z ACLs assigned globally take precedence over those that are assigned to VLANs. That is, when a packet matches a rule of a globally assigned ACL and a rule of an ACL assigned to a VLAN, the device will perform the action defined in the rule of the globally assigned ACL if the actions defined in the two rules conflict.
To do… Use the command… Remarks — Enter system view system-view Apply an ACL to a VLAN packet-filter vlan vlan-id inbound acl-rule Required For description on the acl-rule argument, refer to ACL Command. Configuration example # Apply ACL 2000 to VLAN 10 to filter the inbound packets of VLAN 10 on all the ports.
Assigning an ACL to a Port Configuration prerequisites Before applying ACL rules to a VLAN, you need to define the related ACLs. For information about defining an ACL, refer to Configuring Basic ACL, Configuring Advanced ACL, Configuring Layer 2 ACL.
Examples for Upper-layer Software Referencing ACLs Example for Controlling Telnet Login Users by Source IP Network requirements As shown in Figure 1-1, apply an ACL to permit users with the source IP address of 10.110.100.52 to telnet to the switching engine. Figure 1-1 Network diagram for controlling Telnet login users by source IP Internet PC 10.110.100.52 Switch Configuration procedure # Define ACL 2000. system-view [device] acl number 2000 [device-acl-basic-2000] rule 1 permit source 10.
Configuration procedure # Define ACL 2001. system-view [device] acl number 2001 [device-acl-basic-2001] rule 1 permit source 10.110.100.46 0 [device-acl-basic-2001] quit # Reference ACL 2001 to control users logging in to the Web server. [device] ip http acl 2001 Examples for Applying ACLs to Hardware Basic ACL Configuration Example Network requirements As shown in Figure 1-3, PC1 and PC2 connect to Switch through GigabitEthernet 1/0/1. PC1’s IP address is 10.1.1.1.
GigabitEthernet 1/0/1 of Switch. Apply an ACL to deny requests from the R&D department and destined for the wage server during the working hours (8:00 to 18:00). Figure 1-4 Network diagram for advanced ACL configuration To the router Wage query server 192.168.1 .2 GEth 1/0/1 GEth 1/0/2 Switch The R&D Department Configuration procedure # Define a periodic time range that is active from 8:00 to 18:00 everyday.
system-view [device] time-range test 8:00 to 18:00 daily # Define ACL 4000 to filter packets with the source MAC address of 000f-e20f-0101 and the destination MAC address of 000f-e20f-0303. [device] acl number 4000 [device-acl-ethernetframe-4000] rule 1 deny source 000f-e20f-0101 ffff-ffff-ffff dest 000f-e20f-0303 ffff-ffff-ffff time-range test [device-acl-ethernetframe-4000] quit # Apply ACL 4000 on GigabitEthernet 1/0/1.
# Apply ACL 3000 to VLAN 10.
Table of Contents 1 QoS Configuration·····································································································································1-1 Overview ·················································································································································1-1 Introduction to QoS··························································································································1-1 Traditional Packet Forwarding Servi
Applying a QoS Profile ····················································································································2-2 Displaying and Maintaining QoS Profile ··························································································2-3 Configuration Example····························································································································2-4 QoS Profile Configuration Example······················································
1 QoS Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Overview Introduction to QoS Quality of service (QoS) is a concept generally existing in occasions with service supply and demand. It evaluates the ability to meet the need of the customers in service.
Video-on-Demand (VoD). Enterprise users expect to connect their regional branches together using VPN techniques for coping with daily business, for instance, accessing databases or manage remote equipments through Telnet. All these new applications have one thing in common, that is, they have special requirements for bandwidth, delay, and jitter. For instance, bandwidth, delay, and jitter are critical for videoconference and VoD.
information carried in packet header. Packet payload is rarely adopted for traffic classification. The identifying rule is unlimited in range. It can be a quintuplet consisting of source address, source port number, protocol number, destination address, and destination port number. It can also be simply a network segment.
z Class selector (CS) class: This class comes from the IP ToS field and includes eight subclasses; z Best Effort (BE) class: This class is a special class without any assurance in the CS class. The AF class can be degraded to the BE class if it exceeds the limit. Current IP network traffic belongs to this class by default.
As shown in the figure above, each host supporting 802.1Q protocol adds a 4-byte 802.1Q tag header after the source address of the former Ethernet frame header when sending packets. The 4-byte 802.1Q tag header consists of the tag protocol identifier (TPID, two bytes in length), whose value is 0x8100, and the tag control information (TCI, two bytes in length). Figure 1-3 describes the detailed contents of an 802.1Q tag header. Figure 1-3 802.
The device does not support marking drop precedence for packets. A device can operate in one of the following two priority trust modes when assigning precedence to received packets: z Packet priority trusted mode z Port priority trusted mode In terms of priority trust mode, the priority mapping process is shown in Figure 1-4.
The devices provide COS-precedence-to-other-precedence, DSCP-precedence-to-other-precedence, and DSCP-precedence-to-DSCP- precedence mapping tables for priority mapping. Table 1-4 through Table 1-6 list the default settings of these tables. Table 1-4 The default COS-precedence-to-other-precedence mapping table of the devices Target local precedence 802.
Protocol Priority Protocol packets carry their own priority. You can modify the priority of a protocol packet to implement QoS. Priority Marking The priority marking function is to use ACL rules in traffic classification and reassign the priority for the packets matching the ACL rules. Traffic Policing and Traffic Shaping The network will be made more congested by plenty of continuous burst packets if the traffic of each user is not limited.
Evaluating the traffic with the token bucket When token bucket is used for traffic evaluation, the number of the tokens in the token bucket determines the amount of the packets that can be forwarded. If the number of tokens in the bucket is enough to forward the packets, the traffic is conforming to the specification; otherwise, the traffic is nonconforming or excess.
Figure 1-6 Diagram for traffic shaping Packets to be sent through this port Put tokens in the bucket at the set rate Continue to send Packet classification Queue Token bucket Drop For example, if the device A sends packets to the device B. The device B will perform traffic policing on packets from the device A to drop the packets beyond the specification.
1) SP queuing Figure 1-7 Diagram for SP queuing Queue 7 High priority Packets to be sent through this port Sent packets Queue 6 Queue 2 weight2 Interface …… Queue 1 Queue N- 1 weight N-1 Packet classification Queue scheduling Sending queue Queue 0 Queue N weight N Low priority SP queue-scheduling algorithm is specially designed for critical service applications.
Figure 1-8 Diagram for WRR queuing Queue1 Weight 1 Queue2 Weight 2 Packets to be sent through this port Sent packets Queue 2 weight2 Interface …… Queue N-1 Weight N-1 Queue N- 1 weight N-1 Packet classification Queue N Queue scheduling Sending queue Weight N Queue N weight N WRR queue-scheduling algorithm schedules all the queues in turn and every queue can be assured of a certain service time. Assume there are eight priority queues on a port.
Table 1-7 Queue-scheduling sequence of SDWRR Scheduling algorithm Queue-scheduling sequence Description WRR 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1 0 indicates packets in queue0 SDWRR 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0 1 indicates packets in queue1 Flow-based Traffic Accounting The function of flow-based traffic accounting is to use ACL rules in traffic classification and perform traffic accounting on the packets matching the ACL rules.
Task Remarks Enabling the Burst Function Optional Configuring Traffic Mirroring Optional Configuring Priority Trust Mode Refer to Priority Trust Mode for introduction to priority trust mode. Configuration prerequisites z The priority trust mode to be adopted is determined. z The port where priority trust mode is to be configured is determined. z The port priority value is determined.
Configuration example z Configure to trust port priority on GigabitEthernet 1/0/1 and set the priority of GigabitEthernet 1/0/1 to 7. Configuration procedure: system-view [device] interface GigabitEthernet1/0/1 [device-GigabitEthernet1/0/1] priority 7 z Configure to trust 802.1p precedence on GigabitEthernet 1/0/1.
To do… Configure COS-precedence-to-DSCP -precedence mapping table Use the command… Remarks qos cos-dscp-map cos0-map-dscp cos1-map-dscp cos2-map-dscp cos3-map-dscp cos4-map-dscp cos5-map-dscp cos6-map-dscp cos7-map-dscp Required Follow these steps to configure the DSCP-precedence-to-other-precedence mapping table: To do… Use the command… Remarks Enter system view system-view — Configure DSCP-precedence-to-local -precedence mapping table qos dscp-local-precedence-map dscp-list : local-precedence
[device] qos dscp-local-precedence-map 8 9 10 11 12 13 14 15 : 3 [device] qos dscp-local-precedence-map 16 17 18 19 20 21 22 23 : 4 [device] qos dscp-local-precedence-map 24 25 26 27 28 29 30 31 : 1 [device] qos dscp-local-precedence-map 32 33 34 35 36 37 38 39 : 7 [device] qos dscp-local-precedence-map 40 41 42 43 44 45 46 47 : 0 [device] qos dscp-local-precedence-map 48 49 50 51 52 53 54 55 : 5 [device] qos dscp-local-precedence-map 56 57 58 59 60 61 62 63 : 6 display qos dscp-local-precedence-ma
37 : 7 38 : 7 39 : 7 40 : 0 41 : 0 42 : 0 43 : 0 44 : 0 45 : 0 46 : 0 47 : 0 48 : 5 49 : 5 50 : 5 51 : 5 52 : 5 53 : 5 54 : 5 55 : 5 56 : 6 57 : 6 58 : 6 59 : 6 60 : 6 61 : 6 62 : 6 63 : 6 Setting the Priority of Protocol Packets Refer to Protocol Priority for information about priority of protocol packets. Configuration prerequisites z The protocol type is determined. z The priority value is determined.
Configuration example z Set the IP precedence of ICMP packets to 3. z Display the configuration. Configuration procedure: system-view [device] protocol-priority protocol-type icmp ip-precedence 3 [device] display protocol-priority Protocol: icmp IP-Precedence: flash(3) Marking Packet Priority Refer to Priority Marking for information about marking packet priority.
Follow these steps to mark the priority for packets that are of a port group and match specific ACL rules: To do… Use the command… Remarks Enter system view system-view — Enter port group view port-group group-id — Mark the priorities for packets matching specific ACL rules traffic-priority inbound acl-rule { dscp dscp-value | cos cos-value } Required Follow these steps to mark the priority for packets passing a port and matching specific ACL rules: To do… Use the command… Remarks Enter syste
Configuration prerequisites z The ACL rules used for traffic classification are defined. Refer to the ACL module of this manual for information about defining ACL rules. z The rate limit for traffic policing, and the actions for the packets exceeding the rate limit are determined. Configuration procedure You can configure traffic policing for all the packets matching specific ACL rules, or for the packets that match specific ACL rules and are of a VLAN, of a port group, or pass a port.
To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Configure traffic policing traffic-limit inbound acl-rule target-rate [ conform con-action ] [ exceed exceed-action ] [ meter-statistic ] Required Clear the traffic policing statistics reset traffic-limit inbound acl-rule Optional By default, traffic policing is disabled.
Configuration procedure Follow these steps to configure traffic shaping: To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Required Traffic shaping is not enabled by default.
Follow these steps to redirect packets that are of a VLAN and match specific ACL rules: To do… Use the command… Remarks Enter system view system-view — Configure traffic redirecting traffic-redirect vlan vlan-id inbound acl-rule interface interface-type interface-number Required Follow these steps to redirect packets that are of a port group and match specific ACL rules: To do… Use the command… Remarks Enter system view system-view — Enter port group view port-group group-id — Configure tr
[device-acl-basic-2000] quit [device] interface GigabitEthernet1/0/1 [device-GigabitEthernet1/0/1] traffic-redirect inbound ip-group 2000 interface GigabitEthernet1/0/7 2) Method II system-view [device] acl number 2000 [device-acl-basic-2000] rule permit source 10.1.1.1 0.0.0.255 [device-acl-basic-2000] quit [device] traffic-redirect vlan 2 inbound ip-group 2000 interface GigabitEthernet1/0/7 Configuring VLAN Mapping Refer to VLAN Mapping for information about VLAN mapping.
Configuration prerequisites The algorithm for queue scheduling to be used and the related parameters are determined. Configuration procedure Follow these steps to configure SP queue scheduling algorithm: To do… Enter system view Use the command… Remarks — system-view Optional Configure SP queue scheduling algorithm undo queue-scheduler [ queue-id ] &<1-8> By default, SP queue scheduling algorithm is adopted on all the output queues of a port.
Configuration example # Configure a device to adopt SP+SDWRR combination for queue scheduling, assigning queue 3, queue 4, and queue 5 to WRR scheduling group 1, with the weigh of 20, 20 and 30; assigning queue 0, queue 1, and queue 2 to WRR scheduling group 2, with the weight 20, 20, and 40; using SP for scheduling queue 6 and queue 7. Display the configuration information after configuration.
To do… Use the command… Remarks Collect the statistics on the packets matching specific ACL rules traffic-statistic vlan vlan-id inbound acl-rule Required Clear the statistics on the packets matching specific ACL rules reset traffic-statistic vlan vlan-id inbound acl-rule Optional Follow these steps to collect traffic statistics on packets that are of a port group and match specific ACL rules: To do… Use the command… Remarks Enter system view system-view — Enter port group view port-group gr
[device] acl number 2000 [device-acl-basic-2000] rule permit source 10.1.1.1 0.0.0.255 [device-acl-basic-2000] quit [device] interface GigabitEthernet1/0/1 [device-GigabitEthernet1/0/1] traffic-statistic inbound ip-group 2000 [device-GigabitEthernet1/0/1] reset traffic-statistic inbound ip-group 2000 2) Method II system-view [device] acl number 2000 [device-acl-basic-2000] rule permit source 10.1.1.1 0.0.0.
Configuration procedure You can configure traffic mirroring on all the packets matching specific ACL rules, or on packets that match specific ACL rules and are of a VLAN, of a port group, or pass a port.
Follow these steps to configure traffic mirroring for a port: To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view of the destination port interface interface-type interface-number — Define the current port as the destination port monitor-port Required Exit current view quit — Enter Ethernet port view of traffic mirroring configuration interface interface-type interface-number — Reference ACLs for identifying traffic flows and perform traffic mirroring f
[device] mirrored-to vlan 2 inbound ip-group 2000 monitor-interface Displaying and Maintaining QoS To do… Use the command… Display the protocol packet priority configuration display protocol-priority Display the COS-precedence-to-Drop-precedence mapping relationship display qos cos-drop-precedence-map Display the COS-precedence-to-DSCP-precedence mapping relationship display qos cos-dscp-map Display the COS-precedence-to-local-precedence mapping relationship display qos cos-local-precedence-map D
To do… Use the command… Display VLAN mapping configuration of a port or all the ports display qos-interface { interface-type interface-number | unit-id } traffic-remark-vlanid Display traffic mirroring configuration of a port or all the ports display qos-interface { interface-type interface-number | unit-id } mirrored-to Display the configuration of traffic mirroring, traffic policing, priority marking, traffic redirecting, or traffic accounting performed for all the packets display qos-global { all
# Create ACL 2000 and enter basic ACL view to classify packets sourced from the 192.168.1.0/24 network segment. system-view [device] acl number 2000 [device-acl-basic-2000] rule permit source 192.168.1.0 0.0.0.255 [device-acl-basic-2000] quit # Create ACL 2001 and enter basic ACL view to classify packets sourced from the 192.168.2.0/24 network segment. [device] acl number 2001 [device-acl-basic-2001] rule permit source 192.168.2.0 0.0.0.
2 QoS Profile Configuration Overview Introduction to QoS Profile QoS profile is a set of QoS configurations. It provides an easy way for performing and managing QoS configuration. A QoS profile can contain one or multiple QoS functions. In networks where hosts change their positions frequently, you can define QoS policies for the hosts and add the QoS policies to a QoS profile.
QoS Profile Configuration QoS Profile Configuration Task List Complete the following tasks to configure a QoS profile: Task Remarks Configuring a QoS Profile Required Applying a QoS Profile Optional Applying a QoS Profile Optional Configuring a QoS Profile Configuration prerequisites z The ACL rules used for traffic classification are defined. Refer to the ACL module of this manual for information about defining ACL rules. z The type and number of actions in the QoS profile are specified.
Configuration procedure Follow these steps to configure to apply a QoS profile dynamically: To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Configure the mode to apply a QoS profile as port-based Specify the mode to apply a QoS profile Optional qos-profile port-based By default, the mode to apply a QoS profile is user-based.
Configuration Example QoS Profile Configuration Example Network requirements As shown in Figure 2-1, the user name is “someone”, and the authentication password is “hello”. It is connected to GigabitEthernet 1/0/1 of the switch and belongs to the test.net domain. It is required to configure a QoS profile to limit the rate of all the outbound IP packets of the user to 128 kbps and configuring to drop the packets exceeding the target packet rate.
# Create the user domain test.net and specify radius1 as your RADIUS server group. [device] domain test.net [device-isp-test.net] radius-scheme radius1 [device-isp-test.net] quit # Create ACL 3000 to permit IP packets destined for any IP address.
Table of Contents 1 Mirroring Configuration ····························································································································1-1 Mirroring Overview ··································································································································1-1 Local Port Mirroring ·························································································································1-2 Remote Port Mirroring ···················
1 Mirroring Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Mirroring Overview Mirroring refers to the process of copying packets of one or more ports (source ports) to a destination port which is connected to a data detection device.
z VLAN-based mirroring: a device copies packets of a specified VLAN to the destination port. Local Port Mirroring In local port mirroring, packets passing through one or more source ports of a device are copied to the destination port on the same device for packet analysis and monitoring. In this case, the source ports and the destination port must be located on the same device. Remote Port Mirroring Remote port mirroring does not require the source and destination ports to be on the same device.
Table 1-1 Ports involved in the mirroring operation Switch Source switch Ports involved Function Source port Port monitored. It copies packets to the reflector port through local port mirroring. There can be more than one source port. Reflector port Receives packets from the source port and broadcasts the packets in the remote-probe VLAN. Trunk port Sends mirrored packets to the intermediate switch or the destination switch. Sends mirrored packets to the destination switch.
Mirroring Configuration Complete the following tasks to configure mirroring: Task Remarks Configuring Local Port Mirroring Optional Configuring Remote Port Mirroring Optional Configuring MAC-Based Mirroring Optional Configuring VLAN-Based Mirroring Optional Configuring Local Port Mirroring Configuration prerequisites z The source port is determined and the direction in which the packets are to be mirrored is determined. z The destination port is determined.
Configuring Remote Port Mirroring The device can serve as a source switch, an intermediate switch, or a destination switch in a remote port mirroring networking environment. Configuration on the device acting as a source switch 1) Configuration prerequisites z The source port, the reflector port, and the remote-probe VLAN are determined. z Layer 2 connectivity is ensured between the source and destination switches over the remote-probe VLAN.
When configuring the source switch, note that: All ports of a remote source mirroring group are on the same device. Each remote source mirroring z group can be configured with only one reflector port. The reflector port cannot be a member port of an existing mirroring group, a member port of an z aggregation group, or a port enabled with LACP or STP. It must be an access port and cannot be configured with the functions like VLAN-VPN, port loopback detection, QoS, port security, and so on.
Follow these steps to configure remote port mirroring on the destination switch: To do… Use the command… Remarks Enter system view system-view — Create a VLAN and enter VLAN view vlan vlan-id vlan-id is the ID of the remote-probe VLAN.
Configuration prerequisites z The MAC address to be matched is determined. z The destination port is determined.
Configuration procedure Follow these steps to configure VLAN-based mirroring: To do… Use the command… Remarks Enter system view system-view — Create a local or remote source mirroring group mirroring-group group-id { local | remote-source } Required Configuring VLAN-Based Mirroring mirroring-group group-id mirroring-vlan vlan-id inbound Required Required Configure the destination port for the mirroring group mirroring-group group-id monitor-port monitor-port-id Note that you need not configure
Use the local port mirroring function to meet the requirement. Perform the following configurations on Switch C. z Configure GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 as mirroring source ports. z Configure GigabitEthernet 1/0/3 as the mirroring destination port.
z Department 1 is connected to GigabitEthernet 1/0/1 of Switch A. z Department 2 is connected to GigabitEthernet 1/0/2 of Switch A. z GigabitEthernet 1/0/3 of Switch A connects to GigabitEthernet 1/0/1 of Switch B. z GigabitEthernet 1/0/2 of Switch B connects to GigabitEthernet 1/0/1 of Switch C. z The data detection device is connected to GigabitEthernet 1/0/2 of Switch C. The administrator wants to monitor the packets sent from Department 1 and 2 through the data detection device.
[device] mirroring-group 1 mirroring-port GigabitEthernet 1/0/1 GigabitEthernet 1/0/2 inbound [device] mirroring-group 1 reflector-port GigabitEthernet 1/0/4 [device] mirroring-group 1 remote-probe vlan 10 # Configure GigabitEthernet 1/0/3 as trunk port, allowing packets of VLAN 10 to pass.
# Configure the destination port and remote-probe VLAN for the remote destination mirroring group. [device] mirroring-group 1 monitor-port GigabitEthernet 1/0/2 [device] mirroring-group 1 remote-probe vlan 10 # Configure GigabitEthernet 1/0/1 as the trunk port, allowing packets of VLAN 10 to pass.
Table of Contents 1 ARP Configuration·····································································································································1-1 Introduction to ARP ·································································································································1-1 ARP Function ··································································································································1-1 ARP Message Format ···················
1 ARP Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Introduction to ARP ARP Function Address Resolution Protocol (ARP) is used to resolve an IP address into a data link layer address. An IP address is the address of a host at the network layer.
Figure 1-1 ARP message format Hardware type (16 bits) Protocol type (16 bits) Length of hardware address Length of protocol address Operator (16 bits) Hardware address of the sender IP address of the sender Hardware address of the receiver IP address of the receiver Table 1-1 describes the fields of an ARP packet. Table 1-1 Description on the fields of an ARP packet Field Description Hardware Type Type of the hardware interface. Refer to Table 1-2 for the information about the field values.
Value Description 5 Chaos 6 IEEE802.X 7 ARC network ARP Table In an Ethernet, the MAC addresses of two hosts must be available for the two hosts to communicate with each other. Each host in an Ethernet maintains an ARP table, where the latest used IP address-to-MAC address mapping entries are stored. The device provides the display arp command to display the information about ARP mapping entries. ARP entries in a device can either be static entries or dynamic entries, as described in Table 1-3.
mode, all hosts on this subnet can receive the request, but only the requested host (namely, Host B) will process the request. 4) Host B compares its own IP address with the destination IP address in the ARP request. If they are the same, Host B saves the source IP address and source MAC address into its ARP mapping table, encapsulates its MAC address into an ARP reply, and unicasts the reply to Host A.
After you enable the ARP attack detection function, the device will check the following items of an ARP packet: the source MAC address, source IP address, port number of the port receiving the ARP packet, and the ID of the VLAN the port resides. If these items match the entries of the DHCP snooping table or the manual configured IP binding table, the device will forward the ARP packet; if not, the device discards the ARP packet.
To do… Enable the ARP entry checking function (that is, disable the device from learning ARP entries with multicast MAC addresses) z Use the command… Remarks Optional arp check enable By default, the ARP entry checking function is enabled. Static ARP entries are valid as long as the device operates normally. But some operations, such as removing a VLAN, or removing a port from a VLAN, will make the corresponding ARP entries invalid and therefore removed automatically.
To do… Use the command… Remarks Quit to system view quit — Enter VLAN view vlan vlan-id — Optional Enable ARP restricted forwarding z arp restricted-forwarding enable By default, the ARP restricted forwarding function is disabled. The device forwards legal ARP packets through all its ports. You need to enable DHCP snooping and configure DHCP snooping trusted ports on the device before configuring the ARP attack detection function.
Displaying and Maintaining ARP To do… Use the command… Display specific ARP mapping table entries display arp [ static | dynamic | ip-address ] Display the ARP mapping entries related to a specified string in a specified way display arp [ dynamic | static ] | { begin | include | exclude } text Display the number of the ARP entries of a specified type display arp count [ [ dynamic | static ] [ | { begin | include | exclude } text ] | ip-address ] Display the statistics about the untrusted ARP packets
Figure 1-4 ARP attack detection configuration DHCP Server GE1/0/1 Switch A DHCP Snooping GE1/0/2 GE1/0/3 Client A Client B Configuration procedure # Enable DHCP snooping on Switch A. system-view [SwitchA] dhcp-snooping # Specify GigabitEthernet 1/0/1 as the DHCP snooping trusted port and the ARP trusted port.
Table of Contents 1 SNMP Configuration··································································································································1-1 SNMP Overview······································································································································1-1 SNMP Operation Mechanism··········································································································1-1 SNMP Versions ·········································
1 SNMP Configuration z The term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. SNMP Overview The simple network management protocol (SNMP) is used for ensuring the transmission of the management information between any two network nodes.
SNMP NMS and SNMP agent. Community name functions as password. It can limit accesses made by SNMP NMS to SNMP agent. You can perform the following community name-related configuration. z Specifying MIB view that a community can access. z Set the permission for a community to access an MIB object to be read-only or read-write. Communities with read-only permissions can only query the device information, while those with read-write permission can configure the device as well.
MIB attribute MIB content Related RFC DHCP MIB QACL MIB MSTP MIB VLAN MIB IPV6 ADDRESS MIB MIRRORGROUP MIB Private MIB — QINQ MIB 802.x MIB HGMP MIB NTP MIB Device management Interface management Configuring Basic SNMP Functions Because the configuration of SNMPv3 is quite different from that of SNMPv1 and SNMPv2c, their configuration procedures are described in two subsections.
To do… Direct configura tion Set a community name and access permission Indirect configura tion Use the command… Remarks Required Set a community name snmp-agent community { read | write } community-name [ acl acl-number | mib-view view-name ]* Set an SNMP group snmp-agent group { v1 | v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ] Add a user to an SNMP group snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ]
To do… Use the command… Set an SNMP group snmp-agent group v3 group-name [ authentication | privacy ] [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ] Encrypt a plain-text password to generate a cipher-text one snmp-agent calculate-password plain-password mode { md5 | sha } { local-engineid | specified-engineid engineid } Add a user to an SNMP group snmp-agent usm-user v3 user-name group-name [ cipher ] [ authentication-mode { md5 | sha } auth-password
To do… Use the command… Remarks Enter system view system-view Enable the device to send Trap messages to NMS snmp-agent trap enable [ configuration | flash | standard [ authentication | coldstart | linkdown | linkup | warmstart ]* | system | ] Enter port view or interface view Enable the port to send Trap messages — interface interface-type interface-number Optional Enable the port or interface to send Trap messages enable snmp trap updown By default, a port is enabled to send all types of Trap
Enabling Logging for Network Management Follow these steps to enable logging for network management: To do… Use the command… Remarks Enter system view system-view — Enable logging for network management snmp-agent log { set-operation | get-operation | all } Optional Disabled by default. Use the display logbuffer command to view the log of the get and set operations requested by the NMS.
z Perform the following configuration on Switch A: setting the community name and access permission, administrator ID, contact and location of Switch A, and enabling the device to sent trap messages. Thus, the NMS is able to access Switch A and receive the trap messages sent by Switch A. Figure 1-2 Network diagram for SNMP configuration 10 .10 .10 .2 10.10.10.1 NMS Switch A Ethernet Network procedure # Enable SNMP agent, and set the SNMPv1 and SNMPv2c community names.
[device] snmp-agent trap enable standard linkdown [device] snmp-agent target-host trap address udp-domain 10.10.10.1 udp-port 5000 params securityname public Configuring the NMS The device supports iMC NMS. SNMPv3 adopts user name and password authentication. When you use the iMC, you need to set user names and choose the security level in. For each security level, you need to set authorization mode, authorization password, encryption mode, encryption password, and so on.
2 RMON Configuration Introduction to RMON Remote monitoring (RMON) is a kind of management information base (MIB) defined by Internet Engineering Task Force (IETF). It is an important enhancement made to MIB II standards. RMON is mainly used to monitor the data traffic across a network segment or even the entire network, and is currently a commonly used network management standard. An RMON system comprises of two parts: the network management station (NMS) and the agents running on network devices.
Commonly Used RMON Groups Event group Event group is used to define the indexes of events and the processing methods of the events. The events defined in an event group are mainly used by entries in the alarm group and extended alarm group to trigger alarms.
The statistics include the number of the following items: collisions, packets with cyclic redundancy check (CRC) errors, undersize (or oversize) packets, broadcast packets, multicast packets, and received bytes and packets. With the RMON statistics management function, you can monitor the use of a port and make statistics on the errors occurred when the ports are being used. RMON Configuration Before performing RMON configuration, make sure the SNMP agents are correctly configured.
Displaying and Maintaining RMON To do… Use the command… Display RMON statistics display rmon statistics [ interface-type interface-number | unit unit-number ] Display RMON history information display rmon history [ interface-type interface-number | unit unit-number ] Display RMON alarm information display rmon alarm [ entry-number ] Display extended RMON alarm information display rmon prialarm [ prialarm-entry-number ] Display RMON events display rmon event [ event-entry ] Display RMON event log
[device] rmon prialarm 2 (.1.3.6.1.2.1.16.1.1.1.9.1+.1.3.6.1.2.1.16.1.1.1.10.1) test 10 changeratio rising_threshold 50 1 falling_threshold 5 2 entrytype forever owner user1 # Display the RMON extended alarm entry numbered 2. [device] display rmon prialarm 2 Prialarm table 2 owned by user1 is VALID. Samples type : changeratio Variable formula : (.1.3.6.1.2.1.16.1.1.1.9.1+.1.3.6.1.2.1.16.1.1.1.10.
Table of Contents 1 Multicast Overview ····································································································································1-1 Multicast Overview ··································································································································1-1 Information Transmission in the Unicast Mode ···············································································1-1 Information Transmission in the Broadcast Mode··········
1 Multicast Overview z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of the WX3000 series devices. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Multicast Overview With development of networks on the Internet, more and more interaction services such as data, voice, and video services are running on the networks.
Figure 1-1 Information transmission in the unicast mode Host A Receiver Host B Source Host C Server Receiver Host D Packets for Host B Receiver Packets for Host D Host E Packets for Host E Assume that Hosts B, D and E need this information. The source server establishes transmission channels for the devices of these users respectively.
Figure 1-2 Information transmission in the broadcast mode Host A Receiver Host B Source Host C Server Receiver Host D Receiver Packets for all the network Host E Assume that Hosts B, D, and E need the information. The source server broadcasts this information through routers, and Hosts A and C on the network also receive this information. As we can see from the information transmission process, the security and legal use of paid service cannot be guaranteed.
Figure 1-3 Information transmission in the multicast mode Host A Receiver Host B Source Host C Server Receiver Host D Receiver Packets for the multicast group Host E Assume that Hosts B, D and E need the information. To transmit the information to the right users, it is necessary to group Hosts B, D and E into a receiver set. The routers on the network duplicate and distribute the information based on the distribution of the receivers in this set.
Table 1-1 An analogy between TV transmission and multicast transmission Step z TV transmission Multicast transmission 1 A TV station transmits a TV program through a television channel. A multicast source sends multicast data to a multicast group. 2 A user tunes the TV set to the channel. A receiver joins the multicast group. 3 The user starts to watch the TV program transmitted by the TV station via the channel.
ASM model In the ASM model, any sender can become a multicast source and send information to a multicast group; numbers of receivers can join a multicast group identified by a group address and obtain multicast information addressed to that multicast group. In this model, receivers are not aware of the position of a multicast source in advance. However, they can join or leave the multicast group at any time. SFM model The SFM model is derived from the ASM model.
As receivers are multiple hosts in a multicast group, you should be concerned about the following questions: z What destination should the information source send the information to in the multicast mode? z How to select the destination address? These questions are about multicast addressing. To enable the communication between the information source and members of a multicast group (a group of information receivers), network-layer multicast addresses, namely, IP multicast addresses must be provided.
Class D address range 239.0.0.0 to 239.255.255.255 Description Administratively scoped multicast addresses, which are for specific local use only. As specified by IANA, the IP addresses ranging from 224.0.0.0 to 224.0.0.255 are reserved for network protocols on local networks. The following table lists commonly used reserved IP multicast addresses: Table 1-3 Reserved IP multicast addresses Class D address range Description 224.0.0.1 Address of all hosts 224.0.0.
multicast MAC address is used as the destination address because the destination is a group with an uncertain number of members. As stipulated by IANA, the high-order 24 bits of a multicast MAC address are 0x01005e, while the low-order 23 bits of a MAC address are the low-order 23 bits of the multicast IP address.
Figure 1-5 Positions of Layer 3 multicast protocols Receiver AS 1 Receiver IGMP IGMP PIM AS 2 PIM MSDP IGMP Receiver Source 1) Multicast management protocols Typically, the Internet Group Management Protocol (IGMP) is used between hosts and Layer 3 multicast devices directly connected with the hosts. These protocols define the mechanism of establishing and maintaining group memberships between hosts and Layer 3 multicast devices.
Figure 1-6 Positions of Layer 2 multicast protocols Source IGMP Snooping Receiver Receiver multicast packets 2) IGMP Snooping Running on Layer 2 devices, Internet Group Management Protocol Snooping (IGMP Snooping) are multicast constraining mechanisms that manage and control multicast groups by listening to and analyzing IGMP messages exchanged between the hosts and Layer 3 multicast devices, thus effectively controlling the flooding of multicast data in a Layer 2 network.
2) If the corresponding (S, G) entry exists, but the interface on which the packet actually arrived is not the incoming interface in the multicast forwarding table, the multicast packet is subject to an RPF check. z If the result of the RPF check shows that the RPF interface is the incoming interface of the existing (S, G) entry, this means that the (S, G) entry is correct but the packet arrived from a wrong path and is to be discarded.
z A multicast packet from Source arrives to VLAN-interface 1 of Switch C, and the corresponding forwarding entry does not exist in the multicast forwarding table of Switch C. Switch C performs an RPF check, and finds in its unicast routing table that the outgoing interface to 192.168.0.0/24 is VLAN-interface 2. This means that the interface on which the packet actually arrived is not the RPF interface. The RPF check fails and the packet is discarded.
2 IGMP Snooping Configuration IGMP Snooping Overview Internet Group Management Protocol Snooping (IGMP Snooping) is a multicast constraining mechanism that runs on Layer 2 devices to manage and control multicast groups. Principle of IGMP Snooping By analyzing received IGMP messages, a Layer 2 device running IGMP Snooping establishes mappings between ports and multicast MAC addresses and forwards multicast data based on these mappings.
Figure 2-2 IGMP Snooping related ports Router A Receiver Switch A Eth1/0/1 Eth1/0 /2 Host A Eth 1/0/3 Host B Receiver Eth 1/0/1 Source Eth1/0 /2 Host C Switch B Router port Member port Multicast packets Host D Ports involved in IGMP Snooping, as shown in Figure 2-2, are described as follows: z Router port: A router port is a port on the Layer 3 multicast device (DR or IGMP querier) side of the device. In the figure, Ethernet 1/0/1 of Switch A and Ethernet 1/0/1 of Switch B are router ports.
When receiving a general query The IGMP querier periodically sends IGMP general queries to all hosts and routers on the local subnet to find out whether active multicast group members exist on the subnet. Upon receiving an IGMP general query, the device forwards it through all ports in the VLAN except the receiving port and performs the following to the receiving port: z If the receiving port is a router port existing in its router port list, the device resets the aging timer of this router port.
immediately delete the forwarding entry corresponding to that port from the forwarding table; instead, it resets the aging timer of the member port. Upon receiving the IGMP leave message from a host, the IGMP querier resolves from the message the address of the multicast group that the host just left and sends an IGMP group-specific query to that multicast group through the port that received the leave message.
Operation Remarks Configuring a VLAN Tag for Query Messages Optional Configuring Multicast VLAN Optional Enabling IGMP Snooping Follow these steps to enable IGMP Snooping: To do… Enter system view system-view Remarks — Required Enable IGMP Snooping globally igmp-snooping enable By default, IGMP Snooping is disabled globally.
z Before configuring related IGMP Snooping functions, you must enable IGMP Snooping in the specified VLAN. z Different multicast group addresses should be configured for different multicast sources because IGMPv3 Snooping cannot distinguish multicast data from different sources to the same multicast group. Configuring Timers This section describes how to configure the aging timer of the router port, the aging timer of the multicast member ports, and the query response timer.
Enabling fast leave processing in Ethernet port view Follow these steps to enable fast leave processing in Ethernet view: To do… z Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Enable fast leave processing for specific VLANs igmp-snooping fast-leave [ vlan vlan-list ] Required By default, the fast leave processing feature is disabled.
Configuring a multicast group filter in system view Follow these steps to configure a multicast group filter in system view: To do… Enter system view Use the command… system-view Remarks — Required Configure a multicast group filter igmp-snooping group-policy acl-number [ vlan vlan-list ] No group filter is configured by default, namely hosts can join any multicast group.
Follow these steps to configure the maximum number of multicast groups on a port: To do… z Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Limit the number of multicast groups on a port igmp-snooping group-limit limit [ vlan vlan-list [ overflow-replace ] ] Required The system default for the device is 256.
To do… Use the command… Remarks Required Enable IGMP Snooping querier igmp-snooping querier By default, IGMP Snooping querier is disabled. Optional Configure the interval of sending general queries igmp-snooping query-interval seconds By default, the interval of sending general queries is 60 seconds. igmp-snooping general-query source-ip { current-interface | ip-address } Optional Configure the source IP address of general queries By default, the source IP address of general queries is 0.0.0.0.
In Ethernet port view Follow these steps to configure a static multicast group member port in Ethernet port view: To do… Use the command… Remarks Enter system view system-view — Enter Ethernet port view interface interface-type interface-number — Configure the current port as a static member port for a multicast group in a VLAN Required multicast static-group group-address vlan vlan-id By default, no port is configured as a static multicast group member port.
In VLAN view Follow these steps to configure a static router port in VLAN view: To do… Use the command… Remarks Enter system view system-view — Enter VLAN view vlan vlan-id — Configure a specified port as a static router port multicast static-router-port interface-type interface-number Required By default, no static router port is configured. Configuring a Port as a Simulated Group Member Generally, hosts running IGMP respond to the IGMP query messages of the multicast device.
z Before configuring a simulated host, enable IGMP Snooping in VLAN view first. z The port to be configured must belong to the specified VLAN; otherwise the configuration does not take effect. z You can use the source-ip source-address command to specify a multicast source address that the port will join as a simulated host. This configuration takes effect when IMGPv3 Snooping is enabled in the VLAN.
To do… Enter VLAN interface view Use the command… interface Vlan-interface vlan-id Remarks — Required Enable IGMP igmp enable By default, the IGMP feature is disabled.
z One port can belong to only one multicast VLAN. z The port connected to a user terminal must be a hybrid port. z The multicast member ports must be in the same VLAN with the router port. Otherwise, the multicast member port cannot receive multicast packets. z If a router port is in a multicast VLAN, the router port must be configured as a trunk port or a hybrid port that allows tagged packets to pass for the multicast VLAN.
Figure 2-3 Network diagram for IGMP Snooping configuration Receiver Host A Source GE1/0/2 1 .1.1.2/24 1.1.1.1/24 GE 1/0/1 10 .1 .1.1/24 Router A IGMP querier GE1/0/4 VLAN100 Receiver GE 1/0/3 GE1 /0/1 Switch A GE1/0/2 Multicast packets Host B Host C Configuration procedure 1) Configure the IP address of each interface Configure an IP address and subnet mask for each interface as per Figure 2-3. The detailed configuration steps are omitted.
Total 1 IP Group(s). Total 1 MAC Group(s). Vlan(id):100. Total 1 IP Group(s). Total 1 MAC Group(s). Static Router port(s): Dynamic Router port(s): GigabitEthernet1/0/1 IP group(s):the following ip group(s) match to one mac group. IP group address: 224.1.1.1 Static host port(s): Dynamic host port(s): GigabitEthernet1/0/3 GigabitEthernet1/0/4 MAC group(s): MAC group address: 0100-5e01-0101 Host port(s):GigabitEthernet1/0/3 GigabitEthernet1/0/4 As shown above, the multicast group 224.1.1.
Configure a multicast VLAN, so that users in VLAN 2 and VLAN 3 can receive multicast streams through the multicast VLAN. Figure 2-4 Network diagram for multicast VLAN configuration Vlan-int20 168.10. 1.1 GE1/0/10 GE1/0/1 WorkStation E1 G Vlan-int 10 168.10.2.
# Configure VLAN 10 as the multicast VLAN and enable IGMP Snooping on it. [SwitchB] vlan 10 [SwitchB-vlan10] service-type multicast [SwitchB-vlan10] igmp-snooping enable [SwitchB-vlan10] quit # Define GigabitEthernet 1/0/10 as a hybrid port, add the port to VLAN 2, VLAN 3, and VLAN 10, and configure the port to forward tagged packets for VLAN 2, VLAN 3, and VLAN 10.
3 Common Multicast Configuration Common Multicast Configuration Configuring a Multicast MAC Address Entry In Layer 2 multicast, the system can add multicast forwarding entries dynamically through a Layer 2 multicast protocol. Alternatively, you can statically bind a port to a multicast MAC address entry by configuring a multicast MAC address entry manually.
Configuring Dropping Unknown Multicast Packets Generally, if the multicast address of the multicast packet received on the device is not registered on the local device, the packet will be flooded in the VLAN. When the function of dropping unknown multicast packets is enabled, the device will drop any multicast packets whose multicast address is not registered. Thus, the bandwidth is saved and the processing efficiency of the system is improved.
Table of Contents 1 NTP Configuration ·····································································································································1-1 Introduction to NTP ·································································································································1-1 Applications of NTP ·························································································································1-1 Implementation Principle of NTP········
1 NTP Configuration When configuring NTP, go to these sections for information you are interested in: z Introduction to NTP z NTP Configuration Task List z Configuring NTP Implementation Modes z Configuring Access Control Right z Configuring NTP Authentication z Configuring Optional NTP Parameters z Displaying and Maintaining NTP Configuration z NTP Configuration Examples z The term switch used throughout this document refers to a switching device in a generic sense or the switching engine
z In network management, the analysis of the log information and debugging information collected from different devices is meaningful and valid only when network devices that generate the information adopts the same time. z The billing system requires that the clocks of all network devices be consistent. z Some functions, such as restarting all network devices in a network simultaneously require that they adopt the same time.
Figure 1-1 Implementation principle of NTP NTP message 10:00:00 am IP network 1. Device A Device B NTP message 10:00:00 am 11:00:01 am IP network 2. Device B Device A NTP message 10:00:00 am 11:00:01 am 11:00:02 am IP network 3. Device B Device A NTP message received at 10:00:03 am IP network 4. Device A Device B The procedure of synchronizing the system clock is as follows: z Device A sends an NTP message to Device B, with a timestamp 10:00:00 am (T1) identifying when it is sent.
Server/client mode Figure 1-2 Server/client mode Client Server Network Works in server mode automatically and sends a response packet Clock synchronization request Filters and selects a clock and synchronizes the local clock to that of the preferred server Response Symmetric peer mode Figure 1-3 Symmetric peer mode Active peer Passive peer Network Clock synchronization request Response In peer mode, both sides can be synchronized to each other Works in passive peer mode automatically Synchronize
Multicast mode Figure 1-5 Multicast mode Server Client Network Multicast clock synchronization packets periodically Works in the server mode automatically and sends responses Client/server mode request Initiates a client/server mode request after receiving the first multicast packet Obtains the delay between the client and server and works in Multicast clock synchronization the multicast client mode packets periodically Receives multicast packets and synchronizes the local clock Response Table 1-1 des
NTP Configuration Task List Complete the following tasks to configure NTP: Task Remarks Configuring NTP Implementation Modes Required Configuring Access Control Right Optional Configuring NTP Authentication Optional Configuring Optional NTP Parameters Optional Displaying and Maintaining NTP Configuration Optional Configuring NTP Implementation Modes The device can work in one of the following NTP modes: z Configuring NTP Server/Client Mode z Configuring the NTP Symmetric Peer Mode z Configu
To do… z Use the command… Remarks Enter system view system-view — Required Configure an NTP client ntp-service unicast-server { remote-ip | server-name } [ authentication-keyid key-id | priority | source-interface Vlan-interface vlan-id | version number ]* By default, the device is not configured to work in the NTP client mode. The remote server specified by remote-ip or server-name serves as the NTP server, and the local device serves as the NTP client.
z In the symmetric peer mode, you need to execute the related NTP configuration commands (refer to Configuring NTP Implementation Modes for details) to enable NTP on a symmetric-passive peer; otherwise, the symmetric-passive peer will not process NTP messages from the symmetric-active peer. z The remote device specified by remote-ip or peer-name serves as the peer of the local device, and the local device works in the symmetric-active mode.
Configuring the device to work in the NTP broadcast client mode To do… Use the command… Remarks Enter system view system-view — Enter VLAN interface view interface Vlan-interface vlan-id — Configure the device to work in the NTP broadcast client mode ntp-service broadcast-client Required Not configured by default. Configuring NTP Multicast Mode For devices working in the multicast mode, you need to configure both the server and clients.
Configuring Access Control Right With the following command, you can configure the NTP service access-control right to the local device for a peer device. There are four access-control rights, as follows: z query: Control query right. This level of right permits the peer device to perform control query to the NTP service on the local device but does not permit the peer device to synchronize its clock to the local device.
synchronized only to that of the server that passes the authentication. This improves network security. Table 1-2 shows the roles of devices in the NTP authentication function.
To do… z Use the command… Configure the NTP authentication key ntp-service authentication-keyid key-id authentication-model md5 value Configure the specified key as a trusted key ntp-service reliable authentication-keyid key-id Associat e the specified key with the correspo nding NTP server Configure on the client in the server/client mode ntp-service unicast-server { remote-ip | server-name } authentication-keyid key-id Configure on the symmetric-active peer in the symmetric peer mode ntp-servic
To do… Configure on the NTP broadcast server Associate the specified key with the correspondi ng broadcast/m ulticast client Use the command… Remarks z ntp-service broadcast-server authentication-keyid key-id z Configure on the NTP multicast server ntp-service multicast-server authentication-keyid key-id In NTP broadcast server mode and NTP multicast server mode, you need to associate the specified key with the corresponding broadcast/multicast client You can associate an NTP broadcast/multicast clie
Configuring the Number of Dynamic Sessions Allowed on the Local Device Follow these steps to configure the number of dynamic sessions allowed on the local device: To do… Use the command… Enter system view system-view Configure the maximum number of dynamic sessions that can be established on the local device ntp-service max-dynamic-sessions number Remarks — Required By default, up to 100 dynamic sessions can be established locally.
Figure 1-6 Network diagram for the NTP server/client mode configuration 1.0.1.11/24 1 .0.1.12/24 Device A Device B Configuration procedure Perform the following configurations on Device B. # View the NTP status of Device B before synchronization. display ntp-service status Clock status: unsynchronized Clock stratum: 16 Reference clock ID: none Nominal frequency: 60.0002 Hz Actual frequency: 60.0002 Hz Clock precision: 2^18 Clock offset: 0.0000 ms Root delay: 0.00 ms Root dispersion: 0.
[12345]1.0.1.11 note: 1 127.127.1.0 source(master),2 associations : 2 1 64 source(peer),3 1 350.1 selected,4 15.1 candidate,5 0.0 configured Total 1 Configuring NTP Symmetric Peer Mode Network requirements As shown in Figure 1-7, the local clock of Device A is set as the NTP master clock, with the clock z stratum level of 2. Device C (a WX3000 series device) uses Device A as the NTP server, and Device A works in z server mode automatically.
Reference clock ID: 3.0.1.32 Nominal frequency: 60.0002 Hz Actual frequency: 60.0002 Hz Clock precision: 2^18 Clock offset: 0.66 ms Root delay: 27.47 ms Root dispersion: 208.39 ms Peer dispersion: 9.63 ms Reference time: 17:03:32.022 UTC Thu Sep 7 2006 (BF422AE4.05AEA86C) The output information indicates that the clock of Device C is synchronized to that of Device B and the stratum level of its local clock is 2, one level lower than Device B.
Configuration procedure 1) Configure Device C. # Enter system view. system-view # Set Device C as the broadcast server, which sends broadcast messages through Vlan-interface2. [DeviceC] interface Vlan-interface 2 [DeviceC-Vlan-interface2] ntp-service broadcast-server 2) Configure Device A. (perform the same configuration on Device D) # Enter system view. system-view # Set Device A as a broadcast client.
Configuring NTP Multicast Mode Network requirements z As shown in Figure 1-9, the local clock of Device C is set as the NTP master clock, with a clock stratum level of 2. Configure Device C to work in the NTP multicast server mode and advertise multicast NTP messages through Vlan-interface2. z Device A and Device D are two WX3000 series devices. Configure Device A and Device D to work in the NTP multicast client mode and listen to multicast messages through their own Vlan-interface2.
Clock status: synchronized Clock stratum: 3 Reference clock ID: 3.0.1.31 Nominal frequency: 60.0002 Hz Actual frequency: 60.0002 Hz Clock precision: 2^18 Clock offset: 198.7425 ms Root delay: 27.47 ms Root dispersion: 208.39 ms Peer dispersion: 9.63 ms Reference time: 17:03:32.022 UTC Thu Sep 7 2006 (BF422AE4.05AEA86C) The output information indicates that Device D is synchronized to Device C, with a clock stratum level of 3, one stratum level lower than that Device C.
# Configure an MD5 authentication key, with the key ID being 42 and the key being aNiceKey. [DeviceB] ntp-service authentication-keyid 42 authentication-mode md5 aNiceKey # Specify the key 42 as a trusted key. [DeviceB] ntp-service reliable authentication-keyid 42 [DeviceB] ntp-service unicast-server 1.0.1.11 authentication-keyid 42 After the above configurations, Device B is ready to synchronize with Device A.
Table of Contents 1 SSH Configuration·····································································································································1-1 SSH Overview·········································································································································1-1 Introduction to SSH ·························································································································1-1 Algorithm and Key ······················
1 SSH Configuration z The term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary SSH Overview Introduction to SSH Secure Shell (SSH) is a protocol that provides secure remote login and other security services in insecure network environments.
Figure 1-1 Encryption and decryption Key Key Cipher text Plain text Encryption Decryption Plain text Key-based algorithm is usually classified into symmetric key algorithm and asymmetric key algorithm. Asymmetric Key Algorithm Asymmetric key algorithm means that a key pair exists at both ends. The key pair consists of a private key and a public key. The public key is effective for both ends, while the private key is effective only for the local end.
Version negotiation z The server opens port 22 to listen to connection requests from clients. z The client sends a TCP connection request to the server. After the TCP connection is established, the server sends the first packet to the client, which includes a version identification string in the format of “SSH-.-”.
z In password authentication, the client encrypts the username and password, encapsulates them into a password authentication request, and sends the request to the server. Upon receiving the request, the server decrypts the username and password, compares them with those it maintains, and then informs the client of the authentication result. z The publickey authentication method authenticates clients using digital signatures.
SSH Server Configuration Tasks Complete the following tasks to configure SSH server: Task Configuring the SSH server Remark Configuring the Protocol Support for the User Interface Required Generating/Destroying a RSA or DSA Key Pair Required Exporting the RSA or DSA Public Key Optional Creating an SSH User and Specify an Authentication Type Required Specifying a Service Type for an SSH User Optional Configuring SSH Management Optional Configuring the Client Public Key on the Server Required
z If you have configured a user interface to support SSH protocol, you must configure AAA authentication for the user interface by using the authentication-mode scheme command to ensure successful login. z On a user interface, if the authentication-mode password or authentication-mode none command has been executed, the protocol inbound ssh command is not available.
Exporting the RSA or DSA Public Key You can display the generated RSA or DSA key pair on the screen in a specified format, or export it to a specified file for configuring the key at a remote end.
z For password authentication type, the username argument must be consistent with the valid user name defined in AAA; for publickey authentication, the username argument is the SSH local user name, so that there is no need to configure a local user in AAA. z If the default authentication type for SSH users is password and local AAA authentication is adopted, you need not use the ssh user command to create an SSH user.
To do… Use the command… Enter system view system-view Set SSH authentication timeout time ssh server timeout seconds Set SSH authentication retry times ssh server authentication-retries times Set RSA server key update interval ssh server rekey-interval hours Configure SSH server to be compatible with SSH1.x clients ssh server compatible-ssh1x enable Configure a login header header shell text Remarks — Optional By default, the timeout time is 60 seconds.
To do… Use the command… Remarks public-key-code begin — Configure a public key for the client Enter the content of the public key When you input the key data, spaces are allowed between the characters you input (because the system can remove the spaces automatically); you can also press to continue your input at the next line. But the key you input should be a hexadecimal digit string coded in the public key format.
Follow these steps to import the RSA public key from a public key file: To do… Use the command… Remarks Enter system view system-view — Import the RSA public key from a public key file rsa peer-public-key keyname import sshkey filename Required The result of the display rsa local-key-pair public command or the public key converted with the SSHKEY tool contains no information such as the authentication type, so they cannot be directly used as parameters in the public-key peer command.
Follow these steps to specify a source IP address/interface for the SSH server: To do… Use the command… Enter system view Remarks — system-view Required Specify a source IP address for the SSH server ssh-server source-ip ip-address Specify a source interface for the SSH server ssh-server source-interface interface-type interface-number By default, the system determines the IP address for clients to access. Required By default, the system determines the IP address for clients to access.
z Selecting the protocol for remote connection as SSH. Usually, a client can use a variety of remote connection protocols, such as Telnet, Rlogin, and SSH. To establish an SSH connection, you must select SSH z Selecting the SSH version. Since the device supports SSH Server 2.0 now, select 2.0 or lower for the client. z Specifying the private key file.
Figure 1-3 Generate the client keys (2) After the key pair is generated, click Save public key and enter the name of the file for saving the public key (public in this case) to save the public key.
Likewise, to save the private key, click Save private key. A warning window pops up to prompt you whether to save the private key without any precaution. Click Yes and enter the name of the file for saving the private key (“private” in this case) to save the private key. Figure 1-5 Generate the client keys (4) To generate RSA public key in PKCS format, run SSHKEY.exe, click Browse and select the public key file, and then click Convert.
Figure 1-7 SSH client configuration interface 1 In the Host Name (or IP address) text box, enter the IP address of the server. Note that there must be a route available between the IP address of the server and the client. Select a protocol for remote connection As shown in Figure 1-7, select SSH under Protocol. Select an SSH version From the category on the left pane of the window, select SSH under Connection. The window as shown in Figure 1-8 appears.
Figure 1-8 SSH client configuration interface 2 Under Protocol options, select 2 from Preferred SSH protocol version. Some SSH client software, for example, Tectia client software, supports the DES algorithm only when the ssh1 version is selected. The PuTTY client software supports DES algorithm negotiation ssh2. Open an SSH connection with publickey authentication If a user needs to be authenticated with a public key, the corresponding private key file must be specified.
Figure 1-9 SSH client configuration interface 3 Click Browse… to bring up the file selection window, navigate to the private key file and click Open to enter the following SSH client interface. If the connection is normal, a user will be prompted for a username. Once passing the authentication, the user can log onto the server.
Open an SSH connection with password authentication From the window shown in Figure 1-9, click Open. The following SSH client interface appears. If the connection is normal, you will be prompted to enter the username and password, as shown in Figure 1-11. Figure 1-11 SSH client interface (2) Enter the username and password to establish an SSH connection. To log out, enter the quit command.
Follow these steps to enable the device to support first-time authentication: To do… Enter system view Enable the device to support first-time authentication Use the command… system-view Remarks — Optional ssh client first-time enable By default, the client is enabled to run initial authentication.
When logging into the SSH server using public key authentication, an SSH client needs to read the local private key for authentication. As two algorithms (RSA or DSA) are available, the identity-key keyword must be used to specify one algorithm in order to get the correct private key. Specifying a Source IP address/Interface for the SSH client This configuration task allows you to specify a source IP address or interface for the client to access the SSH server, improving service manageability.
SSH Configuration Examples When the Device Acts as the SSH Server and the Authentication Type is Password Network requirements As shown in Figure 1-12, establish an SSH connection between the host (SSH Client) and the device (SSH Server) for secure data exchange. The host runs SSH2.0 client software. Password authentication is required. Figure 1-12 Network diagram of SSH server configuration using password authentication 192 .168 .0 .2/24 VLAN-Interface 1 192.168.0.
Take SSH client software “Putty” (version 0.58) as an example: 1) Run PuTTY.exe to enter the following configuration interface. Figure 1-13 SSH client configuration interface In the Host Name (or IP address) text box, enter the IP address of the SSH server. 2) As shown in Figure 1-13, click Open to enter the following interface. If the connection is normal, you will be prompted to enter the user name “client001” and password “abc”. Once authentication succeeds, you will log onto the server.
Figure 1-14 SSH client interface When the Device Acts as an SSH Server and the Authentication Type is Publickey Network requirements As shown in Figure 1-15, establish an SSH connection between the host (SSH client) and the device (SSH Server) for secure data exchange. The host runs SSH2.0 client software. Publickey authentication is required. Figure 1-15 Network diagram of SSH server configuration 192 .168.0 .2/24 VLAN-Interface 1 192.168.0.
system-view [device] interface vlan-interface 1 [device-Vlan-interface1] ip address 192.168.0.1 255.255.255.0 [device-Vlan-interface1] quit # Generate RSA and DSA key pairs. [device] public-key local create rsa [device] public-key local create dsa # Set the authentication mode for the user interfaces to AAA. [device] user-interface vty 0 4 [device-ui-vty0-4] authentication-mode scheme # Enable the user interfaces to support SSH.
Figure 1-16 Generate a client key pair (1) While generating the key pair, you must move the mouse continuously and keep the mouse off the green process bar shown in Figure 1-17. Otherwise, the process bar stops moving and the key pair generating process is stopped.
Figure 1-17 Generate a client key pair (2) After the key pair is generated, click Save public key and enter the name of the file for saving the public key (“public” in this case).
Likewise, to save the private key, click Save private key. A warning window pops up to prompt you whether to save the private key without any protection. Click Yes and enter the name of the file for saving the private key (“private” in this case). Figure 1-19 Generate a client key pair (4) After a public key pair is generated, you need to upload the pubic key file to the server through FTP or TFTP, and complete the server end configuration before you continue to configure the client.
Figure 1-21 SSH client configuration interface (2) Click Browse… to bring up the file selection window, navigate to the private key file and click OK. 3) From the window shown in Figure 1-21, click Open. The following SSH client interface appears. If the connection is normal, you will be prompted to enter the username and password, as shown in Figure 1-22.
When the Switch Acts as an SSH Client and the Authentication Type is Password Network requirements As shown in Figure 1-23, establish an SSH connection between Switch A (SSH Client) and Switch B (SSH Server) for secure data exchange. The user name for login is client001 and the SSH server’s IP address is 10.165.87.136. Password authentication is required.
[device-Vlan-interface1] ip address 10.165.87.137 255.255.255.0 [device-Vlan-interface1] quit # Establish a connection to the server 10.165.87.136. [device] ssh2 10.165.87.136 Username: client001 Trying 10.165.87.136 ... Press CTRL+K to abort Connected to 10.165.87.136 ... The Server is not authenticated.
system-view [device] interface vlan-interface 1 [device-Vlan-interface1] ip address 10.165.87.136 255.255.255.0 [device-Vlan-interface1] quit # Generate RSA and DSA key pairs. [device] public-key local create rsa [device] public-key local create dsa # Set the authentication mode for the user interfaces to AAA. [device] user-interface vty 0 4 [device-ui-vty0-4] authentication-mode scheme # Enable the user interfaces to support SSH.
After the key pair is generated, you need to upload the pubic key file to the server through FTP or TFTP and complete the server end configuration before you continue to configure the client. # Establish an SSH connection to the server 10.165.87.136. [device] ssh2 10.165.87.136 identity-key dsa Username: client001 Trying 10.165.87.136 ... Press CTRL+K to abort Connected to 10.165.87.136 ... The Server is not authenticated.
[device-Vlan-interface1] quit # Generate RSA and DSA key pairs. [device] public-key local create rsa [device] public-key local create dsa # Set AAA authentication on user interfaces. [device] user-interface vty 0 4 [device-ui-vty0-4] authentication-mode scheme # Configure the user interfaces to support SSH. [device-ui-vty0-4] protocol inbound ssh # Set the user command privilege level to 3.
[device-Vlan-interface1] ip address 10.165.87.137 255.255.255.0 [device-Vlan-interface1] quit # Generate a DSA key pair [device] public-key local create dsa # Export the generated DSA key pair to a file named Switch001. [device] public-key local export dsa ssh2 Switch001 After generating the key pair, you need to upload the key pair file to the server through FTP or TFTP and complete the server end configuration before you continue to configure the client.
Table of Contents 1 File System Management Configuration ·································································································1-1 File System Configuration·······················································································································1-1 Introduction to File System ··············································································································1-1 File System Configuration Tasks·································
1 File System Management Configuration The sample output information in this manual was created on the WX3024. The output information on your device may vary. File System Configuration Introduction to File System To facilitate management on the device memory, the device provides the file system function, allowing you to access and manage the files and directories. You can create, remove, copy or delete a file through command lines, and you can manage files using directories.
z Displaying the current work directory, or contents in a specified directory Follow these steps to perform directory-related operations in user view: To do… Use the command… Remarks Create a directory mkdir directory Optional Delete a directory rmdir directory Optional Display the current work directory pwd Optional Display the information about specific directories and files dir [ /all ] [ file-url ] Optional Enter a specified directory cd directory Optional z Only empty directories c
To do… z Use the command… Enter system view system-view Execute the specified batch file execute filename Remarks — Optional This command should be executed in system view. For deleted files whose names are the same, only the latest deleted file is kept in the recycle bin and can be restored. z The files which are deleted by the delete command without the /unreserved keyword are actually moved to the recycle bin and thus still take storage space.
Follow these steps to perform configuration on prompt mode of file system: To do… Use the command… Enter system view — system-view Configure the prompt mode of the file system Remarks Required file prompt { alert | quiet } By default, the prompt mode of the file system is alert. File System Configuration Example # Display all the files in the root directory of the file system. dir /all Directory of unit1>flash:/ 1 -rw- 1443 Apr 02 2000 02:45:13 startup.
dir unit1>flash:/test/ Directory of unit1>flash:/test/ 1 -rw- 1443 Apr 02 2000 02:45:13 1.cfg 6858 KB total (6841 KB free) (*) -with main attribute (b) -with backup attribute (*b) -with both main and backup attribute File Attribute Configuration Introduction to File Attributes The following two startup files support file attribute configuration: z Configuration files: A configuration file is used to store and restore configuration, with .cfg as the extension.
attribute. If you download a valid file with the same name as the deleted file to the flash memory, the file will possess the main attribute. Configuring File Attributes You can configure and view the main attribute or backup attribute of the startup file used for the next startup of a switch, and change the main or backup attribute of the file.
Table of Contents 1 FTP and SFTP Configuration····················································································································1-1 Introduction to FTP and SFTP ················································································································1-1 Introduction to FTP ··························································································································1-1 Introduction to SFTP···································
1 FTP and SFTP Configuration z The term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. z FTP banner is newly added. For details, see Configuring the banner for an FTP server.
Introduction to SFTP Secure FTP (SFTP) is established based on an SSH2 connection. It allows a remote user to log in to the switching engine to manage and transmit files, providing a securer guarantee for data transmission. In addition, since the device can be used as a client, you can log in to remote devices to transfer files securely.
Enabling an FTP server Follow these steps to enable an FTP server: To do… Use the command… Enter system view system-view Enable the FTP server function ftp server enable Remarks — Required Disabled by default. z Only one user can access the device at a given time when the latter operates as an FTP server. z Operating as an FTP server, the device cannot receive a file whose size exceeds its storage space.
Source interface refers to the existing VLAN interface or Loopback interface on the device. Source IP address refers to the IP address configured for the interface on the device. Each source interface corresponds to a source IP address. Therefore, specifying a source interface for the FTP server is the same as specifying the IP address of this interface as the source IP address.
With the device acting as the FTP server, if a network administrator attempts to disconnect a user that is uploading/downloading data to/from the FTP server the device will disconnect the user after the data transmission is completed. Configuring the banner for an FTP server Displaying a banner: With a banner configured on the FTP server, when you access the FTP server through FTP, the configured banner is displayed on the FTP client.
To do… Use the command… Remarks Use either command or both. Configure a shell banner header shell text By default, no banner is configured. For details about the header command, refer to the Login part of the manual.
To do… Use the command… Change the working directory on the remote FTP server cd pathname Change the working directory to be the parent directory cdup Get the local working path on the FTP client lcd Display the working directory on the FTP server pwd Create a directory on the remote FTP server mkdir pathname Remove a directory on the remote FTP server rmdir pathname Delete a specified file delete remotefile Remarks Optional dir [ remotefile ] [ localfile ] Optional If no file name is spe
Specifying the source interface and source IP address for an FTP client You can specify the source interface and source IP address for the device acting as an FTP client, so that it can connect to a remote FTP server.
saved-configuration command to specify config.cfg as the main configuration file for next startup and then reboot the device. z Create a user account on the FTP server with the user name “switch” and password “hello”. z The IP addresses 1.1.1.1 for a VLAN interface on the switching engine and 2.2.2.2 for the PC have been configured. Ensure that a route exists between the device and the PC.
200 Port command okay. 150 Opening ASCII mode data connection for config.cfg. 226 Transfer complete. This example uses the command line window tool provided by Windows. When you log in to the FTP server through another FTP client, refer to the corresponding instructions for operation description.
Figure 1-4 Network diagram for FTP banner display configuration FTP Client FTP Server 2.2 .2.2/8 Vlan-Int1 1.1.1.1 /8 Network Switch PC Configuration procedure 1) Configure the switch (FTP server) # Configure the login banner of the switching engine as “login banner appears” and the shell banner as “shell banner appears”. For detailed configuration of other network requirements, see Configuration Example: The Device Operating as an FTP Server.
Figure 1-5 Network diagram for FTP configurations: the device operating as an FTP client FTP Client Switch A Vlan -Int1 1.1.1.1/8 FTP Server Network 2.2.2 .2/8 PC Configuration procedure 1) Configure the PC (FTP server) Perform FTP server–related configurations on the PC, that is, create a user account on the FTP server with user name “switch” and password “hello”. (For detailed configuration, refer to the configuration instruction relevant to the FTP server software.
# After downloading the file, use the startup saved-configuration command to specify the downloaded configuration file as the main configuration file for next startup, and then restart the device. startup saved-configuration config.cfg main Please wait........................................Done! For information about the startup saved-configuration command and how to specify the startup file for the device, refer to the “System Maintenance and Debugging” module of this manual.
To do… Use the command… Enter system view system-view Configure the connection idle time for the SFTP server ftp timeout time-out-value Remarks — Optional 10 minutes by default Supported SFTP client software The device operating as an SFTP server can interoperate with SFTP client software, including SSH Tectia Client v4.2.0 (SFTP), v5.0, and WINSCP.
To do… Use the command… Enter SFTP client view sftp { host-ip | host-name } [ port-num ] [ identity-key { dsa | rsa } | prefer_kex { dh_group1 | dh_exchange_group } | prefer_ctos_cipher { des | aes128 } | prefer_stoc_cipher { des | aes128 } | prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } | prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] * Change the working directory on the remote SFTP server cd pathname Change the working directory to be the parent directory cdup Display the working direc
If you specify to authenticate a client through public key on the server, the client needs to read the local private key when logging in to the SFTP server. Since both RSA and DSA are available for public key authentication, you need to use the identity-key key word to specify the algorithms to get correct local private key; otherwise you will fail to log in. For details, see SSH Operation.
# Create a VLAN interface on the device and assign to it an IP address, which is used as the destination address for the client to connect to the SFTP server. [device] interface vlan-interface 1 [device-Vlan-interface1] ip address 192.168.0.1 255.255.255.0 [device-Vlan-interface1] quit # Specify the SSH authentication mode as AAA. [device] user-interface vty 0 4 [device-ui-vty0-4] authentication-mode scheme # Configure the protocol through which the remote user logs in to the device as SSH.
sftp-client> # Display the current directory of the server. Delete the file z and verify the result. sftp-client> dir -rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.
-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey1 drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new -rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub drwxrwxrwx 1 noone nogroup 0 Sep 02 06:33 new2 Received status: End of file Received status: Success # Download the file pubkey2 from the server and rename it as public. sftp-client> get pubkey2 public This operation may take a long time, please wait... . Remote file:/pubkey2 ---> Local file: public..
2 TFTP Configuration Introduction to TFTP Compared with FTP, TFTP (trivial file transfer protocol) features simple interactive access interface and no authentication control. Therefore, TFTP is applicable in the networks where client-server interactions are relatively simple. TFTP is implemented based on UDP. It transfers data through UDP port 69. Basic TFTP operations are described in RFC 1986.
Task TFTP server configuration Remarks For details, see the corresponding manual — TFTP Configuration: The Device Operating as a TFTP Client Basic configurations on a TFTP client By default the device can operate as a TFTP client. In this case you can connect the device to the TFTP server to perform TFTP-related operations (such as creating/removing a directory) by executing commands on the device.
z To do… Use the command… Specify an interface as the source interface a TFTP client uses every time it connects to a TFTP server tftp source-interface interface-type interface-number Remarks Use either command Not specified by default Specify an IP address as the source IP address a TFTP client uses every time it connects to a TFTP server tftp source-ip ip-address Display the source IP address used by a TFTP client every time it connects to a TFTP server display tftp source-ip Optional Available
Configuration procedure 1) Configure the TFTP server (PC) Start the TFTP server and configure the working directory on the PC. 2) Configure the TFTP client (switch). # Log in to the switching engine. (You can log in to the switching engine through the console port or by telnetting the device. See the “Login” module for detailed information.
Table of Contents 1 Information Center·····································································································································1-1 Information Center Overview ··················································································································1-1 Introduction to Information Center···································································································1-1 System Information Format ····························
1 Information Center z The term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Information Center Overview Introduction to Information Center Acting as the system information hub, information center classifies and manages system information.
Severity Severity value Description informational 7 Informational information to be recorded debugging 8 Information generated during debugging Information filtering by severity works this way: information with the severity value greater than the configured threshold is not output during the filtering. z If the threshold is set to 1, only information with the severity being emergencies will be output; z If the threshold is set to 8, information of all severities will be output.
Configurations for the six output directions function independently and take effect only after the information center is enabled. Outputting system information by source module The system information can be classified by source module and then filtered. Some module names and description are shown in Table 1-3. Table 1-3 Source module name list Module name Description 8021X 802.
Module name Description NTP Network time protocol module PKI Public key infrastructure module RDS Radius module RMON Remote monitor module RSA Revest, Shamir and Adleman encryption module SHELL User interface module SNMP Simple network management protocol module SOCKET Socket module SSH Secure shell module SYSMIB System MIB module TAC HWTACACS module TELNET Telnet module TFTPC TFTP client module VLAN Virtual local area network module VTY Virtual type terminal module XM XMODE
Priority The priority is calculated using the following formula: facility*8+severity-1, in which z facility (the device name) defaults to local7 with the value being 23 (the value of local6 is 22, that of local5 is 21, and so on). z severity (the information level) ranges from 1 to 8. Table 1-1 details the value and meaning associated with each severity.
You can use the sysname command to modify the system name. Refer to the System Maintenance and Debugging part of this manual for details) Note that there is a space between the sysname and module fields. Module The module field represents the name of the module that generates system information. You can enter the info-center source ? command in system view to view the module list. Refer to Table 1-3 for module name and description. Between “module” and “level” is a “/”.
Task Remarks Setting to Output System Information to the SNMP NMS Optional Configuring Synchronous Information Output Synchronous information output refers to the feature that if the system information such as log, trap, or debugging information is output when the user is inputting commands, the command line prompt (in command editing mode a prompt, or a [Y/N] string in interaction mode) and the input information are echoed after the output.
To do… Set the time stamp format in the output direction of the information center to date Log host direction Use the command… Remarks info-center timestamp loghost date Required Non log host direction Set to display the UTC time zone in the output information of the information center Use either command info-center timestamp { log | trap | debugging } date Required By default, no UTC time zone is displayed in the output information info-center timestamp utc Setting to Output System Information t
Table 1-4 Default output rules for different output directions LOG Output direction TRAP DEBUG Modules allowed Enable d/disab led Severit y Enabled/ disabled Console default (all modules) Enable d warning s Enabled debuggin g Enabled debuggin g Monitor terminal default (all modules) Enable d warning s Enabled debuggin g Enabled debuggin g Log host default (all modules) Enable d informati onal Enabled debuggin g Disabled debuggin g Trap buffer default (all modules) Disable d
Setting to Output System Information to a Monitor Terminal System information can also be output to a monitor terminal, which is a user terminal that has login connections through the AUX, VTY, or TTY user interface.
Follow these steps to enable the display of system information on a monitor terminal: To do… Use the command… Enable the debugging/log/trap information terminal display function terminal monitor Enable debugging information terminal display function terminal debugging Enable log information terminal display function terminal logging Enable trap information terminal display function terminal trapping Remarks Optional Enabled by default Optional Disabled by default Optional Enabled by default Option
To do… Use the command… Set the format of the time stamp to be sent to the log host info-center timestamp loghost { date | no-year-date | none } Remarks Optional By default, the time stamp format of the information output to the log host is date. Be sure to set the correct IP address when using the info-center loghost command. A loopback IP address will cause an error message prompting that this address is invalid.
To do… Use the command… Remarks Optional Enable information output to the log buffer info-center logbuffer [ channel { channel-number | channel-name } | size buffersize ]* Configure the output rules of system information info-center source { modu-name | default } channel { channel-number | channel-name } [ { log | trap | debug } { level severity | state state } ]* Set the format of time stamp in the output information info-center timestamp { log | trap | debugging } { boot | date | none } By defaul
Displaying and Maintaining Information Center To do… Use the command… Display information on an information channel display channel [ channel-number | channel-name ] Display the operation status of information center, the configuration of information channels, the format of time stamp display info-center [ unit unit-id ] Display the status of log buffer and the information recorded in the log buffer display logbuffer [ unit unit-id ] [ level severity | size buffersize ]* [ | { begin | exclude | inclu
# Configure the host whose IP address is 202.38.1.10 as the log host. Permit ARP and IP modules to output information with severity level higher than informational to the log host. [Switch] info-center loghost 202.38.1.
Through combined configuration of the device name (facility), information severity level threshold (severity), module name (filter) and the file “syslog.conf”, you can sort information precisely for filtering. Log Output to a Linux Log Host Network requirements As shown in Figure 1-2, Switch sends the following log information to the Linux log host whose IP address is 202.38.1.10: All modules' log information, with severity higher than “errors”.
Note the following items when you edit file “/etc/syslog.conf”. z A note must start in a new line, starting with a “#" sign. z In each pair, a tab should be used as a separator instead of a space. z No space is permitted at the end of the file name. z The device name (facility) and received log information severity specified in file “/etc/syslog.conf” must be the same with those corresponding parameters configured in commands info-center loghost and info-center source.
[Switch] info-center enable # Disable the function of outputting information to the console channels. [Switch] undo info-center source default channel console # Enable log information output to the console. Permit ARP and IP modules to output log information with severity level higher than informational to the console.
Table of Contents 1 Host Configuration File Loading··············································································································1-1 Introduction to Loading Approaches ·······································································································1-1 Remote Loading Using FTP ············································································································1-1 Remote Loading Using TFTP···········································
1 Host Configuration File Loading The term switch used throughout this document refers to a switching device in a generic sense or z the switching engine of a WX3000 series. The sample output information in this manual was created on the WX3024. The output information z on your device may vary. Traditionally, device software is loaded through a serial port. This approach is slow, time-consuming and cannot be used for remote loading.
Connected to OAP! ftp 192.168.0.100 Trying ... Press CTRL+K to abort Connected. 220 3Com 3CDaemon FTP Server Version 2.0 User(none):admin 331 User name ok, need password Password: 230 User logged in [ftp]get config.cfg config.cfg 227 Entering passive mode (192,168,0,100,5,95) 125 Using existing data connection ..........226 Closing data connection; File transfer successful. FTP: 7590 byte(s) received in 15.139 second(s) 501.00 byte(s)/sec.
Figure 1-2 Remote loading using FTP server Switch PC Ethernet port Internet FTP Server FTP Serve 192 .168 .0.51 10 .1 .1.1 Step 1: As shown in Figure 1-2, connect Switch through an Ethernet port to the PC (whose IP address is 10.1.1.1) Step 2: Configure the IP address of VLAN-interface 1 on Switch to 192.168.0.51, and subnet mask to 255.255.255.0. You can configure the IP address for any VLAN on Switch for FTP transmission.
Step 6: Enter ftp 192.168.0.51 and enter the user name test, password pass to log on to the FTP server. C:\Documents and Settings\Administrator>d: D:\>cd update D:\Update>ftp 192.168.0.51 Connected to 192.168.0.51. 220 FTP service ready. User (192.168.0.51:(none)): test 331 Password required for test. Password: 230 User logged in. ftp> Step 7: Use the put command to upload the file config.cfg to Switch. C:\Documents and Settings\Administrator>d: D:\>cd update D:\Update>ftp 192.168.0.
z The steps listed above are performed in the Windows operating system, if you use other FTP client software, refer to the corresponding user guide before operation. z Only the configuration steps concerning loading are listed here. For detailed description on the corresponding configuration commands, refer to the “FTP-SFTP-TFTP” part of this manual. Remote Loading Using TFTP The remote loading using TFTP is similar to that using FTP.
2 Basic System Configuration and Debugging Basic System Configuration Follow these steps to perform basic system configuration: To do… Use the command… Remarks Required Set the current date and time of the system clock datetime HH:MM:SS { YYYY/MM/DD | MM/DD/YYYY } Optional Set the local time zone clock timezone zone-name { add | minus } HH:MM:SS Execute this command in user view. The default value is 23:55:00 04/01/2000 when the system starts up. Execute this command in user view.
Displaying the System Status To do… Use the command… Display the current date and time of the system display clock Display the version of the system display version Display the information about users logging onto the device display users [ all ] Remarks Available in any view Debugging the System Enabling/Disabling System Debugging The device provides a variety of debugging functions. Most of the protocols and features supported by the device are provided with corresponding debugging functions.
You can use the following commands to enable the two settings. Follow these steps to enable debugging and terminal display for a specific module: To do… Use the command… Enable system debugging for specific module debugging module-name [ debugging-option ] Enable terminal display for debugging terminal debugging Remarks Required Disabled for all modules by default. Required Disabled by default. The output of debugging information affects the system operation.
3 Network Connectivity Test Network Connectivity Test ping You can use the ping command to check the network connectivity and the reachability of a host.
4 Device Management Introduction to Device Management Device Management includes the following: z Reboot the device z Configure real-time monitoring of the running status of the system z Specify the main configuration file to be used at the next reboot Device Management Configuration Device Management Configuration Tasks Complete the following tasks to configure device management: Task Remarks Rebooting the Device Optional Scheduling a Reboot on the Device Optional Configuring Real-time Monito
Scheduling a Reboot on the Device After you schedule a reboot on the device, the device will reboot at the specified time.
Follow the step below to specify the main configuration file to be used at reboot: To do… Use the command… Specify the main configuration file to be used at next reboot startup saved-configuration filename [ main | backup ] Remarks Required Identifying and Diagnosing Pluggable Transceivers Introduction to pluggable transceivers At present, four types of pluggable transceivers are commonly used, and they can be divided into optical transceivers and electrical transceivers based on transmission media as
Follow these steps to identify pluggable transceivers: To do… Display main parameters of the pluggable transceiver(s) Use the command… display transceiver interface [ interface-type interface-number ] Remarks Available for all pluggable transceivers Diagnosing pluggable transceivers The system outputs alarm information for you to diagnose and troubleshoot faults of pluggable transceivers. When these parameters are abnormal, you can take corresponding measures to prevent transceiver faults.
Table of Contents 1 VLAN-VPN Configuration··························································································································1-1 VLAN-VPN Overview ······························································································································1-1 Introduction to VLAN-VPN···············································································································1-1 Implementation of VLAN-VPN·······························
1 VLAN-VPN Configuration The term switch used throughout this chapter refers to a switching device in a generic sense or the z switching engine of a unified switch in the WX3000 series. The sample output information in this manual was created on the WX3024. The output information z on your device may vary. VLAN-VPN Overview Introduction to VLAN-VPN Virtual private network (VPN) is a new technology that emerges with the expansion of the Internet.
Figure 1-2 Structure of packets with double-layer VLAN tags 15 0 31 Destination MAC address Source MAC address Outer VLAN Tag Inner VLAN Tag Data Compared with MPLS-based Layer 2 VPN, VLAN-VPN has the following features: z It provides Layer 2 VPN tunnels that are simpler. z VLAN-VPN can be implemented through manual configuration. That is, signaling protocol-related configuration is not needed. The VLAN-VPN feature provides you with the following benefits: z Saves public network VLAN ID resource.
As the position of the TPID field in an Ethernet packet is the same as that of the upper-layer protocol type field in a packet without VLAN Tag, to avoid confusion in the process of receiving/forwarding a packet, the TPID value cannot be any of the protocol type value listed in Table 1-1. Table 1-1 Commonly used protocol type values in Ethernet frames Protocol type Value ARP 0x0806 IP 0x0800 MPLS 0x8847/0x8848 IPX 0x8137 IS-IS 0x8000 LACP 0x8809 802.
TPID Adjusting Configuration Configuration Prerequisites z To change the global TPID value 0x8100, you need to specify a port on the device as a VLAN VPN uplink port. Before the configuration, make sure that VLAN VPN is disabled on the port. z For proper packet transmission, confirm the TPID value of the peer device in the public network before adjusting the TPID value.
VLAN-VPN Configuration Example Transmitting User Packets through a Tunnel in the Public Network by Using VLAN-VPN Network requirements z As shown in Figure 1-4, both Switch A and Switch B are the WX3000 series devices. They connect the users to the servers through the public network. z PC users and PC servers are in VLAN 100 created in the private network, while terminal users and terminal servers are in VLAN 200, which is also created in the private network.
# Set the global TPID value of Switch A to 0x9200 and configure GigabitEthernet 1/0/12 as a VLAN VPN uplink port, so that Switch A can intercommunicate with devices in the public network. [SwitchA] vlan-vpn tpid 9200 [SwitchA] interface GigabitEthernet1/0/12 [SwitchA-GigabitEthernet1/0/12] port link-type trunk [SwitchA-GigabitEthernet1/0/12] port trunk permit vlan 1040 [SwitchA-GigabitEthernet1/0/12] vlan-vpn uplink enable z Configure Switch B.
1) As GigabitEthernet 1/0/11 of Switch A is a VLAN-VPN port, when a packet from the customer’s network side reaches this port, it is tagged with the default VLAN tag of the port (VLAN 1040). 2) The device sets the TPID value for the outer VLAN tags of packets to user-defined value 0x9200 and then forwards these packets to the public network through the VLAN-VPN uplink port GigabitEthernet 1/0/12.
2 Selective QinQ Configuration Selective QinQ Overview Selective QinQ Overview Selective QinQ is an enhanced application of the VLAN-VPN feature. With the selective QinQ feature, you can configure inner-to-outer VLAN tag mapping, according to which you can add different outer VLAN tags to the packets with different inner VLAN tags. The selective QinQ feature makes the service provider network structure more flexible.
In this way, you can configure different forwarding policies for data of different type of users, thus improving the flexibility of network management. On the other hand, network resources are well utilized, and users of the same type are also isolated by their inner VLAN tags. This helps to improve network security. Inner-to-Outer Tag Priority Mapping As shown in Figure 1-3, the user priority field is the 802.1p priority of the tag. The value of this 3-bit field is in the range 0 to 7.
You are recommended not to configure both the DHCP snooping and selective Q-in-Q function on the device, which may result in the DHCP snooping to function abnormally.
Figure 2-2 Network diagram for selective QinQ configuration For PC User VLAN100~108 GE1/0/12 Public Network VLAN1000/VLAN1200 SwitchB GE1/0/11 GE1/0/13 GE1/0/5 SwitchA For IP Phone VLAN200~230 GE1/0/3 PC User VLAN100~108 IP Phone User VLAN200~230 Configuration procedure z Configure Switch A. # Create VLAN 1000, VLAN 1200 and VLAN 5 (the default VLAN of GigabitEthernet 1/0/3) on SwitchA.
[SwitchA-GigabitEthernet1/0/3] vlan-vpn enable # Enable the selective QinQ feature on GigabitEthernet 1/0/3 to tag packets of VLAN 100 through VLAN 108 with the tag of VLAN 1000 as the outer VLAN tag, and tag packets of VLAN 200 through VLAN 230 with the tag of VLAN 1200 as the outer VLAN tag.
To make the packets from the servers be transmitted to the clients in the same way, you need to configure the selective QinQ feature on GigabitEthernet 1/0/12 and GigabitEthernet 1/0/13. The configuration on Switch B is similar to that on Switch A and is thus omitted. z The port configuration on Switch B is only an example for a specific network requirement. The key to this example is to enable the ports to receive and forward packets of specific VLANs.
Table of Contents 1 HWPing Configuration ······························································································································1-1 HWPing Overview ···································································································································1-1 Introduction to HWPing····················································································································1-1 Test Types Supported by HWPing ·················
1 HWPing Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a WX3000. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. HWPing Overview Introduction to HWPing HWPing (pronounced Hua’Wei Ping) is a network diagnostic tool. It is used to test the performance of various protocols running in networks.
Figure 1-1 HWPing illustration IP network Switch A Switch B HWPing Client HWPing Server Test Types Supported by HWPing Table 1-1 Test types supported by HWPing Supported test types Description ICMP test DHCP test FTP test For these types of tests, you need to configure HWPing client and corresponding servers. HTTP test DNS test SNMP test Jitter test z Tcppublic test TCP test Tcpprivate test z Udppublic test UDP test These types of tests need the cooperation of HWPing client and HWPing Server.
Test parameter Description z Source interface (source-interface) z z For DHCP test, you must specify a source interface, which will be used by HWPing client to send DHCP requests. If no source interface is specified for a DHCP test, the test will not succeed. After a source interface is specified, HWPing client uses this source interface to send DHCP requests during a DHCP test. The IP address of the specified source interface will be used as the source IP address of DHCP requests.
Test parameter File name for FTP operation (filename) Description Name of a file to be transferred between HWPing client and FTP server z z Number of jitter test packets to be sent per probe (jitter-packetnum) Interval to send jitter test packets (jitter-interval) Each jitter probe will send multiple UDP test packets at regular intervals (you can set the interval). The smaller the interval is, the faster the test is. But a too small interval may somewhat impact your network.
HWPing server configuration The following table describes the configuration on HWPing server, which is the same for HWPing test types that need to configure HWPing server.
To do… Configure the number of probes per test Use the command… Remarks Optional count times By default, each test makes one probe. Optional Configure the packet size datasize size Configure the maximum number of history records that can be saved history-records number By default, the packet size is 56 bytes. Optional By default, the maximum number is 50.
To do… Use the command… Remarks Required Configure the source interface source-interface interface-type interface-number Configure the test type test-type dhcp Configure the number of probes per test count times Configure the maximum number of history records that can be saved history-records number You can only configure a VLAN interface as the source interface. By default, no source interface is configured. Required By default, the test type is ICMP.
To do… Configure the number of probes per test Configure the maximum number of history records that can be saved Use the command… Remarks Optional count times By default, each test makes one probe. Optional history-records number By default, the maximum number is 50. Optional Configure the automatic test interval frequency interval Configure the probe timeout time timeout time By default, the automatic test interval is zero seconds, indicating no automatic test will be made.
To do… Use the command… Remarks Required Configure the destination IP address destination-ip ip-address You can configure an IP address or a host name. By default, no destination address is configured. Configure dns-server dns-server ip-address Required when you use the destination-ip command to configure the destination address as the host name. By default, no IP address of the DNS server is configured.
5) Configuring jitter test on HWPing client Follow these steps to configure jitter test on HWPing client: To do… Enter system view Use the command… system-view Remarks — Required Enable the HWPing client function hwping-agent enable Create a HWPing test group and enter its view hwping administrator-name operation-tag By default, the HWPing client function is disabled. Required By default, no test group is configured.
To do… Configure the probe timeout time Use the command… Remarks Optional timeout time By default, a probe times out in three seconds. Optional Configure the type of service tos value Configure the number of test packets that will be sent in each jitter probe jitter-packetnum number Configure the interval to send test packets in the jitter test jitter-interval interval By default, the interval is 20 milliseconds.
To do… Configure the maximum number of history records that can be saved Use the command… Remarks Optional history-records number By default, the maximum number is 50. Optional By default, the automatic test interval is zero seconds, indicating no automatic test will be made. Configure the automatic test interval frequency interval Configure the probe timeout time timeout time Configure the type of service tos value By default, the service type is zero.
To do… Use the command… Remarks Required in a Tcpprivate test Configure the destination port destination-port port-number A Tcppublic test is a TCP connection test on port 7. Use the hwping-server tcpconnect ip-address 7 command on the server to configure the listening service port; otherwise the test will fail. No port number needs to be configured on the client; any destination port number configured on the client will not take effect. By default, no destination port number is configured.
To do… Use the command… Enter system view system-view Enable the HWPing client function hwping-agent enable Create a HWPing test group and enter its view hwping administrator-name operation- tag Remarks — Required By default, the HWPing client function is disabled. Required By default, no test group is configured. Required Configure the destination address destination-ip ip-address This IP address and the one configured on the HWPing server for listening service must be the same.
To do… Use the command… Remarks Optional By default, the automatic test interval is zero seconds, indicating no automatic test will be made. Configure the automatic test interval frequency interval Configure the probe timeout time timeout time Configure the service type tos value By default, the service type is zero. Start the test test-enable Required Display test results display hwping results [ admin-name operation-tag ] Optional By default, a probe times out in three seconds.
To do… Configure the probe timeout time Use the command… Remarks Optional timeout time By default, a probe times out in three seconds. Optional Configure the type of service tos value Configure the domain name to be resolved dns resolve-targetdomai domainname Configure the IP address of the DNS server dns-server ip-address By default, no DNS server address is configured.
Displaying and Maintaining HWPing To do… Use the command… Display test history display hwping history [ administrator-name operation-tag ] Display the results of the latest test display hwping results [ administrator-name operation-tag ] Remarks Available in any view HWPing Configuration Example ICMP Test Network requirements As shown in Figure 1-2, Switch A serves as the HWPing client.
# Display test results. [device-hwping-administrator-icmp] display hwping results administrator icmp HWPing entry(admin administrator, tag icmp) test result: Destination ip address:10.2.2.2 Send operation times: 10 Receive response times: 10 Min/Max/Average Round Trip Time: 3/6/3 Square-Sum of Round Trip Time: 145 Last succeeded test time: 2000-4-2 20:55:12.
# Create a HWPing test group, setting the administrator name to "administrator" and test tag to "DHCP". [device] Hwping administrator dhcp # Configure the test type as dhcp. [device-hwping-administrator-dhcp] test-type dhcp # Configure the source interface, which must be a VLAN interface. Make sure the DHCP server resides on the network connected to this interface. [device-hwping-administrator-dhcp] source-interface Vlan-interface 1 # Configure to make 10 probes per test.
FTP Test Network requirements As shown in Figure 1-4, both the HWPing client and the FTP server are WX3000 series devices. Perform a HWPing FTP test between the two devices to test the connectivity to the specified FTP server and the time required to upload a file to the server after the connection is established. Both the username and password used to log in to the FTP server are “admin”. The file to be uploaded to the server is cmdtree.txt. Figure 1-4 Network diagram for the FTP test IP network 10.1.1.
[device-hwping-administrator-ftp] count 10 # Set the probe timeout time to 30 seconds. [device-hwping-administrator-ftp] timeout 30 # Configure the source IP address [device-hwping-administrator-ftp] source-ip 10.1.1.1 # Start the test. [device-hwping-administrator-ftp] test-enable # Display test results [device-hwping-administrator-ftp] display hwping results administrator ftp HWPing entry(admin administrator, tag ftp) test result: Destination ip address:10.2.2.
HTTP Test Network requirements As shown in Figure 1-5, Switch serves as the HWPing client, and a PC serves as the HTTP server. Perform a HWPing HTTP test between Switch and the HTTP server to test the connectivity and the time required to download a file from the HTTP server after the connection to the server is established. Figure 1-5 Network diagram for the HTTP test IP network 10.1.1.1/8 10.2.2.
SD Maximal delay: 0 DS Maximal delay: 0 Packet lost in test: 0% Disconnect operation number: 0 Operation timeout number: 0 System busy operation number: 0 Connection fail number: 0 Operation sequence errors: 0 Drop operation number: 0 Other operation errors: 0 Http result: DNS Resolve Time: 0 HTTP Operation Time: 675 DNS Resolve Min Time: 0 HTTP Test Total Time: 748 DNS Resolve Max Time: 0 HTTP Transmission Successful Times: 10 DNS Resolve Failed Times: 0 HTTP Transmission Failed Times: 0 DN
Network diagram Figure 1-6 Network diagram for the Jitter test IP network 10.1.1.1/8 10.2.2.2/8 Switch A HWPing Client Switch B HWPing Server Configuration procedure z Configure HWPing Server (Switch B): # Enable the HWPing server and configure the IP address and port to listen on. system-view [device] hwping-server enable [device] hwping-server udpecho 10.2.2.2 9000 z Configure HWPing Client (Switch A): # Enable the HWPing client.
Packet lost in test: 0% Disconnect operation number: 0 Operation timeout number: 0 System busy operation number: 0 Connection fail number: 0 Operation sequence errors: 0 Drop operation number: 0 Other operation errors: 0 Jitter result: RTT Number:100 Min Positive SD:1 Min Positive DS:1 Max Positive SD:6 Max Positive DS:8 Positive SD Number:38 Positive DS Number:25 Positive SD Sum:85 Positive DS Sum:42 Positive SD average:2 Positive DS average:1 Positive SD Square Sum:267 Positive DS Square
Network diagram Figure 1-7 Network diagram for the SNMP test IP n etwork 10.1.1.1/8 10.2.2.2/8 Switch A Switch B HWPing Client SNMP Agent Configuration procedure z Configure SNMP Agent (Switch B): # Start SNMP agent and set SNMP version to V2C, read-only community name to "public", and read-write community name to "private".
[device-hwping-administrator-snmp] test-enable # Display test results [device-hwping-administrator-snmp] display hwping results administrator snmp HWPing entry(admin administrator, tag snmp) test result: Destination ip address:10.2.2.2 Send operation times: 10 Receive response times: 10 Min/Max/Average Round Trip Time: 9/11/10 Square-Sum of Round Trip Time: 983 Last complete test time: 2000-4-3 8:57:20.
Configuration procedure z Configure HWPing Server (Switch B): # Enable the HWPing server and configure the IP address and port to listen on. system-view [device] hwping-server enable [device] hwping-server tcpconnect 10.2.2.2 8000 z Configure HWPing Client (Switch A): # Enable the HWPing client. system-view [device] hwping-agent enable # Create a HWPing test group, setting the administrator name to "administrator" and test tag to "tcpprivate".
Index Response Status LastRC Time 1 4 1 0 2000-04-02 08:26:02.9 2 5 1 0 2000-04-02 08:26:02.8 3 4 1 0 2000-04-02 08:26:02.8 4 5 1 0 2000-04-02 08:26:02.7 5 4 1 0 2000-04-02 08:26:02.7 6 5 1 0 2000-04-02 08:26:02.6 7 6 1 0 2000-04-02 08:26:02.6 8 7 1 0 2000-04-02 08:26:02.5 9 5 1 0 2000-04-02 08:26:02.5 10 7 1 0 2000-04-02 08:26:02.4 For detailed output description, see the corresponding command manual.
[device-hwping-administrator-udpprivate] destination-ip 10.2.2.2 # Configure the destination port on the HWPing server. [device-hwping-administrator-udpprivate] destination-port 8000 # Configure to make 10 probes per test. [device-hwping-administrator-udpprivate] count 10 # Set the probe timeout time to 5 seconds. [device-hwping-administrator-udpprivate] timeout 5 # Start the test. [device-hwping-administrator-udpprivate] test-enable # Display test results.
Network diagram Figure 1-10 Network diagram for the DNS test IP network 10.1.1.1/8 10.2.2.2/8 Switch DNS Server HWPing Client Configuration procedure z Configure DNS Server: Use Windows 2003 Server as the DNS server. For DNS server configuration, refer to the related instruction on Windows 2003 Server configuration. z Configure HWPing Client (Switch) # Enable the HWPing client.
System busy operation number: 0 Connection fail number: 0 Operation sequence errors: 0 Drop operation number: 0 Other operation errors: 0 Dns result: DNS Resolve Current Time: 10 DNS Resolve Min Time: 6 DNS Resolve Times: 10 DNS Resolve Max Time: 10 DNS Resolve Timeout Times: 0 DNS Resolve Failed Times: 0 [device-hwping-administrator-dns] display hwping history administrator dns HWPing entry(admin administrator, tag dns) history record: Index Response Status LastRC Time 1 10 1 0 2006-11-2
Table of Contents 1 DNS Configuration·····································································································································1-1 DNS Overview·········································································································································1-1 Static Domain Name Resolution ·····································································································1-1 Dynamic Domain Name Resolution ···················
1 DNS Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. z This chapter covers only IPv4 DNS configuration. For details about IPv6 DNS, refer to IPv6 Management Operation.
Figure 1-1 Dynamic domain name resolution Request User program Request Resolver Response Response DNS server Read Save Cache DNS client Figure 1-1 shows the relationship between user program, DNS client, and DNS server. The resolver and cache comprise the DNS client. The user program and DNS client run on the same device, while the DNS server and the DNS client usually run on different devices.
To do… Use the command… Enter system view system-view Configure a mapping between a host name and an IP address ip host hostname ip-address Remarks — Required No IP address is assigned to a host name by default. The IP address you assign to a host name last time will overwrite the previous one if there is any. You may create up to 50 static mappings between domain names and IP addresses.
Figure 1-2 Network diagram for static DNS configuration 10 .1.1. 2/ 24 host.com 10.1 .1.1/24 Switch Host Configuration procedure # Configure a mapping between host name host.com and IP address 10.1.1.2. system-view [device] ip host host.com 10.1.1.2 # Execute the ping host.com command to verify that the device can use static domain name resolution to get the IP address 10.1.1.2 corresponding to host.com. [device] ping host.com PING host.com (10.1.1.
Configuration procedure Before doing the following configuration, make sure that: z The routes between the DNS server, Switch, and Host are reachable. z Necessary configurations are done on the devices. For the IP addresses of the interfaces, see the figure above. z There is a mapping between domain name host and IP address 3.1.1.1/16 on the DNS server. z The DNS server works normally. # Enable dynamic domain name resolution. system-view [device] dns resolve # Configure the IP address 2.
Displaying and Maintaining DNS To do… Use the command… Remarks Display static DNS database display ip host Display the DNS server information display dns server [ dynamic ] Display the DNS suffixes display dns domain [ dynamic ] Display the information in the dynamic domain name cache display dns dynamic-host Display the DNS resolution result nslookup type { ptr ip-address | a domain-name } Available in any view Clear the information in the dynamic domain name cache reset dns dynamic-host Av
Table of Contents 1 Smart Link Configuration ·························································································································1-1 Smart Link Overview ·······························································································································1-1 Basic Concepts in Smart Link ·········································································································1-1 Operating Mechanism of Smart Link ···················
1 Smart Link Configuration z The term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series. z The sample output information in this manual was created on the WX3024. The output information on your device may vary. Smart Link Overview As shown in Figure 1-1, dual-uplink networking is widely applied currently. Usually, spanning tree protocol (STP) is used to implement link redundancy backup in the network.
Master port The master port can be either an Ethernet port or a manually-configured or static LACP aggregation group. For example, you can configure GigabitEthernet 1/0/1 of switch A in Figure 1-1 as the master port through the command line. Slave port The slave port can be either an Ethernet port or a manually-configured or static LACP aggregation group. For example, you can configure GigabitEthernet 1/0/2 of switch A in Figure 1-1 as the slave port through the command line.
Operating Mechanism of Smart Link Figure 1-2 Network diagram of Smart Link operating mechanism GE 1/0/12 GE 1/0/11 Switch E Switch C GE 1/0 /3 GE1 /0/1 GE 1/0/1 GE1 /0/2 GE 1/0/2 GE 1/0 /1 Switch D GE1/0/3 BLOCK GE1 /0/2 Switch A Switch B As shown in Figure 1-2, GigabitEthernet 1/0/1 on Switch A is active and GigabitEthernet 1/0/2 on Switch A is blocked.
Task Remarks Create a Smart Link group Configuring a Smart Link Device Add member ports to the Smart Link group Required Enable the function of sending flush messages in the specified control VLAN Configuring Associated Devices Enable the function of processing flush messages received from the specified control VLAN Required Configuring a Smart Link Device A Smart Link device refers to a device on which Smart Link is enabled and a Smart Link group is configured, and that sends flush messages from t
To do… Use the command… Enable the function of sending flush messages in the specified control VLAN Remarks Optional flush enable control-vlan vlan-id By default, no control VLAN for sending flush messages is specified. Configuring Associated Devices An associated device mentioned in this document refers to a device that supports Smart Link and locally configured to process flush messages received from the specified control VLAN so as to work with the corresponding Smart Link device.
z When you copy a port, the Smart Link/Monitor Link group member information configured on the port will not be copied to other ports. z If a single port is specified as a member of a Smart Link/Monitor Link group, you cannot execute the lacp enable command on this port or add this port into other dynamic link aggregation groups, because these operations will make this port become a link aggregation group member.
Figure 1-3 Network diagram for Smart Link configuration Server GE 1/0/2 GE 1/0/3 Switch E Switch C GE1/0/1 GE 1/0 /1 GE1/0/2 GE 1/0/2 GE 1/0/1 Switch D GE 1/0/2 Switch A PC Configuration procedure 1) Configure a Smart Link group on Switch A and configure member ports for it. Enable the function of sending flush messages in Control VLAN 1. # Enter system view. system-view # Enter Ethernet port view. Disable STP on GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2.
# Enable the function of processing flush messages received from VLAN 1 on GigabitEthernet 1/0/2. smart-link flush enable control-vlan 1 port GigabitEthernet 1/0/2 3) Enable the function of processing flush messages received from VLAN 1 on Switch D. # Enter system view. system-view # Enable the function of processing flush messages received from VLAN 1 on GigabitEthernet 1/0/2.
2 Monitor Link Configuration Introduction to Monitor Link Monitor Link is a collaboration scheme introduced to complement for Smart Link. It is used to monitor uplink and to perfect the backup function of Smart Link. A monitor Link consists of an uplink port and one or multiple downlink ports. When the link for the uplink port of a Monitor Link group fails, all the downlink ports in the Monitor Link group are forced down.
How Monitor Link Works Figure 2-2 Network diagram for a Monitor Link group implementation GE 1/0/12 GE 1/0/11 Switch E Switch C GE 1/0 /3 GE1 /0/1 GE 1/0/1 GE1 /0/2 GE 1/0/2 GE 1/0 /1 Switch D GE1/0/3 BLOCK GE1 /0/2 Switch A Switch B As shown in Figure 2-2, the devices Switch C and Switch D are connected to the uplink device Switch E.
Configuring Monitor Link Before configuring a Monitor Link group, you must create a Monitor Link group and configure member ports for it. A Monitor Link group consists of an uplink port and one or multiple downlink ports. The uplink port can be a manually-configured or static LACP link aggregation group, an Ethernet port, or a Smart Link group. The downlink ports can be manually-configured link aggregation groups or static LACP link aggregation groups, or Ethernet ports.
To do… Configure the uplink port for the Monitor Link group Use the command… Configure the specified link aggregation group as the uplink port of the Monitor Link group link-aggregation group group-id uplink Configure the specified Smart Link group as the uplink port of the Monitor Link group smart-link group group-id uplink Configure the specified Ethernet port as the uplink port of the Monitor Link group Remarks Required Monitor Link group view port interface-type interface-number uplink Use a
z A Smart Link/Monitor Link group with members cannot be deleted. A Smart Link group as a Monitor Link group member cannot be deleted. z The Smart Link/Monitor Link function and the remote port mirroring function are incompatible with each other. z If a single port is specified as a Smart Link/Monitor Link group member, do not use the lacp enable command on the port or add the port to another dynamic link aggregation group because doing so will cause the port to become an aggregation group member.
Figure 2-3 Network diagram for Monitor Link configuration Server GE1/0/10 GE 1/0/11 Switch E Switch C GE1/0 /1 GE 1/0/1 GE1/0 /2 GE 1/0/2 GE1 /0/3 GE1 /0/3 GE1 /0/1 GE1 /0/1 BLOCK GE1/0 /2 GE 1/0/2 Switch A PC 1 Switch D Switch B PC 2 PC 3 PC 4 Configuration procedure 1) Enable Smart Link on Switch A and Switch B to implement link redundancy backup. Perform the following configuration on Switch A. The configuration on Switch B is the same as on Switch A. # Enter system view.
2) Enable Monitor Link on Switch C and Switch D and enable the function of processing flush messages received from VLAN 1. Perform the following configuration on Switch C. The operation procedure on Switch D is the same as that performed on Switch C. # Enter system view.
Table of Contents 1 PoE Configuration ·····································································································································1-1 PoE Overview ·········································································································································1-1 Introduction to PoE ··························································································································1-1 PoE Features Supported by the Device
1 PoE Configuration When configuring PoE, go to these sections for information you are interested in: z PoE Overview z PoE Configuration z PoE Configuration Example The terms switching engine and Ethernet switch used throughout this documentation refer to a switching device in a generic sense or the switching engine of a unified switch in the WX3000 series.
PoE Features Supported by the Device Table 1-1 Power supply parameters of PoE device Device Input power supply Number of electrical ports supplying power Maximum PoE distance Maximum power provided by each electrical port 24 100 m (328.08 ft.) 25 W DC input WX3024 AC input Total Maximum PoE output power 600 W 370 W WX3010 DC input 8 100 m (328.08 ft.) 25 W 125 W WX3008 DC input 4 100 m (328.08 ft.
Task Remarks Enabling the PoE Feature on a Port Required Setting the Maximum Output Power on a Port Optional Setting PoE Management Mode and PoE Priority of a Port Optional Setting the PoE Mode on a Port Optional Configuring the PD Compatibility Detection Function Optional Upgrading the PSE Processing Software Online Optional Displaying and Maintaining PoE Configuration Optional Enabling the PoE Feature on a Port Follow these steps to enable the PoE feature on a port: To do… z Use the comm
Setting PoE Management Mode and PoE Priority of a Port When the device is close to its full load in supplying power, you can adjust the power supply of the device through the cooperation of the PoE management mode and the port PoE priority settings. The device supports two PoE management modes, auto and manual. The auto mode is adopted by default.
To do… Set the PoE mode on the port to signal Use the command… Remarks Optional poe mode signal signal by default. Configuring the PD Compatibility Detection Function After the PD compatibility detection function is enabled, the device can detect the PDs that do not conform to the 802.3af standard and supply power to them. After the PoE feature is enabled, perform the following configuration to enable the PD compatibility detection function.
z In the case that the PSE processing software is damaged (that is, no PoE command can be executed successfully), use the full update mode to upgrade and thus restore the software. z The refresh update mode is to upgrade the original processing software in the PSE through refreshing the software, while the full update mode is to delete the original processing software in PSE completely and then reload the software. z Generally, the refresh update mode is used to upgrade the PSE processing software.
Figure 1-1 Network diagram for PoE Network Switch A GE1 /0/1 GE1 /0/8 GE1/0/2 Switch B AP AP Configuration procedure # Upgrade the PSE processing software online. system-view [SwitchA] poe update refresh 0290_021.s19 # Enable the PoE feature on GigabitEthernet 1/0/1, and set the PoE maximum output power of GigabitEthernet 1/0/1 to 12,000 mW.
2 PoE Profile Configuration Introduction to PoE Profile On a large-sized network or a network with mobile users, to help network administrators to monitor the PoE features of the device, the device provides the PoE profile features. A PoE profile is a set of PoE configurations, including multiple PoE features. Features of PoE profile: z Various PoE profiles can be created. PoE policy configurations applicable to different user groups are stored in the corresponding PoE profiles.
To do… Use the command… apply poe-profile profile-name interface interface-type interface-number [ to interface-type interface-number ] In system view Apply the existing PoE profile to the specified Ethernet port In Ethernet port view Remarks Enter Ethernet port view interface interface-type interface-number Apply the existing PoE profile to the port apply poe-profile profile-name Use either approach.
PoE Profile Configuration Example PoE Profile Application Example Network requirements As shown in Figure 2-1, Switch A supports PoE. GigabitEthernet 1/0/1 through GigabitEthernet 1/0/10 of Switch A are used by users of group A, who have the following requirements: z The PoE function can be enabled on all ports in use. z Signal mode is used to supply power.
[SwitchA-poe-profile-Profile1] poe enable [SwitchA-poe-profile-Profile1] poe mode signal [SwitchA-poe-profile-Profile1] poe priority critical [SwitchA-poe-profile-Profile1] poe max-power 3000 [SwitchA-poe-profile-Profile1] quit # Display detailed configuration information for Profile1. [SwitchA] display poe-profile name Profile1 Poe-profile: Profile1, 3 action poe enable poe max-power 3000 poe priority critical # Create Profile2, and enter PoE profile view.
Table of Contents 1 IP Routing Protocol Overview ··················································································································1-1 Introduction to IP Route and Routing Table····························································································1-1 IP Route···········································································································································1-1 Routing Table ··········································
Filters ···············································································································································4-1 IP Route Policy Configuration Task List··································································································4-2 Route Policy Configuration ·····················································································································4-2 Configuration Prerequisites ········································
1 IP Routing Protocol Overview Go to these sections for information you are interested in: z Introduction to IP Route and Routing Table z Routing Protocol Overview z Displaying and Maintaining a Routing Table The term router in this chapter refers to a router in a generic sense or a WX3000 series device running a routing protocol. Introduction to IP Route and Routing Table IP Route Routers are used for route selection on the Internet.
host or router resides. For example, if the destination address is 129.102.8.10 and the mask is 255.255.0.0, the address of the network segment where the destination host or router resides is 129.102.0.0. A mask consists of some consecutive 1s, represented either in dotted decimal notation or by the number of the consecutive 1s in the mask. z Interface: It indicates through which interface IP packets should be forwarded to the destination.
Routing Protocol Overview Static Routing and Dynamic Routing Static routing is easy to configure and requires less system resources. It works well in small, stable networks with simple topologies. It cannot adapt itself to any network topology change automatically so that you must perform routing configuration again whenever the network topology changes. Dynamic routing is based on dynamic routing protocols, which can detect network topology changes and recalculate the routes accordingly.
each routing protocol (including static routes) is assigned a priority. The route found by the routing protocol with the highest priority is preferred. The following table lists some routing protocols and the default priorities for routes found by them: Table 1-1 Routing protocols and priorities of their default route Routing approach Priority DIRECT 0 OSPF 10 STATIC 60 RIP 100 OSPF ASE 150 OSPF NSSA 150 UNKNOWN 255 z The smaller the priority value, the higher the priority.
routing information. Each routing protocol shares routing information discovered by other routing protocols through a route redistribution mechanism.
2 Static Route Configuration When configuring a static route, go to these sections for information you are interested in: z Introduction to Static Route z Static Route Configuration z Displaying and Maintaining Static Routes z Static Route Configuration Example z Troubleshooting a Static Route The term router in this chapter refers to a router in a generic sense or a WX3000 series device running a routing protocol. Introduction to Static Route Static Route Static routes are special routes.
Default Route To avoid too large a routing table, you can configure a default route. When the destination address of a packet fails to match any entry in the routing table, z If there is default route in the routing table, the default route will be selected to forward the packet. z If there is no default route, the packet will be discarded and an ICMP Destination Unreachable or Network Unreachable packet will be returned to the source.
Displaying and Maintaining Static Routes To do... Use the command...
Configuration procedure When only one interface of the device is interconnected with another network segment, you can implement network communication by configuring either a static route or default route. 1) Perform the following configurations on the device. # Approach 1: Configure static routes on Switch A. system-view [SwitchA] ip route-static 1.1.3.0 255.255.255.0 1.1.2.2 [SwitchA] ip route-static 1.1.4.0 255.255.255.0 1.1.2.2 [SwitchA] ip route-static 1.1.5.0 255.255.255.0 1.1.2.
3 RIP Configuration When configuring RIP, go to these sections for information you are interested in: z RIP Overview z RIP Configuration Task List z RIP Configuration Example z Troubleshooting RIP Configuration The term router in this chapter refers to a router in a generic sense or a WX3000 series device running a routing protocol. RIP Overview Routing information protocol (RIP) is a simple interior gateway protocol (IGP) suitable for small-sized networks.
z Interface: Outbound interface on this router, through which IP packets should be forwarded to reach the destination. z Metric: Cost from the local router to the destination. z Route time: Time elapsed since the routing entry was last updated. The time is reset to 0 every time the routing entry is updated. RIP timers As defined in RFC 1058, RIP is controlled by three timers: Period update, Timeout, and Garbage-collection.
RIP Configuration Task List Complete the following tasks to configure RIP: Task Configuring Basic RIP Functions Configuring RIP Route Control RIP Network Adjustment and Optimization Remarks Enabling RIP on the interfaces attached to a specified network segment Required Setting the RIP operating status on an interface Optional Specifying the RIP version on an interface Optional Setting the additional routing metrics of an interface Optional Configuring RIP route summarization Optional Disablin
z Related RIP commands configured in interface view can take effect only after RIP is enabled. z RIP operates on the interfaces attached to a specified network segment. When RIP is disabled on an interface, it does not operate on the interface, that is, it neither receives/sends routes on the interface, nor forwards any interface route. Therefore, after RIP is enabled globally, you must also specify its operating network segments to enable it on the corresponding interfaces.
z Set the preference of RIP to change the preference order of routing protocols. This order makes sense when more than one route to the same destination is discovered by multiple routing protocols. z Redistribute external routes in an environment with multiple routing protocols.
Follow these steps to configure RIP route summarization: To do... Use the command... Remarks Enter system view system-view — Enter RIP view rip — Enable RIP-2 automatic route summarization summary Required Enabled by default Disabling the router from receiving host routes In some special cases, the router can receive a lot of host routes from the same segment, and these routes are of little help in route addressing but consume a lot of network resources.
z The filter-policy import command filters the RIP routes received from neighbors, and the routes being filtered out will neither be added to the routing table nor be advertised to any neighbors. z The filter-policy export command filters all the routes to be advertised, including the routes redistributed with the import-route command and routes learned from neighbors. z You can also use the filter-policy export command to filter outgoing routes redistributed from a specified routing protocol.
Configuration Prerequisites Before adjusting RIP, perform the following tasks: z Configuring the network layer addresses of interfaces so that adjacent nodes are reachable to each other at the network layer z Configuring basic RIP functions Configuration Tasks Configuring RIP timers Follow these steps to configure RIP timers: To do... Use the command...
To do... Use the command... Remarks Enter system view system-view — Enter RIP view rip — Enable the check of the must be zero field in RIP-1 packets checkzero Required Enabled by default Some fields in a RIP-1 packet must be 0, and they are known as must be zero field. For RIP-1, the must be zero field is checked for incoming packets, and those RIP-1 packets with this field being nonzero will not be processed.
To do... Use the command... Remarks Required Configure RIP to unicast RIP packets When RIP runs on the link that does not support broadcast or multicast, you must configure RIP to unicast RIP packets. peer ip-address Displaying and Maintaining RIP Configuration To do... Use the command...
Configuration procedure Only the configuration related to RIP is listed below. Before the following configuration, make sure the Ethernet link layer works normally and the IP addresses of VLAN interfaces are configured correctly. 1) Configure Switch A: # Configure RIP. system-view [SwitchA] rip [SwitchA-rip] network 110.11.2.0 [SwitchA-rip] network 155.10.1.0 2) Configure Switch B: # Configure RIP. system-view [SwitchB] rip [SwitchB-rip] network 196.38.165.
4 IP Route Policy Configuration When configuring an IP route policy, go to these sections for information you are interested in: z IP Route Policy Overview z IP Route Policy Configuration Task List z Displaying and Maintaining IP Route Policy z IP Route Policy Configuration Example z Troubleshooting IP Route Policy The term router in this chapter refers to a router in a generic sense or a WX3000 series device running a routing protocol.
For ACL configuration, refer to the part discussing ACL. Route policy A route policy is used to match some attributes with given routing information and the attributes of the information will be set if the conditions are satisfied. A route policy can comprise multiple nodes. Each node is a unit for matching test, and the nodes will be matched in ascending order of their node numbers. Each node comprises a set of if-match and apply clauses. The if-match clauses define the matching rules.
z Match conditions z Route attributes to be changed Defining a Route Policy Follow these steps to define a route policy: To do... z Use the command... Remarks Enter system view system-view — Define a route policy and enter the route policy view route-policy route-policy-name { permit | deny } node node-number Required Not defined by default The permit argument specifies the matching mode for a defined node in the route policy to be in permit mode.
To do... Define a rule to match the next-hop address of routing information Apply a cost to routes satisfying matching rules z Use the command... Remarks Optional if-match ip next-hop acl acl-number By default, no matching is performed on the next-hop address of routing information. Optional apply cost value By default, no cost is applied to routes satisfying matching rules. A route policy comprises multiple nodes. There is an OR relationship between the nodes in a route policy.
Figure 4-1 Network diagram Device Switch A Switch B Switch C Interface Vlan-int 2 Vlan-int 3 Vlan-int 10 Vlan-int 3 Vlan-int 6 Vlan-int 10 Vlan-int 1 Vlan-int 2 Vlan-int 6 IP address 2.2.2.1/8 3.3.3.254/8 1.1.1.254/8 3.3.3.253/8 6.6.6.5/8 1.1.1.253/8 192.168.0.39/24 2.2.2.2/8 6.6.6.6/8 1.1.1.1/32 3.3.3.3/32 192.168.0.9/24 OA Server Service Server Host Configuration considerations z According to the network requirements, select RIP.
[SwitchA-rip] network 2.0.0.0 [SwitchA-rip] network 3.0.0.0 2) Configure Switch B. # Create VLANs and configure IP addresses for the VLAN interfaces. The configuration procedure is omitted. # Configure RIP. system-view [SwitchB] rip [SwitchB-rip] network 1.0.0.0 [SwitchB-rip] network 3.0.0.0 [SwitchB-rip] network 6.0.0.0 3) Configure Switch C. # Create VLANs and configure IP addresses for the VLAN interfaces. The configuration procedure is omitted.
# Create node 40 with the matching mode being permit in the route policy. Define if-match clauses. Apply the cost 5 to routes matching the outgoing interface VLAN-interface 6 and ACL 2001. [SwitchC] route-policy in permit node 40 [SwitchC-route-policy] if-match interface Vlan-interface6 [SwitchC-route-policy] if-match acl 2001 [SwitchC-route-policy] apply cost 5 [SwitchC-route-policy] quit # Create node 50 with the matching mode being permit, to allow all routing information to pass.
Precautions 1) When you configure the apply cost command in a route policy: z The new cost should be greater than the original one to prevent RIP from generating routing loop in the case that a loop exists in the topology. z The cost will become 16 if you try to set it to a value greater than 16. z The cost will become the original one if you try to set it to 0. z The cost will still be 16 if you try to set it to 16.
Table of Contents 1 UDP Helper Configuration ························································································································1-1 Introduction to UDP Helper ·····················································································································1-1 Configuring UDP Helper ·························································································································1-2 Displaying and Maintaining UDP Helper··········
1 UDP Helper Configuration When configuring UDP helper, go to these sections for information you are interested in: z Introduction to UDP Helper z Configuring UDP Helper z Displaying and Maintaining UDP Helper z UDP Helper Configuration Example Introduction to UDP Helper Sometimes, a host needs to forward broadcasts to obtain network configuration information or request the names of other devices on the network.
Protocol UDP port number Time Service 37 Configuring UDP Helper Follow these steps to configure UDP Helper: To do… Use the command… Enter system view system-view Enable UDP Helper udp-helper enable Remarks — Required Disabled by default.
Displaying and Maintaining UDP Helper To do… Use the command… Remarks Display the UDP broadcast relay forwarding information of a specified VLAN interface on the device display udp-helper server [ interface vlan-interface vlan-id ] Available in any view Clear statistics about packets forwarded by UDP Helper reset udp-helper packet Available in user view UDP Helper Configuration Example Cross-Network Computer Search Through UDP Helper Network requirements As shown in Figure 1-1, PC A resides on netw
Table of Contents Appendix A Acronyms ································································································································ A-1 i
Appendix A Acronyms A AAA Authentication, Authorization and Accounting ABR Area Border Router ACL Access Control List ARP Address Resolution Protocol AS Autonomous System ASBR Autonomous System Border Router B BDR Backup Designated Router C CAR Committed Access Rate CLI Command Line Interface CoS Class of Service D DDM Distributed Device Management DLA Distributed Link Aggregation DRR Distributed Resilient Routing DHCP Dynamic Host Configuration Protocol DR Designated Router D-
L LSA Link State Advertisement LSDB Link State DataBase M MAC Medium Access Control MIB Management Information Base N NBMA Non Broadcast MultiAccess NIC Network Information Center NMS Network Management System NVRAM Nonvolatile RAM P PIM Protocol Independent Multicast PIM-DM Protocol Independent Multicast-Dense Mode PIM-SM Protocol Independent Multicast-Sparse Mode Q QoS Quality of Service R RMON Remote Network Monitoring RSTP Rapid Spanning Tree Protocol S SNMP Simple Network M
