1. DL manuals
  2. 3Com
  3. Switch
  4. WX3000
  5. Operation Manual

3Com WX3000 Operation Manual

Summary of WX3000

  • Page 1

    3com wx3000 series unified switches switching engine operation manual manual version: 6w100 www.3com.Com 3com corporation 350 campus drive, marlborough, ma, usa 01752 3064.

  • Page 2

    Copyright © 2009, 3com corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from 3com corporation. 3com corporation reserves th...

  • Page 3

    About this manual organization 3com wx3000 series unified switches consists of three models: the wx3024 , the wx3010 and the wx3008. 3com wx3000 series unified switches switching engine operation manual is organized as follows: part contents 1 cli introduces the command hierarchy, command view and c...

  • Page 4

    Part contents 24 snmp-rmon introduces the configuration for network management through snmp and rmon 25 multicast introduces igmp snooping and the related configuration. 26 ntp introduces ntp and the related configuration. 27 ssh introduces ssh2.0 and the related configuration. 28 file system manage...

  • Page 5

    Convention description & the argument(s) before the ampersand (&) sign can be entered 1 to n times. # a line starting with the # sign is comments. Gui conventions convention description boldface window names, button names, field names, and menu items are in boldface. For example, the new user window...

  • Page 6

    Manual description 3com wx3000 series unified switches web-based configuration manual introduces the web-based functions of the access control engine of wx3000 series unified switches access controller engines. Obtaining documentation you can access the most up-to-date 3com product documentation on ...

  • Page 7: Table of Contents

    I table of contents 1 cli configuration ······································································································································1-1 introduction to the cli···································································································...

  • Page 8: Cli Configuration

    1-1 1 cli configuration the sample output information in this manual was created on the wx3024. The output information on your device may vary. Introduction to the cli a command line interface (cli) is a user interface to interact with a device. Through the cli on a device, a user can enter commands...

  • Page 9

    1-2 z manage level (level 3): commands at this level are associated with the basic operation modules and support modules of the system. These commands provide support for services. Commands concerning file system, ftp/tftp/xmodem downloading, user management, and level setting are at this level. Use...

  • Page 10

    1-3 configuration example after a general user telnets to the device, his/her user level is 0. Now, the network administrator wants to allow general users to switch to level 3, so that they are able to configure the device. # a level 3 user sets a switching password for user level 3. System-view [de...

  • Page 11

    1-4 # change the tftp get command in user view (shell) from level 3 to level 0. (originally, only level 3 users can change the level of a command.) system-view [device] command-privilege level 0 view shell tftp [device] command-privilege level 0 view shell tftp 192.168.0.1 [device] command-privilege...

  • Page 12

    1-5 view available operation prompt example enter method quit method 1000 mbps ethernet port view: [device-gigabiteth ernet1/0/1] execute the interface gigabitethernet command in system view. Ethernet port view configure ethernet port parameters 10 gigabit ethernet port view: [device-tengigabit ethe...

  • Page 13

    1-6 view available operation prompt example enter method quit method edit the rsa public key for ssh users [device-rsa-key-co de] public key editing view edit the rsa or dsa public key for ssh users [device-peer-key-c ode] execute the public-key-code begin command in public key view. Execute the pub...

  • Page 14

    1-7 view available operation prompt example enter method quit method qinq view configure qinq parameters [device-gigabiteth ernet1/0/1-vid-20] execute the vlan-vpn vid command in ethernet port view. The vlan-vpn enable command should be first executed. Execute the quit command to return to ethernet ...

  • Page 15

    1-8 timezone configure time zone if the question mark (?) is at an argument position in the command, the description of the argument will be displayed on your terminal. [device] interface vlan-interface ? Vlan interface number if only is displayed after you enter a question mark (?), it means no par...

  • Page 16

    1-9 by default, the cli can store up to 10 latest executed commands for each user. You can view the command history by performing the operations listed in table 1-3 . Table 1-3 view history commands purpose operation remarks display the latest executed history commands execute the display history-co...

  • Page 17

    1-10 table 1-5 edit operations press… to… a common key insert the corresponding character at the cursor position and move the cursor one character to the right if the command is shorter than 254 characters. Backspace key delete the character on the left of the cursor and move the cursor one characte...

  • Page 18: Table of Contents

    I table of contents 1 logging in to the switching engine ········································································································1-1 logging in to the switching engine·····································································································...

  • Page 19

    Ii configuring source ip address for telnet service packets ···································································6-1 displaying source ip address configuration ··························································································6-2 7 user control ·················...

  • Page 20

    1-1 1 logging in to the switching engine the sample output information in this manual was created on the wx3024. The output information on your device may vary. Logging in to the switching engine you can log in to the switching engine of the device in one of the following ways: z logging in through ...

  • Page 21

    1-2 user interface index two kinds of user interface index exist: absolute user interface index and relative user interface index. 1) the absolute user interface indexes are as follows: z the absolute aux user interfaces is numbered 0. Z vty user interface indexes follow aux user interface indexes. ...

  • Page 23: Logging In Through Oap

    2-1 2 logging in through oap oap overview as an open software and hardware system, open application architecture (oaa) provides a set of complete standard software and hardware interfaces. The third party vendors can develop products with special functions. These products can be compatible with each...

  • Page 24

    2-2 therefore, when you use the nms to manage the access control engine and the switching engine on the same interface, you must first obtain the management ip addresses of the two snmp agents and obtain the link relationship between them, and then you can access the two agents. By default, the mana...

  • Page 25

    2-3 resetting the oap software system if the operating system works abnormally or is under other anomalies, you can reset the oap software system. Follow these steps to reset the oap software system: to do… use the command… remarks reset the oap software system oap reboot slot 0 required available i...

  • Page 26: Logging In Through Telnet

    3-1 3 logging in through telnet introduction the device supports telnet. You can manage and maintain the switching engine remotely by telnetting to the switching engine. To log in to the switching engine through telnet, the corresponding configuration is required on both the switching engine and the...

  • Page 27

    3-2 configuration description make terminal services available optional by default, terminal services are available in all user interfaces set the maximum number of lines the screen can contain optional by default, the screen can contain up to 24 lines. Set history command buffer size optional by de...

  • Page 28

    3-3 to improve security and prevent attacks to the unused sockets, tcp 23 and tcp 22, ports for telnet and ssh services respectively, will be enabled or disabled after corresponding configurations. Z if the authentication mode is none, tcp 23 will be enabled, and tcp 22 will be disabled. Z if the au...

  • Page 29

    3-4 to do… use the command… remarks set the history command buffer size history-command max-size value optional the default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default. Set the timeout time of the vty user interface idle-timeout minutes...

  • Page 30

    3-5 # specify commands of level 2 are available to users logging in through vty 0. [device-ui-vty0] user privilege level 2 # configure telnet protocol is supported. [device-ui-vty0] protocol inbound telnet # set the maximum number of lines the screen can contain to 30. [device-ui-vty0] screen-length...

  • Page 31

    3-6 to do… use the command… remarks set the history command buffer size history-command max-size value optional the default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default. Set the timeout time of the user interface idle-timeout minutes [ s...

  • Page 32

    3-7 [device-ui-vty0] authentication-mode password # set the local password to 123456 (in plain text). [device-ui-vty0] set authentication password simple 123456 # specify commands of level 2 are available to users logging in to vty 0. [device-ui-vty0] user privilege level 2 # configure telnet protoc...

  • Page 33

    3-8 to do… use the command… remarks enter one or more vty user interface views user-interface vty first-number [ last-number ] — configure to authenticate users locally or remotely authentication-mode scheme [ command- authorization ] required the specified aaa scheme determines whether to authentic...

  • Page 34

    3-9 table 3-4 determine the command level when users logging in to the switching engine are authenticated in the scheme mode scenario authentication mode user type command command level the user privilege level level command is not executed, and the service-type command does not specify the availabl...

  • Page 35

    3-10 refer to aaa operation and ssh operation of this manual for information about aaa, radius, and ssh. Configuration example network requirements as shown in figure 3-3 , assume a current user logs in using the oap connect slot 0 command and the user level is set to the manage level (level 3). Per...

  • Page 36

    3-11 [device-ui-vty0] protocol inbound telnet # set the maximum number of lines the screen can contain to 30. [device-ui-vty0] screen-length 30 # set the maximum number of commands the history command buffer can store to 20. [device-ui-vty0] history-command max-size 20 # set the timeout time to 6 mi...

  • Page 37

    3-12 z perform the following operations in the terminal window to assign ip address 202.38.160.90/24 to vlan–interface 1 of the access control engine. System-view [device] interface vlan-interface 1 [device-vlan-interface1] ip address 202.38.160.90 255.255.255.0 z log in to the switching engine of t...

  • Page 38

    3-13 figure 3-7 launch telnet 5) if the password authentication mode is specified, enter the password when the telnet window displays “login authentication” and prompts for login password. The cli prompt (such as ) appears if the password is correct. If all vty user interfaces of the switching engin...

  • Page 39

    3-14 1) perform telnet-related configuration on the switching engine operating as the telnet server. For details, refer to telnet configuration with authentication mode being none , telnet configuration with authentication mode being password , and telnet configuration with authentication mode being...

  • Page 40: Management System

    4-1 4 logging in from the web-based network management system when logging in from the web-based network management system, go to these sections for information you are interested in: z introduction z setting up a web configuration environment z configuring the login banner z enabling/disabling the ...

  • Page 41

    4-2 setting up a web configuration environment your wx series access controller products were delivered with a factory default configuration. This configuration allows you to log into the built-in web-based management system of the access controller product from a web browser on a pc by inputting ht...

  • Page 42

    4-3 figure 4-1 web interface of the access controller engine 3) set up a web configuration environment, as shown in figure 4-2 . Figure 4-2 set up a web configuration environment 4) log in to the switching engine through ie. Launch ie on the web-based network management terminal (your pc) and enter ...

  • Page 43

    4-4 configured by the header command, a user logging in through web directly enters the user login authentication page. Follow these steps to configure the login banner: to do… use the command… remarks enter system view system-view — configure the banner to be displayed when a user logs in through w...

  • Page 44

    4-5 figure 4-5 banner page displayed when a user logs in to the switching engine through web click continue to enter user login authentication page. You will enter the main page of the web-based network management system if the authentication succeeds. Enabling/disabling the web server follow these ...

  • Page 45: Logging In From Nms

    5-1 5 logging in from nms introduction you can also log in to the switching engine from a network management station (nms), and then configure and manage the switching engine through the agent module on the switch. Simple network management protocol (snmp) is applied between the nms and the agent. R...

  • Page 46: Packets

    6-1 6 configuring source ip address for telnet service packets overview you can configure source ip address or source interface for the telnet server and telnet client. This provides a way to manage services and enhances security. The source ip address specified for telnet service packets is the ip ...

  • Page 47

    6-2 to do… use the command… remarks specify a source interface for telnet client telnet source-interface interface-type interface-number optional when configuring a source ip address for telnet packets, ensure that: z the source ip address must be one on the local device. Z the source interface must...

  • Page 48: User Control

    7-1 7 user control refer to the acl part for information about acl. Introduction the switching engine provides ways to control different types of login users, as listed in table 7-1 . Table 7-1 ways to control different types of login users login mode control method implementation reference by sourc...

  • Page 50

    7-3 controlling telnet users by source mac addresses controlling telnet users by source mac addresses is achieved by applying layer 2 acls, which are numbered from 4000 to 4999. Follow these steps to control telnet users by source mac addresses: to do… use the command… remarks enter system view syst...

  • Page 51

    7-4 controlling network management users by source ip addresses you can manage the device through network management software. Network management users can access switching engines through snmp. You need to perform the following two operations to control network management users by source ip address...

  • Page 52

    7-5 you can specify different acls while configuring the snmp community name, snmp group name, and snmp user name. As snmp community name is a feature of snmpv1 and snmpv2c, the specified acls in the command that configures snmp community names (the snmp-agent community command) take effect in the n...

  • Page 53

    7-6 z applying the acl to control web users prerequisites the controlling policy against web users is determined, including the source ip addresses to be controlled and the controlling actions (permitting or denying). Controlling web users by source ip addresses controlling web users by source ip ad...

  • Page 54

    7-7 configuration procedure # define a basic acl. System-view [device] acl number 2030 [device-acl-basic-2030] rule 1 permit source 10.110.100.52 0 [device-acl-basic-2030] quit # apply acl 2030 to only permit the web users sourced from the ip address of 10.110.100.52 to access the switching engine. ...

  • Page 55: Table of Contents

    I table of contents 1 configuration file management···············································································································1-1 introduction to configuration file ···································································································...

  • Page 56

    1-1 1 configuration file management the sample output information in this manual was created on the wx3024. The output information on your device may vary. Introduction to configuration file a configuration file records and stores user configurations performed to the device. It also enables users to...

  • Page 57

    1-2 can configure a file to have both main and backup attribute, but only one file of either main or backup attribute is allowed on a device. The following three situations are concerned with the main/backup attributes: z when saving the current configuration, you can specify the file to be a main o...

  • Page 58

    1-3 z safe mode. This is the mode when you use the save command with the safely keyword. The mode saves the file slower but can retain the original configuration file in the device even if the device reboots or the power fails during the process. The configuration file to be used for next startup ma...

  • Page 60

    1-5 the configuration file must use “.Cfg” as its extension name and the startup configuration file must be saved at the root directory of the device. Displaying and maintaining device configuration to do… use the command… remarks display the initial configuration file saved in the storage device di...

  • Page 61: Table of Contents

    I table of contents 1 vlan overview ··········································································································································1-1 vlan overview·············································································································...

  • Page 62: Vlan Overview

    1-1 1 vlan overview z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may var...

  • Page 63

    1-2 of network layer devices, such as routers and layer 3 switches. Figure 1-1 illustrates a vlan implementation. Figure 1-1 a vlan implementation switch router switch vlan a vlanb vlan a vlanb vlan a vlan b advantages of vlans compared with the traditional ethernet, vlan enjoys the following advant...

  • Page 64

    1-3 figure 1-2 encapsulation format of traditional ethernet frames type data da&sa in figure 1-2 da refers to the destination mac address, sa refers to the source mac address, and type refers to the upper layer protocol type of the packet. Ieee 802.1q protocol defines that a 4-byte vlan tag is encap...

  • Page 65

    1-4 after vlans are configured on a switch, the mac address learning of the switch has the following two modes. Z shared vlan learning (svl): the switch records all the mac address entries learnt by ports in all vlans to a shared mac address forwarding table. Packets received on any port of any vlan...

  • Page 66

    1-5 the link type of a port on the device can be one of the following: access, trunk, and hybrid. For the three types of ports, the process of being added into a vlan and the way of forwarding packets are different. For details, refer to the “port basic configuration” part of the manual. Port-based ...

  • Page 67

    1-6 the switch identifies whether a packet is an ethernet ii packet or an 802.2/802.3 packet according to the ranges of the two fields. Extended encapsulation formats of 802.2/802.3 packets 802.2/802.3 packets have the following three extended encapsulation formats: z 802.3 raw encapsulation: only t...

  • Page 68

    1-7 procedure for the switch to judge packet protocol figure 1-9 procedure for the switch to judge packet protocol receive packets type(length) field ethernet ii encapsulation match the type value invalid packets that cannot be matched 802.2/802.3 encapsulation control field invalid packets that can...

  • Page 69

    1-8 the protocol template is the standard to determine the protocol to which a packet belongs. Protocol templates include standard templates and user-defined templates: z the standard template adopts the rfc-defined packet encapsulation formats and values of some specific fields as the matching crit...

  • Page 70: Vlan Configuration

    2-1 2 vlan configuration vlan configuration configuration task list complete the following tasks to configure vlan: task remarks basic vlan configuration required basic vlan interface configuration optional displaying and maintaining vlan optional basic vlan configuration follow these steps to make ...

  • Page 71

    2-2 basic vlan interface configuration configuration prerequisites before configuring a vlan interface, create the corresponding vlan. Configuration procedure follow these steps to make basic vlan interface configuration: to do… use the command… remarks enter system view system-view — create a vlan ...

  • Page 72

    2-3 configuring a port-based vlan configuring a port-based vlan configuration prerequisites create a vlan before configuring a port-based vlan. Configuration procedure follow these steps to configure a port-based vlan: to do… use the command… remarks enter system view system-view — enter vlan view v...

  • Page 73

    2-4 configuration procedure z configure switch a. # create vlan 101, specify its descriptive string as “dmz”, and add gigabitethernet 1/0/1 to vlan 101. System-view [switcha] vlan 101 [switcha-vlan101] description dmz [switcha-vlan101] port gigabitethernet 1/0/1 [switcha-vlan101] quit # create vlan ...

  • Page 74

    2-5 for the command of configuring a port link type (port link-type) and the command of allowing packets of certain vlans to pass through a port (port trunk permit), refer to the section of configuring ethernet ports in the “port basic configuration” part of this document. Configuring a protocol-bas...

  • Page 75

    2-6 z because the ip protocol is closely associated with the arp protocol, you are recommended to configure the arp protocol type when configuring the ip protocol type and associate the two protocol types with the same port to avoid that arp packets and ip packets are not assigned to the same vlan, ...

  • Page 76

    2-7 for the operation of adding a hybrid port to a vlan in the untagged way (when forwarding a packet, the port removes the vlan tag of the packet), refer to the section of configuring ethernet ports in the “port basic configuration” part of this manual. Displaying and maintaining protocol-based vla...

  • Page 77

    2-8 configuration procedure # create vlan 100 and vlan 200, and add gigabitethernet 1/0/11 and gigabitethernet 1/0/12 to vlan 100 and vlan 200 respectively. System-view [device] vlan 100 [device-vlan100] port gigabitethernet 1/0/11 [device-vlan100] quit [device] vlan 200 [device-vlan200] port gigabi...

  • Page 78

    2-9 vlan id protocol-index protocol-type 100 0 ip 100 1 ethernetii etype 0x0806 200 0 at the above output information indicates that gigabitethernet 1/0/10 has already been associated with the corresponding protocol templates of vlan 100 and vlan 200. Thus, packets from the ip and appletalk workstat...

  • Page 79: Table of Contents

    I table of contents 1 auto detect configuration························································································································1-1 introduction to the auto detect function·························································································...

  • Page 80: Auto Detect Configuration

    1-1 1 auto detect configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your de...

  • Page 81

    1-2 auto detect configuration complete the following tasks to configure auto detect: task remarks auto detect basic configuration required auto detect implementation in static routing optional auto detect implementation in vlan interface backup optional auto detect basic configuration follow these s...

  • Page 82

    1-3 auto detect implementation in static routing you can bind a static route with a detected group. The auto detect function will then detect the reachability of the static route through the path specified in the detected group. Z the static route is valid if the detected group is reachable. Z the s...

  • Page 83

    1-4 to do… use the command… remarks enter system view system-view — enter vlan interface view interface vlan-interface vlan-id — enable the auto detect function to implement vlan interface backup standby detect-group group-number required this operation is only needed on the secondary vlan interface...

  • Page 84

    1-5 system-view # configure a static route to switch a. [switchc] ip route-static 192.168.1.1 24 10.1.1.3 configuration example for auto detect implementation in vlan interface backup network requirements z as shown in figure 1-2 , make sure the routes between switch a, switch b, and switch c, and b...

  • Page 85: Table of Contents

    I table of contents 1 voice vlan configuration························································································································1-1 voice vlan overview···············································································································...

  • Page 86: Voice Vlan Configuration

    1-1 1 voice vlan configuration the sample output information in this manual was created on the wx3024. The output information on your device may vary. Voice vlan overview voice vlans are vlans configured specially for voice traffic. By adding the ports connected with voice devices to voice vlans, yo...

  • Page 87

    1-2 figure 1-1 network diagram for ip phones dhcp server1 dhcp server2 call agent ip phone ② ① ③ as shown in figure 1-1 , the ip phone needs to work in conjunction with the dhcp server and the ncp to establish a path for voice data transmission. An ip phone goes through the following three phases to...

  • Page 88

    1-3 3) after the ip phone acquires the ip address assigned by dhcp server2, the ip phone establishes a connection to the ncp specified by dhcp server1 and downloads corresponding software. After that, the ip phone can communicate properly. Z an untagged packet carries no vlan tag. Z a tagged packet ...

  • Page 89

    1-4 processing mode of untagged packets sent by ip voice devices z automatic mode. A wx3000 device automatically adds a port connecting an ip voice device to the voice vlan by learning the source mac address in the untagged packet sent by the ip voice device when it is powered on. The voice vlan use...

  • Page 90

    1-5 table 1-2 matching relationship between port types and voice traffic types port voice vlan mode voice traffic type port type supported or not access not supported trunk supported make sure the default vlan of the port exists and is not a voice vlan. And the access port permits the traffic of the...

  • Page 91

    1-6 voice vlan configuration configuration prerequisites z create the corresponding vlan before configuring a voice vlan. Z vlan 1 (the default vlan) cannot be configured as a voice vlan. Configuring a voice vlan to operate in automatic mode follow these steps to configure a voice vlan to operate in...

  • Page 92

    1-7 when the voice vlan is working normally, if the device restarts, in order to make the established voice connections work normally, the system does not need to be triggered by the voice traffic to add the port in automatic mode to the local devices of the voice vlan but does so immediately after ...

  • Page 94

    1-9 displaying and maintaining voice vlan to do… use the command… remarks display the information about ports on which voice vlan configuration fails display voice vlan error-info display the voice vlan configuration status display voice vlan status display the currently valid oui addresses display ...

  • Page 95

    1-10 [devicea] voice vlan aging 100 # add a user-defined oui address 0011-2200-000 and set the description string to “test”. [devicea] voice vlan mac-address 0011-2200-0000 mask ffff-ff00-0000 description test # enable the voice vlan function globally. [devicea] voice vlan 2 enable # configure the v...

  • Page 96

    1-11 system-view [devicea] voice vlan security enable # add a user-defined oui address 0011-2200-000 and set the description string to “test”. [devicea] voice vlan mac-address 0011-2200-0000 mask ffff-ff00-0000 description test # create vlan 2 and configure it as a voice vlan. [devicea] vlan 2 [devi...

  • Page 97: Table of Contents

    I table of contents 1 gvrp configuration ··································································································································1-1 introduction to gvrp ········································································································...

  • Page 98: Gvrp Configuration

    1-1 1 gvrp configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device ma...

  • Page 99

    1-2 leave messages, leaveall messages, together with join messages ensure attribute information can be deregistered and re-registered. Through message exchange, all the attribute information to be registered can be propagated to all the garp-enabled switches in the same lan. 2) garp timers timers de...

  • Page 100

    1-3 figure 1-1 format of garp packets ethernet frame pdu da da length dsap ctrl ssap protocol id message 1 message n ... End mark 1 3 n attribute type attribute list 1 2 n attribute 1 attribute n ... End mark 1 n attribute length attribute event attribute vlaue 1 2 3 n garp pdu structure message str...

  • Page 101

    1-4 gvrp as an implementation of garp, garp vlan registration protocol (gvrp) maintains dynamic vlan registration information and propagates the information to the other devices through garp. With gvrp enabled on a device, the vlan registration information received by the device from other devices i...

  • Page 102

    1-5 configuration procedure follow these steps to enable gvrp on an ethernet port: to do… use the command… remarks enter system view system-view — enable gvrp globally gvrp required by default, gvrp is disabled globally. Enter ethernet port view interface interface-type interface-number — enable gvr...

  • Page 103

    1-6 table 1-2 relations between the timers timer lower threshold upper threshold hold 10 centiseconds this upper threshold is less than or equal to one-half of the timeout time of the join timer. You can change the threshold by changing the timeout time of the join timer. Join this lower threshold i...

  • Page 104

    1-7 gvrp configuration example gvrp configuration example network requirements z enable gvrp on all the switches in the network so that the vlan configurations on switch c and switch e can be applied to all switches in the network, thus implementing dynamic vlan information registration and refresh,...

  • Page 105

    1-8 [switcha-gigabitethernet1/0/3] port trunk permit vlan all # enable gvrp on gigabitethernet 1/0/3. [switcha-gigabitethernet1/0/3] gvrp [switcha-gigabitethernet1/0/3] quit 2) configure switch b # the configuration procedure of switch b is similar to that of switch a and is thus omitted. 3) configu...

  • Page 106

    1-9 [switche-gigabitethernet1/0/1] gvrp registration fixed # display the vlan information dynamically registered on switch a. [switcha] display vlan dynamic total 3 dynamic vlan exist(s). The following dynamic vlans exist: 5, 7, 8, # display the vlan information dynamically registered on switch b. [...

  • Page 107: Table of Contents

    I table of contents 1 basic port configuration ··························································································································1-1 ethernet port overview ········································································································...

  • Page 108: Basic Port Configuration

    1-1 1 basic port configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your dev...

  • Page 109

    1-2 link types of ethernet ports an ethernet port of the device can operate in one of the following three link types: z access: an access port can belong to only one vlan, and is generally used to connect user pcs. Z trunk: a trunk port can belong to more than one vlan. It can receive/send packets f...

  • Page 110

    1-3 table 1-3 processing of incoming/outgoing packets processing of an incoming packet port type if the packet does not carry a vlan tag if the packet carries a vlan tag processing of an outgoing packet access z if the vlan id is just the default vlan id, receive the packet. Z if the vlan id is not ...

  • Page 111

    1-4 to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — enable the ethernet port undo shutdown by default, the port is enabled. Use the shutdown command to disable the port. Set the description of the ethernet port desc...

  • Page 113

    1-6 to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — enable flow control on the ethernet port flow-control required by default, flow control is not enabled on a port. Configuring access port attribute follow these st...

  • Page 114

    1-7 to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — set the link type for the port as trunk port link-type trunk required set the default vlan id for the trunk port port trunk pvid vlan vlan-id optional by default, ...

  • Page 115

    1-8 system-view [device] interface gigabitethernet 1/0/1 [device-gigabitethernet1/0/1] shutdown [device-gigabitethernet1/0/1] %apr 2 08:11:14:220 2000 device l2inf/5/port link status change:- 1 - gigabitethernet1/0/1 is down [device-gigabitethernet1/0/1] undo shutdown [device-gigabitethernet1/0/1] %...

  • Page 116

    1-9 configuration command once on one port and that configuration will apply to all ports in the port group. This effectively reduces redundant configurations. A port group could be manually created by users. Multiple ethernet ports can be added to the same port group but one ethernet port can only ...

  • Page 117

    1-10 to do… use the command… remarks configure the system to run loopback detection on all vlans for the trunk and hybrid ports loopback-detection per-vlan enable optional by default, the system runs loopback detection only on the default vlan for the trunk and hybrid ports. Z to enable loopback det...

  • Page 118

    1-11 enabling the system to test connected cable you can enable the system to test the cable connected to a specific port. The test result will be returned in five minutes. The system can test these attributes of the cable: receive and transmit directions (rx and tx), short circuit/open circuit or n...

  • Page 120

    1-13 [device] vlan 100 # configure the default vlan id of gigabitethernet 1/0/1 as 100. [device-gigabitethernet1/0/1] port trunk pvid vlan 100 troubleshooting ethernet port configuration symptom: default vlan id configuration failed. Solution: take the following steps. Z use the display interface or...

  • Page 121: Table of Contents

    I table of contents 1 link aggregation configuration ··············································································································1-1 overview ····························································································································...

  • Page 122

    1-1 1 link aggregation configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on yo...

  • Page 123

    1-2 operation key an operation key of an aggregation port is a configuration combination generated by system depending on the configurations of the port (rate, duplex mode, other basic configuration, and management key) when the port is aggregated. 1) the selected ports in a manual/static aggregatio...

  • Page 124

    1-3 for an aggregation group: z when the rate or duplex mode of a port in the aggregation group changes, packet loss may occur on this port; z when the rate of a port decreases, if the port belongs to a manual or static lacp aggregation group, the port will be switched to the unselected state; if th...

  • Page 125

    1-4 dynamic lacp aggregation group introduction to dynamic lacp aggregation group a dynamic lacp aggregation group is automatically created and removed by the system. Users cannot add/remove ports to/from it. A port can participate in dynamic link aggregation only when it is lacp-enabled. Ports can ...

  • Page 126

    1-5 changing the system priority of a device may change the preferred device between the two parties, and may further change the states (selected or unselected) of the member ports of dynamic aggregation groups. Configuring port priority lacp determines the selected and unselected states of the dyna...

  • Page 127

    1-6 a load-sharing aggregation group contains at least two selected ports, but a non-load-sharing aggregation group can only have one selected port at most, while others are unselected ports. Link aggregation configuration z the commands of link aggregation cannot be configured with the commands of ...

  • Page 128

    1-7 to do… use the command… remarks configure a description for the aggregation group link-aggregation group agg-id description agg-name optional by default, an aggregation group has no description. Enter ethernet port view interface interface-type interface-number — add the ethernet port to the agg...

  • Page 129

    1-8 to do… use the command… remarks configure a description for the aggregation group link-aggregation group agg-id description agg-name optional by default, an aggregation group has no description. Enter ethernet port view interface interface-type interface-number — add the port to the aggregation ...

  • Page 130

    1-9 to do… use the command… remarks enable lacp on the port lacp enable required by default, lacp is disabled on a port. Configure the port priority lacp port-priority port-priority optional by default, the port priority is 32,768. Displaying and maintaining link aggregation to do… use the command… ...

  • Page 131

    1-10 figure 1-1 network diagram for link aggregation configuration switch a link aggregation switch b configuration procedure 1) adopting manual aggregation mode # create manual aggregation group 1. System-view [device] link-aggregation group 1 mode manual # add gigabitethernet 1/0/1 through gigabit...

  • Page 132

    1-11 note that, the three lacp-enabled ports can be aggregated into a dynamic aggregation group to implement load sharing only when they have the same basic configuration (such as rate and duplex mode and so on)..

  • Page 133: Table of Contents

    I table of contents 1 port isolation configuration ·····················································································································1-1 port isolation overview ········································································································...

  • Page 134: Port Isolation Configuration

    1-1 1 port isolation configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your...

  • Page 135

    1-2 z when a member port of an aggregation group is added to an isolation group, the other ports in the same aggregation group are added to the isolation group automatically. Z when a member port of an aggregation group is deleted from an isolation group, the other ports in the same aggregation grou...

  • Page 136

    1-3 system-view system view: return to user view with ctrl+z. [device] interface gigabitethernet1/0/2 [device-gigabitethernet1/0/2] port isolate [device-gigabitethernet1/0/2] quit [device] interface gigabitethernet1/0/3 [device-gigabitethernet1/0/3] port isolate [device-gigabitethernet1/0/3] quit [d...

  • Page 137: Table of Contents

    I table of contents 1 port security configuration······················································································································1-1 port security overview···········································································································...

  • Page 138: Port Security Configuration

    1-1 1 port security configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your ...

  • Page 139

    1-2 port security modes table 1-1 describes the available port security modes. Table 1-1 description of port security modes security mode description feature norestriction port security is disabled on the port and access to the port is not restricted. In this mode, neither the ntk nor the intrusion ...

  • Page 140

    1-3 security mode description feature userloginsecure in this mode, a port performs 802.1x authentication of users and services only one user passing 802.1x authentication at a time. Userloginsecure ext in this mode, a port performs 802.1x authentication of users and services users passing 802.1x au...

  • Page 141

    1-4 port security configuration complete the following tasks to configure port security: task remarks enabling port security required setting the maximum number of mac addresses allowed on a port optional setting the port security mode required configuring the ntk feature configuring intrusion prote...

  • Page 142

    1-5 setting the maximum number of mac addresses allowed on a port port security allows more than one user to be authenticated on a port. The number of authenticated users allowed, however, cannot exceed the configured upper limit. By setting the maximum number of mac addresses allowed on a port, you...

  • Page 144

    1-7 the wx3000 series devices do not support the ntkonly ntk feature. Configuring intrusion protection follow these steps to configure the intrusion protection feature: to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number ...

  • Page 146

    1-9 the security mac addresses manually configured are written to the configuration file; they will not get lost when the port is up or down. As long as the configuration file is saved, the security mac addresses can be restored after the device reboots. Configuration prerequisites z port security i...

  • Page 147

    1-10 z to ensure that host can access the network, add the mac address 0001-0002-0003 of host as a security mac address to the port in vlan 1. Z after the number of security mac addresses reaches 80, the port stops learning mac addresses. If any frame with an unknown mac address arrives, intrusion p...

  • Page 148: Port Binding Configuration

    2-1 2 port binding configuration port binding overview introduction port binding enables the network administrator to bind the mac address and ip address of a user to a specific port. After the binding, the switch forwards only the packets received on the port whose mac address and ip address are id...

  • Page 149

    2-2 port binding configuration example network requirements as shown in figure 2-1 , it is required to bind the mac and ip addresses of host 1 to gigabitethernet 1/0/1 on switch a, so as to prevent malicious users from using the ip address they steal from host 1 to access the network. Figure 2-1 net...

  • Page 150: Table of Contents

    I table of contents 1 dldp configuration ··································································································································1-1 dldp overview················································································································...

  • Page 151: Dldp Configuration

    1-1 1 dldp configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device ma...

  • Page 152

    1-2 figure 1-2 fiber correct connection/disconnection in one direction ge1/0/10 switcha ge1/0/11 ge1/0/10 switchb ge1/0/11 pc dldp provides the following features: z as a link layer protocol, it works together with the physical layer protocols to monitor the link status of a device. While the auto-n...

  • Page 153

    1-3 status description probe dhcp sends packets to check if it is a unidirectional link. It enables the probe sending timer and an echo waiting timer for each target neighbor. Disable dldp detects a unidirectional link, or finds (in enhanced mode) that a neighbor disappears. In this case, dldp does ...

  • Page 154

    1-4 timer description enhanced timer in enhanced mode, if no packet is received from the neighbor when the entry aging timer expires, dldp enables the enhanced timer for the neighbor. The timeout time for the enhanced timer is 10 seconds. The enhanced timer then sends one probe packets every one sec...

  • Page 155

    1-5 table 1-4 types of packets sent by dldp dldp status packet types active advertisement packets, including those with or without rsy tags advertisement advertisement packets probe probe packets 2) dldp analyzes and processes received packets as follows: z in authentication mode, dldp authenticates...

  • Page 156

    1-6 dldp neighbor state a dldp neighbor can be in one of these two states: two way and unknown. You can check the state of a dldp neighbor by using the display dldp command. Table 1-7 description on the two dldp neighbor states dldp neighbor state description two way the link to the neighbor operate...

  • Page 158

    1-8 to do… use the command… remarks enter system view system-view reset the dldp status of the system dldp reset enter ethernet port view interface interface-type interface-number reset the dldp status of a port dldp reset optional this command only applies to the ports in dldp down status. Dldp net...

  • Page 159

    1-9 [switcha-gigabitethernet1/0/11] duplex full [switcha-gigabitethernet1/0/11] speed 1000 [switcha-gigabitethernet1/0/11] quit # enable dldp globally [switcha] dldp enable dldp is enabled on all fiber ports except fabric ports. # set the interval of sending dldp packets to 15 seconds [switcha] dldp...

  • Page 160: Table of Contents

    I table of contents 1 mac address table management············································································································1-1 overview ·································································································································...

  • Page 161: Mac Address Table Management

    1-1 1 mac address table management z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your...

  • Page 162

    1-2 1) as shown in figure 1-1 , user a and user b are both in vlan 1. When user a communicates with user b, the packet from user a needs to be transmitted to gigabitethernet 1/0/1. At this time, the device records the source mac address of the packet, that is, the address “mac-a” of user a to the ma...

  • Page 163

    1-3 figure 1-4 mac address learning diagram (3) geth 1/0/1 geth 1/0/3 geth 1/0/4 user a user b user c 4) at this time, the mac address table of the device includes two forwarding entries shown in figure 1-5 . When forwarding the response packet, the device unicasts the packet instead of broadcasting...

  • Page 164

    1-4 aging timer only takes effect on dynamic mac address entries. Entries in a mac address table entries in a mac address table fall into the following categories according to their characteristics and configuration methods: z static mac address entry: also known as permanent mac address entry. This...

  • Page 165

    1-5 configuring a mac address entry you can add, modify, or remove a mac address entry, remove all mac address entries concerning a specific port, or remove specific type of mac address entries (dynamic or static mac address entries). You can add a mac address entry in either system view or ethernet...

  • Page 166

    1-6 setting the aging time of mac address entries setting aging time properly helps effective utilization of mac address aging. The aging time that is too long or too short affects the performance of the device. Z if the aging time is too long, excessive invalid mac address entries maintained by the...

  • Page 167

    1-7 to do… use the command… remarks set the maximum number of mac addresses the port can learn mac-address max-mac-count count required by default, the number of the mac addresses a port can learn is not limited. Specifying the maximum number of mac addresses a port can learn disables centralized ma...

  • Page 168

    1-8 displaying and maintaining mac address table to do… use the command… remarks display information about the mac address table display mac-address [ display-option ] display the aging time of the dynamic mac address entries in the mac address table display mac-address aging-time the display comman...

  • Page 169: Table of Contents

    I table of contents 1 mstp configuration ··································································································································1-1 stp overview ················································································································...

  • Page 170

    Ii configuring root guard·················································································································1-37 configuring loop guard ················································································································1-38 configuring tc-bp...

  • Page 171: Mstp Configuration

    1-1 1 mstp configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device ma...

  • Page 172

    1-2 upon network convergence, the root bridge generates and sends out configuration bpdus periodically. Other devices just forward the configuration bpdus received. This mechanism ensures the topological stability. 2) root port on a non-root bridge device, the root port is the port with the lowest p...

  • Page 173

    1-3 4) path cost path cost is a value used for measuring link capacity. By comparing the path costs of different links, stp selects the most robust links and blocks the other links to prune the network into a tree. How stp works stp identifies the network topology by transmitting configuration bpdus...

  • Page 174

    1-4 step description 2 the device compares the configuration bpdus of all the ports and chooses the optimum configuration bpdu. Principle for configuration bpdu comparison: z the configuration bpdu that has the lowest root bridge id has the highest priority. Z if all the configuration bpdus have the...

  • Page 175

    1-5 when the network topology is stable, only the root port and designated ports forward traffic, while other ports are all in the blocked state – they only receive stp packets but do not forward user traffic. Once the root bridge, the root port on each non-root bridge and designated ports have been...

  • Page 176

    1-6 table 1-5 comparison process and result on each device device comparison process bpdu of port after comparison device a z port ap1 receives the configuration bpdu of device b {1, 0, 1, bp1}. Device a finds that the configuration bpdu of the local port {0, 0, 0, ap1} is superior to the configurat...

  • Page 177

    1-7 device comparison process bpdu of port after comparison z port cp1 receives the configuration bpdu of device a {0, 0, 0, ap2}. Device c finds that the received configuration bpdu is superior to the configuration bpdu of the local port {2, 0, 2, cp1}, and updates the configuration bpdu of cp1. Z ...

  • Page 178

    1-8 figure 1-3 the final calculated spanning tree ap 1 ap 2 device a with priority 0 device b device c bp 1 bp 2 cp 2 5 4 with priority 1 with priority 2 to facilitate description, the spanning tree calculation process in this example is simplified, while the actual process is more complicated. 2) t...

  • Page 179

    1-9 for this reason, the protocol uses a state transition mechanism. Namely, a newly elected root port and the designated ports must go through a period, which is twice the forward delay time, before they transit to the forwarding state. The period allows the new configuration bpdus to be propagated...

  • Page 180

    1-10 z mstp supports mapping vlans to mst instances by means of a vlan-to-instance mapping table. Mstp introduces “instance” (integrates multiple vlans into a set) and can bind multiple vlans to an instance, thus saving communication overhead and improving resource utilization. Z mstp divides a swit...

  • Page 181

    1-11 msti a multiple spanning tree instance (msti) refers to a spanning tree in an mst region. Multiple spanning trees can be established in one mst region. These spanning trees are independent of each other. For example, each region in figure 1-4 contains multiple spanning trees known as mstis. Eac...

  • Page 182

    1-12 z a region edge port is located on the edge of an mst region and is used to connect one mst region to another mst region, an stp-enabled region or an rstp-enabled region z an alternate port is a secondary port of a root port or master port and is used for rapid transition. With the root port or...

  • Page 183

    1-13 z forwarding state. Ports in this state can forward user packets and receive/send bpdu packets. Z learning state. Ports in this state can receive/send bpdu packets. Z discarding state. Ports in this state can only receive bpdu packets. Port roles and port states are not mutually dependent. Tabl...

  • Page 184

    1-14 for mstp, cist configuration information is generally expressed as follows: (root bridge id, external path cost, master bridge id, internal path cost, designated bridge id, id of sending port, id of receiving port), so the compared as follows z the smaller the root bridge id of the configuratio...

  • Page 185

    1-15 z bpdu guard z loop guard z tc-bpdu attack guard z bpdu packet drop stp-related standards stp-related standards include the following. Z ieee 802.1d: spanning tree protocol z ieee 802.1w: rapid spanning tree protocol z ieee 802.1s: multiple spanning tree protocol configuring root bridge complet...

  • Page 186

    1-16 in a network containing devices with both gvrp and mstp enabled, gvrp packets are forwarded along the cist. If you want to advertise packets of a specific vlan through gvrp, be sure to map the vlan to the cist when configuring the mstp vlan mapping table (the cist of a network is spanning tree ...

  • Page 187

    1-17 configuring mst region-related parameters (especially the vlan mapping table) results in spanning tree recalculation and network topology jitter. To reduce network topology jitter caused by the configuration, mstp does not recalculate spanning trees immediately after the configuration; it does ...

  • Page 188

    1-18 to do… use the command… remarks enter system view system-view — specify the current device as the root bridge of a spanning tree stp [ instance instance-id ] root primary [ bridge-diameter bridgenumber [ hello-time centi-seconds ] ] required specify the current device as the secondary root brid...

  • Page 189

    1-19 z you can configure a device as the root bridges of multiple spanning tree instances. But you cannot configure two or more root bridges for one spanning tree instance. So, do not configure root bridges for the same spanning tree instance on two or more devices using the stp root primary command...

  • Page 190

    1-20 configuration example # set the bridge priority of the current device to 4,096 in spanning tree instance 1. System-view [device] stp instance 1 priority 4096 configuring the mode a port recognizes and sends mstp packets a port can be configured to recognize and send mstp packets in the followin...

  • Page 192

    1-22 configuration example # specify the mstp operation mode as stp-compatible. System-view [device] stp mode stp configuring the maximum hop count of an mst region the maximum hop count configured on the region root is also the maximum hops of the mst region. The value of the maximum hop count limi...

  • Page 193

    1-23 to do… use the command… remarks enter system view system-view — configure the network diameter of the switched network stp bridge-diameter bridgenumber required the default network diameter of a network is 7. The network diameter parameter indicates the size of a network. The bigger the network...

  • Page 194

    1-24 z the forward delay parameter and the network diameter are correlated. Normally, a large network diameter corresponds to a large forward delay. A too small forward delay parameter may result in temporary redundant paths. And a too large forward delay parameter may cause a network unable to resu...

  • Page 195

    1-25 configuration procedure follow these steps to configure the timeout time factor: to do… use the command… remarks enter system view system-view — configure the timeout time factor for the device stp timer-factor number required the timeout time factor defaults to 3. For a steady network, the tim...

  • Page 196

    1-26 configuration example # set the maximum transmitting speed of gigabitethernet 1/0/1 to 15. 1) configure the maximum transmitting speed in system view system-view [device] stp interface gigabitethernet1/0/1 transmit-limit 15 2) configure the maximum transmitting speed in ethernet port view syste...

  • Page 197

    1-27 you are recommended to configure the ethernet ports connected directly to terminals as edge ports and enable the bpdu guard function at the same time. This not only enables these ports to turn to the forwarding state rapidly but also secures your network. Configuration example # configure gigab...

  • Page 199

    1-29 to do… use the command… remarks enter system view system-view — enable mstp stp enable required mstp is disabled by default. Enter ethernet port view interface interface-type interface-number — disable mstp on the port stp disable optional by default, mstp is enabled on all ports after you enab...

  • Page 200

    1-30 task remarks configuring the mode a port recognizes and sends mstp packets optional configuring the timeout time factor optional configuring the maximum transmitting speed on the current port optional the default value is recommended. Configuring the current port as an edge port optional config...

  • Page 201

    1-31 configuring the path cost for a port the path cost parameter reflects the rate of the link connected to the port. For a port on an mstp-enabled device, the path cost may be different in different spanning tree instances. You can enable flows of different vlans to travel along different physical...

  • Page 202

    1-32 when calculating the path cost of an aggregated link, the 802.1d-1998 standard does not take the number of the ports on the aggregated link into account, whereas the 802.1t standard does. The following formula is used to calculate the path cost of an aggregated link: path cost = 200,000/ link t...

  • Page 203

    1-33 [device] stp pathcost-standard dot1d-1998 2) perform this configuration in ethernet port view system-view [device] interface gigabitethernet1/0/1 [device-gigabitethernet1/0/1] undo stp instance 1 cost [device-gigabitethernet1/0/1] quit [device] stp pathcost-standard dot1d-1998 configuring port ...

  • Page 204

    1-34 [device] stp interface gigabitethernet1/0/1 instance 1 port priority 16 2) perform this configuration in ethernet port view system-view [device] interface gigabitethernet1/0/1 [device-gigabitethernet1/0/1] stp instance 1 port priority 16 specifying whether the link connected to a port is a poin...

  • Page 205

    1-35 to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — perform the mcheck operation stp mcheck required configuration example # perform the mcheck operation on gigabitethernet 1/0/1. 1) perform this configuration in s...

  • Page 206

    1-36 loop guard a device maintains the states of the root port and other blocked ports by receiving and processing bpdus from the upstream device. These bpdus may get lost because of network congestions or unidirectional link failures. If a device does not receive bpdus from the upstream device for ...

  • Page 207

    1-37 configuration prerequisites mstp runs normally on the device. Configuring bpdu guard configuration procedure follow these steps to configure bpdu guard: to do… use the command… remarks enter system view system-view — enable the bpdu guard function stp bpdu-protection required the bpdu guard fun...

  • Page 208

    1-38 2) perform this configuration in ethernet port view system-view [device] interface gigabitethernet1/0/1 [device-gigabitethernet1/0/1] stp root-protection configuring loop guard configuration procedure follow these steps to configure loop guard: to do… use the command… remarks enter system view ...

  • Page 209

    1-39 # set the maximum times for the device to remove the mac address table within 10 seconds to 5. System-view [device] stp tc-protection threshold 5 configuring bpdu dropping follow these steps to configure bpdu dropping: to do… use the command… remarks enter system view system-view — enter ethern...

  • Page 210

    1-40 configuring digest snooping configure the digest snooping feature on a device to enable it to communicate with other devices adopting proprietary protocols to calculate configuration digests in the same mst region through mstis. Configuration prerequisites the device to be configured is connect...

  • Page 211

    1-41 z when the digest snooping feature is enabled on a port, the port state turns to the discarding state. That is, the port will not send bpdu packets. The port is not involved in the stp calculation until it receives bpdu packets from the peer port. Z the digest snooping feature is needed only wh...

  • Page 212

    1-42 figure 1-6 the rstp rapid transition mechanism figure 1-7 the mstp rapid transition mechanism the cooperation between mstp and rstp is limited in the process of rapid transition. For example, when the upstream device adopts rstp, the downstream device adopts mstp and the downstream device does ...

  • Page 213

    1-43 configuring rapid transition configuration prerequisites as shown in figure 1-8 , a wx3000 series device is connected to a device of another vendor. The former operates as the downstream device, and the latter operates as the upstream device. The network operates normally. The upstream device i...

  • Page 214

    1-44 z the rapid transition feature can be enabled on only root ports or alternate ports. Z if you configure the rapid transition feature on a designated port, the feature does not take effect on the port. Configuring vlan-vpn tunnel introduction the vlan-vpn tunnel function enables stp packets to b...

  • Page 215

    1-45 to do… use the command… remarks enter ethernet port view interface interface-type interface-number make sure that you enter the ethernet port view of the port for which you want to enable the vlan-vpn tunnel function. Enable the vlan vpn function for the ethernet port vlan-vpn enable required b...

  • Page 216

    1-46 [device] stp portlog all enabling trap messages conforming to 802.1d standard the device sends trap messages conforming to 802.1d standard to the network management device in the following two cases: z the device becomes the root bridge of an instance. Z network topology changes are detected. C...

  • Page 217

    1-47 mstp configuration example network requirements implement mstp in the network shown in figure 1-10 to enable packets of different vlans to be forwarded along different spanning tree instances. The detailed configurations are as follows: z all switches in the network belong to the same mst regio...

  • Page 218

    1-48 [switcha] stp instance 1 root primary 2) configure switch b # enter mst region view. System-view [switchb] stp region-configuration # configure the region name, vlan-to-msti mapping table, and revision level for the mst region. [switchb-mst-region] region-name example [switchb-mst-region] insta...

  • Page 219

    1-49 vlan-vpn tunnel configuration example network requirements as shown in figure 1-11 : z the wx3000 series devices operate as the access devices of the operator’s network, that is, switch c and switch d in the network diagram. Z devices of other series operate as the access devices of the user’s ...

  • Page 220

    1-50 [switchc] stp enable # enable the vlan-vpn tunnel function. [switchc] vlan-vpn tunnel # add gigabitethernet 1/0/1 to vlan 10. [switchc] vlan 10 [switchc-vlan10] port gigabitethernet1/0/1 [switchc-vlan10] quit # disable stp on gigabitethernet 1/0/1 and then enable the vlan vpn function on it. [s...

  • Page 221: Table of Contents

    I table of contents 1 802.1x configuration ·································································································································1-1 introduction to 802.1x······································································································...

  • Page 222: 802.1X Configuration

    1-1 1 802.1x configuration the sample output information in this manual was created on the wx3024. The output information on your device may vary. Introduction to 802.1x the 802.1x protocol (802.1x for short) was developed by ieee802 lan/wan committee to address security issues of wireless lans. It ...

  • Page 223

    1-2 z the authenticator system, residing at the other end of the lan segment link, is the entity that authenticates the connected supplicant system. The authenticator system is usually an 802.1x-supported network device. It provides ports (physical or logical) for the supplicant system to access the...

  • Page 224

    1-3 the mechanism of an 802.1x authentication system ieee 802.1x authentication uses the extensible authentication protocol (eap) to exchange information between supplicant systems and the authentication servers. To be compatible with 802.1x in a lan environment, the client program must support the ...

  • Page 225

    1-4 03: indicates that the packet is an eapol-key packet, which carries key information. 04: indicates that the packet is an eapol-encapsulated-asf-alert packet, which is used to support the alerting messages of asf (alerting standards forum). Z the length field indicates the size of the packet body...

  • Page 226

    1-5 fields added for eap authentication two fields, eap-message and message-authenticator, are added to a radius protocol packet for eap authentication. (refer to the introduction to radius protocol section in the aaa operation manual for information about the format of a radius protocol packet.) th...

  • Page 227

    1-6 z eap-ttls is a kind of extended eap-tls. Eap-tls implements bidirectional authentication between the client and authentication server. Eap-ttls transmit message using a tunnel established using tls. Z peap creates and uses tls security channels to ensure data integrity and then performs new eap...

  • Page 228

    1-7 password using a randomly-generated key, and sends the key to the device through an radius access-challenge packet. The device then sends the key to the inode client. Z upon receiving the key (encapsulated in an eap-request/md5 challenge packet) from the device, the client program encrypts the p...

  • Page 229

    1-8 figure 1-9 802.1x authentication procedure (in eap terminating mode) supplicant system pae authenticator system pae radius server eapol radius eapol- start eap- request /identity eap- response /identity eap- request / md5 challenge eap- success eap- response /md5 challenge radius access-request ...

  • Page 230

    1-9 z radius server timer (server-timeout). This timer sets the server-timeout period. After sending an authentication request packet to the radius server, the device sends another authentication request packet if it does not receive the response from the radius server when this timer times out. Z s...

  • Page 231

    1-10 this function needs the cooperation of inode client and a imc server. Z the inode client needs to capable of detecting multiple network adapters, proxies, and ie proxies. Z the imc server is configured to disable the use of multiple network adapters, proxies, or ie proxies. By default, an inode...

  • Page 232

    1-11 refer to aaa operation manual for detailed information about the dynamic vlan delivery function. Enabling 802.1x re-authentication 802.1x re-authentication is timer-triggered or packet-triggered. It re-authenticates users who have passed authentication. With 802.1x re-authentication enabled, th...

  • Page 233

    1-12 figure 1-11 802.1x configuration isp domain configuration aaa scheme local authentication radius scheme 802.1x configuration isp domain configuration aaa scheme local authentication radius scheme 802.1x configuration z an 802.1x user uses the domain name to associate with the isp domain configu...

  • Page 234

    1-13 to do… use the command… remarks in system view dot1x [ interface interface-list ] interface interface-type interface-number dot1x enable 802.1x for specified ports in port view quit required by default, 802.1x is disabled on all ports. Set port authorization mode for specified ports dot1x port-...

  • Page 235

    1-14 z 802.1x configurations take effect only after you enable 802.1x both globally and for specified ports. Z if you enable 802.1x for a port, you cannot set the maximum number of mac addresses that can be learnt for the port. Meanwhile, if you set the maximum number of mac addresses that can be le...

  • Page 238

    1-17 as for the dot1x version-user command, if you execute it in system view without specifying the interface-list argument, the command applies to all ports. You can also execute this command in port view. In this case, this command applies to the current port only and the interface-list argument i...

  • Page 239

    1-18 configuring 802.1x re-authentication follow these steps to enable 802.1x re-authentication: to do… use the command… remarks enter system view system-view — enable 802.1x globally dot1x required by default, 802.1x is disabled globally. In system view dot1x [ interface interface-list ] enable 802...

  • Page 240

    1-19 follow these steps to configure the re-authentication interval: to do… use the command… remarks enter system view system-view — configure a re-authentication interval dot1x timer reauth-period reauth-period-value optional by default, the re-authentication interval is 3,600 seconds. Displaying a...

  • Page 241

    1-20 figure 1-12 network diagram for aaa configuration with 802.1x and radius enabled configuration procedure following configuration covers the major aaa/radius configuration commands. Refer to aaa operation manual for the information about these commands. Configuration on the client and the radius...

  • Page 242

    1-21 [device-radius-radius1] key accounting money # set the interval and the number of the retries for the switch to send packets to the radius servers. [device-radius-radius1] timer 5 [device-radius-radius1] retry 5 # set the timer for the switch to send real-time accounting packets to the radius s...

  • Page 243

    2-1 2 quick ead deployment configuration introduction to quick ead deployment quick ead deployment overview as an integrated solution, an endpoint admission defense (ead) solution can improve the overall defense power of a network. In real applications, however, deploying ead clients proves to be ti...

  • Page 244

    2-2 configuration procedure configuring a free ip range a free ip range is an ip range that users can access before passing 802.1x authentication. Follow these steps to configure a free ip range: to do… use the command… remarks enter system view system-view — configure the url for http redirection d...

  • Page 245

    2-3 follow these steps to configure the acl timer: to do… use the command… remarks enter system view system-view — set the acl timer dot1x timer acl-timeout acl-timeout-value required by default, the acl timeout period is 30 minutes. Displaying and maintaining quick ead deployment to do… use the com...

  • Page 246

    2-4 configuration procedure before enabling quick ead deployment, make sure that: z the web server is configured properly. Z the default gateway of the pc is configured as the ip address of the layer-3 virtual interface of the vlan to which the port that is directly connected with the pc belongs. # ...

  • Page 247: System-Guard Configuration

    3-1 3 system-guard configuration system-guard overview at first, you must determine whether the cpu is under attack to implement system guard for the cpu. You should not determine whether the cpu is under attack just according to whether congestion occurs in a queue. Instead, you must do that in the...

  • Page 248

    3-2 displaying and maintaining system-guard to do… use the command… remarks display the record of detected attacks display system-guard attack-record available in any view display the state of the system-guard feature display system-guard state available in any view.

  • Page 249: Table of Contents

    I table of contents 1 aaa overview ············································································································································1-1 introduction to aaa ·····································································································...

  • Page 250

    Ii troubleshooting aaa ····························································································································2-30 troubleshooting radius configuration························································································2-30 troubleshooting hwt...

  • Page 251: Aaa Overview

    1-1 1 aaa overview the sample output information in this manual was created on the wx3024. The output information on your device may vary. Introduction to aaa aaa is the acronym for the three security functions: authentication, authorization and accounting. It provides a uniform framework for you to...

  • Page 252

    1-2 z local authorization: users are authorized according to the related attributes configured for their local accounts on this device. Z radius authorization: users are authorized after they pass radius authentication. In radius protocol, authentication and authorization are combined together, and ...

  • Page 253

    1-3 z the radius server receives user connection requests, authenticates users, and returns all required information to the device. Generally, a radius server maintains the following three databases (see figure 1-1 ): z users: this database stores information about users (such as user name, password...

  • Page 254

    1-4 2) the radius client receives the user name and password, and then sends an authentication request (access-request) to the radius server. 3) the radius server compares the received user information with that in the users database to authenticate the user. If the authentication succeeds, the radi...

  • Page 255

    1-5 code message type message description 3 access-reject direction: server->client. The server transmits this message to the client if any attribute value carried in the access-request message is unacceptable (that is, the user fails the authentication). 4 accounting-requ est direction: client->ser...

  • Page 256

    1-6 type field value attribute type type field value attribute type 8 framed-ip-address 30 called-station-id 9 framed-ip-netmask 31 calling-station-id 10 framed-routing 32 nas-identifier 11 filter-id 33 proxy-state 12 framed-mtu 34 login-lat-service 13 framed-compression 35 login-lat-node 14 login-i...

  • Page 257

    1-7 compared with radius, hwtacacs provides more reliable transmission and encryption, and therefore is more suitable for security control. Table 1-3 lists the primary differences between hwtacacs and radius. Table 1-3 differences between hwtacacs and radius hwtacacs radius adopts tcp, providing mor...

  • Page 258

    1-8 figure 1-6 aaa implementation procedure for a telnet user tacacs server user tacacs client requests to log in authentication start request authentication response , requesting username requests username enters username authentication continuous message , carrying username authentication response...

  • Page 259

    1-9 9) after receiving the response indicating an authorization success, the tacacs client pushes the configuration interface of the device to the user. 10) the tacacs client sends an accounting start request to the tacacs server. 11) the tacacs server returns an accounting response, indicating that...

  • Page 260: Aaa Configuration

    2-1 2 aaa configuration aaa configuration task list configuration introduction you need to configure aaa to provide network access services for legal users while protecting network devices and preventing unauthorized access and repudiation behavior. Complete the following tasks to configure a combin...

  • Page 261

    2-2 task remarks creating an isp domain and configuring its attributes required configuring separate aaa schemes required configuring an aaa scheme for an isp domain required z with separate aaa schemes, you can specify authentication, authorization and accounting schemes respectively. Z you need to...

  • Page 263

    2-4 this way, you cannot specify different schemes for authentication, authorization and accounting respectively. Follow these steps to configure a combined aaa scheme: to do… use the command… remarks enter system view system-view — create an isp domain and enter its view, or enter the view of an ex...

  • Page 264

    2-5 you can use an arbitrary combination of the above implementations for your aaa scheme configuration. 2) for ftp users only authentication is supported for ftp users. Authentication: radius, local, or hwtacacs. Follow these steps to configure separate aaa schemes: to do… use the command… remarks ...

  • Page 265

    2-6 upon receiving an integer id assigned by the radius authentication server, the device adds the port to the vlan whose vlan id is equal to the assigned integer id. If no such a vlan exists, the device first creates a vlan with the assigned id, and then adds the port to the newly created vlan. Z s...

  • Page 267

    2-8 z the following characters are not allowed in the user-name string: /:*?. And you cannot input more than one “@” in the string. Z after the local-user password-display-mode cipher-force command is executed, any password will be displayed in cipher mode even though you specify to display a user p...

  • Page 268

    2-9 complete the following tasks configure radius for the device functioning as a radius client: task remarks creating a radius scheme required configuring radius authentication/authorization servers required configuring radius accounting servers required configuring shared keys for radius messages ...

  • Page 269

    2-10 secondary servers with the same configuration but different ip addresses) in a radius scheme. After creating a new radius scheme, you should configure the ip address and udp port number of each radius server you want to use in this scheme. These radius servers fall into two types: authenticatio...

  • Page 270

    2-11 to do… use the command… remarks enter system view system-view — create a radius scheme and enter its view radius scheme radius-scheme-name required by default, a radius scheme named "system" has already been created in the system. Set the ip address and port number of the primary radius authent...

  • Page 271

    2-12 to do… use the command… remarks set the ip address and port number of the secondary radius accounting server secondary accounting ip-address [ port-number ] optional by default, the ip address and udp port number of the secondary accounting server are 0.0.0.0 and 1813 for a newly created radius...

  • Page 272

    2-13 received from each other by using the shared keys that have been set on them, and can accept and respond to the messages only when both parties have the same shared key. Follow these steps to configure shared keys for radius messages: to do… use the command… remarks enter system view system-vie...

  • Page 273

    2-14 to do… use the command… remarks enter system view system-view — create a radius scheme and enter its view radius scheme radius-scheme-name required by default, a radius scheme named "system" has already been created in the system. Configure the type of radius servers to be supported server-type...

  • Page 275

    2-16 z generally, the access users are named in the userid@isp-name or userid.Isp-name format. Here, isp-name after the “@” or “.” character represents the isp domain name, by which the device determines which isp domain a user belongs to. However, some old radius servers cannot accept the user name...

  • Page 276

    2-17 z if you adopt the local radius authentication server function, the udp port number of the authentication/authorization server must be 1645, the udp port number of the accounting server must be 1646, and the ip addresses of the servers must be set to the addresses of this device. Z the message ...

  • Page 277

    2-18 to do… use the command… remarks set the response timeout time of radius servers timer response-timeout seconds optional by default, the response timeout time of radius servers is three seconds. Set the time that the device waits before it try to re-communicate with primary server and restore th...

  • Page 278

    2-19 online when the user re-logs into the switching engine before the imc performs online user detection, and the user cannot get authenticated. In this case, the user can access the network again only when the imc administrator manually removes the user's online information. The user re-authentica...

  • Page 279

    2-20 task remarks creating a hwtacacs scheme required configuring tacacs authentication servers required configuring tacacs authorization servers required configuring tacacs accounting servers optional configuring shared keys for radius messages optional configuring the attributes of data to be sent...

  • Page 280

    2-21 to do… use the command… remarks set the ip address and port number of the primary tacacs authentication server primary authentication ip-address [ port ] required by default, the ip address of the primary authentication server is 0.0.0.0, and the port number is 0. Set the ip address and port nu...

  • Page 281

    2-22 z you are not allowed to configure the same ip address for both primary and secondary authorization servers. If you do this, the system will prompt that the configuration fails. Z you can remove a server only when it is not used by any active tcp connection for sending authorization messages. C...

  • Page 282

    2-23 the tacacs client and server adopt md5 algorithm to encrypt hwtacacs messages before they are exchanged between the two parties. The two parties verify the validity of the hwtacacs messages received from each other by using the shared keys that have been set on them, and can accept and respond ...

  • Page 283

    2-24 generally, the access users are named in the userid@isp-name or userid.Isp-name format. Where, isp-name after the “@” or “.” character represents the isp domain name. If the tacacs server does not accept the user names that carry isp domain names, it is necessary to remove domain names from use...

  • Page 285

    2-26 displaying and maintaining hwtacacs protocol information to do… use the command… remarks display the configuration or statistic information about one specific or all hwtacacs schemes display hwtacacs [ hwtacacs-scheme-name [ statistics ] ] display buffered non-response stop-accounting requests ...

  • Page 286

    2-27 figure 2-1 remote radius authentication of telnet users internet telnet user authentication server 10. 110.91. 164 configuration procedure # enter system view. System-view # adopt aaa authentication for telnet users. [device] user-interface vty 0 4 [device-ui-vty0-4] authentication-mode scheme ...

  • Page 287

    2-28 local authentication of ftp/telnet users the configuration procedure for local authentication of ftp users is similar to that for telnet users. The following text only takes telnet users as example to describe the configuration procedure for local authentication. Network requirements in the net...

  • Page 288

    2-29 z change the server ip address, and the udp port number of the authentication server to 127.0.0.1, and 1645 respectively in the configuration step "configure a radius scheme" in remote radius authentication of telnet/ssh users z enable the local radius server function, set the ip address and sh...

  • Page 289

    2-30 troubleshooting aaa troubleshooting radius configuration the radius protocol operates at the application layer in the tcp/ip protocol suite. This protocol prescribes how the device and the radius server of the isp exchange user information with each other. Symptom 1: user authentication/authori...

  • Page 290: Ead Configuration

    3-1 3 ead configuration introduction to ead endpoint admission defense (ead) is an attack defense solution. Using this solution, you can enhance the active defense capability of network endpoints, prevents viruses and worms from spreading on the network, and protects the entire network by limiting t...

  • Page 291

    3-2 after the client is patched and compliant with the required security standard, the security policy server reissues an acl to the device, which then assigns access right to the client so that the client can access more network resources. Ead configuration the ead configuration includes: z configu...

  • Page 292

    3-3 figure 3-2 ead configuration ge 1/0 /1 internet user security policy servers 10.110.91.166 virus patch servers 10.110.91.168 authentication servers 10 .110 .91.164 configuration procedure # configure 802.1x on the device. Refer to the section ”configuring 802.1x” of 802.1x configuration. # confi...

  • Page 293: Table of Contents

    I table of contents 1 mac authentication configuration··········································································································1-1 mac authentication overview ············································································································...

  • Page 294

    1-1 1 mac authentication configuration the sample output information in this manual was created on the wx3024. The output information on your device may vary. Mac authentication overview mac authentication provides a way for authenticating users based on ports and mac addresses, without requiring an...

  • Page 295

    1-2 included depending on the format configured with the mac-authentication authmode usernameasmacaddress usernameformat command; otherwise, the authentication will fail. Z if the username type is fixed username, you need to configure the fixed username and password on the device, which are used by ...

  • Page 296

    1-3 to do… use the command… remarks in system view mac-authentication interface interface-list interface interface-type interface-number mac-authentication enable mac authentication for the specified port(s) or the current port in interface view quit use either method disabled by default set the use...

  • Page 297

    1-4 mac address authentication enhanced function configuration mac address authentication enhanced function configuration tasks complete the following tasks to configure mac address authentication enhanced function: task remarks configuring a guest vlan optional configuring the maximum number of mac...

  • Page 298

    1-5 z guest vlans are implemented in the mode of adding a port to a vlan. For example, when multiple users are connected to a port, if the first user fails in the authentication, the other users can access only the contents of the guest vlan. The device will re-authenticate only the first user acces...

  • Page 299

    1-6 z if more than one client is connected to a port, you cannot configure a guest vlan for this port. Z when a guest vlan is configured for a port, only one mac address authentication user can access the port. Even if you set the limit on the number of mac address authentication users to more than ...

  • Page 300

    1-7 z if both the limit on the number of mac address authentication users and the limit on the number of users configured in the port security function are configured for a port, the smaller value of the two configured limits is adopted as the maximum number of mac address authentication users allow...

  • Page 301

    1-8 # add a local user. Z specify the username and password. [device] local-user 00-0d-88-f6-44-c1 [device-luser-00-0d-88-f6-44-c1] password simple 00-0d-88-f6-44-c1 z set the service type to “lan-access”. [device-luser-00-0d-88-f6-44-c1] service-type lan-access [device-luser-00-0d-88-f6-44-c1] quit...

  • Page 302: Table of Contents

    I table of contents 1 ip addressing configuration····················································································································1-1 ip addressing overview·············································································································...

  • Page 303: Ip Addressing Configuration

    1-1 z the term switch used throughout this document refers to a switching device in a generic sense or the switching engine of the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. 1 ip addressing configuration ip...

  • Page 304

    1-2 table 1-1 ip address classes and ranges class address range remarks a 0.0.0.0 to 127.255.255.255 address 0.0.0.0 means this host no this network. This address is used by a host at bootstrap when it does not know its ip address. This address is never a valid destination address. Addresses startin...

  • Page 305

    1-3 adds an additional level, subnet id, to the two-level hierarchy with ip addressing, ip routing now involves three steps: delivery to the site, delivery to the subnet, and delivery to the host. In the absence of subnetting, some special addresses such as the addresses with the net id of all zeros...

  • Page 306

    1-4 z you can assign at most two ip address to an interface, among which one is the primary ip address and another is secondary ip addresses. A newly specified primary ip address overwrites the previous one if there is any. Z the primary and secondary ip addresses of an interface cannot reside on th...

  • Page 307

    1-5 ip address configuration example ii network requirements as shown in figure 1-4 , vlan-interface 1 on switch is connected to a lan comprising two segments: 172.16.1.0/24 and 172.16.2.0/24. To enable the hosts on the two network segments to communicate with the external network through switch, an...

  • Page 308

    1-6 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/26/27 ms the output information shows that switch can communicate with the hosts on the subnet 172.16.1.0/24. # ping a host on the subnet 172.16.2.0/24 from switch to check the connectivity. Ping 172.16.2....

  • Page 309: Ip Performance Configuration

    2-1 2 ip performance configuration ip performance overview introduction to ip performance configuration in some network environments, you need to adjust the ip parameters to achieve best network performance. The ip performance configuration supported by the device includes: z configuring tcp attribu...

  • Page 310

    2-2 to do… use the command… remarks enter system view system-view — configure tcp synwait timer’s timeout value tcp timer syn-timeout time-value optional by default, the timeout value is 75 seconds. Configure tcp finwait timer’s timeout value tcp timer fin-timeout time-value optional by default, the...

  • Page 311

    2-3 displaying and maintaining ip performance configuration to do… use the command… remarks display tcp connection status display tcp status display tcp connection statistics display tcp statistics display udp traffic statistics display udp statistics display ip traffic statistics display ip statist...

  • Page 312: Table of Contents

    I table of contents 1 dhcp overview··········································································································································1-1 introduction to dhcp ······································································································...

  • Page 313: Dhcp Overview

    1-1 z the term switch used throughout this document refers to a switching device in a generic sense or the switching engine of the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. 1 dhcp overview introduction to ...

  • Page 314

    1-2 z manual assignment. The administrator configures static ip-to-mac bindings for some special clients, such as a www server. Then the dhcp server assigns these fixed ip addresses to the clients. Z automatic assignment. The dhcp server assigns ip addresses to dhcp clients. The ip addresses will be...

  • Page 315

    1-3 updating ip address lease after a dhcp server dynamically assigns an ip address to a dhcp client, the ip address keeps valid only within a specified lease time and will be reclaimed by the dhcp server when the lease expires. If the dhcp client wants to use the ip address for a longer time, it mu...

  • Page 316

    1-4 z siaddr: ip address of the dhcp server. Z giaddr: ip address of the first dhcp relay agent that the dhcp client passes after it sent the request packet. Z chaddr: hardware address of the dhcp client. Z sname: name of the dhcp server. Z file: path and name of the boot configuration file that the...

  • Page 317

    2-1 2 dhcp relay agent configuration when configuring the dhcp relay agent, go to these sections for information you are interested in: z introduction to dhcp relay agent z configuring the dhcp relay agent z displaying and maintaining dhcp relay agent configuration z dhcp relay agent configuration e...

  • Page 318

    2-2 figure 2-1 typical dhcp relay agent application in the process of dynamic ip address assignment through the dhcp relay agent, the dhcp client and dhcp server interoperate with each other in a similar way as they do without the dhcp relay agent. The following sections only describe the forwarding...

  • Page 319

    2-3 figure 2-2 padding contents for sub-option 1 of option 82 figure 2-3 padding contents for sub-option 2 of option 82 mechanism of option 82 supported on dhcp relay agent the procedure for a dhcp client to obtain an ip address from a dhcp server through a dhcp relay agent is similar to that for th...

  • Page 320

    2-4 configuring the dhcp relay agent if a device belongs to an irf fabric, you need to enable the udp helper function on it before configuring it as a dhcp relay agent. Dhcp relay agent configuration task list complete the following tasks to configure the dhcp relay agent: task remarks correlating a...

  • Page 321

    2-5 to improve security and avoid malicious attack to the unused sockets, the device provides the following functions: z udp 67 and udp 68 ports used by dhcp are enabled only when dhcp is enabled. Z udp 67 and udp 68 ports are disabled when dhcp is disabled. The corresponding implementation is as fo...

  • Page 322

    2-6 to do… use the command… remarks enter system view system-view — create a static ip-to-mac binding dhcp-security static ip-address mac-address optional not created by default. Enter interface view interface interface-type interface-number — enable the address checking function address-check enabl...

  • Page 324

    2-8 to do… use the command… remarks enter system view system-view — enable option 82 support on the dhcp relay agent dhcp relay information enable required disabled by default. Configure the strategy for the dhcp relay agent to process request packets containing option 82 dhcp relay information stra...

  • Page 325

    2-9 figure 2-4 network diagram for dhcp relay agent configuration procedure # create dhcp server group 1 and configure an ip address of 10.1.1.1 for it. System-view [switcha] dhcp-server 1 ip 10.1.1.1 # map vlan-interface 1 to dhcp server group 1. [switcha] interface vlan-interface 1 [switcha-vlan-i...

  • Page 326

    2-10 z check if an address pool that is on the same network segment with the dhcp clients is configured on the dhcp server. Z check if a reachable route is configured between the dhcp relay agent and the dhcp server. Z check the dhcp relay agent. Check if the correct dhcp server group is configured ...

  • Page 327: Dhcp Snooping Configuration

    3-1 3 dhcp snooping configuration after dhcp snooping is enabled on a device, clients connected with the device cannot obtain ip addresses dynamically through bootp. Dhcp snooping overview function of dhcp snooping for security, the ip addresses used by online dhcp clients need to be tracked for the...

  • Page 328

    3-2 figure 3-1 typical network diagram for dhcp snooping application dhcp client switch a (dhcp snooping) dhcp client dhcp client dhcp client switch b (dhcp relay) internet ge1/0/2 ge1/0/1 dhcp server dhcp snooping listens the following two types of packets to retrieve the ip addresses the dhcp clie...

  • Page 329

    3-3 contents). That is, the circuit id or remote id sub-option defines the type and length of a circuit id or remote id. The remote id type field and circuit id type field are determined by the option storage format. They are both set to “0” in the case of hex format and to “1” in the case of ascii ...

  • Page 330

    3-4 table 3-1 ways of handling a dhcp packet with option 82 handling policy sub-option configuration the dhcp snooping device will… drop — drop the packet. Keep — forward the packet without changing option 82. Neither of the two sub-options is configured forward the packet after replacing the origin...

  • Page 331

    3-5 z the resources on the server are exhausted, so the server does not respond to other requests. Z after receiving such type of packets, a device needs to send them to the cpu for processing. Too many request packets cause high cpu usage rate. As a result, the cpu cannot work normally. The device ...

  • Page 332

    3-6 to do… use the command… remarks specify the current port as a trusted port dhcp-snooping trust required by default, after dhcp snooping is enabled, all ports of a device are untrusted ports. Z you need to specify the ports connected to the valid dhcp servers as trusted to ensure that dhcp client...

  • Page 333

    3-7 to do… use the command… remarks enter system view system-view — enable dhcp-snooping option 82 support dhcp-snooping information enable required by default, dhcp snooping option 82 support is disabled. Configure a handling policy for dhcp packets with option 82 follow these steps to configure a ...

  • Page 334

    3-8 the dhcp-snooping information format command applies only to the default content of the option 82 field. If you have configured the circuit id or remote id sub-option, the format of the sub-option is ascii, instead of the one specified with the dhcp-snooping information format command. Configure...

  • Page 336

    3-10 to do… use the command… remarks enable ip filtering ip check source ip-address [ mac-address ] required by default, this function is disabled. Create an ip static binding entry ip source static binding ip-address ip-address [ mac-address mac-address] optional by default, no static binding entry...

  • Page 337

    3-11 configuration procedure # enable dhcp snooping on switch. System-view [switch] dhcp-snooping # specify gigabitethernet 1/0/5 as the trusted port. [switch] interface gigabitethernet 1/0/5 [switch-gigabitethernet1/0/5] dhcp-snooping trust [switch-gigabitethernet1/0/5] quit # enable dhcp-snooping ...

  • Page 338

    3-12 figure 3-7 network diagram for ip filtering configuration switch dhcp snooping ge1/0/2 client c ge1/0/1 dhcp server client b host a ip:1.1.1.1 mac:0001-0001-0001 ge1/0/3 ge1/0/4 configuration procedure # enable dhcp snooping on switch. System-view [switch] dhcp-snooping # specify gigabitetherne...

  • Page 339

    3-13 displaying and maintaining dhcp snooping configuration to do… use the command… remarks display the user ip-mac address mapping entries recorded by the dhcp snooping function display dhcp-snooping [ unit unit-id ] display the (enabled/disabled) state of the dhcp snooping function and the trusted...

  • Page 340

    4-1 4 dhcp/bootp client configuration introduction to dhcp client after you specify a vlan interface as a dhcp client, the device can use dhcp to obtain parameters such as ip address dynamically from the dhcp server, which facilitates user configuration and management. Refer to obtaining ip addresse...

  • Page 342

    4-3 displaying and maintaining dhcp/bootp client configuration to do… use the command… remarks display related information on a dhcp client display dhcp client [ verbose ] display related information on a bootp client display bootp client [ interface vlan-interface vlan-id ] available in any view.

  • Page 343: Table of Contents

    I table of contents 1 acl configuration·····································································································································1-1 acl overview ···············································································································...

  • Page 344: Acl Configuration

    1-1 1 acl configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a wx3000. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Acl overview as the ne...

  • Page 345

    1-2 z auto: where rules in an acl are matched in the order determined by the system, namely the “depth-first” rule. For depth-first rule, there are two cases: depth-first match order for rules of a basic acl 1) range of source ip address: the smaller the source ip address range (that is, the more th...

  • Page 346

    1-3 when applying an acl in this way, you can specify the order in which the rules in the acl are matched. The match order cannot be modified once it is determined, unless you delete all the rules in the acl and define the match order. An acl can be referenced by upper-layer software: z referenced b...

  • Page 348

    1-5 configuring basic acl a basic acl filters packets based on their source ip addresses. A basic acl can be numbered from 2000 to 2999. Configuration prerequisites z to configure a time range-based basic acl rule, you need to create the corresponding time range first. For information about time ran...

  • Page 349

    1-6 rule 0 deny source 192.168.0.1 0 configuring advanced acl an advanced acl can filter packets by their source and destination ip addresses, the protocols carried by ip, and protocol-specific features such as tcp/udp source and destination ports, icmp message type and message code. An advanced acl...

  • Page 350

    1-7 z if the acl is created with the auto keyword specified, the newly created rules will be inserted in the existent ones by depth-first principle, but the numbers of the existent rules are unaltered. Configuration example # configure acl 3000 to permit the tcp packets sourced from the network 129....

  • Page 351

    1-8 note that: z you can modify any existent rule of the layer 2 acl and the unmodified part of the acl remains. Z if you do not specify the rule-id argument when creating an acl rule, the rule will be numbered automatically. If the acl has no rules, the rule is numbered 0; otherwise, it is the maxi...

  • Page 352

    1-9 z acls assigned globally take precedence over those that are assigned to vlans. That is, when a packet matches a rule of a globally assigned acl and a rule of an acl assigned to a vlan, the device will perform the action defined in the rule of the globally assigned acl if the actions defined in ...

  • Page 353

    1-10 to do… use the command… remarks enter system view system-view — apply an acl to a vlan packet-filter vlan vlan-id inbound acl-rule required for description on the acl-rule argument, refer to acl command. Configuration example # apply acl 2000 to vlan 10 to filter the inbound packets of vlan 10 ...

  • Page 354

    1-11 assigning an acl to a port configuration prerequisites before applying acl rules to a vlan, you need to define the related acls. For information about defining an acl, refer to configuring basic acl , configuring advanced acl , configuring layer 2 acl . Configuration procedure follow these step...

  • Page 355

    1-12 examples for upper-layer software referencing acls example for controlling telnet login users by source ip network requirements as shown in figure 1-1 , apply an acl to permit users with the source ip address of 10.110.100.52 to telnet to the switching engine. Figure 1-1 network diagram for con...

  • Page 356

    1-13 configuration procedure # define acl 2001. System-view [device] acl number 2001 [device-acl-basic-2001] rule 1 permit source 10.110.100.46 0 [device-acl-basic-2001] quit # reference acl 2001 to control users logging in to the web server. [device] ip http acl 2001 examples for applying acls to h...

  • Page 357

    1-14 gigabitethernet 1/0/1 of switch. Apply an acl to deny requests from the r&d department and destined for the wage server during the working hours (8:00 to 18:00). Figure 1-4 network diagram for advanced acl configuration geth 1/0/1 the r&d department switch to the router wage query server 192.16...

  • Page 358

    1-15 system-view [device] time-range test 8:00 to 18:00 daily # define acl 4000 to filter packets with the source mac address of 000f-e20f-0101 and the destination mac address of 000f-e20f-0303. [device] acl number 4000 [device-acl-ethernetframe-4000] rule 1 deny source 000f-e20f-0101 ffff-ffff-ffff...

  • Page 359

    1-16 # apply acl 3000 to vlan 10. [device] packet-filter vlan 10 inbound ip-group 3000

  • Page 360: Table of Contents

    I table of contents 1 qos configuration·····································································································································1-1 overview ···················································································································...

  • Page 361

    Ii applying a qos profile ····················································································································2-2 displaying and maintaining qos profile ··························································································2-3 configuration example...

  • Page 362: Qos Configuration

    1-1 1 qos configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Overview intr...

  • Page 363

    1-2 video-on-demand (vod). Enterprise users expect to connect their regional branches together using vpn techniques for coping with daily business, for instance, accessing databases or manage remote equipments through telnet. All these new applications have one thing in common, that is, they have sp...

  • Page 364

    1-3 information carried in packet header. Packet payload is rarely adopted for traffic classification. The identifying rule is unlimited in range. It can be a quintuplet consisting of source address, source port number, protocol number, destination address, and destination port number. It can also b...

  • Page 365

    1-4 z class selector (cs) class: this class comes from the ip tos field and includes eight subclasses; z best effort (be) class: this class is a special class without any assurance in the cs class. The af class can be degraded to the be class if it exceeds the limit. Current ip network traffic belon...

  • Page 366

    1-5 as shown in the figure above, each host supporting 802.1q protocol adds a 4-byte 802.1q tag header after the source address of the former ethernet frame header when sending packets. The 4-byte 802.1q tag header consists of the tag protocol identifier (tpid, two bytes in length), whose value is 0...

  • Page 367

    1-6 the device does not support marking drop precedence for packets. A device can operate in one of the following two priority trust modes when assigning precedence to received packets: z packet priority trusted mode z port priority trusted mode in terms of priority trust mode, the priority mapping ...

  • Page 368

    1-7 the devices provide cos-precedence-to-other-precedence, dscp-precedence-to-other-precedence, and dscp-precedence-to-dscp- precedence mapping tables for priority mapping. Table 1-4 through table 1-6 list the default settings of these tables. Table 1-4 the default cos-precedence-to-other-precedenc...

  • Page 369

    1-8 protocol priority protocol packets carry their own priority. You can modify the priority of a protocol packet to implement qos. Priority marking the priority marking function is to use acl rules in traffic classification and reassign the priority for the packets matching the acl rules. Traffic p...

  • Page 370

    1-9 evaluating the traffic with the token bucket when token bucket is used for traffic evaluation, the number of the tokens in the token bucket determines the amount of the packets that can be forwarded. If the number of tokens in the bucket is enough to forward the packets, the traffic is conformin...

  • Page 371

    1-10 figure 1-6 diagram for traffic shaping token bucket drop packet classification packets to be sent through this port continue to send put tokens in the bucket at the set rate queue for example, if the device a sends packets to the device b. The device b will perform traffic policing on packets f...

  • Page 372

    1-11 1) sp queuing figure 1-7 diagram for sp queuing packets to be sent through this port packet classification queue scheduling queue 2 weight 2 queue n- 1 weight n-1 queue n weight n sent packets sending queue interface …… queue 7 queue 6 queue 1 queue 0 high priority low priority sp queue-schedul...

  • Page 373

    1-12 figure 1-8 diagram for wrr queuing packets to be sent through this port packet classification queue scheduling queue 2 weight 2 queue n- 1 weight n-1 queue n weight n sent packets sending queue interface …… queue 1 queue 2 weight 2 queue n-1 weight n-1 queue n weight n weight 1 wrr queue-schedu...

  • Page 374

    1-13 table 1-7 queue-scheduling sequence of sdwrr scheduling algorithm queue-scheduling sequence description wrr 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1 sdwrr 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0 0 indicates packets in queue0 1 indicates packets in queue1 flow-based traffic accounti...

  • Page 375

    1-14 task remarks enabling the burst function optional configuring traffic mirroring optional configuring priority trust mode refer to priority trust mode for introduction to priority trust mode. Configuration prerequisites z the priority trust mode to be adopted is determined. Z the port where prio...

  • Page 376

    1-15 configuration example z configure to trust port priority on gigabitethernet 1/0/1 and set the priority of gigabitethernet 1/0/1 to 7. Configuration procedure: system-view [device] interface gigabitethernet1/0/1 [device-gigabitethernet1/0/1] priority 7 z configure to trust 802.1p precedence on g...

  • Page 377

    1-16 to do… use the command… remarks configure cos-precedence-to-dscp -precedence mapping table qos cos-dscp-map cos0-map-dscp cos1-map-dscp cos2-map-dscp cos3-map-dscp cos4-map-dscp cos5-map-dscp cos6-map-dscp cos7-map-dscp required follow these steps to configure the dscp-precedence-to-other-prece...

  • Page 378

    1-17 [device] qos dscp-local-precedence-map 8 9 10 11 12 13 14 15 : 3 [device] qos dscp-local-precedence-map 16 17 18 19 20 21 22 23 : 4 [device] qos dscp-local-precedence-map 24 25 26 27 28 29 30 31 : 1 [device] qos dscp-local-precedence-map 32 33 34 35 36 37 38 39 : 7 [device] qos dscp-local-prece...

  • Page 379

    1-18 37 : 7 38 : 7 39 : 7 40 : 0 41 : 0 42 : 0 43 : 0 44 : 0 45 : 0 46 : 0 47 : 0 48 : 5 49 : 5 50 : 5 51 : 5 52 : 5 53 : 5 54 : 5 55 : 5 56 : 6 57 : 6 58 : 6 59 : 6 60 : 6 61 : 6 62 : 6 63 : 6 setting the priority of protocol packets refer to protocol priority for information about priority of prot...

  • Page 380

    1-19 configuration example z set the ip precedence of icmp packets to 3. Z display the configuration. Configuration procedure: system-view [device] protocol-priority protocol-type icmp ip-precedence 3 [device] display protocol-priority protocol: icmp ip-precedence: flash(3) marking packet priority r...

  • Page 381

    1-20 follow these steps to mark the priority for packets that are of a port group and match specific acl rules: to do… use the command… remarks enter system view system-view — enter port group view port-group group-id — mark the priorities for packets matching specific acl rules traffic-priority inb...

  • Page 382

    1-21 configuration prerequisites z the acl rules used for traffic classification are defined. Refer to the aclmodule of this manual for information about defining acl rules. Z the rate limit for traffic policing, and the actions for the packets exceeding the rate limit are determined. Configuration ...

  • Page 383

    1-22 to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — configure traffic policing traffic-limit inbound acl-rule target-rate [ conform con-action ] [ exceed exceed-action ] [ meter-statistic ] required by default, tra...

  • Page 384

    1-23 configuration procedure follow these steps to configure traffic shaping: to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — configure traffic shaping traffic-shape [ queue queue-id ] max-rate burst-size required t...

  • Page 385

    1-24 follow these steps to redirect packets that are of a vlan and match specific acl rules: to do… use the command… remarks enter system view system-view — configure traffic redirecting traffic-redirect vlan vlan-id inbound acl-rule interface interface-type interface-number required follow these st...

  • Page 386

    1-25 [device-acl-basic-2000] quit [device] interface gigabitethernet1/0/1 [device-gigabitethernet1/0/1] traffic-redirect inbound ip-group 2000 interface gigabitethernet1/0/7 2) method ii system-view [device] acl number 2000 [device-acl-basic-2000] rule permit source 10.1.1.1 0.0.0.255 [device-acl-ba...

  • Page 387

    1-26 configuration prerequisites the algorithm for queue scheduling to be used and the related parameters are determined. Configuration procedure follow these steps to configure sp queue scheduling algorithm: to do… use the command… remarks enter system view system-view — configure sp queue scheduli...

  • Page 388

    1-27 configuration example # configure a device to adopt sp+sdwrr combination for queue scheduling, assigning queue 3, queue 4, and queue 5 to wrr scheduling group 1, with the weigh of 20, 20 and 30; assigning queue 0, queue 1, and queue 2 to wrr scheduling group 2, with the weight 20, 20, and 40; u...

  • Page 389

    1-28 to do… use the command… remarks collect the statistics on the packets matching specific acl rules traffic-statistic vlan vlan-id inbound acl-rule required clear the statistics on the packets matching specific acl rules reset traffic-statistic vlan vlan-id inbound acl-rule optional follow these ...

  • Page 390

    1-29 [device] acl number 2000 [device-acl-basic-2000] rule permit source 10.1.1.1 0.0.0.255 [device-acl-basic-2000] quit [device] interface gigabitethernet1/0/1 [device-gigabitethernet1/0/1] traffic-statistic inbound ip-group 2000 [device-gigabitethernet1/0/1] reset traffic-statistic inbound ip-grou...

  • Page 391

    1-30 configuration procedure you can configure traffic mirroring on all the packets matching specific acl rules, or on packets that match specific acl rules and are of a vlan, of a port group, or pass a port. Follow these steps to configure traffic mirroring globally: to do… use the command… remarks...

  • Page 392

    1-31 follow these steps to configure traffic mirroring for a port: to do… use the command… remarks enter system view system-view — enter ethernet port view of the destination port interface interface-type interface-number — define the current port as the destination port monitor-port required exit c...

  • Page 393

    1-32 [device] mirrored-to vlan 2 inbound ip-group 2000 monitor-interface displaying and maintaining qos to do… use the command… remarks display the protocol packet priority configuration display protocol-priority display the cos-precedence-to-drop-precedence mapping relationship display qos cos-drop...

  • Page 395

    1-34 # create acl 2000 and enter basic acl view to classify packets sourced from the 192.168.1.0/24 network segment. System-view [device] acl number 2000 [device-acl-basic-2000] rule permit source 192.168.1.0 0.0.0.255 [device-acl-basic-2000] quit # create acl 2001 and enter basic acl view to classi...

  • Page 396: Qos Profile Configuration

    2-1 2 qos profile configuration overview introduction to qos profile qos profile is a set of qos configurations. It provides an easy way for performing and managing qos configuration. A qos profile can contain one or multiple qos functions. In networks where hosts change their positions frequently, ...

  • Page 397

    2-2 qos profile configuration qos profile configuration task list complete the following tasks to configure a qos profile: task remarks configuring a qos profile required applying a qos profile optional applying a qos profile optional configuring a qos profile configuration prerequisites z the acl r...

  • Page 398

    2-3 configuration procedure follow these steps to configure to apply a qos profile dynamically: to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — configure the mode to apply a qos profile as port-based qos-profile por...

  • Page 399

    2-4 configuration example qos profile configuration example network requirements as shown in figure 2-1 , the user name is “someone”, and the authentication password is “hello”. It is connected to gigabitethernet 1/0/1 of the switch and belongs to the test.Net domain. It is required to configure a q...

  • Page 400

    2-5 # create the user domain test.Net and specify radius1 as your radius server group. [device] domain test.Net [device-isp-test.Net] radius-scheme radius1 [device-isp-test.Net] quit # create acl 3000 to permit ip packets destined for any ip address. [device] acl number 3000 [device-acl-adv-3000] ru...

  • Page 401: Table of Contents

    I table of contents 1 mirroring configuration ····························································································································1-1 mirroring overview ···········································································································...

  • Page 402: Mirroring Configuration

    1-1 1 mirroring configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your devi...

  • Page 403

    1-2 z vlan-based mirroring: a device copies packets of a specified vlan to the destination port. Local port mirroring in local port mirroring, packets passing through one or more source ports of a device are copied to the destination port on the same device for packet analysis and monitoring. In thi...

  • Page 404

    1-3 table 1-1 ports involved in the mirroring operation switch ports involved function source port port monitored. It copies packets to the reflector port through local port mirroring. There can be more than one source port. Reflector port receives packets from the source port and broadcasts the pac...

  • Page 405

    1-4 mirroring configuration complete the following tasks to configure mirroring: task remarks configuring local port mirroring optional configuring remote port mirroring optional configuring mac-based mirroring optional configuring vlan-based mirroring optional configuring local port mirroring confi...

  • Page 406

    1-5 configuring remote port mirroring the device can serve as a source switch, an intermediate switch, or a destination switch in a remote port mirroring networking environment. Configuration on the device acting as a source switch 1) configuration prerequisites z the source port, the reflector port...

  • Page 407

    1-6 when configuring the source switch, note that: z all ports of a remote source mirroring group are on the same device. Each remote source mirroring group can be configured with only one reflector port. Z the reflector port cannot be a member port of an existing mirroring group, a member port of a...

  • Page 408

    1-7 follow these steps to configure remote port mirroring on the destination switch: to do… use the command… remarks enter system view system-view — create a vlan and enter vlan view vlan vlan-id vlan-id is the id of the remote-probe vlan. Configure the current vlan as a remote-probe vlan remote-pro...

  • Page 409

    1-8 configuration prerequisites z the mac address to be matched is determined. Z the destination port is determined. Configuration procedure follow these steps to configure mac-based mirroring: to do… use the command… remarks enter system view system-view — create a local or remote source mirroring ...

  • Page 411

    1-10 use the local port mirroring function to meet the requirement. Perform the following configurations on switch c. Z configure gigabitethernet 1/0/1 and gigabitethernet 1/0/2 as mirroring source ports. Z configure gigabitethernet 1/0/3 as the mirroring destination port. Figure 1-3 network diagram...

  • Page 412

    1-11 z department 1 is connected to gigabitethernet 1/0/1 of switch a. Z department 2 is connected to gigabitethernet 1/0/2 of switch a. Z gigabitethernet 1/0/3 of switch a connects to gigabitethernet 1/0/1 of switch b. Z gigabitethernet 1/0/2 of switch b connects to gigabitethernet 1/0/1 of switch ...

  • Page 413

    1-12 [device] mirroring-group 1 mirroring-port gigabitethernet 1/0/1 gigabitethernet 1/0/2 inbound [device] mirroring-group 1 reflector-port gigabitethernet 1/0/4 [device] mirroring-group 1 remote-probe vlan 10 # configure gigabitethernet 1/0/3 as trunk port, allowing packets of vlan 10 to pass. [de...

  • Page 414

    1-13 # configure the destination port and remote-probe vlan for the remote destination mirroring group. [device] mirroring-group 1 monitor-port gigabitethernet 1/0/2 [device] mirroring-group 1 remote-probe vlan 10 # configure gigabitethernet 1/0/1 as the trunk port, allowing packets of vlan 10 to pa...

  • Page 415: Table of Contents

    I table of contents 1 arp configuration·····································································································································1-1 introduction to arp ········································································································...

  • Page 416: Arp Configuration

    1-1 1 arp configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Introduction ...

  • Page 417

    1-2 figure 1-1 arp message format hardware type (16 bits) protocol type (16 bits) length of hardware address length of protocol address operator (16 bits) hardware address of the sender ip address of the sender hardware address of the receiver ip address of the receiver hardware type (16 bits) hardw...

  • Page 418

    1-3 value description 5 chaos 6 ieee802.X 7 arc network arp table in an ethernet, the mac addresses of two hosts must be available for the two hosts to communicate with each other. Each host in an ethernet maintains an arp table, where the latest used ip address-to-mac address mapping entries are st...

  • Page 419

    1-4 mode, all hosts on this subnet can receive the request, but only the requested host (namely, host b) will process the request. 4) host b compares its own ip address with the destination ip address in the arp request. If they are the same, host b saves the source ip address and source mac address...

  • Page 420

    1-5 after you enable the arp attack detection function, the device will check the following items of an arp packet: the source mac address, source ip address, port number of the port receiving the arp packet, and the id of the vlan the port resides. If these items match the entries of the dhcp snoop...

  • Page 421

    1-6 to do… use the command… remarks enable the arp entry checking function (that is, disable the device from learning arp entries with multicast mac addresses) arp check enable optional by default, the arp entry checking function is enabled. Z static arp entries are valid as long as the device opera...

  • Page 422

    1-7 to do… use the command… remarks quit to system view quit — enter vlan view vlan vlan-id — enable arp restricted forwarding arp restricted-forwarding enable optional by default, the arp restricted forwarding function is disabled. The device forwards legal arp packets through all its ports. Z you ...

  • Page 424

    1-9 figure 1-4 arp attack detection configuration ge1/0/3 client b ge1/0/2 client a dhcp server switch a dhcp snooping ge1/0/1 configuration procedure # enable dhcp snooping on switch a. System-view [switcha] dhcp-snooping # specify gigabitethernet 1/0/1 as the dhcp snooping trusted port and the arp...

  • Page 425: Table of Contents

    I table of contents 1 snmp configuration··································································································································1-1 snmp overview·················································································································...

  • Page 426: Snmp Configuration

    1-1 1 snmp configuration z the term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Snmp overview...

  • Page 427

    1-2 snmp nms and snmp agent. Community name functions as password. It can limit accesses made by snmp nms to snmp agent. You can perform the following community name-related configuration. Z specifying mib view that a community can access. Z set the permission for a community to access an mib object...

  • Page 428

    1-3 mib attribute mib content related rfc dhcp mib qacl mib mstp mib vlan mib ipv6 address mib mirrorgroup mib qinq mib 802.X mib hgmp mib ntp mib device management private mib interface management — configuring basic snmp functions because the configuration of snmpv3 is quite different from that of...

  • Page 433

    1-8 z perform the following configuration on switch a: setting the community name and access permission, administrator id, contact and location of switch a, and enabling the device to sent trap messages. Thus, the nms is able to access switch a and receive the trap messages sent by switch a. Figure ...

  • Page 434

    1-9 [device] snmp-agent trap enable standard linkdown [device] snmp-agent target-host trap address udp-domain 10.10.10.1 udp-port 5000 params securityname public configuring the nms the device supports imc nms. Snmpv3 adopts user name and password authentication. When you use the imc, you need to se...

  • Page 435: Rmon Configuration

    2-1 2 rmon configuration introduction to rmon remote monitoring (rmon) is a kind of management information base (mib) defined by internet engineering task force (ietf). It is an important enhancement made to mib ii standards. Rmon is mainly used to monitor the data traffic across a network segment o...

  • Page 436

    2-2 commonly used rmon groups event group event group is used to define the indexes of events and the processing methods of the events. The events defined in an event group are mainly used by entries in the alarm group and extended alarm group to trigger alarms. You can specify a network device to a...

  • Page 437

    2-3 the statistics include the number of the following items: collisions, packets with cyclic redundancy check (crc) errors, undersize (or oversize) packets, broadcast packets, multicast packets, and received bytes and packets. With the rmon statistics management function, you can monitor the use of...

  • Page 439

    2-5 [device] rmon prialarm 2 (.1.3.6.1.2.1.16.1.1.1.9.1+.1.3.6.1.2.1.16.1.1.1.10.1) test 10 changeratio rising_threshold 50 1 falling_threshold 5 2 entrytype forever owner user1 # display the rmon extended alarm entry numbered 2. [device] display rmon prialarm 2 prialarm table 2 owned by user1 is va...

  • Page 440: Table of Contents

    I table of contents 1 multicast overview ····································································································································1-1 multicast overview ········································································································...

  • Page 441: Multicast Overview

    1-1 1 multicast overview z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of the wx3000 series devices. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Mult...

  • Page 442

    1-2 figure 1-1 information transmission in the unicast mode source server receiver receiver receiver host a host b host c host d host e packets for host b packets for host d packets for host e assume that hosts b, d and e need this information. The source server establishes transmission channels for...

  • Page 443

    1-3 figure 1-2 information transmission in the broadcast mode source server receiver receiver receiver host a host b host c host d host e packets for all the network assume that hosts b, d, and e need the information. The source server broadcasts this information through routers, and hosts a and c o...

  • Page 444

    1-4 figure 1-3 information transmission in the multicast mode source server receiver receiver receiver host a host b host c host d host e packets for the multicast group assume that hosts b, d and e need the information. To transmit the information to the right users, it is necessary to group hosts ...

  • Page 445

    1-5 table 1-1 an analogy between tv transmission and multicast transmission step tv transmission multicast transmission 1 a tv station transmits a tv program through a television channel. A multicast source sends multicast data to a multicast group. 2 a user tunes the tv set to the channel. A receiv...

  • Page 446

    1-6 asm model in the asm model, any sender can become a multicast source and send information to a multicast group; numbers of receivers can join a multicast group identified by a group address and obtain multicast information addressed to that multicast group. In this model, receivers are not aware...

  • Page 447

    1-7 as receivers are multiple hosts in a multicast group, you should be concerned about the following questions: z what destination should the information source send the information to in the multicast mode? Z how to select the destination address? These questions are about multicast addressing. To...

  • Page 448

    1-8 class d address range description 239.0.0.0 to 239.255.255.255 administratively scoped multicast addresses, which are for specific local use only. As specified by iana, the ip addresses ranging from 224.0.0.0 to 224.0.0.255 are reserved for network protocols on local networks. The following tabl...

  • Page 449

    1-9 multicast mac address is used as the destination address because the destination is a group with an uncertain number of members. As stipulated by iana, the high-order 24 bits of a multicast mac address are 0x01005e, while the low-order 23 bits of a mac address are the low-order 23 bits of the mu...

  • Page 450

    1-10 figure 1-5 positions of layer 3 multicast protocols as 1 as 2 source receiver receiver receiver pim pim msdp igmp igmp igmp 1) multicast management protocols typically, the internet group management protocol (igmp) is used between hosts and layer 3 multicast devices directly connected with the ...

  • Page 451

    1-11 figure 1-6 positions of layer 2 multicast protocols source receiver receiver multicast packets igmp snooping 2) igmp snooping running on layer 2 devices, internet group management protocol snooping (igmp snooping) are multicast constraining mechanisms that manage and control multicast groups by...

  • Page 452

    1-12 2) if the corresponding (s, g) entry exists, but the interface on which the packet actually arrived is not the incoming interface in the multicast forwarding table, the multicast packet is subject to an rpf check. Z if the result of the rpf check shows that the rpf interface is the incoming int...

  • Page 453

    1-13 z a multicast packet from source arrives to vlan-interface 1 of switch c, and the corresponding forwarding entry does not exist in the multicast forwarding table of switch c. Switch c performs an rpf check, and finds in its unicast routing table that the outgoing interface to 192.168.0.0/24 is ...

  • Page 454: Igmp Snooping Configuration

    2-1 2 igmp snooping configuration igmp snooping overview internet group management protocol snooping (igmp snooping) is a multicast constraining mechanism that runs on layer 2 devices to manage and control multicast groups. Principle of igmp snooping by analyzing received igmp messages, a layer 2 de...

  • Page 455

    2-2 figure 2-2 igmp snooping related ports router a switch a switch b eth1/0/1 eth1/0 /2 eth 1/0/3 eth 1/0/1 eth1/0 /2 receiver receiver host a host b host c host d source multicast packets router port member port ports involved in igmp snooping, as shown in figure 2-2 , are described as follows: z ...

  • Page 456

    2-3 when receiving a general query the igmp querier periodically sends igmp general queries to all hosts and routers on the local subnet to find out whether active multicast group members exist on the subnet. Upon receiving an igmp general query, the device forwards it through all ports in the vlan ...

  • Page 457

    2-4 immediately delete the forwarding entry corresponding to that port from the forwarding table; instead, it resets the aging timer of the member port. Upon receiving the igmp leave message from a host, the igmp querier resolves from the message the address of the multicast group that the host just...

  • Page 458

    2-5 operation remarks configuring a vlan tag for query messages optional configuring multicast vlan optional enabling igmp snooping follow these steps to enable igmp snooping: to do… use the command… remarks enter system view system-view — enable igmp snooping globally igmp-snooping enable required ...

  • Page 459

    2-6 z before configuring related igmp snooping functions, you must enable igmp snooping in the specified vlan. Z different multicast group addresses should be configured for different multicast sources because igmpv3 snooping cannot distinguish multicast data from different sources to the same multi...

  • Page 460

    2-7 enabling fast leave processing in ethernet port view follow these steps to enable fast leave processing in ethernet view: to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — enable fast leave processing for specific...

  • Page 461

    2-8 configuring a multicast group filter in system view follow these steps to configure a multicast group filter in system view: to do… use the command… remarks enter system view system-view — configure a multicast group filter igmp-snooping group-policy acl-number [vlan vlan-list ] required no grou...

  • Page 462

    2-9 follow these steps to configure the maximum number of multicast groups on a port: to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — limit the number of multicast groups on a port igmp-snooping group-limit limit [ ...

  • Page 463

    2-10 to do… use the command… remarks enable igmp snooping querier igmp-snooping querier required by default, igmp snooping querier is disabled. Configure the interval of sending general queries igmp-snooping query-interval seconds optional by default, the interval of sending general queries is 60 se...

  • Page 464

    2-11 in ethernet port view follow these steps to configure a static multicast group member port in ethernet port view: to do… use the command… remarks enter system view system-view — enter ethernet port view interface interface-type interface-number — configure the current port as a static member po...

  • Page 465

    2-12 in vlan view follow these steps to configure a static router port in vlan view: to do… use the command… remarks enter system view system-view — enter vlan view vlan vlan-id — configure a specified port as a static router port multicast static-router-port interface-type interface-number required...

  • Page 466

    2-13 z before configuring a simulated host, enable igmp snooping in vlan view first. Z the port to be configured must belong to the specified vlan; otherwise the configuration does not take effect. Z you can use the source-ip source-address command to specify a multicast source address that the port...

  • Page 467

    2-14 to do… use the command… remarks enter vlan interface view interface vlan-interface vlan-id — enable igmp igmp enable required by default, the igmp feature is disabled. Return to system view quit — enter ethernet port view for the layer 2 device to be configured interface interface-type interfac...

  • Page 468

    2-15 z one port can belong to only one multicast vlan. Z the port connected to a user terminal must be a hybrid port. Z the multicast member ports must be in the same vlan with the router port. Otherwise, the multicast member port cannot receive multicast packets. Z if a router port is in a multicas...

  • Page 469

    2-16 figure 2-3 network diagram for igmp snooping configuration multicast packets source router a switch a receiver receiver host b host a host c 1.1.1.1/24 ge1/0/4 ge1/0/2 ge 1/0/3 igmp querier ge1 /0/1 ge 1/0/1 10 .1 .1.1/24 ge1/0/2 1 .1.1.2/24 vlan100 configuration procedure 1) configure the ip a...

  • Page 470

    2-17 total 1 ip group(s). Total 1 mac group(s). Vlan(id):100. Total 1 ip group(s). Total 1 mac group(s). Static router port(s): dynamic router port(s): gigabitethernet1/0/1 ip group(s):the following ip group(s) match to one mac group. Ip group address: 224.1.1.1 static host port(s): dynamic host por...

  • Page 471

    2-18 configure a multicast vlan, so that users in vlan 2 and vlan 3 can receive multicast streams through the multicast vlan. Figure 2-4 network diagram for multicast vlan configuration hosta hostb workstation switcha switchb vlan-int20 168.10. 1.1 ge1/0/1 ge1/0/10 vla n2 vlan 3 ge1/0/10 vlan10 ge 1...

  • Page 472

    2-19 # configure vlan 10 as the multicast vlan and enable igmp snooping on it. [switchb] vlan 10 [switchb-vlan10] service-type multicast [switchb-vlan10] igmp-snooping enable [switchb-vlan10] quit # define gigabitethernet 1/0/10 as a hybrid port, add the port to vlan 2, vlan 3, and vlan 10, and conf...

  • Page 473

    3-1 3 common multicast configuration common multicast configuration configuring a multicast mac address entry in layer 2 multicast, the system can add multicast forwarding entries dynamically through a layer 2 multicast protocol. Alternatively, you can statically bind a port to a multicast mac addre...

  • Page 474

    3-2 configuring dropping unknown multicast packets generally, if the multicast address of the multicast packet received on the device is not registered on the local device, the packet will be flooded in the vlan. When the function of dropping unknown multicast packets is enabled, the device will dro...

  • Page 475: Table of Contents

    I table of contents 1 ntp configuration ·····································································································································1-1 introduction to ntp ·······································································································...

  • Page 476: Ntp Configuration

    1-1 1 ntp configuration when configuring ntp, go to these sections for information you are interested in: z introduction to ntp z ntp configuration task list z configuring ntp implementation modes z configuring access control right z configuring ntp authentication z configuring optional ntp paramete...

  • Page 477

    1-2 z in network management, the analysis of the log information and debugging information collected from different devices is meaningful and valid only when network devices that generate the information adopts the same time. Z the billing system requires that the clocks of all network devices be co...

  • Page 478

    1-3 figure 1-1 implementation principle of ntp ip network ip network ip network ip network device b device a device b device a device b device a device b device a 10:00:00 am 11:00:01 am 10:00:00 am ntp message 10:00:00 am 11:00:01 am 11:00:02 am ntp message ntp message ntp message received at 10:00...

  • Page 479

    1-4 server/client mode figure 1-2 server/client mode server clock synchronization request response network client works in server mode automatically and sends a response packet filters and selects a clock and synchronizes the local clock to that of the preferred server symmetric peer mode figure 1-3...

  • Page 480

    1-5 multicast mode figure 1-5 multicast mode client multicast clock synchronization packets periodically network server initiates a client/server mode request after receiving the first multicast packet works in the server mode automatically and sends responses client/server mode request response obt...

  • Page 481

    1-6 ntp configuration task list complete the following tasks to configure ntp: task remarks configuring ntp implementation modes required configuring access control right optional configuring ntp authentication optional configuring optional ntp parameters optional displaying and maintaining ntp conf...

  • Page 483

    1-8 z in the symmetric peer mode, you need to execute the related ntp configuration commands (refer to configuring ntp implementation modes for details) to enable ntp on a symmetric-passive peer; otherwise, the symmetric-passive peer will not process ntp messages from the symmetric-active peer. Z th...

  • Page 484

    1-9 configuring the device to work in the ntp broadcast client mode to do… use the command… remarks enter system view system-view — enter vlan interface view interface vlan-interface vlan-id — configure the device to work in the ntp broadcast client mode ntp-service broadcast-client required not con...

  • Page 485

    1-10 configuring access control right with the following command, you can configure the ntp service access-control right to the local device for a peer device. There are four access-control rights, as follows: z query: control query right. This level of right permits the peer device to perform contr...

  • Page 486

    1-11 synchronized only to that of the server that passes the authentication. This improves network security. Table 1-2 shows the roles of devices in the ntp authentication function. Table 1-2 description on the roles of devices in ntp authentication function role of device working mode client in the...

  • Page 487

    1-12 to do… use the command… remarks configure the ntp authentication key ntp-service authentication-keyid key-id authentication-model md5 value required by default, no ntp authentication key is configured. Configure the specified key as a trusted key ntp-service reliable authentication-keyid key-id...

  • Page 488

    1-13 to do… use the command… remarks configure on the ntp broadcast server ntp-service broadcast-server authentication-keyid key-id associate the specified key with the correspondi ng broadcast/m ulticast client configure on the ntp multicast server ntp-service multicast-server authentication-keyid ...

  • Page 489

    1-14 configuring the number of dynamic sessions allowed on the local device follow these steps to configure the number of dynamic sessions allowed on the local device: to do… use the command… remarks enter system view system-view — configure the maximum number of dynamic sessions that can be establi...

  • Page 490

    1-15 figure 1-6 network diagram for the ntp server/client mode configuration 1.0.1.11/24 1 .0.1.12/24 device a device b configuration procedure perform the following configurations on device b. # view the ntp status of device b before synchronization. Display ntp-service status clock status: unsynch...

  • Page 491

    1-16 [12345]1.0.1.11 127.127.1.0 2 1 64 1 350.1 15.1 0.0 note: 1 source(master),2 source(peer),3 selected,4 candidate,5 configured total associations : 1 configuring ntp symmetric peer mode network requirements z as shown in figure 1-7 , the local clock of device a is set as the ntp master clock, wi...

  • Page 492

    1-17 reference clock id: 3.0.1.32 nominal frequency: 60.0002 hz actual frequency: 60.0002 hz clock precision: 2^18 clock offset: 0.66 ms root delay: 27.47 ms root dispersion: 208.39 ms peer dispersion: 9.63 ms reference time: 17:03:32.022 utc thu sep 7 2006 (bf422ae4.05aea86c) the output information...

  • Page 493

    1-18 configuration procedure 1) configure device c. # enter system view. System-view # set device c as the broadcast server, which sends broadcast messages through vlan-interface2. [devicec] interface vlan-interface 2 [devicec-vlan-interface2] ntp-service broadcast-server 2) configure device a. (per...

  • Page 494

    1-19 configuring ntp multicast mode network requirements z as shown in figure 1-9 , the local clock of device c is set as the ntp master clock, with a clock stratum level of 2. Configure device c to work in the ntp multicast server mode and advertise multicast ntp messages through vlan-interface2. Z...

  • Page 495

    1-20 clock status: synchronized clock stratum: 3 reference clock id: 3.0.1.31 nominal frequency: 60.0002 hz actual frequency: 60.0002 hz clock precision: 2^18 clock offset: 198.7425 ms root delay: 27.47 ms root dispersion: 208.39 ms peer dispersion: 9.63 ms reference time: 17:03:32.022 utc thu sep 7...

  • Page 496

    1-21 # configure an md5 authentication key, with the key id being 42 and the key being anicekey. [deviceb] ntp-service authentication-keyid 42 authentication-mode md5 anicekey # specify the key 42 as a trusted key. [deviceb] ntp-service reliable authentication-keyid 42 [deviceb] ntp-service unicast-...

  • Page 497: Table of Contents

    I table of contents 1 ssh configuration·····································································································································1-1 ssh overview················································································································...

  • Page 498: Ssh Configuration

    1-1 1 ssh configuration z the term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary ssh overview in...

  • Page 499

    1-2 figure 1-1 encryption and decryption encryption key decryption cipher text plain text key plain text encryption key decryption cipher text plain text key plain text key-based algorithm is usually classified into symmetric key algorithm and asymmetric key algorithm. Asymmetric key algorithm asymm...

  • Page 500

    1-3 version negotiation z the server opens port 22 to listen to connection requests from clients. Z the client sends a tcp connection request to the server. After the tcp connection is established, the server sends the first packet to the client, which includes a version identification string in the...

  • Page 501

    1-4 z in password authentication, the client encrypts the username and password, encapsulates them into a password authentication request, and sends the request to the server. Upon receiving the request, the server decrypts the username and password, compares them with those it maintains, and then i...

  • Page 502

    1-5 ssh server configuration tasks complete the following tasks to configure ssh server: task remark configuring the protocol support for the user interface required generating/destroying a rsa or dsa key pair required exporting the rsa or dsa public key optional creating an ssh user and specify an ...

  • Page 503

    1-6 z if you have configured a user interface to support ssh protocol, you must configure aaa authentication for the user interface by using the authentication-mode scheme command to ensure successful login. Z on a user interface, if the authentication-mode password or authentication-mode none comma...

  • Page 504

    1-7 exporting the rsa or dsa public key you can display the generated rsa or dsa key pair on the screen in a specified format, or export it to a specified file for configuring the key at a remote end. Follow these steps to export the rsa public key: to do… use the command… remarks enter system view ...

  • Page 505

    1-8 z for password authentication type, the username argument must be consistent with the valid user name defined in aaa; for publickey authentication, the username argument is the ssh local user name, so that there is no need to configure a local user in aaa. Z if the default authentication type fo...

  • Page 506

    1-9 to do… use the command… remarks enter system view system-view — set ssh authentication timeout time ssh server timeout seconds optional by default, the timeout time is 60 seconds. Set ssh authentication retry times ssh server authentication-retries times optional by default, the number of retry ...

  • Page 507

    1-10 to do… use the command… remarks enter public key edit view public-key-code begin — configure a public key for the client enter the content of the public key when you input the key data, spaces are allowed between the characters you input (because the system can remove the spaces automatically);...

  • Page 508

    1-11 follow these steps to import the rsa public key from a public key file: to do… use the command… remarks enter system view system-view — import the rsa public key from a public key file rsa peer-public-key keyname import sshkey filename required the result of the display rsa local-key-pair publi...

  • Page 509

    1-12 follow these steps to specify a source ip address/interface for the ssh server: to do… use the command… remarks enter system view system-view — specify a source ip address for the ssh server ssh-server source-ip ip-address required by default, the system determines the ip address for clients to...

  • Page 510

    1-13 z selecting the protocol for remote connection as ssh. Usually, a client can use a variety of remote connection protocols, such as telnet, rlogin, and ssh. To establish an ssh connection, you must select ssh z selecting the ssh version. Since the device supports ssh server 2.0 now, select 2.0 o...

  • Page 511

    1-14 figure 1-3 generate the client keys (2) after the key pair is generated, click save public key and enter the name of the file for saving the public key (public in this case) to save the public key. Figure 1-4 generate the client keys (3).

  • Page 512

    1-15 likewise, to save the private key, click save private key. A warning window pops up to prompt you whether to save the private key without any precaution. Click yes and enter the name of the file for saving the private key (“private” in this case) to save the private key. Figure 1-5 generate the...

  • Page 513

    1-16 figure 1-7 ssh client configuration interface 1 in the host name (or ip address) text box, enter the ip address of the server. Note that there must be a route available between the ip address of the server and the client. Select a protocol for remote connection as shown in figure 1-7 , select s...

  • Page 514

    1-17 figure 1-8 ssh client configuration interface 2 under protocol options, select 2 from preferred ssh protocol version. Some ssh client software, for example, tectia client software, supports the des algorithm only when the ssh1 version is selected. The putty client software supports des algorith...

  • Page 515

    1-18 figure 1-9 ssh client configuration interface 3 click browse… to bring up the file selection window, navigate to the private key file and click open to enter the following ssh client interface. If the connection is normal, a user will be prompted for a username. Once passing the authentication,...

  • Page 516

    1-19 open an ssh connection with password authentication from the window shown in figure 1-9 , click open. The following ssh client interface appears. If the connection is normal, you will be prompted to enter the username and password, as shown in figure 1-11 . Figure 1-11 ssh client interface (2) ...

  • Page 517

    1-20 follow these steps to enable the device to support first-time authentication: to do… use the command… remarks enter system view system-view — enable the device to support first-time authentication ssh client first-time enable optional by default, the client is enabled to run initial authenticat...

  • Page 518

    1-21 when logging into the ssh server using public key authentication, an ssh client needs to read the local private key for authentication. As two algorithms (rsa or dsa) are available, the identity-key keyword must be used to specify one algorithm in order to get the correct private key. Specifyin...

  • Page 519

    1-22 ssh configuration examples when the device acts as the ssh server and the authentication type is password network requirements as shown in figure 1-12 , establish an ssh connection between the host (ssh client) and the device (ssh server) for secure data exchange. The host runs ssh2.0 client so...

  • Page 520

    1-23 take ssh client software “putty” (version 0.58) as an example: 1) run putty.Exe to enter the following configuration interface. Figure 1-13 ssh client configuration interface in the host name (or ip address) text box, enter the ip address of the ssh server. 2) as shown in figure 1-13 , click op...

  • Page 521

    1-24 figure 1-14 ssh client interface when the device acts as an ssh server and the authentication type is publickey network requirements as shown in figure 1-15 , establish an ssh connection between the host (ssh client) and the device (ssh server) for secure data exchange. The host runs ssh2.0 cli...

  • Page 522

    1-25 system-view [device] interface vlan-interface 1 [device-vlan-interface1] ip address 192.168.0.1 255.255.255.0 [device-vlan-interface1] quit # generate rsa and dsa key pairs. [device] public-key local create rsa [device] public-key local create dsa # set the authentication mode for the user inte...

  • Page 523

    1-26 figure 1-16 generate a client key pair (1) while generating the key pair, you must move the mouse continuously and keep the mouse off the green process bar shown in figure 1-17 . Otherwise, the process bar stops moving and the key pair generating process is stopped..

  • Page 524

    1-27 figure 1-17 generate a client key pair (2) after the key pair is generated, click save public key and enter the name of the file for saving the public key (“public” in this case). Figure 1-18 generate a client key pair (3).

  • Page 525

    1-28 likewise, to save the private key, click save private key. A warning window pops up to prompt you whether to save the private key without any protection. Click yes and enter the name of the file for saving the private key (“private” in this case). Figure 1-19 generate a client key pair (4) afte...

  • Page 526

    1-29 figure 1-21 ssh client configuration interface (2) click browse… to bring up the file selection window, navigate to the private key file and click ok. 3) from the window shown in figure 1-21 , click open. The following ssh client interface appears. If the connection is normal, you will be promp...

  • Page 527

    1-30 when the switch acts as an ssh client and the authentication type is password network requirements as shown in figure 1-23 , establish an ssh connection between switch a (ssh client) and switch b (ssh server) for secure data exchange. The user name for login is client001 and the ssh server’s ip...

  • Page 528

    1-31 [device-vlan-interface1] ip address 10.165.87.137 255.255.255.0 [device-vlan-interface1] quit # establish a connection to the server 10.165.87.136. [device] ssh2 10.165.87.136 username: client001 trying 10.165.87.136 ... Press ctrl+k to abort connected to 10.165.87.136 ... The server is not aut...

  • Page 529

    1-32 system-view [device] interface vlan-interface 1 [device-vlan-interface1] ip address 10.165.87.136 255.255.255.0 [device-vlan-interface1] quit # generate rsa and dsa key pairs. [device] public-key local create rsa [device] public-key local create dsa # set the authentication mode for the user in...

  • Page 530

    1-33 after the key pair is generated, you need to upload the pubic key file to the server through ftp or tftp and complete the server end configuration before you continue to configure the client. # establish an ssh connection to the server 10.165.87.136. [device] ssh2 10.165.87.136 identity-key dsa...

  • Page 531

    1-34 [device-vlan-interface1] quit # generate rsa and dsa key pairs. [device] public-key local create rsa [device] public-key local create dsa # set aaa authentication on user interfaces. [device] user-interface vty 0 4 [device-ui-vty0-4] authentication-mode scheme # configure the user interfaces to...

  • Page 532

    1-35 [device-vlan-interface1] ip address 10.165.87.137 255.255.255.0 [device-vlan-interface1] quit # generate a dsa key pair [device] public-key local create dsa # export the generated dsa key pair to a file named switch001. [device] public-key local export dsa ssh2 switch001 after generating the ke...

  • Page 533: Table of Contents

    I table of contents 1 file system management configuration ·································································································1-1 file system configuration ··················································································································...

  • Page 534

    1-1 1 file system management configuration the sample output information in this manual was created on the wx3024. The output information on your device may vary. File system configuration introduction to file system to facilitate management on the device memory, the device provides the file system ...

  • Page 535

    1-2 z displaying the current work directory, or contents in a specified directory follow these steps to perform directory-related operations in user view: to do… use the command… remarks create a directory mkdir directory optional delete a directory rmdir directory optional display the current work ...

  • Page 536

    1-3 to do… use the command… remarks enter system view system-view — execute the specified batch file execute filename optional this command should be executed in system view. Z for deleted files whose names are the same, only the latest deleted file is kept in the recycle bin and can be restored. Z ...

  • Page 538

    1-5 dir unit1>flash:/test/ directory of unit1>flash:/test/ 1 -rw- 1443 apr 02 2000 02:45:13 1.Cfg 6858 kb total (6841 kb free) (*) -with main attribute (b) -with backup attribute (*b) -with both main and backup attribute file attribute configuration introduction to file attributes the following two ...

  • Page 539

    1-6 attribute. If you download a valid file with the same name as the deleted file to the flash memory, the file will possess the main attribute. Configuring file attributes you can configure and view the main attribute or backup attribute of the startup file used for the next startup of a switch, a...

  • Page 540: Table of Contents

    I table of contents 1 ftp and sftp configuration····················································································································1-1 introduction to ftp and sftp ·······································································································...

  • Page 541: Ftp and Sftp Configuration

    1-1 1 ftp and sftp configuration z the term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Z ftp...

  • Page 542

    1-2 introduction to sftp secure ftp (sftp) is established based on an ssh2 connection. It allows a remote user to log in to the switching engine to manage and transmit files, providing a securer guarantee for data transmission. In addition, since the device can be used as a client, you can log in to...

  • Page 543

    1-3 enabling an ftp server follow these steps to enable an ftp server: to do… use the command… remarks enter system view system-view — enable the ftp server function ftp server enable required disabled by default. Z only one user can access the device at a given time when the latter operates as an f...

  • Page 544

    1-4 source interface refers to the existing vlan interface or loopback interface on the device. Source ip address refers to the ip address configured for the interface on the device. Each source interface corresponds to a source ip address. Therefore, specifying a source interface for the ftp server...

  • Page 545

    1-5 with the device acting as the ftp server, if a network administrator attempts to disconnect a user that is uploading/downloading data to/from the ftp server the device will disconnect the user after the data transmission is completed. Configuring the banner for an ftp server displaying a banner:...

  • Page 546

    1-6 to do… use the command… remarks configure a shell banner header shell text use either command or both. By default, no banner is configured. For details about the header command, refer to the login part of the manual. Displaying ftp server information to do… use the command… remarks display the i...

  • Page 547

    1-7 to do… use the command… remarks change the working directory on the remote ftp server cd pathname change the working directory to be the parent directory cdup get the local working path on the ftp client lcd display the working directory on the ftp server pwd create a directory on the remote ftp...

  • Page 548

    1-8 specifying the source interface and source ip address for an ftp client you can specify the source interface and source ip address for the device acting as an ftp client, so that it can connect to a remote ftp server. Follow these steps to specify the source interface and source ip address for a...

  • Page 549

    1-9 saved-configuration command to specify config.Cfg as the main configuration file for next startup and then reboot the device. Z create a user account on the ftp server with the user name “switch” and password “hello”. Z the ip addresses 1.1.1.1 for a vlan interface on the switching engine and 2....

  • Page 550

    1-10 200 port command okay. 150 opening ascii mode data connection for config.Cfg. 226 transfer complete. This example uses the command line window tool provided by windows. When you log in to the ftp server through another ftp client, refer to the corresponding instructions for operation descriptio...

  • Page 551

    1-11 figure 1-4 network diagram for ftp banner display configuration network switch pc ftp server ftp client vlan-int1 1.1.1.1 /8 2.2 .2.2/8 configuration procedure 1) configure the switch (ftp server) # configure the login banner of the switching engine as “login banner appears” and the shell banne...

  • Page 552

    1-12 figure 1-5 network diagram for ftp configurations: the device operating as an ftp client switch a ftp client ftp server vlan -int1 1.1.1.1/8 2.2.2 .2/8 network pc configuration procedure 1) configure the pc (ftp server) perform ftp server–related configurations on the pc, that is, create a user...

  • Page 553

    1-13 # after downloading the file, use the startup saved-configuration command to specify the downloaded configuration file as the main configuration file for next startup, and then restart the device. Startup saved-configuration config.Cfg main please wait........................................Don...

  • Page 554

    1-14 to do… use the command… remarks enter system view system-view — configure the connection idle time for the sftp server ftp timeout time-out-value optional 10 minutes by default supported sftp client software the device operating as an sftp server can interoperate with sftp client software, incl...

  • Page 556

    1-16 if you specify to authenticate a client through public key on the server, the client needs to read the local private key when logging in to the sftp server. Since both rsa and dsa are available for public key authentication, you need to use the identity-key key word to specify the algorithms to...

  • Page 557

    1-17 # create a vlan interface on the device and assign to it an ip address, which is used as the destination address for the client to connect to the sftp server. [device] interface vlan-interface 1 [device-vlan-interface1] ip address 192.168.0.1 255.255.255.0 [device-vlan-interface1] quit # specif...

  • Page 558

    1-18 sftp-client> # display the current directory of the server. Delete the file z and verify the result. Sftp-client> dir -rwxrwxrwx 1 noone nogroup 1759 aug 23 06:52 config.Cfg -rwxrwxrwx 1 noone nogroup 225 aug 24 08:01 pubkey2 -rwxrwxrwx 1 noone nogroup 283 aug 24 07:39 pubkey1 drwxrwxrwx 1 noon...

  • Page 559

    1-19 -rwxrwxrwx 1 noone nogroup 283 aug 24 07:39 pubkey1 drwxrwxrwx 1 noone nogroup 0 sep 01 06:22 new -rwxrwxrwx 1 noone nogroup 225 sep 01 06:55 pub drwxrwxrwx 1 noone nogroup 0 sep 02 06:33 new2 received status: end of file received status: success # download the file pubkey2 from the server and ...

  • Page 560: Tftp Configuration

    2-1 2 tftp configuration introduction to tftp compared with ftp, tftp (trivial file transfer protocol) features simple interactive access interface and no authentication control. Therefore, tftp is applicable in the networks where client-server interactions are relatively simple. Tftp is implemented...

  • Page 561

    2-2 task remarks tftp server configuration for details, see the corresponding manual — tftp configuration: the device operating as a tftp client basic configurations on a tftp client by default the device can operate as a tftp client. In this case you can connect the device to the tftp server to per...

  • Page 562

    2-3 to do… use the command… remarks specify an interface as the source interface a tftp client uses every time it connects to a tftp server tftp source-interface interface-type interface-number specify an ip address as the source ip address a tftp client uses every time it connects to a tftp server ...

  • Page 563

    2-4 configuration procedure 1) configure the tftp server (pc) start the tftp server and configure the working directory on the pc. 2) configure the tftp client (switch). # log in to the switching engine. (you can log in to the switching engine through the console port or by telnetting the device. Se...

  • Page 564: Table of Contents

    I table of contents 1 information center·····································································································································1-1 information center overview ·······························································································...

  • Page 565: Information Center

    1-1 1 information center z the term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Information c...

  • Page 566

    1-2 severity severity value description informational 7 informational information to be recorded debugging 8 information generated during debugging information filtering by severity works this way: information with the severity value greater than the configured threshold is not output during the fil...

  • Page 567

    1-3 configurations for the six output directions function independently and take effect only after the information center is enabled. Outputting system information by source module the system information can be classified by source module and then filtered. Some module names and description are show...

  • Page 568

    1-4 module name description ntp network time protocol module pki public key infrastructure module rds radius module rmon remote monitor module rsa revest, shamir and adleman encryption module shell user interface module snmp simple network management protocol module socket socket module ssh secure s...

  • Page 569

    1-5 priority the priority is calculated using the following formula: facility*8+severity-1, in which z facility (the device name) defaults to local7 with the value being 23 (the value of local6 is 22, that of local5 is 21, and so on). Z severity (the information level) ranges from 1 to 8. Table 1-1 ...

  • Page 570

    1-6 you can use the sysname command to modify the system name. Refer to the system maintenance and debugging part of this manual for details) note that there is a space between the sysname and module fields. Module the module field represents the name of the module that generates system information....

  • Page 571

    1-7 task remarks setting to output system information to the snmp nms optional configuring synchronous information output synchronous information output refers to the feature that if the system information such as log, trap, or debugging information is output when the user is inputting commands, the...

  • Page 573

    1-9 table 1-4 default output rules for different output directions log trap debug output direction modules allowed enable d/disab led severit y enabled/ disabled severity enabled/ disabled severity console default (all modules) enable d warning s enabled debuggin g enabled debuggin g monitor termina...

  • Page 574

    1-10 setting to output system information to a monitor terminal system information can also be output to a monitor terminal, which is a user terminal that has login connections through the aux, vty, or tty user interface. Setting to output system information to a monitor terminal follow these steps ...

  • Page 575

    1-11 follow these steps to enable the display of system information on a monitor terminal: to do… use the command… remarks enable the debugging/log/trap information terminal display function terminal monitor optional enabled by default enable debugging information terminal display function terminal ...

  • Page 579

    1-15 # configure the host whose ip address is 202.38.1.10 as the log host. Permit arp and ip modules to output information with severity level higher than informational to the log host. [switch] info-center loghost 202.38.1.10 facility local4 [switch] info-center source arp channel loghost log level...

  • Page 580

    1-16 through combined configuration of the device name (facility), information severity level threshold (severity), module name (filter) and the file “syslog.Conf”, you can sort information precisely for filtering. Log output to a linux log host network requirements as shown in figure 1-2 , switch s...

  • Page 581

    1-17 note the following items when you edit file “/etc/syslog.Conf”. Z a note must start in a new line, starting with a “#" sign. Z in each pair, a tab should be used as a separator instead of a space. Z no space is permitted at the end of the file name. Z the device name (facility) and received log...

  • Page 582

    1-18 [switch] info-center enable # disable the function of outputting information to the console channels. [switch] undo info-center source default channel console # enable log information output to the console. Permit arp and ip modules to output log information with severity level higher than info...

  • Page 583: Table of Contents

    I table of contents 1 host configuration file loading··············································································································1-1 introduction to loading approaches ··································································································...

  • Page 584

    1-1 1 host configuration file loading z the term switch used throughout this document refers to a switching device in a generic sense or the switching engine of a wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. ...

  • Page 585

    1-2 connected to oap! Ftp 192.168.0.100 trying ... Press ctrl+k to abort connected. 220 3com 3cdaemon ftp server version 2.0 user(none):admin 331 user name ok, need password password: 230 user logged in [ftp]get config.Cfg config.Cfg 227 entering passive mode (192,168,0,100,5,95) 125 using existing ...

  • Page 586

    1-3 figure 1-2 remote loading using ftp server switch pc ethernet port internet ftp serve 10 .1 .1.1 ftp server 192 .168 .0.51 step 1: as shown in figure 1-2 , connect switch through an ethernet port to the pc (whose ip address is 10.1.1.1) step 2: configure the ip address of vlan-interface 1 on swi...

  • Page 587

    1-4 step 6: enter ftp 192.168.0.51 and enter the user name test, password pass to log on to the ftp server. C:\documents and settings\administrator>d: d:\>cd update d:\update>ftp 192.168.0.51 connected to 192.168.0.51. 220 ftp service ready. User (192.168.0.51:(none)): test 331 password required for...

  • Page 588

    1-5 z the steps listed above are performed in the windows operating system, if you use other ftp client software, refer to the corresponding user guide before operation. Z only the configuration steps concerning loading are listed here. For detailed description on the corresponding configuration com...

  • Page 590

    2-2 displaying the system status to do… use the command… remarks display the current date and time of the system display clock display the version of the system display version display the information about users logging onto the device display users [ all ] available in any view debugging the syste...

  • Page 591

    2-3 you can use the following commands to enable the two settings. Follow these steps to enable debugging and terminal display for a specific module: to do… use the command… remarks enable system debugging for specific module debugging module-name [ debugging-option ] required disabled for all modul...

  • Page 592: Network Connectivity Test

    3-1 3 network connectivity test network connectivity test ping you can use the ping command to check the network connectivity and the reachability of a host. Follow these steps to execute the ping command: to do… use the command… remarks check the ip network connectivity and the reachability of a ho...

  • Page 593: Device Management

    4-1 4 device management introduction to device management device management includes the following: z reboot the device z configure real-time monitoring of the running status of the system z specify the main configuration file to be used at the next reboot device management configuration device mana...

  • Page 594

    4-2 scheduling a reboot on the device after you schedule a reboot on the device, the device will reboot at the specified time. Follow these steps to schedule a reboot on the device: to do… use the command… remarks schedule a reboot on the device, and set the reboot date and time schedule reboot at h...

  • Page 596

    4-4 follow these steps to identify pluggable transceivers: to do… use the command… remarks display main parameters of the pluggable transceiver(s) display transceiver interface [ interface-type interface-number ] available for all pluggable transceivers diagnosing pluggable transceivers the system o...

  • Page 597: Table of Contents

    I table of contents 1 vlan-vpn configuration··························································································································1-1 vlan-vpn overview ················································································································...

  • Page 598: Vlan-Vpn Configuration

    1-1 1 vlan-vpn configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your devic...

  • Page 599

    1-2 figure 1-2 structure of packets with double-layer vlan tags destination mac address 0 31 data source mac address 15 inner vlan tag outer vlan tag compared with mpls-based layer 2 vpn, vlan-vpn has the following features: z it provides layer 2 vpn tunnels that are simpler. Z vlan-vpn can be imple...

  • Page 600

    1-3 as the position of the tpid field in an ethernet packet is the same as that of the upper-layer protocol type field in a packet without vlan tag, to avoid confusion in the process of receiving/forwarding a packet, the tpid value cannot be any of the protocol type value listed in table 1-1 . Table...

  • Page 601

    1-4 tpid adjusting configuration configuration prerequisites z to change the global tpid value 0x8100, you need to specify a port on the device as a vlan vpn uplink port. Before the configuration, make sure that vlan vpn is disabled on the port. Z for proper packet transmission, confirm the tpid val...

  • Page 602

    1-5 vlan-vpn configuration example transmitting user packets through a tunnel in the public network by using vlan-vpn network requirements z as shown in figure 1-4 , both switch a and switch b are the wx3000 series devices. They connect the users to the servers through the public network. Z pc users...

  • Page 603

    1-6 # set the global tpid value of switch a to 0x9200 and configure gigabitethernet 1/0/12 as a vlan vpn uplink port, so that switch a can intercommunicate with devices in the public network. [switcha] vlan-vpn tpid 9200 [switcha] interface gigabitethernet1/0/12 [switcha-gigabitethernet1/0/12] port ...

  • Page 604

    1-7 1) as gigabitethernet 1/0/11 of switch a is a vlan-vpn port, when a packet from the customer’s network side reaches this port, it is tagged with the default vlan tag of the port (vlan 1040). 2) the device sets the tpid value for the outer vlan tags of packets to user-defined value 0x9200 and the...

  • Page 605: Selective Qinq Configuration

    2-1 2 selective qinq configuration selective qinq overview selective qinq overview selective qinq is an enhanced application of the vlan-vpn feature. With the selective qinq feature, you can configure inner-to-outer vlan tag mapping, according to which you can add different outer vlan tags to the pa...

  • Page 606

    2-2 in this way, you can configure different forwarding policies for data of different type of users, thus improving the flexibility of network management. On the other hand, network resources are well utilized, and users of the same type are also isolated by their inner vlan tags. This helps to imp...

  • Page 607

    2-3 you are recommended not to configure both the dhcp snooping and selective q-in-q function on the device, which may result in the dhcp snooping to function abnormally. Configuring the inner-to-outer tag priority mapping feature configuration prerequisites enabling the vlan-vpn feature on the curr...

  • Page 608

    2-4 figure 2-2 network diagram for selective qinq configuration public network vlan1000/vlan1200 pc user vlan100~108 ip phone user vlan200~230 ge1/0/3 ge1/0/5 for pc user vlan100~108 for ip phone vlan200~230 switcha switchb ge1/0/11 ge1/0/12 ge1/0/13 configuration procedure z configure switch a. # c...

  • Page 609

    2-5 [switcha-gigabitethernet1/0/3] vlan-vpn enable # enable the selective qinq feature on gigabitethernet 1/0/3 to tag packets of vlan 100 through vlan 108 with the tag of vlan 1000 as the outer vlan tag, and tag packets of vlan 200 through vlan 230 with the tag of vlan 1200 as the outer vlan tag. [...

  • Page 610

    2-6 to make the packets from the servers be transmitted to the clients in the same way, you need to configure the selective qinq feature on gigabitethernet 1/0/12 and gigabitethernet 1/0/13. The configuration on switch b is similar to that on switch a and is thus omitted. Z the port configuration on...

  • Page 611: Table of Contents

    I table of contents 1 hwping configuration ······························································································································1-1 hwping overview ···············································································································...

  • Page 612: Hwping Configuration

    1-1 1 hwping configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a wx3000. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Hwping overview int...

  • Page 613

    1-2 figure 1-1 hwping illustration switch a switch b hwping client ip network hwping server test types supported by hwping table 1-1 test types supported by hwping supported test types description icmp test dhcp test ftp test http test dns test snmp test for these types of tests, you need to configu...

  • Page 614

    1-3 test parameter description source interface (source-interface) z for dhcp test, you must specify a source interface, which will be used by hwping client to send dhcp requests. If no source interface is specified for a dhcp test, the test will not succeed. Z after a source interface is specified,...

  • Page 615

    1-4 test parameter description file name for ftp operation (filename) name of a file to be transferred between hwping client and ftp server number of jitter test packets to be sent per probe (jitter-packetnum) z jitter test is used to collect statistics about delay jitter in udp packet transmission ...

  • Page 616

    1-5 hwping server configuration the following table describes the configuration on hwping server, which is the same for hwping test types that need to configure hwping server. Follow these steps to configure the hwping server: to do… use the command… remarks enter system view system-view — enable th...

  • Page 617

    1-6 to do… use the command… remarks configure the number of probes per test count times optional by default, each test makes one probe. Configure the packet size datasize size optional by default, the packet size is 56 bytes. Configure the maximum number of history records that can be saved history-...

  • Page 618

    1-7 to do… use the command… remarks configure the source interface source-interface interface-type interface-number required you can only configure a vlan interface as the source interface. By default, no source interface is configured. Configure the test type test-typedhcp required by default, the ...

  • Page 619

    1-8 to do… use the command… remarks configure the number of probes per test count times optional by default, each test makes one probe. Configure the maximum number of history records that can be saved history-records number optional by default, the maximum number is 50. Configure the automatic test...

  • Page 620

    1-9 to do… use the command… remarks configure the destination ip address destination-ip ip-address required you can configure an ip address or a host name. By default, no destination address is configured. Configure dns-server dns-server ip-address required when you use the destination-ip command to...

  • Page 621

    1-10 5) configuring jitter test on hwping client follow these steps to configure jitter test on hwping client: to do… use the command… remarks enter system view system-view — enable the hwping client function hwping-agent enable required by default, the hwping client function is disabled. Create a h...

  • Page 622

    1-11 to do… use the command… remarks configure the probe timeout time timeout time optional by default, a probe times out in three seconds. Configure the type of service tos value optional by default, the service type is zero. Configure the number of test packets that will be sent in each jitter pro...

  • Page 623

    1-12 to do… use the command… remarks configure the maximum number of history records that can be saved history-records number optional by default, the maximum number is 50. Configure the automatic test interval frequency interval optional by default, the automatic test interval is zero seconds, indi...

  • Page 624

    1-13 to do… use the command… remarks configure the destination port destination-port port-number required in a tcpprivate test a tcppublic test is a tcp connection test on port 7. Use the hwping-server tcpconnect ip-address 7 command on the server to configure the listening service port; otherwise t...

  • Page 625

    1-14 to do… use the command… remarks enter system view system-view — enable the hwping client function hwping-agent enable required by default, the hwping client function is disabled. Create a hwping test group and enter its view hwping administrator-name operation- tag required by default, no test ...

  • Page 626

    1-15 to do… use the command… remarks configure the automatic test interval frequency interval optional by default, the automatic test interval is zero seconds, indicating no automatic test will be made. Configure the probe timeout time timeout time optional by default, a probe times out in three sec...

  • Page 627

    1-16 to do… use the command… remarks configure the probe timeout time timeout time optional by default, a probe times out in three seconds. Configure the type of service tos value optional by default, the service type is zero. Configure the domain name to be resolved dns resolve-targetdomai domainna...

  • Page 628

    1-17 displaying and maintaining hwping to do… use the command… remarks display test history display hwping history [ administrator-name operation-tag ] display the results of the latest test display hwping results [ administrator-name operation-tag ] available in any view hwping configuration exampl...

  • Page 629

    1-18 # display test results. [device-hwping-administrator-icmp] display hwping results administrator icmp hwping entry(admin administrator, tag icmp) test result: destination ip address:10.2.2.2 send operation times: 10 receive response times: 10 min/max/average round trip time: 3/6/3 square-sum of ...

  • Page 630

    1-19 # create a hwping test group, setting the administrator name to "administrator" and test tag to "dhcp". [device] hwping administrator dhcp # configure the test type as dhcp. [device-hwping-administrator-dhcp] test-type dhcp # configure the source interface, which must be a vlan interface. Make ...

  • Page 631

    1-20 ftp test network requirements as shown in figure 1-4 , both the hwping client and the ftp server are wx3000 series devices. Perform a hwping ftp test between the two devices to test the connectivity to the specified ftp server and the time required to upload a file to the server after the conne...

  • Page 632

    1-21 [device-hwping-administrator-ftp] count 10 # set the probe timeout time to 30 seconds. [device-hwping-administrator-ftp] timeout 30 # configure the source ip address [device-hwping-administrator-ftp] source-ip 10.1.1.1 # start the test. [device-hwping-administrator-ftp] test-enable # display te...

  • Page 633

    1-22 http test network requirements as shown in figure 1-5 , switch serves as the hwping client, and a pc serves as the http server. Perform a hwping http test between switch and the http server to test the connectivity and the time required to download a file from the http server after the connecti...

  • Page 634

    1-23 sd maximal delay: 0 ds maximal delay: 0 packet lost in test: 0% disconnect operation number: 0 operation timeout number: 0 system busy operation number: 0 connection fail number: 0 operation sequence errors: 0 drop operation number: 0 other operation errors: 0 http result: dns resolve time: 0 h...

  • Page 635

    1-24 network diagram figure 1-6 network diagram for the jitter test switch a switch b hwping client ip network 10.1.1.1/8 10.2.2.2/8 hwping server configuration procedure z configure hwping server (switch b): # enable the hwping server and configure the ip address and port to listen on. System-view ...

  • Page 636

    1-25 packet lost in test: 0% disconnect operation number: 0 operation timeout number: 0 system busy operation number: 0 connection fail number: 0 operation sequence errors: 0 drop operation number: 0 other operation errors: 0 jitter result: rtt number:100 min positive sd:1 min positive ds:1 max posi...

  • Page 637

    1-26 network diagram figure 1-7 network diagram for the snmp test switch a switch b hwping client ip n etwork 10.1.1.1/8 10.2.2.2/8 snmp agent configuration procedure z configure snmp agent (switch b): # start snmp agent and set snmp version to v2c, read-only community name to "public", and read-wri...

  • Page 638

    1-27 [device-hwping-administrator-snmp] test-enable # display test results [device-hwping-administrator-snmp] display hwping results administrator snmp hwping entry(admin administrator, tag snmp) test result: destination ip address:10.2.2.2 send operation times: 10 receive response times: 10 min/max...

  • Page 639

    1-28 configuration procedure z configure hwping server (switch b): # enable the hwping server and configure the ip address and port to listen on. System-view [device] hwping-server enable [device] hwping-server tcpconnect 10.2.2.2 8000 z configure hwping client (switch a): # enable the hwping client...

  • Page 640

    1-29 index response status lastrc time 1 4 1 0 2000-04-02 08:26:02.9 2 5 1 0 2000-04-02 08:26:02.8 3 4 1 0 2000-04-02 08:26:02.8 4 5 1 0 2000-04-02 08:26:02.7 5 4 1 0 2000-04-02 08:26:02.7 6 5 1 0 2000-04-02 08:26:02.6 7 6 1 0 2000-04-02 08:26:02.6 8 7 1 0 2000-04-02 08:26:02.5 9 5 1 0 2000-04-02 08...

  • Page 641

    1-30 [device-hwping-administrator-udpprivate] destination-ip 10.2.2.2 # configure the destination port on the hwping server. [device-hwping-administrator-udpprivate] destination-port 8000 # configure to make 10 probes per test. [device-hwping-administrator-udpprivate] count 10 # set the probe timeou...

  • Page 642

    1-31 network diagram figure 1-10 network diagram for the dns test switch hwping client ip network 10.1.1.1/8 10.2.2.2/8 dns server configuration procedure z configure dns server: use windows 2003 server as the dns server. For dns server configuration, refer to the related instruction on windows 2003...

  • Page 643

    1-32 system busy operation number: 0 connection fail number: 0 operation sequence errors: 0 drop operation number: 0 other operation errors: 0 dns result: dns resolve current time: 10 dns resolve min time: 6 dns resolve times: 10 dns resolve max time: 10 dns resolve timeout times: 0 dns resolve fail...

  • Page 644: Table of Contents

    I table of contents 1 dns configuration·····································································································································1-1 dns overview················································································································...

  • Page 645: Dns Configuration

    1-1 1 dns configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your device may vary. Z this chapte...

  • Page 646

    1-2 figure 1-1 dynamic domain name resolution request response response request save read dns client dns server resolver cache user program figure 1-1 shows the relationship between user program, dns client, and dns server. The resolver and cache comprise the dns client. The user program and dns cli...

  • Page 647

    1-3 to do… use the command… remarks enter system view system-view — configure a mapping between a host name and an ip address ip host hostname ip-address required no ip address is assigned to a host name by default. The ip address you assign to a host name last time will overwrite the previous one i...

  • Page 648

    1-4 figure 1-2 network diagram for static dns configuration 10.1 .1.1/24 10 .1.1. 2/ 24 host.Com host switch configuration procedure # configure a mapping between host name host.Com and ip address 10.1.1.2. System-view [device] ip host host.Com 10.1.1.2 # execute the ping host.Com command to verify ...

  • Page 649

    1-5 configuration procedure before doing the following configuration, make sure that: z the routes between the dns server, switch, and host are reachable. Z necessary configurations are done on the devices. For the ip addresses of the interfaces, see the figure above. Z there is a mapping between do...

  • Page 650

    1-6 displaying and maintaining dns to do… use the command… remarks display static dns database display ip host display the dns server information display dns server [ dynamic ] display the dns suffixes display dns domain [ dynamic ] display the information in the dynamic domain name cache display dn...

  • Page 651: Table of Contents

    I table of contents 1 smart link configuration ·························································································································1-1 smart link overview ············································································································...

  • Page 652: Smart Link Configuration

    1-1 1 smart link configuration z the term switch used throughout this chapter refers to a switching device in a generic sense or the switching engine of a unified switch in the wx3000 series. Z the sample output information in this manual was created on the wx3024. The output information on your dev...

  • Page 653

    1-2 master port the master port can be either an ethernet port or a manually-configured or static lacp aggregation group. For example, you can configure gigabitethernet 1/0/1 of switch a in figure 1-1 as the master port through the command line. Slave port the slave port can be either an ethernet po...

  • Page 654

    1-3 operating mechanism of smart link figure 1-2 network diagram of smart link operating mechanism block switch a switch b ge 1/0 /1 ge1 /0/2 switch c switch d switch e ge1 /0/1 ge1 /0/2 ge 1/0 /3 ge 1/0/1 ge 1/0/2 ge1/0/3 ge 1/0/11 ge 1/0/12 as shown in figure 1-2 , gigabitethernet 1/0/1 on switch ...

  • Page 655

    1-4 task remarks create a smart link group add member ports to the smart link group configuring a smart link device enable the function of sending flush messages in the specified control vlan required configuring associated devices enable the function of processing flush messages received from the s...

  • Page 656

    1-5 to do… use the command… remarks enable the function of sending flush messages in the specified control vlan flush enable control-vlan vlan-id optional by default, no control vlan for sending flush messages is specified. Configuring associated devices an associated device mentioned in this docume...

  • Page 657

    1-6 z when you copy a port, the smart link/monitor link group member information configured on the port will not be copied to other ports. Z if a single port is specified as a member of a smart link/monitor link group, you cannot execute the lacp enable command on this port or add this port into oth...

  • Page 658

    1-7 figure 1-3 network diagram for smart link configuration switch a ge 1/0/1 ge 1/0 /2 switch c server ge1/0/1 ge1/0/2 ge 1/0/2 pc switch d switch e ge 1/0 /3 ge 1/0/2 ge 1/0 /1 configuration procedure 1) configure a smart link group on switch a and configure member ports for it. Enable the functio...

  • Page 659

    1-8 # enable the function of processing flush messages received from vlan 1 on gigabitethernet 1/0/2. Smart-link flush enable control-vlan 1 port gigabitethernet 1/0/2 3) enable the function of processing flush messages received from vlan 1 on switch d. # enter system view. System-view # enable the ...

  • Page 660: Monitor Link Configuration

    2-1 2 monitor link configuration introduction to monitor link monitor link is a collaboration scheme introduced to complement for smart link. It is used to monitor uplink and to perfect the backup function of smart link. A monitor link consists of an uplink port and one or multiple downlink ports. W...

  • Page 661

    2-2 how monitor link works figure 2-2 network diagram for a monitor link group implementation block switch a switch b ge 1/0 /1 ge1 /0/2 switch c switch d switch e ge1 /0/1 ge1 /0/2 ge 1/0 /3 ge 1/0/1 ge 1/0/2 ge1/0/3 ge 1/0/11 ge 1/0/12 as shown in figure 2-2 , the devices switch c and switch d are...

  • Page 662

    2-3 configuring monitor link before configuring a monitor link group, you must create a monitor link group and configure member ports for it. A monitor link group consists of an uplink port and one or multiple downlink ports. The uplink port can be a manually-configured or static lacp link aggregati...

  • Page 663

    2-4 to do… use the command… remarks configure the specified link aggregation group as the uplink port of the monitor link group link-aggregation group group-id uplink configure the specified smart link group as the uplink port of the monitor link group smart-link group group-id uplink monitor link g...

  • Page 664

    2-5 z a smart link/monitor link group with members cannot be deleted. A smart link group as a monitor link group member cannot be deleted. Z the smart link/monitor link function and the remote port mirroring function are incompatible with each other. Z if a single port is specified as a smart link/m...

  • Page 665

    2-6 figure 2-3 network diagram for monitor link configuration block switch a switch b ge1 /0/1 ge1/0 /2 switch c switch d switch e ge1/0 /1 ge1/0 /2 ge1 /0/3 server ge 1/0/2 ge 1/0/2 ge 1/0/1 ge1 /0/1 ge1 /0/3 ge 1/0/11 ge1/0/10 pc 1 pc 4 pc 3 pc 2 configuration procedure 1) enable smart link on swi...

  • Page 666

    2-7 2) enable monitor link on switch c and switch d and enable the function of processing flush messages received from vlan 1. Perform the following configuration on switch c. The operation procedure on switch d is the same as that performed on switch c. # enter system view. System-view # create mon...

  • Page 667: Table of Contents

    I table of contents 1 poe configuration ·····································································································································1-1 poe overview ··············································································································...

  • Page 668: Poe Configuration

    1-1 1 poe configuration when configuring poe, go to these sections for information you are interested in: z poe overview z poe configuration z poe configuration example the terms switching engine and ethernet switch used throughout this documentation refer to a switching device in a generic sense or...

  • Page 669

    1-2 poe features supported by the device table 1-1 power supply parameters of poe device device input power supply number of electrical ports supplying power maximum poe distance maximum power provided by each electrical port total maximum poe output power dc input 600 w wx3024 ac input 24 100 m (32...

  • Page 670

    1-3 task remarks enabling the poe feature on a port required setting the maximum output power on a port optional setting poe management mode and poe priority of a port optional setting the poe mode on a port optional configuring the pd compatibility detection function optional upgrading the pse proc...

  • Page 671

    1-4 setting poe management mode and poe priority of a port when the device is close to its full load in supplying power, you can adjust the power supply of the device through the cooperation of the poe management mode and the port poe priority settings. The device supports two poe management modes, ...

  • Page 672

    1-5 to do… use the command… remarks set the poe mode on the port to signal poe mode signal optional signal by default. Configuring the pd compatibility detection function after the pd compatibility detection function is enabled, the device can detect the pds that do not conform to the 802.3af standa...

  • Page 673

    1-6 z in the case that the pse processing software is damaged (that is, no poe command can be executed successfully), use the full update mode to upgrade and thus restore the software. Z the refresh update mode is to upgrade the original processing software in the pse through refreshing the software...

  • Page 674

    1-7 figure 1-1 network diagram for poe switch a network ge1/0/2 ge1 /0/1 ge1 /0/8 switch b ap ap configuration procedure # upgrade the pse processing software online. System-view [switcha] poe update refresh 0290_021.S19 # enable the poe feature on gigabitethernet 1/0/1, and set the poe maximum outp...

  • Page 675: Poe Profile Configuration

    2-1 2 poe profile configuration introduction to poe profile on a large-sized network or a network with mobile users, to help network administrators to monitor the poe features of the device, the device provides the poe profile features. A poe profile is a set of poe configurations, including multipl...

  • Page 676

    2-2 to do… use the command… remarks in system view apply poe-profile profile-name interface interface-type interface-number [ to interface-type interface-number ] enter ethernet port view interface interface-type interface-number apply the existing poe profile to the specified ethernet port in ether...

  • Page 677

    2-3 poe profile configuration example poe profile application example network requirements as shown in figure 2-1 , switch a supports poe. Gigabitethernet 1/0/1 through gigabitethernet 1/0/10 of switch a are used by users of group a, who have the following requirements: z the poe function can be ena...

  • Page 678

    2-4 [switcha-poe-profile-profile1] poe enable [switcha-poe-profile-profile1] poe mode signal [switcha-poe-profile-profile1] poe priority critical [switcha-poe-profile-profile1] poe max-power 3000 [switcha-poe-profile-profile1] quit # display detailed configuration information for profile1. [switcha]...

  • Page 679: Table of Contents

    I table of contents 1 ip routing protocol overview ··················································································································1-1 introduction to ip route and routing table·························································································...

  • Page 680

    Ii filters ···············································································································································4-1 ip route policy configuration task list··································································································4-2 r...

  • Page 681: Ip Routing Protocol Overview

    1-1 1 ip routing protocol overview go to these sections for information you are interested in: z introduction to ip route and routing table z routing protocol overview z displaying and maintaining a routing table the term router in this chapter refers to a router in a generic sense or a wx3000 serie...

  • Page 682

    1-2 host or router resides. For example, if the destination address is 129.102.8.10 and the mask is 255.255.0.0, the address of the network segment where the destination host or router resides is 129.102.0.0. A mask consists of some consecutive 1s, represented either in dotted decimal notation or by...

  • Page 683

    1-3 routing protocol overview static routing and dynamic routing static routing is easy to configure and requires less system resources. It works well in small, stable networks with simple topologies. It cannot adapt itself to any network topology change automatically so that you must perform routin...

  • Page 684

    1-4 each routing protocol (including static routes) is assigned a priority. The route found by the routing protocol with the highest priority is preferred. The following table lists some routing protocols and the default priorities for routes found by them: table 1-1 routing protocols and priorities...

  • Page 685

    1-5 routing information. Each routing protocol shares routing information discovered by other routing protocols through a route redistribution mechanism. Displaying and maintaining a routing table to do… use the command… remarks display brief information about a routing table display ip routing-tabl...

  • Page 686: Static Route Configuration

    2-1 2 static route configuration when configuring a static route, go to these sections for information you are interested in: z introduction to static route z static route configuration z displaying and maintaining static routes z static route configuration example z troubleshooting a static route t...

  • Page 687

    2-2 default route to avoid too large a routing table, you can configure a default route. When the destination address of a packet fails to match any entry in the routing table, z if there is default route in the routing table, the default route will be selected to forward the packet. Z if there is n...

  • Page 688

    2-3 displaying and maintaining static routes to do... Use the command... Remarks display the current configuration information display current-configuration display the brief information of a routing table display ip routing-table display the detailed information of a routing table display ip routin...

  • Page 689

    2-4 configuration procedure when only one interface of the device is interconnected with another network segment, you can implement network communication by configuring either a static route or default route. 1) perform the following configurations on the device. # approach 1: configure static route...

  • Page 690: Rip Configuration

    3-1 3 rip configuration when configuring rip, go to these sections for information you are interested in: z rip overview z rip configuration task list z rip configuration example z troubleshooting rip configuration the term router in this chapter refers to a router in a generic sense or a wx3000 ser...

  • Page 691

    3-2 z interface: outbound interface on this router, through which ip packets should be forwarded to reach the destination. Z metric: cost from the local router to the destination. Z route time: time elapsed since the routing entry was last updated. The time is reset to 0 every time the routing entry...

  • Page 692

    3-3 rip configuration task list complete the following tasks to configure rip: task remarks enabling rip on the interfaces attached to a specified network segment required setting the rip operating status on an interface optional configuring basic rip functions specifying the rip version on an inter...

  • Page 693

    3-4 z related rip commands configured in interface view can take effect only after rip is enabled. Z rip operates on the interfaces attached to a specified network segment. When rip is disabled on an interface, it does not operate on the interface, that is, it neither receives/sends routes on the in...

  • Page 694

    3-5 z set the preference of rip to change the preference order of routing protocols. This order makes sense when more than one route to the same destination is discovered by multiple routing protocols. Z redistribute external routes in an environment with multiple routing protocols. Configuration pr...

  • Page 695

    3-6 follow these steps to configure rip route summarization: to do... Use the command... Remarks enter system view system-view — enter rip view rip — enable rip-2 automatic route summarization summary required enabled by default disabling the router from receiving host routes in some special cases, ...

  • Page 696

    3-7 z the filter-policy import command filters the rip routes received from neighbors, and the routes being filtered out will neither be added to the routing table nor be advertised to any neighbors. Z the filter-policy export command filters all the routes to be advertised, including the routes red...

  • Page 697

    3-8 configuration prerequisites before adjusting rip, perform the following tasks: z configuring the network layer addresses of interfaces so that adjacent nodes are reachable to each other at the network layer z configuring basic rip functions configuration tasks configuring rip timers follow these...

  • Page 698

    3-9 to do... Use the command... Remarks enter system view system-view — enter rip view rip — enable the check of the must be zero field in rip-1 packets checkzero required enabled by default some fields in a rip-1 packet must be 0, and they are known as must be zero field. For rip-1, the must be zer...

  • Page 699

    3-10 to do... Use the command... Remarks configure rip to unicast rip packets peer ip-address required when rip runs on the link that does not support broadcast or multicast, you must configure rip to unicast rip packets. Displaying and maintaining rip configuration to do... Use the command... Remar...

  • Page 700

    3-11 configuration procedure only the configuration related to rip is listed below. Before the following configuration, make sure the ethernet link layer works normally and the ip addresses of vlan interfaces are configured correctly. 1) configure switch a: # configure rip. System-view [switcha] rip...

  • Page 701

    4-1 4 ip route policy configuration when configuring an ip route policy, go to these sections for information you are interested in: z ip route policy overview z ip route policy configuration task list z displaying and maintaining ip route policy z ip route policy configuration example z troubleshoo...

  • Page 702

    4-2 for acl configuration, refer to the part discussing acl. Route policy a route policy is used to match some attributes with given routing information and the attributes of the information will be set if the conditions are satisfied. A route policy can comprise multiple nodes. Each node is a unit ...

  • Page 704

    4-4 to do... Use the command... Remarks define a rule to match the next-hop address of routing information if-match ip next-hop acl acl-number optional by default, no matching is performed on the next-hop address of routing information. Apply a cost to routes satisfying matching rules apply cost val...

  • Page 705

    4-5 figure 4-1 network diagram device interface ip address switch a vlan-int 2 2.2.2.1/8 vlan-int 3 3.3.3.254/8 vlan-int 10 1.1.1.254/8 switch b vlan-int 3 3.3.3.253/8 vlan-int 6 6.6.6.5/8 vlan-int 10 1.1.1.253/8 switch c vlan-int 1 192.168.0.39/24 vlan-int 2 2.2.2.2/8 vlan-int 6 6.6.6.6/8 oa server...

  • Page 706

    4-6 [switcha-rip] network 2.0.0.0 [switcha-rip] network 3.0.0.0 2) configure switch b. # create vlans and configure ip addresses for the vlan interfaces. The configuration procedure is omitted. # configure rip. System-view [switchb] rip [switchb-rip] network 1.0.0.0 [switchb-rip] network 3.0.0.0 [sw...

  • Page 707

    4-7 # create node 40 with the matching mode being permit in the route policy. Define if-match clauses. Apply the cost 5 to routes matching the outgoing interface vlan-interface 6 and acl 2001. [switchc] route-policy in permit node 40 [switchc-route-policy] if-match interface vlan-interface6 [switchc...

  • Page 708

    4-8 precautions 1) when you configure the apply cost command in a route policy: z the new cost should be greater than the original one to prevent rip from generating routing loop in the case that a loop exists in the topology. Z the cost will become 16 if you try to set it to a value greater than 16...

  • Page 709: Table of Contents

    I table of contents 1 udp helper configuration ························································································································1-1 introduction to udp helper ······································································································...

  • Page 710: Udp Helper Configuration

    1-1 1 udp helper configuration when configuring udp helper, go to these sections for information you are interested in: z introductiontoudphelper z configuring udp helper z displaying and maintaining udp helper z udp helper configuration example introduction to udp helper sometimes, a host needs to ...

  • Page 712

    1-3 displaying and maintaining udp helper to do… use the command… remarks display the udp broadcast relay forwarding information of a specified vlan interface on the device display udp-helper server [ interface vlan-interface vlan-id ] available in any view clear statistics about packets forwarded b...

  • Page 713: Table of Contents

    I table of contents appendix a acronyms ································································································································ a-1.

  • Page 714: Appendix A  Acronyms

    A-1 appendix a acronyms a aaa authentication, authorization and accounting abr area border router acl access control list arp address resolution protocol as autonomous system asbr autonomous system border router b bdr backup designated router c car committed access rate cli command line interface co...

  • Page 715

    A-2 l lsa link state advertisement lsdb link state database m mac medium access control mib management information base n nbma non broadcast multiaccess nic network information center nms network management system nvram nonvolatile ram p pim protocol independent multicast pim-dm protocol independent...