Page 1 H3C S5120-EI Switch Series Layer 2 - LAN Switching Configuration Guide Hangzhou H3C Technologies Co., Ltd. http://www.h3c.com Software version: Release 2210 Document version: 6W100-20110915...
Page 2 SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V G, V G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. All other trademarks that may be mentioned in this manual are the property of their respective owners Notice The information in this document is subject to change without notice.
Page 3 The H3C S5120-EI documentation set includes 10 configuration guides, which describe the software features for the H3C S5120-EI Switch Series Release 2210, and guide you through the software configuration procedures. These configuration guides also provide configuration examples to help you apply software features to different network scenarios.
Page 4 Feature module New features Changed features • Restoring the default setting of an aggregate interface • Limiting the number of selected ports in Ethernet link an aggregation group aggregation • Assigning aggregation priority to ports in a static aggregation group Port isolation •...
Page 5 Convention Description Square brackets enclose a set of optional syntax choices separated by vertical bars, from [ x | y | ... ] which you select one or none. Asterisk marked braces enclose a set of required syntax choices separated by vertical { x | y | ...
Page 6: Obtaining Documentation
Obtaining documentation You can access the most up-to-date H3C product documentation on the World Wide Web at http://www.h3c.com. Click the links on the top navigation bar to obtain different categories of product documentation: [Technical Support &...
Page 7: Technical Support
[Technical Support & Documents > Software Download] – Provides the documentation released with the software version. Technical support customer_service@h3c.com http://www.h3c.com Documentation feedback You can e-mail your comments about product documentation to info@h3c.com. We appreciate your comments.
Page 8: Table Of Contents
Contents Ethernet interface configuration ·································································································································· 1 Ethernet interface naming conventions ···························································································································1 Configuring a combo interface ·······································································································································1 Introduction to combo interfaces·····························································································································1 Configuration prerequisites ·····································································································································1 Changing the active port of a combo interface ····································································································1 Configuring basic settings of an Ethernet interface·······································································································2 Shutting down an Ethernet interface ·······························································································································3 Setting speed options for auto negotiation on an Ethernet interface···········································································3 Configuring flow control on an Ethernet interface·········································································································4 Configuring link change suppression on an Ethernet interface····················································································5...
Page 9 MAC Information configuration ································································································································28 Overview········································································································································································· 28 Introduction to MAC Information ························································································································· 28 How MAC Information works ······························································································································ 28 Configuring MAC Information ······································································································································ 28 Enabling MAC Information globally ··················································································································· 28 Enabling MAC Information on an interface ······································································································· 28 Configuring MAC Information mode ·················································································································· 29 Configuring the interval for sending Syslog or trap messages·········································································...
Page 10 Implementation of MSTP on devices···················································································································· 66 Protocols and standards ················································································································································ 66 Spanning tree configuration task list···························································································································· 66 Configuring the spanning tree ······································································································································ 71 Setting the spanning tree mode ··························································································································· 71 Configuring an MST region ································································································································· 71 Configuring the root bridge or a secondary root bridge·················································································· 72 Configuring the device priority ····························································································································...
Page 11 Assigning an access port to a VLAN ················································································································114 Assigning a trunk port to a VLAN······················································································································115 Assigning a hybrid port to a VLAN···················································································································116 Port-based VLAN configuration example··········································································································117 MAC-based VLAN configuration································································································································119 Introduction to MAC-based VLAN ·····················································································································119 Configuring a MAC-based VLAN······················································································································121 MAC-based VLAN configuration example ·······································································································123 Protocol-based VLAN configuration ···························································································································126 Introduction to protocol-based VLAN ················································································································126 Configuring a protocol-based VLAN·················································································································126...
Page 12 QinQ configuration················································································································································· 163 Introduction to QinQ····················································································································································163 Background and benefits····································································································································163 How QinQ works ················································································································································163 QinQ frame structure ··········································································································································164 Implementations of QinQ ···································································································································165 Modifying the TPID in a VLAN tag ····················································································································165 Protocols and standards ·····································································································································166 QinQ configuration task list········································································································································167 Configuring basic QinQ ·············································································································································167 Enabling basic QinQ··········································································································································167 Configuring VLAN transparent transmission ····································································································167 Configuring selective QinQ ········································································································································168...
Page 13: Ethernet Interface Configuration
Ethernet interface configuration Ethernet interface naming conventions The GE and 10-GE interfaces on the S5120-EI switches are named in the format of interface-type A/B/C, where the following definitions apply: A represents the ID of the switch in an IRF fabric. If the switch is not assigned to any IRF fabric, A •...
Page 14: Configuring Basic Settings Of An Ethernet Interface
To do… Use the command… Remarks Optional Activate the current undo shutdown By default, of the two ports that compose a combo interface interface, the one with a smaller port ID is active. Configuring basic settings of an Ethernet interface You can set an Ethernet interface to operate in one of the following duplex modes: •...
Page 15: Shutting Down An Ethernet Interface
NOTE: Make sure that the fiber port speed matches the speed requirement of the inserted transceiver module. For example, after you insert a 1000-Mbps transceiver module into a fiber port, configure the port speed with the speed 1000 or speed auto command. Shutting down an Ethernet interface You might need to shut down and then bring up an Ethernet interface to activate some configuration changes, for example, the speed or duplex mode changes.
Page 16: Configuring Flow Control On An Ethernet Interface
Figure 1 Speed auto negotiation application scenario IP network GE1/0/4 Switch A Server 1 Server 2 Server 3 As shown inFigure 1, all ports on Switch A are operating in speed auto negotiation mode, with the highest speed of 1000 Mbps. If the transmission rate of each server in the server cluster is 1000 Mbps, their total transmission rate will exceed the capability of port GigabitEthernet 1/0/4, the port providing access to the Internet for the servers.
Page 17: Configuring Link Change Suppression On An Ethernet Interface
To handle unidirectional traffic congestion on a link, configure the flow-control receive enable command at one end, and the flow-control command at the other. To enable both ends of the link to handle traffic congestion, configure the flow-control command at both ends. Follow these steps to enable flow control on an Ethernet interface: To do…...
Page 18: Configuring Link-Up Event Suppression
To do… Use the command… Remarks Required Set a link-down event link-delay delay-time Link-down event suppression is disabled by suppression interval default. Configuring link-up event suppression Follow these steps to configure link-up event suppression on an Ethernet interface: To do… Use the command…...
Page 19: Configuring Jumbo Frame Support
NOTE: On an interface that is physically down, you can only perform internal loopback testing. On an interface • administratively shut down, you can perform neither internal nor external loopback testing. The speed, duplex, mdi, and shutdown commands are not available during loopback testing. •...
Page 20: Enabling Energy Saving Functions On An Ethernet Interface
To do… Use the command… Remarks Enter system view system-view — Create a manual port group and port-group manual Required enter manual port group view port-group-name Required If you use the group-member interface-type interface-start-number to interface-type Assign Ethernet interfaces to the group-member interface-end-number command to add multiple manual port group...
Page 21: Configuring Storm Suppression
Configuring storm suppression You can use the storm suppression function to limit the size of a particular type of traffic (broadcast, multicast, or unknown unicast traffic) as a whole globally in system view or on a per-interface basis in Ethernet interface view or port group view. NOTE: The storm suppression thresholds configured for an Ethernet interface might become invalid if you enable the storm control function for the interface.
Page 22: Enabling Loopback Detection On An Ethernet Interface
To do… Use the command… Remarks interface interface-type Enter Ethernet interface view — interface-number Optional Set the statistics polling interval on flow-interval interval The default interface statistics the Ethernet interface polling interval is 300 seconds. To display the interface statistics collected in the last polling interval, use the display interface command. To clear interface statistics, use the reset counters interface command.
Page 23 when a loop is detected, for example, to shut down the interface. Depending on whether a protective action is configured, the switch takes the actions in Table 1 to alleviate the impact of the loop condition. Table 1 Actions to take upon detection of a loop condition Actions Port type No protective action is configured...
Page 24: Setting The Mdi Mode Of An Ethernet Interface
To do… Use the command… Remarks Optional By default, a looped interface does not receive or send packets; the system generates traps and deletes all MAC Set the protective action to loopback-detection action address entries of the looped interface. take on the interface when { no-learning | semi-block | With the shutdown keyword specified, the a loop is detected...
Page 25: Enabling Bridging On An Ethernet Interface
When a straight-through cable is used, set the interface to work in the MDI mode different than its • peer. • When a crossover cable is used, set the interface to work in the same MDI mode as its peer, or set either end to work in auto mode.
Page 26: Configuring Storm Control On An Ethernet Interface
To do… Use the command… Remarks Enter system view system-view — Enter Ethernet interface view interface interface-type interface-number — Test the cable connected to the virtual-cable-test Required Ethernet interface Configuring storm control on an Ethernet interface Storm control compares broadcast, multicast, and unknown unicast traffic regularly with their respective traffic thresholds on an Ethernet interface.
Page 27: Displaying And Maintaining An Ethernet Interface
To do… Use the command… Remarks Optional By default, the interface sends Enable the interface to send storm traps when monitored traffic storm-constrain enable trap control threshold event traps. exceeds the upper threshold or drops below the lower threshold from the upper threshold. Optional By default, the interface outputs log Enable the interface to log storm...
Page 28 To do… Use the command… Remarks display storm-constrain [ broadcast | multicast | unicast ] Display information about storm Available in [ interface interface-type interface-number ] [ | { begin | control any view exclude | include } regular-expression ] reset counters interface [ interface-type Available in Clear the interface statistics...
Page 29: Loopback And Null Interface Configuration
Loopback and null interface configuration Configuring a loopback interface Introduction to the loopback interface A loopback interface is a software-only virtual interface. It delivers the following benefits. The physical layer state and link-layer protocols of a loopback interface are always up unless the •...
Page 30: Configuring The Null Interface
NOTE: You can configure settings such as IP addresses and IP routes on loopback interfaces. For more Layer 3—IP Services Configuration Guide Layer 3—IP Routing Configuration Guide information, see Configuring the null interface Introduction to the null interface A null interface is a completely software-based logical interface, and is always up. However, you cannot use it to forward data packets or configure an IP address or link-layer protocol on it.
Page 31 To do… Use the command… Remarks display interface [ null ] [ brief [ down ] ] [ | { begin | exclude | include } regular-expression ] Display information about Available in any view the null interface display interface null 0 [ brief ] [ | { begin | exclude | include } regular-expression ] Clear the statistics on a reset counters interface [ loopback...
Page 32: Mac Address Table Configuration
MAC address table configuration Overview An Ethernet device uses a MAC address table for forwarding frames through unicast instead of broadcast. This table describes from which port a MAC address (or host) can be reached. When forwarding a frame, the device first looks up the MAC address of the frame in the MAC address table for a match.
Page 33: Mac Address Table-Based Frame Forwarding
Blackhole entries, which are manually configured and never age out. Blackhole entries are • configured for filtering out frames with specific source or destination MAC addresses. For example, to block all packets destined for a specific user for security concerns, you can configure the MAC address of this user as a blackhole MAC address entry.
Page 34: Disabling Mac Address Learning
To do… Use the command… Remarks Required mac-address { dynamic | static } Add or modify a dynamic or mac-address interface interface-type Use either command. static MAC address entry interface-number vlan vlan-id Make sure that you have created Add or modify a blackhole mac-address blackhole mac-address vlan the VLAN and assign the MAC address entry...
Page 35: Configuring The Aging Timer For Dynamic Mac Address Entries
To do… Use the command… Remarks Optional Enable global MAC undo mac-address mac-learning address learning disable Enabled by default. • Enter Layer 2 Ethernet interface Required view or Layer 2 aggregate Use either command. interface view: Settings in Layer 2 Ethernet interface view Enter interface view or interface interface-type or Layer 2 aggregate interface view take...
Page 36: Enabling Mac Address Roaming
Follow these steps to configure the MAC learning limit on a Layer 2 Ethernet interface or all ports in a port group: To do… Use the command… Remarks Enter system view system-view — Enter Layer 2 Ethernet interface Required view: Use either command.
Page 37 Figure 4 MAC address tables of devices when Client A associates with AP C MAC address Port MAC address Port MAC A MAC A Device A Device B Port B1 Port A1 AP C AP D Client A If Client A roams to AP D, Device B learns the MAC address of Client A and advertises it to Device A to ensure service continuity for Client A, as shown in Figure Figure 5 MAC address tables of devices when Client A roams to AP D...
Page 38: Displaying And Maintaining Mac Address Tables
Displaying and maintaining MAC address tables To do… Use the command… Remarks display mac-address [ mac-address [ vlan vlan-id ] | [ [ dynamic | static ] [ interface interface-type Display MAC address table interface-number ] | blackhole ] [ vlan vlan-id ] Available in any view information [ count ] ] [ | { begin | exclude | include }...
Page 39 # Add a blackhole MAC address entry. [Sysname] mac-address blackhole 000f-e235-abcd vlan 1 # Set the aging timer for dynamic MAC address entries to 500 seconds. [Sysname] mac-address timer aging 500 # Display the MAC address entry for port GigabitEthernet 1/0/1. [Sysname] display mac-address interface gigabitethernet 1/0/1 MAC ADDR VLAN ID...
Page 40: Mac Information Configuration
MAC Information configuration Overview Introduction to MAC Information To monitor a network, you must monitor users who are joining and leaving the network. Because a MAC address uniquely identifies a network user, you can monitor users who are joining and leaving a network by monitoring their MAC addresses.
Page 41: Configuring Mac Information Mode
To do… Use the command… Remarks Enter system view system-view — Enter Layer 2 Ethernet interface interface interface-type — view interface-number Required Enable MAC Information on the mac-address information enable interface { added | deleted } Disabled by default. NOTE: To enable MAC Information on an Ethernet port, enable MAC Information globally first.
Page 42: Mac Information Configuration Example
MAC Information configuration example Network requirements As shown in Figure Host A is connected to a remote server (Server) through Device. • • Enable MAC Information on GigabitEthernet 1/0/1 on Device. Device sends MAC address changes in Syslog messages to Host B through GigabitEthernet 1/0/3. Host B analyzes and displays the Syslog messages.
Page 43: Ethernet Link Aggregation Configuration
Ethernet link aggregation configuration Overview Ethernet link aggregation, or simply link aggregation, combines multiple physical Ethernet ports into one logical link, called an “aggregate link”. Link aggregation delivers the following benefits: Increases bandwidth beyond the limits of any single link. In an aggregate link, traffic is distributed •...
Page 44 Configuration classes Every configuration setting on a port might affect its aggregation state. Port configurations fall into the following classes: • Port attribute configurations, including port rate, duplex mode, and link status (up/down). These are the most basic port configurations. Class-two configurations.
Page 45: Link Aggregation Modes
Extended LACP how the LACP multi-active detection (MAD) mechanism of the Intelligent Resilient Framework functions (IRF) feature is implemented.The S5120-EI Switch Series can participate in LACP MAD as either an IRF member switch or an intermediate device. NOTE: For more information about IRF, member switches, intermediate devices, and the LACP MAD mechanism,...
Page 46: Aggregating Links In Static Mode
Table 5 A comparison between static and dynamic aggregation modes Aggregation LACP status on Pros Cons mode member ports The member ports do not adjust the Aggregation is stable. Peers do aggregation state according to Static Disabled not affect the aggregation state of that of the peer ports.
Page 47: Aggregating Links In Dynamic Mode
Figure 9 Setting the aggregation state of a member port in a static aggregation group NOTE: To ensure stable aggregation state and service continuity, do not change port attributes or class-two • configurations on any member port. If a static aggregation group has reached the limit on Selected ports, any port that joins the group is •...
Page 48 The system with the smaller system ID selects the port with the smallest port ID as the reference port. A port ID comprises a port aggregation priority and a port number. The port with the lower aggregation priority value wins. If two ports have the same aggregation priority, the system compares their port numbers.
Page 49: Load-Sharing Criteria For Link Aggregation Groups
NOTE: A dynamic link aggregation group preferably sets full-duplex ports as the Selected ports, and will set • one, and only one, half-duplex port as a Selected port when none of the full-duplex ports can be selected or only half-duplex ports exist in the group. To ensure stable aggregation state and service continuity, do not change port attributes or class-two •...
Page 50: Configuring An Aggregation Group
Configuring an aggregation group Configuration guidelines You cannot assign a port to an aggregation group if any of the features listed in Table 6 is configured on the port. Table 6 Features incompatible with aggregation groups Feature Reference RRPP RRPP in High Availability Configuration Guide MAC authentication MAC authentication in Security Configuration Guide Port security...
Page 51: Configuring A Dynamic Aggregation Group
To do... Use the command... Remarks interface interface-type Required Enter Ethernet interface view interface-number Repeat these two steps to assign more Ethernet Assign the Ethernet interface port link-aggregation interfaces to the aggregation group. to the aggregation group group number Optional By default, the aggregation priority of a port is Assign the port an link-aggregation...
Page 52: Configuring An Aggregate Interface
To do... Use the command... Remarks Optional By default, the aggregation priority of a port is 32768. Assign the port an link-aggregation Changing the aggregation priority of a port might affect aggregation priority port-priority port-priority the aggregation state of the ports in the dynamic aggregation group.
Page 53: Setting The Minimum Number Of Selected Ports For An Aggregation Group
To do... Use the command... Remarks Optional snmp-agent trap enable [ standard By default, link state trapping is Enable the trap function globally [ linkdown | linkup ] * ] enabled globally and on all interfaces. Required interface bridge-aggregation Enter aggregate interface view interface-number Use either command.
Page 54: Restoring The Default Settings For An Aggregate Interface
When an aggregate interface is shut down, all Selected ports in the corresponding aggregation • group become unselected and their link state becomes down. • When an aggregate interface is brought up, the aggregation state of ports in the corresponding aggregation group is recalculated and their link state becomes up.
Page 55: Enabling Local-First Load Sharing For Link Aggregation
To do... Use the command... Remarks Required link-aggregation load-sharing By default, Layer 2 packets are load-shared Configure the global mode { { destination-ip | based on the source/destination MAC link-aggregation destination-mac | destination-port addresses and incoming ports; Layer 3 packets load-sharing criteria | ingress-port | source-ip | are load-shared based on the...
Page 56: Enabling Link-Aggregation Traffic Redirection
When you aggregate ports on different member switches in an IRF fabric, you can use local-first load sharing to reduce traffic on IRF links, as shown in Figure 1 1. For more information about IRF, see IRF Configuration Guide. Figure 11 Local-first link-aggregation load sharing Follow these steps to enable local-first load sharing for link aggregation: To do...
Page 57: Displaying And Maintaining Ethernet Link Aggregation
CAUTION: Link-aggregation traffic redirection applies only to dynamic link aggregation groups and only to known • unicast packets. To prevent traffic interruption, enable link-aggregation traffic redirection on devices at both ends of the • aggregate link. • To prevent packet loss that might occur at a reboot, disable both MSTP and link-aggregation traffic redirection.
Page 58: Static Aggregation Configuration Example
NOTE: In an aggregation group, only ports that have the same port attributes and class-two configurations (see “Configuration classes”) as the reference port (see “Reference port”) can operate as Selected ports. Make sure that all member ports have the same port attributes and class-two configurations as the reference port.
Page 59 [DeviceA-Bridge-Aggregation1] quit # Assign ports GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to link aggregation group 1. [DeviceA] interface gigabitethernet 1/0/1 [DeviceA-GigabitEthernet1/0/1] port link-aggregation group 1 [DeviceA-GigabitEthernet1/0/1] quit [DeviceA] interface gigabitethernet 1/0/2 [DeviceA-GigabitEthernet1/0/2] port link-aggregation group 1 [DeviceA-GigabitEthernet1/0/2] quit [DeviceA] interface gigabitethernet 1/0/3 [DeviceA-GigabitEthernet1/0/3] port link-aggregation group 1 [DeviceA-GigabitEthernet1/0/3] quit # Configure aggregate interface Bridge-Aggregation 1 as a trunk port and assign it to VLANs 10 and...
Page 60: Dynamic Aggregation Configuration Example
destination-mac address, source-mac address The output shows that all link aggregation groups created on the device perform load sharing based on source and destination MAC addresses. Dynamic aggregation configuration example Network requirements As shown in Figure Device A and Device B are connected through their respective Ethernet interfaces GigabitEthernet •...
Page 61 # Assign ports GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to link aggregation group 1 one at a time. [DeviceA] interface gigabitethernet 1/0/1 [DeviceA-GigabitEthernet1/0/1] port link-aggregation group 1 [DeviceA-GigabitEthernet1/0/1] quit [DeviceA] interface gigabitethernet 1/0/2 [DeviceA-GigabitEthernet1/0/2] port link-aggregation group 1 [DeviceA-GigabitEthernet1/0/2] quit [DeviceA] interface gigabitethernet 1/0/3 [DeviceA-GigabitEthernet1/0/3] port link-aggregation group 1 [DeviceA-GigabitEthernet1/0/3] quit # Configure aggregate interface Bridge-Aggregation 1 as a trunk port and assign it to VLANs 10 and...
Page 62 destination-mac address, source-mac address The output shows that all link aggregation groups created on the device perform load sharing based on source and destination MAC addresses.
Page 63: Port Isolation Configuration
Port isolation configuration Introduction to port isolation Port isolation enables isolating Layer 2 traffic for data privacy and security without using VLANs. You can also use this feature to isolate the hosts in a VLAN from one another. To use the feature, you assign ports to a port isolation group. Ports in an isolation group are called “isolated ports.”...
Page 64: Port Isolation Configuration Example
Port isolation configuration example Network requirements As shown in Figure 14, Host A, Host B, and Host C are connected to GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 of Device, and Device is connected to the Internet through GigabitEthernet 1/0/4. All these ports are in the same VLAN. Configure Device to provide Internet access for all the hosts and isolate them from one another.
Page 65: Spanning Tree Configuration
Spanning tree configuration As a Layer 2 management protocol, the Spanning Tree Protocol (STP) eliminates Layer 2 loops by selectively blocking redundant links in a network, putting them in a standby state, which still also allows for link redundancy. The recent versions of STP include the Rapid Spanning Tree Protocol (RSTP), Per VLAN Spanning Tree (PVST), and the Multiple Spanning Tree Protocol (MSTP).
Page 66: Basic Concepts In Stp
Basic concepts in STP Root bridge A tree network must have a root bridge. The entire network contains only one root bridge. The root bridge is not permanent, but can change with changes of the network topology. Upon initialization of a network, each device generates and periodically sends configuration BPDUs with itself as the root bridge.
Page 67: Calculation Process Of The Stp Algorithm
Calculation process of the STP algorithm NOTE: The spanning tree calculation process described in the following sections is a simplified process for example only. The STP algorithm uses the following calculation process: Initial state Upon initialization of a device, each port generates a BPDU with the port as the designated port, the device as the root bridge, 0 as the root path cost, and the device ID as the designated bridge ID.
Page 68 Table 9 Selection of the optimum configuration BPDU Step Actions Upon receiving a configuration BPDU on a port, the device compares the priority of the received configuration BPDU with that of the configuration BPDU generated by the port, and: • If the former priority is lower, the device discards the received configuration BPDU and keeps the configuration BPDU the port generated.
Page 69 Table 10 Initial state of each device Device Port name Configuration BPDU on the port Port A1 {0, 0, 0, Port A1} Device A Port A2 {0, 0, 0, Port A2} Port B1 {1, 0, 1, Port B1} Device B Port B2 {1, 0, 1, Port B2} Port C1...
Page 70 Configuration BPDU on Device Comparison process ports after comparison • Port B1 receives the configuration BPDU of Port A1 {0, 0, 0, Port A1}, finds that the received configuration BPDU is superior to its • Port B1: {0, 0, 0, Port existing configuration BPDU {1, 0, 1, Port B1}, and updates its configuration BPDU.
Page 71 Configuration BPDU on Device Comparison process ports after comparison • Device C finds that the root path cost of Port C1 (10) (root path cost of the received configuration BPDU (0) plus path cost of Port C1 (10)) is larger than that of Port C2 (9) (root path cost of the received configuration BPDU (5) plus path cost of Port C2 (4)), decides that the configuration BPDU of Port C2 is the optimum, and selects Port C2 as the root port with the configuration BPDU...
Page 72: Rstp
If the configuration BPDU received on a designated port has a lower priority than the configuration • BPDU of the local port, the port immediately sends its own configuration BPDU in response. • If a path becomes faulty, the root port on this path no longer receives new configuration BPDUs and the old configuration BPDUs will be discarded due to timeout.
Page 73: Pvst
PVST PVST was introduced to improve link bandwidth usage in network environments where multiple virtual LANs (VLANs) exist. Unlike STP and RSTP whose bridges in a LAN must forward their VLAN packets in the same spanning tree, PVST allows each VLAN to build a separate spanning tree. PVST uses the following BPDUs: STP BPDUs: Sent by access ports according to the VLAN status, or by trunk ports and hybrid ports •...
Page 74 Figure 18 Basic concepts in MSTP VLAN 1 MSTI 1 VLAN 1 MSTI 1 VLAN 2 MSTI 2 VLAN 2 MSTI 2 Other VLANs MSTI 0 Other VLANs MSTI 0 MST region 1 MST region 4 MST region 2 MST region 3 VLAN 1 MSTI 1 VLAN 1...
Page 75 Same VLAN-to-instance mapping configuration • • Same MSTP revision level Physically linked together • Multiple MST regions can exist in a switched network. You can assign multiple devices to the same MST region. In Figure 18, the switched network comprises four MST regions, MST region 1 through MST region 4, and all devices in each MST region have the same MST region configuration.
Page 76 Port roles A port can play different roles in different MSTIs. As shown in Figure 20, an MST region comprises Device A, Device B, Device C, and Device D. Port A1 and port A2 of Device A connect to the common root bridge.
Page 77: How Mstp Works
Forwarding: The port receives and sends BPDUs, obtains MAC addresses, and forwards user • traffic. • Learning: The port receives and sends BPDUs, obtains MAC addresses, but does not forward user traffic. Learning is an intermediate port state. Discarding: The port receives and sends BPDUs, but does not obtain MAC addresses or forward •...
Page 78: Implementation Of Mstp On Devices
Implementation of MSTP on devices MSTP is compatible with STP and RSTP. Devices that are running MSTP and that are used for spanning tree calculation can identify STP and RSTP protocol packets. In addition to basic MSTP functions, the following functions are provided for ease of management: Root bridge hold •...
Page 79 Task Remarks Required Setting the spanning tree mode Configure the device to work in STP-compatible mode. Configuring the device priority Optional Configuring the timeout factor Optional Configuring the maximum port rate Optional Configuring the leaf nodes Configuring path costs of ports Optional Configuring the port priority Optional...
Page 80 Task Remarks Required Setting the spanning tree mode Configure the device to work in RSTP mode. Configuring the device priority Optional Configuring the timeout factor Optional Configuring the maximum port rate Optional Configuring Configuring edge ports Optional the leaf Configuring path costs of ports Optional nodes Configuring the port priority...
Page 81 Task Remarks Required Setting the spanning tree mode Configure the device to work in PVST mode. Configuring the device priority Optional Configuring the timeout factor Optional Configuring the maximum port rate Optional Configuring Configuring edge ports Optional the leaf nodes Configuring path costs of ports Optional Configuring the port priority...
Page 82 Task Remarks Optional Setting the spanning tree mode By default, the device works in MSTP mode. Configuring an MST region Required Configuring the device priority Optional Configuring the timeout factor Optional Configuring the maximum port rate Optional Configuri ng the leaf Configuring edge ports Optional nodes...
Page 83: Configuring The Spanning Tree
VLAN. The number of VLANs that PVST can maintain instances for depends on the switch model. Suppose the number is n, which is 32 on the S5120-EI Switch Series. When you configure PVST on devices of different models in a network, to avoid network failures, make sure that the number of VLANs for which PVST maintains instances does not exceed the lowest n.
Page 84: Configuring The Root Bridge Or A Secondary Root Bridge
To do... Use the command... Remarks Optional instance instance-id vlan vlan-list Configure the Use either command. VLAN-to-instance mapping vlan-mapping modulo modulo All VLANs in an MST region are mapped table to the CIST (or MSTI 0) by default. Optional Configure the MSTP revision revision-level level level of the MST region 0 by default.
Page 85: Configuring The Device Priority
bridge. If you have specified multiple secondary root bridges for an instance, when the root bridge fails, the secondary root bridge with the lowest MAC address is selected as the new root bridge. Configuring the current device as the root bridge of a specific spanning tree Follow these steps to configure the current device as the root bridge of a specific spanning tree: To do...
Page 86: Configuring The Maximum Hops Of An Mst Region
To do... Use the command... Remarks Configure the priority of the current stp [ instance instance-id ] priority device (in MSTP mode) priority CAUTION: • You cannot change the priority of a device after it is configured as the root bridge or as a secondary root bridge.
Page 87: Configuring Spanning Tree Timers
Max age ƒ 2 × (hello time + 1 second) H3C does not recommend you to manually set the spanning tree timers. Instead, you can specify the network diameter and let spanning tree protocols automatically calculate the timers based on the network diameter.
Page 88: Configuring The Timeout Factor
If the forward delay timer is too long, network convergence might take a long time. H3C recommends you to use the default setting. An appropriate hello time setting enables the device to quickly detect link failures on the network without •...
Page 89: Configuring The Maximum Port Rate
By setting an appropriate maximum port rate, you can limit the rate at which the port sends BPDUs and prevent spanning tree protocols from using excessive network resources when the network becomes unstable. H3C recommends you to use the default setting. Configuring edge ports If a port directly connects to a user terminal rather than another device or a shared LAN segment, this port is regarded as an edge port.
Page 90: Configuring Path Costs Of Ports
NOTE: If BPDU guard is disabled, a port set as an edge port will become a non-edge port again if it receives • a BPDU from another port. To restore the edge port, re-enable it. If a port directly connects to a user terminal, configure it as an edge port and enable BPDU guard for it. •...
Page 91 Path cost Link speed Port type IEEE 802.1d-1998 IEEE 802.1t Private standard Aggregate interface 1,000,000 1800 containing 2 Selected ports Aggregate interface 666,666 1600 containing 3 Selected ports Aggregate interface 500,000 1400 containing 4 Selected ports Single port 200,000 Aggregate interface 100,000 containing 2 Selected ports 100 Mbps...
Page 92: Configuring The Port Priority
To do... Use the command... Remarks Configure the path cost of the ports (in stp cost cost Required STP/RSTP mode) Use any command. Configure the path cost of the ports (in stp vlan vlan-list cost cost By default, the system PVST mode) automatically calculates the Configure the path cost of the ports (in...
Page 93: Configuring The Port Link Type
You can configure the link type as point-to-point for a Layer 2 aggregate interface or a port that works • in full duplex mode. H3C recommends you to use the default setting and let the device to automatically detect the port link type.
Page 94: Enabling The Output Of Port State Transition Information
By default, the packet format recognition mode of a port is auto. The port automatically distinguishes the two MSTP packet formats, and determines the format of packets that it will send based on the recognized format. You can configure the MSTP packet format on a port. When working in MSTP mode after the configuration, the port sends and receives only MSTP packets of the format that you have configured to communicate with devices that send packets of the same format.
Page 95 Enabling the spanning tree feature (in STP/RSTP/MSTP mode) In STP/RSTP/MSTP mode, make sure that the spanning tree feature is enabled globally and on the desired ports. Follow these steps to enable the spanning tree feature in STP/RSTP/MSTP mode: To do... Use the command...
Page 96: Performing Mcheck
NOTE: To globally enable or disable the spanning tree feature (not for VLANs), use the stp enable command • or undo stp enable command in system view. To enable or disable the spanning tree feature for specific VLANs, use the stp vlan enable command or undo stp vlan enable command. You can disable the spanning tree feature for certain ports with the undo stp enable command to •...
Page 97 To enable communication between an H3C device and a third-party device, enable the Digest Snooping feature on the port that connects the H3C device to the third-party device in the same MST region. NOTE: Before you enable Digest Snooping, make sure that associated devices of different vendors are connected and run spanning tree protocols.
Page 98: Configuring No Agreement Check
Digest Snooping configuration example Network requirements As shown in Figure Device A and Device B connect to Device C, which is a third-party device. All these devices are in • the same region. • Enable Digest Snooping on the ports of Device A and Device B that connect to Device C, so that the three devices can communicate with one another.
Page 99 Both RSTP and MSTP devices can perform rapid transition on a designated port only when the port receives an agreement packet from the downstream device. RSTP and MSTP devices have the following differences: • For MSTP, the root port of the downstream device sends an agreement packet only after it receives an agreement packet from the upstream device.
Page 100: Configuring Tc Snooping
Configure the same region name, revision level and VLAN-to-instance mappings on the two devices, • assigning them to the same region. Configuring the No Agreement Check function To make the No Agreement Check feature take effect, enable it on the root port. Follow these steps to configure No Agreement Check: To do...
Page 101 Figure 25 TC snooping application scenario In the network, the IRF fabric transparently transmits the received BPDUs and does not participate in spanning tree calculations. When a topology change occurs to the IRF fabric or user network networks, the IRF fabric may need a long time to learn the correct MAC address table entries and ARP entries, resulting in long network disruption.
Page 102: Configuring Protection Functions
Configuring protection functions A spanning tree device supports the following protection functions: BPDU guard • Root guard • Loop guard • TC-BPDU guard • • BPDU drop Configuration prerequisites The spanning tree feature has been correctly configured on the device. Enabling BPDU guard For access layer devices, the access ports can directly connect to the user terminals (such as PCs) or file servers.
Page 103 in the MSTI, without forwarding the packet. This is equivalent to disconnecting the link connected with this port in the MSTI. If the port receives no BPDUs with a higher priority within twice the forwarding delay, it reverts to its original state. Configure root guard on a designated port.
Page 104 6 by default. device can perform every 10 seconds NOTE: H3C does not recommend you disable this feature. Enabling BPDU drop In a spanning tree network, after receiving BPDUs, the device performs STP calculation according to the received BPDUs and forwards received BPDUs to other devices in the network. This allows malicious attackers to attack the network by forging BPDUs.
Page 105: Displaying And Maintaining The Spanning Tree
NOTE: Because a port with BPDU drop enabled also drops the received 802.1X packets, do not enable BPDU Security drop and 802.1X on a port at the same time. For more information about 802.1X, see Configuration Guide Displaying and maintaining the spanning tree To do...
Page 106 those of VLAN 40 are forwarded along MSTI 4, and those of VLAN 20 are forwarded along MSTI • VLAN 10 and VLAN 30 are terminated on the distribution layer devices, and VLAN 40 is terminated on the access layer devices. The root bridges of MSTI 1 and MSTI 3 are Device A and Device B respectively, and the root bridge of MSTI 4 is Device C.
Page 107 Configure Device B. # Enter MST region view, configure the MST region name as example, map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4 respectively, and configure the revision level of the MST region as 0.
Page 108 [DeviceD-mst-region] instance 4 vlan 40 [DeviceD-mst-region] revision-level 0 # Activate MST region configuration. [DeviceD-mst-region] active region-configuration [DeviceD-mst-region] quit # Enable the spanning tree feature globally. [DeviceD] stp enable Verify the configurations You can use the display stp brief command to display brief spanning tree information on each device after the network is stable.
Page 109: Pvst Configuration Example
GigabitEthernet1/0/2 ALTE DISCARDING NONE GigabitEthernet1/0/3 ROOT FORWARDING NONE Based on the output, you can draw the MSTI mapped to each VLAN, as shown in Figure Figure 27 MSTIs mapped to different VLANs PVST configuration example Network requirements As shown in Figure Device A and Device B work at the distribution layer.
Page 110 Figure 28 Network diagram Configuration procedure Configure VLANs and VLAN member ports. (Details not shown) Create VLAN 10, VLAN 20, and VLAN 30 on Device A and Device B respectively, VLAN 10, VLAN 20, and VLAN 40 on Device C, and VLAN 20, VLAN 30, and VLAN 40 on Device D. Configure the ports on these devices as trunk ports and assign them to related VLANs.
Page 111 # Enable the spanning tree feature globally and for VLANs 10, 20, and 40. [DeviceC] stp enable [DeviceC] stp vlan 10 20 40 enable Configure Device D. # Set the spanning tree mode to PVST. <DeviceD> system-view [DeviceD] stp mode pvst # Enable the spanning tree feature globally and for VLANs 20, 30, and 40.
Page 112 GigabitEthernet1/0/1 ALTE FORWARDING NONE GigabitEthernet1/0/2 ROOT DISCARDING NONE GigabitEthernet1/0/3 ALTE DISCARDING NONE GigabitEthernet1/0/1 ROOT FORWARDING NONE GigabitEthernet1/0/2 ALTE DISCARDING NONE GigabitEthernet1/0/3 ROOT FORWARDING NONE Based on the output, you can draw the spanning tree mapped to each VLAN, as shown in Figure Figure 29 Spanning trees mapped to different VLANs...
Page 113: Bpdu Tunneling Configuration
PE 2 at the other end of the service provider network, which de-encapsulates the packet, restores the original destination MAC address of the packet, and then sends the packet to CE 2. H3C devices support BPDU tunneling for the following protocols: •...
Page 114: Bpdu Tunneling Implementation
Ethernet Operation, Administration and Maintenance (EOAM) • • GARP VLAN Registration Protocol (GVRP) HW Group Management Protocol (HGMP) • Link Aggregation Control Protocol (LACP) • • Link Layer Discovery Protocol (LLDP) Port Aggregation Protocol (PAGP) • • Per VLAN Spanning Tree (PVST) Spanning Tree Protocol (STP) •...
Page 115: Configuring Bpdu Tunneling
Figure 31 BPDU tunneling implementation The upper section of Figure 31 represents the service provider network (ISP network). The lower section, including User A network 1 and User A network 2, represents the customer networks. Enabling BPDU tunneling on edge devices (PE 1 and PE 2) in the service provider network allows BPDUs of User A network 1 and User A network 2 to be transparently transmitted through the service provider network.
Page 116: Enabling Bpdu Tunneling
Enabling BPDU tunneling You can enable BPDU tunneling for different protocols in different views. NOTE: Settings made in Layer 2 Ethernet interface view or Layer 2 aggregate interface view take effect only on • the current port. Settings made in port group view take effect on all ports in the port group. Before you enable BPDU tunneling for DLDP, EOAM, GVRP, HGMP, LLDP, or STP on a port, disable the •...
Page 117: Bpdu Tunneling Configuration Examples
Follow these steps to configure destination multicast MAC address for BPDUs: To do… Use the command… Remarks Enter system view system-view — Optional Configure the destination multicast bpdu-tunnel tunnel-dmac MAC address for BPDUs mac-address 0x010F-E200-0003 by default NOTE: For BPDUs to be recognized, the destination multicast MAC addresses configured for BPDU tunneling must be the same on the edge devices on the service provider network.
Page 118: Bpdu Tunneling For Pvst Configuration Example
[PE1] vlan 2 [PE1-vlan2] quit [PE1] interface gigabitethernet 1/0/1 [PE1-GigabitEthernet1/0/1] port access vlan 2 # Disable STP on GigabitEthernet 1/0/1, and then enable BPDU tunneling for STP on it. [PE1-GigabitEthernet1/0/1] undo stp enable [PE1-GigabitEthernet1/0/1] bpdu-tunnel dot1q stp Configure PE 2. # Configure the destination multicast MAC address for BPDUs as 0x0100-0CCD-CDD0.
Page 119 Configuration procedure Configure PE 1. # Configure the destination multicast MAC address for BPDUs as 0x0100-0CCD-CDD0. <PE1> system-view [PE1] bpdu-tunnel tunnel-dmac 0100-0ccd-cdd0 # Configure GigabitEthernet 1/0/1 as a trunk port and assign it to all VLANs. [PE1] interface gigabitethernet 1/0/1 [PE1-GigabitEthernet1/0/1] port link-type trunk [PE1-GigabitEthernet1/0/1] port trunk permit vlan all # Disable STP on GigabitEthernet 1/0/1, and then enable BPDU tunneling for STP and PVST on it.
Page 120: Vlan Configuration
VLAN configuration Overview VLAN Ethernet is a network technology based on the Carrier Sense Multiple Access/Collision Detect (CSMA/CD) mechanism. Because the medium is shared, collisions and excessive broadcasts are common on Ethernet networks. To address the issue, virtual LAN (VLAN) was introduced to break a LAN down into separate VLANs.
Page 121: Vlan Types
The format of VLAN-tagged frames is defined in IEEE 802.1Q issued by the Institute of Electrical and Electronics Engineers (IEEE) in 1999. In the header of a traditional Ethernet data frame, the field after the destination MAC address and the source MAC address is the Type field, which indicates the upper layer protocol type, as shown in Figure Figure 35 Traditional Ethernet frame format...
Page 122: Protocols And Standards
Other criteria • This chapter covers port-based VLAN, MAC-based VLAN, protocol-based VLAN, and IP-based VLAN. The port-based VLAN implementation is the basis of all other VLAN implementations. To use any other VLAN implementations, you must configure port-based VLAN settings. You can configure all these types of VLANs on a port at the same time. When the switch is determining which VLAN a packet that passes through the port should be assigned to, it looks up the VLANs in the default order of MAC-based VLAN, IP-based VLAN, protocol-based VLAN, and port-based VLAN.
Page 123: Configuring Basic Settings Of A Vlan Interface
Configuring basic settings of a VLAN interface VLAN interface overview For hosts of different VLANs to communicate, you must use a router or Layer 3 switch to perform Layer 3 forwarding. You use VLAN interfaces to achieve this. VLAN interfaces are virtual interfaces used for Layer 3 communication between different VLANs. They do not exist as physical entities on devices.
Page 124: Vlan Interface Configuration Example
VLAN interface configuration example Network requirements As shown in Figure 37, PC A is assigned to VLAN 5. PC B is assigned to VLAN 10. The PCs belong to different IP subnets and cannot communicate with each other. Configure VLAN interfaces on Switch A and configure the PCs to enable Layer 3 communication between the PCs.
Page 125: Port-Based Vlan Configuration
Verifying the configurations The PCs can ping each other. Display brief information about Layer 3 interfaces on Switch A to verify the configuration. <SwitchA> display ip interface brief *down: administratively down (s): spoofing Interface Physical Protocol IP Address Description Vlan-interface5 192.168.0.10 Vlan-inte...
Page 126: Assigning An Access Port To A Vlan
• information about voice VLAN, see the chapter “Voice VLAN configuration.” H3C recommends that you set the same PVID ID for local and remote ports. • Make sure that a port is assigned to its PVID. Otherwise, when the port receives frames tagged with the •...
Page 127: Assigning A Trunk Port To A Vlan
Follow these steps to assign an access port (in interface view) or multiple access ports (in port group view) to a VLAN: To do… Use the command… Remarks Enter system view system-view — Required Enter Layer 2 Ethernet Use any command. interface view: •...
Page 128: Assigning A Hybrid Port To A Vlan
Follow these steps to assign a trunk port to one or multiple VLANs: To do… Use the command… Remarks Enter system view system-view — Required Use any command. • The configuration made in Layer 2 Ethernet Enter Layer 2 Ethernet interface view: interface view applies only to the port.
Page 129: Port-Based Vlan Configuration Example
To do… Use the command… Remarks Required Use any command. • The configuration made in Ethernet interface view applies only to the port. Enter Layer 2 Ethernet interface view: • The configuration made in port group interface interface-type view applies to all ports in the port group. interface-number •...
Page 130 Figure 38 Network diagram Configuration procedure Configure Device A. # Create VLAN 100, and assign port GigabitEthernet 1/0/1 to VLAN 100. <DeviceA> system-view [DeviceA] vlan 100 [DeviceA-vlan100] port gigabitethernet 1/0/1 [DeviceA-vlan100] quit # Create VLAN 200, and assign port GigabitEthernet 1/0/2 to VLAN 200. [DeviceA] vlan 200 [DeviceA-vlan200] port gigabitethernet 1/0/2 [DeviceA-vlan200] quit...
Page 131: Mac-Based Vlan Configuration
[DeviceA-GigabitEthernet1/0/3] display vlan 200 VLAN ID: 200 VLAN Type: static Route Interface: not configured Description: VLAN 0200 Name: VLAN 0200 Tagged Ports: GigabitEthernet1/0/3 Untagged Ports: GigabitEthernet1/0/2 MAC-based VLAN configuration Introduction to MAC-based VLAN The MAC-based VLAN feature assigns hosts to a VLAN based on their MAC addresses. This feature is usually used in conjunction with security technologies such as 802.1X to provide secure, flexible network access for terminal devices.
Page 132 If not, the port selects a VLAN for the frame by tagging the untagged frame with the PVID tag and • obtaining the tag, and then reports the source MAC address of the frame. After reporting the source MAC address of the frame, the port looks up the source MAC address in the MAC-to-VLAN map, and processes the frame as follows: If the source MAC address of the frame matches a MAC address-to-VLAN entry configured on the •...
Page 133: Configuring A Mac-Based Vlan
Dynamic MAC-based VLAN You can use dynamic MAC-based VLAN with access authentication (such as 802.1X authentication based on MAC addresses) to implement secure, flexible terminal access. After configuring dynamic MAC-based VLAN on the device, you must configure the username-to-VLAN entries on the access authentication server.
Page 134 To do... Use the command... Remarks Enter Layer 2 Ethernet interface view: Use either command. interface interface-type • The configuration made in Ethernet Enter interface view or port interface-number interface view applies only to the port. group view Enter port group view: •...
Page 135: Mac-Based Vlan Configuration Example
Follow these steps to configure dynamic MAC-based VLAN: To do... Use the command... Remarks Enter system view system-view — Enter Ethernet interface interface-type Use either command. interface view interface-number • Enter The configuration made in Ethernet interface interface view applies only to the port. view or port •...
Page 136 Figure 40 Network diagram VLAN 100 VLAN 200 Server1 Server2 IP: 1.1.1.1/24 IP: 1.1.2.1/24 GE1/0/14 GE1/0/13 GE1/0/4 GE1/0/3 Device B GE1/0/2 GE1/0/2 Device C Device A GE1/0/1 GE1/0/1 VLAN 100 VLAN 200 Laptop1 Laptop2 IP: 1.1.1.2/24 IP: 1.1.2.2/24 MAC: 000d-88f8-4e71 MAC: 0014-222c-aa69 Configuration consideration Create VLANs 100 and 200.
Page 137 [DeviceA-GigabitEthernet1/0/1] port hybrid vlan 100 200 untagged Please wait... Done. [DeviceA-GigabitEthernet1/0/1] mac-vlan enable [DeviceA-GigabitEthernet1/0/1] quit # To enable the laptops to access Server 1 and Server 2, configure the uplink port GigabitEthernet 1/0/2 as a trunk port, and assign it to VLANs 100 and 200. [DeviceA] interface gigabitethernet 1/0/2 [DeviceA-GigabitEthernet1/0/2] port link-type trunk [DeviceA-GigabitEthernet1/0/2] port trunk permit vlan 100 200...
Page 138: Protocol-Based Vlan Configuration
Configuration guidelines MAC-based VLAN can be configured only on hybrid ports. MAC-based VLAN is usually configured on the downlink ports of access layer devices, and cannot be configured together with the link aggregation function. Protocol-based VLAN configuration Introduction to protocol-based VLAN You use the protocol-based VLAN feature to assign packets to VLANs by their application type.
Page 139: Protocol-Based Vlan Configuration Example
To do… Use the command… Remarks Required Use any command. • The configuration made in Ethernet Enter Layer 2 Ethernet interface interface view applies only to the port. view: • The configuration made in port group interface interface-type view applies to all ports in the port group. interface-number •...
Page 140 Figure 41 Network diagram VLAN 100 VLAN 200 IPv4 Server IPv6 Server GE1/0/11 GE1/0/12 GE1/0/1 GE1/0/2 Device L2 Switch A L2 Switch B IPv4 Host A IPv6 Host A IPv4 Host B IPv6 Host B VLAN 100 VLAN 200 VLAN 100 VLAN 200 Configuration consideration Create VLANs 100 and 200.
Page 141 [Device-GigabitEthernet1/0/1] port link-type hybrid [Device-GigabitEthernet1/0/1] port hybrid vlan 100 200 untagged Please wait... Done. # Associate port GigabitEthernet 1/0/1 with the IPv4 protocol template of VLAN 100 and the IPv6 protocol template of VLAN 200. [Device-GigabitEthernet1/0/1] port hybrid protocol-vlan vlan 100 1 [Device-GigabitEthernet1/0/1] port hybrid protocol-vlan vlan 200 1 [Device-GigabitEthernet1/0/1] quit # Configure GigabitEthernet 1/0/2 as a hybrid port that forwards packets of VLANs 100 and 200...
Page 142: Ip Subnet-Based Vlan Configuration
====================================================== ipv4 ipv6 Configuration guidelines Protocol-based VLAN configuration applies only to hybrid ports. IP subnet-based VLAN configuration Introduction In this approach, packets are assigned to VLANs based on their source IP addresses and subnet masks. A port configured with IP subnet-based VLANs assigns a received untagged packet to a VLAN based on the source address of the packet.
Page 143: Ip Subnet-Based Vlan Configuration Example
To do… Use the command… Remarks Required Use any command. • The configuration made in Ethernet interface view applies only to the port. • The configuration made in port group Enter Layer 2 Ethernet interface view: view applies to all ports in the port group.
Page 144 Configuration consideration Create VLANs 100 and 200. • Associate IP subnets with the VLANs. • Assign ports to the VLANs. • Configuration procedure # Associate IP subnet 192.168.5.0/24 with VLAN 100. <DeviceC> system-view [DeviceC] vlan 100 [DeviceC-vlan100] ip-subnet-vlan ip 192.168.5.0 255.255.255.0 [DeviceC-vlan100] quit # Associate IP subnet 192.168.50.0/24 with VLAN 200.
Page 145: Displaying And Maintaining Vlan
[DeviceC-GigabitEthernet1/0/12] quit # Associate interface GigabitEthernet 1/0/1 with IP subnet-based VLANs 100 and 200. [DeviceC] interface GigabitEthernet 1/0/1 [DeviceC-GigabitEthernet1/0/1] port link-type hybrid [DeviceC-GigabitEthernet1/0/1] port hybrid vlan 100 200 untagged Please wait... Done. [DeviceC-GigabitEthernet1/0/1] port hybrid ip-subnet-vlan vlan 100 [DeviceC-GigabitEthernet1/0/1] port hybrid ip-subnet-vlan vlan 200 [DeviceC-GigabitEthernet1/0/1] return Verifying the configurations # Display the IP subnet information for all VLANs.
Page 146 To do... Use the command… Remarks display mac-vlan { all | dynamic | mac-address Display MAC address-to-VLAN Available in any mac-address | static | vlan vlan-id } [ | { begin | entries view exclude | include } regular-expression ] Display all interfaces with display mac-vlan interface [ | { begin | exclude | Available in any...
Page 147: Isolate-User-Vlan Configuration
Isolate-user-VLAN configuration Overview An isolate-user-VLAN uses a two-tier VLAN structure. In this approach, the following types of VLANs, isolate-user-VLAN and secondary VLAN, are configured on the same device. The following are the characteristics of the isolate-user-VLAN implementation: Isolate-user-VLANs are mainly used for upstream data exchange. An isolate-user-VLAN can be •...
Page 148: Configuring An Isolate-User-Vlan
downstream ports can be added to the isolate-user-VLAN associated with the secondary VLAN synchronously. Associate the isolate-user-VLAN with the specified secondary VLANs. To enable users in the isolate-user-VLAN to communicate with other networks at Layer 3, follow these steps: Configure VLAN interfaces for the isolate-user-VLAN and the secondary VLANs, and configure the •...
Page 149: Associating Secondary Vlans With An Isolate-User-Vlan
To do… Use the command… Remarks vlan { vlan-id1 [ to vlan-id2 ] | Create secondary VLANs Required all } Optional By default, ports in the same secondary VLAN can communicate at Layer 2. Isolate ports in the same isolated-vlan enable This configuration takes effect only after you secondary VLAN at Layer 2 configure the ports to work in host mode and...
Page 150: Displaying And Maintaining Isolate-User-Vlan
Displaying and maintaining isolate-user-VLAN To do... Use the command... Remarks Display the mapping between an display isolate-user-vlan Available in any isolate-user-VLAN and its secondary VLANs [ isolate-user-vlan-id ] [ | { begin | exclude view and information about these VLANs | include } regular-expression ] Isolate-user-VLAN configuration example Network requirements...
Page 151 # Configure the uplink port GigabitEthernet 1/0/5 to operate in promiscuous mode in VLAN 5. [DeviceB] interface gigabitethernet 1/0/5 [DeviceB-GigabitEthernet1/0/5] port isolate-user-vlan 5 promiscuous [DeviceB-GigabitEthernet1/0/5] quit # Assign downlink ports GigabitEthernet 1/0/1 to VLAN 3 and GigabitEthernet 1/0/2 to VLAN 2, and configure the ports to operate in host mode.
Page 152 VLAN ID: 5 VLAN Type: static Isolate-user-VLAN type : isolate-user-VLAN Route Interface: not configured Description: VLAN 0005 Name: VLAN 0005 Tagged Ports: none Untagged Ports: GigabitEthernet1/0/1 GigabitEthernet1/0/2 GigabitEthernet1/0/5 VLAN ID: 2 VLAN Type: static Isolate-user-VLAN type : secondary Route Interface: not configured Description: VLAN 0002 Name: VLAN 0002 Tagged...
Page 153: Voice Vlan Configuration
Voice VLAN configuration Overview A voice VLAN is configured for voice traffic. After assigning the ports that connect to voice devices to a voice VLAN, the system automatically configures quality of service (QoS) parameters for voice traffic, to improve the transmission priority of voice traffic and ensure voice quality. NOTE: Common voice devices include IP phones and integrated access devices (IADs).
Page 154 In automatic mode, the system matches the source MAC address carried in the untagged packets • sent when an IP phone is powered on against the device’s OUI addresses. If the system finds a match, it automatically assigns the receiving port to the voice VLAN, issues ACL rules, and configures the packet precedence.
Page 155 Table 15 Required configurations on ports of different link types for them to support tagged voice traffic Port link Voice VLAN Support for tagged Configuration requirements type assignment mode voice traffic Automatic Access — Manual Automatic The PVID of the port cannot be the voice VLAN. The PVID of the port cannot be the voice VLAN.
Page 156: Security Mode And Normal Mode Of Voice Vlans
MAC addresses checking. TIP: H3C does not recommend you transmit both voice traffic and non-voice traffic in a voice VLAN. If you must transmit both voice traffic and nonvoice traffic, make sure that the voice VLAN security mode is disabled.
Page 157: Configuring Qos Priority Settings For Voice Traffic On An Interface
If the configuration order is reversed, your priority configuration will fail. For more information, see “Configuring QoS priority settings for voice traffic on an interface.” • Configure the voice VLAN assignment mode. For more information, see “Configuring a port to operate in automatic voice VLAN assignment mode”...
Page 158: Configuring A Port To Operate In Manual Voice Vlan Assignment Mode
To do... Use the command... Remarks Optional Enable the voice VLAN voice vlan security enable security mode By default, the voice VLAN security mode is enabled. Optional voice vlan mac-address oui Add a recognizable By default, each voice VLAN has default OUI mask oui-mask [ description OUI address addresses configured.
Page 159: Displaying And Maintaining Voice Vlan
To do... Use the command... Remarks Required Assign the access, trunk, For the configuration procedure, or hybrid port in manual After you assign an access port to the voice see the chapter “VLAN voice VLAN assignment VLAN, the voice VLAN becomes the PVID of the configuration.”...
Page 160 Configure GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to work in automatic voice VLAN • assignment mode. In addition, if one of them has not received any voice packet in 30 minutes, the port is removed from the corresponding voice VLAN automatically. Figure 47 Network diagram Configuration procedure # Create VLAN 2 and VLAN 3.
Page 161: Manual Voice Vlan Assignment Mode Configuration Example
# Configure GigabitEthernet 1/0/2. [DeviceA] interface gigabitethernet 1/0/2 [DeviceA-GigabitEthernet1/0/2] port link-type hybrid [DeviceA-GigabitEthernet1/0/2] voice vlan mode auto [DeviceA-GigabitEthernet1/0/2] voice vlan 3 enable Verifying the configurations # Display the OUI addresses, OUI address masks, and description strings. <DeviceA> display voice vlan oui Oui Address Mask Description...
Page 162 Figure 48 Network diagram Device A Device B Internet GE1/0/1 GE1/0/1 VLAN 2 0755-2002 010-1001 OUI: 0011-2200-0000 Mask: ffff-ff00-0000 Configuration procedure # Configure the voice VLAN to operate in security mode. A voice VLAN operates in security mode by default. (Optional) <DeviceA>...
Page 163 # Display the states of voice VLANs. <DeviceA> display voice vlan state Maximum of Voice VLANs: 8 Current Voice VLANs: 1 Voice VLAN security mode: Security Voice VLAN aging time: 1440 minutes Voice VLAN enabled port and its mode: PORT VLAN MODE DSCP...
Page 164: Gvrp Configuration
GVRP configuration The Generic Attribute Registration Protocol (GARP) provides a generic framework for devices in a switched LAN, such as end stations and switches, to register and deregister attribute values. The GARP VLAN Registration Protocol (GVRP) is a GARP application that registers and deregisters VLAN attributes. GVRP uses the operating mechanism of GARP to maintain and propagate dynamic VLAN registration information for GVRP devices on the network.
Page 165 The value ranges for the Hold, Join, Leave, and LeaveAll timers are dependent on one another. See Table 19 for their dependencies. H3C's implementation of GARP uses the following timers to control GARP message transmission: Hold timer The Hold timer sets the delay that a GARP participant waits before sending a Join or Leave message.
Page 166 A GARP participant starts a Leave timer when it receives a Leave message for an attribute value. If the GARP participant receives no Join message for the attribute value before the timer expires, it deregisters the attribute value. LeaveAll timer When a GARP application is enabled, a LeaveAll timer starts.
Page 167: Gvrp
Field Description Value Consists of an attribute length, an attribute Attribute –– event, and an attribute value Length of an attribute, inclusive of the Attribute length 2 to 255 (in bytes) attribute length field • 0x00: LeaveAll event • 0x01: JoinEmpty event •...
Page 168: Gvrp Configuration Task List
GVRP configuration task list Complete these tasks to configure GVRP: Task Remarks Configuring GVRP functions Required Configuring the GARP timers Optional NOTE: GVRP configuration made in Ethernet interface view or Layer 2 aggregate interface view takes effect on • the current interface only; GVRP configuration made in port group view takes effect on all the member ports in the group.
Page 169: Configuring The Garp Timers
NOTE: For more information about the port link-type trunk and port trunk permit vlan all commands, see • Layer 2—LAN Switching Command Reference GVRP can work with STP, RSTP, or MSTP CIST but not PVST. When GVRP runs on the CIST, blocked ports •...
Page 170: Displaying And Maintaining Gvrp
Table 19 Dependencies of the GARP timers Timer Lower limit Upper limit Hold 10 centiseconds No greater than half of the Join timer Join No less than twice the Hold timer Less than half of the Leave timer Leave Greater than twice the Join timer Less than the LeaveAll timer LeaveAll Greater than the Leave timer...
Page 171 Enable GVRP and configure the normal registration mode on ports to enable the registration and • deregistration of dynamic and static VLAN information between the two devices. Figure 51 Network diagram Configuration procedure Configure Device A. # Enable GVRP globally. <DeviceA>...
Page 172: Gvrp Fixed Registration Mode Configuration Example
According to the output, information about VLAN 1, static VLAN information of VLAN 2 on the local device, and dynamic VLAN information of VLAN 3 on Device B are all registered through GVRP. # Display the local VLAN information that GVRP maintains on port GigabitEthernet 1/0/1 of Device B. [DeviceB] display gvrp local-vlan interface gigabitethernet 1/0/1 Following VLANs exist in GVRP local database: 1(default),2-3...
Page 173: Gvrp Forbidden Registration Mode Configuration Example
[DeviceB-GigabitEthernet1/0/1] port link-type trunk [DeviceB-GigabitEthernet1/0/1] port trunk permit vlan all # Enable GVRP on GigabitEthernet 1/0/1, and set the GVRP registration mode to fixed on the port. [DeviceB-GigabitEthernet1/0/1] gvrp [DeviceB-GigabitEthernet1/0/1] gvrp registration fixed [DeviceB-GigabitEthernet1/0/1] quit # Create VLAN 3 (a static VLAN). [DeviceB] vlan 3 [DeviceB-vlan3] quit Verify the configuration.
Page 174 [DeviceA] interface gigabitethernet 1/0/1 [DeviceA-GigabitEthernet1/0/1] port link-type trunk [DeviceA-GigabitEthernet1/0/1] port trunk permit vlan all # Enable GVRP on GigabitEthernet 1/0/1, and set the GVRP registration mode to forbidden on the port. [DeviceA-GigabitEthernet1/0/1] gvrp [DeviceA-GigabitEthernet1/0/1] gvrp registration forbidden [DeviceA-GigabitEthernet1/0/1] quit # Create VLAN 2 (a static VLAN). [DeviceA] vlan 2 [DeviceA-vlan2] quit Configure Device B.
Page 175: Qinq Configuration
QinQ configuration NOTE: Throughout this document, customer network VLANs (CVLANs), also called inner VLANs, refer to the VLANs that a customer uses on the private network; and service provider network VLANs (SVLANs), also called outer VLANs, refer to the VLANs that a service provider uses to carry VLAN tagged traffic for customers.
Page 176: Qinq Frame Structure
Figure 54 Typical QinQ application scenario VLANs 1 to 20 VLANs 1 to 10 CE 3 CE 4 Customer Customer network B network A VLAN 3 VLAN 4 IP network PE 1 PE 2 VLAN 3 VLAN 4 Public network Customer Customer network A...
Page 177: Implementations Of Qinq
The default maximum transmission unit (MTU) of an interface is 1500 bytes. The size of an outer VLAN tag is 4 bytes. H3C recommends you to increase the MTU of each interface on the service provider network to at least 1504 bytes. For more information about interface MTU configuration, see the chapter “Ethernet interface configuration.”...
Page 178: Protocols And Standards
Figure 56 VLAN tag structure of an Ethernet frame The switch determines whether a received frame carries a VLAN tag by checking the TPID value. For example, if a frame carries a VLAN tag with TPID value 0x8100, but the configured TPID value is 0x9100, the switch considers that the frame does not carry any VLAN tag.
Page 179: Qinq Configuration Task List
QinQ configuration task list Complete the follows tasks to configure QinQ: Task Remarks Enabling basic QinQ Required Configuring basic QinQ Configuring VLAN transparent transmission Optional Configuring an outer VLAN tagging policy Required Configuring selective QinQ Perform at least one of Configuring an inner-outer VLAN 802.1p priority these tasks.
Page 180: Configuring Selective Qinq
the port not to add its PVID tag to packets carrying specific inner VLAN tags when they pass through it, so that these packets are transmitted in the service provider network with single tags. Follow these steps to configure VLAN transparent transmission: To do...
Page 181: Configuring An Inner-Outer Vlan 802.1P Priority Mapping
• new outer VLAN tag. Configuring an inner-outer VLAN 802.1p priority mapping Through QoS policies, the S5120-EI switches achieve the following inner-outer VLAN 802.1p priority mapping modes: • Marking the 802.1p priorities in outer VLAN tags according to the inner VLAN IDs or the 802.1p priorities in the inner VLAN tags.
Page 182: Configuring The Tpid Value In Vlan Tags
To do... Use the command... Remarks Create a traffic behavior and traffic behavior behavior-name Required enter traffic behavior view Mark the 802.1p priorities in outer VLAN tags: Configure a marking action or remark dot1p 8021p Required an inner-to-outer tag priority Copy the inner 802.1p priorities to outer Use either command.
Page 183 The two branches of Company A, Site 1 and Site 2, are connected through the service provider • network and use CVLANs 10 through 70. The two branches of Company B, Site 3 and Site 4, are connected through the service provider network and use CVLANs 30 through 90. •...
Page 184 Configure GigabitEthernet 1/0/2. • # Configure GigabitEthernet 1/0/2 as a trunk port and assign it to VLAN 100 and VLAN 200. [PE1] interface gigabitethernet 1/0/2 [PE1-GigabitEthernet1/0/2] port link-type trunk [PE1-GigabitEthernet1/0/2] port trunk permit vlan 100 200 # Set the TPID value in the outer VLAN tag to 0x8200 on the port. [PE1-GigabitEthernet1/0/2] quit [PE1] qinq ethernet-type 8200 •...
Page 185: Selective Qinq Configuration Example
[PE2] interface gigabitethernet 1/0/3 [PE2-GigabitEthernet1/0/3] port link-type trunk [PE2-GigabitEthernet1/0/3] port trunk permit vlan 100 10 to 70 # Configure VLAN 100 as the PVID for the port. [PE2-GigabitEthernet1/0/3] port trunk pvid vlan 100 # Enable basic QinQ on the port. [PE2-GigabitEthernet1/0/3] qinq enable [PE2-GigabitEthernet1/0/3] quit Configure third-party devices.
Page 186 NOTE: Make sure that you have configured the devices in the service provider network to allow QinQ packets to pass through. Configure PE 1. Configure GigabitEthernet 1/0/1. • # Configure GigabitEthernet 1/0/1 as a hybrid port to permit frames of VLAN 10 and VLAN 20 to pass through tagged, and frames of VLAN 100 and VLAN 200 to pass through untagged.
Page 187 [PE2-GigabitEthernet1/0/1-vid-100] raw-vlan-id inbound 10 [PE2-GigabitEthernet1/0/1-vid-100] quit # Configure the port to tag VLAN 20 frames with outer VLAN ID 200. [PE2-GigabitEthernet1/0/1] qinq vid 200 [PE2-GigabitEthernet1/0/1-vid-200] raw-vlan-id inbound 20 [PE2-GigabitEthernet1/0/1-vid-200] quit [PE2-GigabitEthernet1/0/1] quit Configure GigabitEthernet 1/0/2. • # Configure GigabitEthernet 1/0/2 as a trunk port and assign it to VLAN 100 and VLAN 200. [PE2] interface gigabitethernet 1/0/2 [PE2-GigabitEthernet1/0/2] port link-type trunk [PE2-GigabitEthernet1/0/2] port trunk permit vlan 100 200...
Page 188: Lldp Configuration
LLDP configuration Overview Background In a heterogeneous network, a standard configuration exchange platform ensures that different types of network devices from different vendors can discover one another and exchange configuration for the sake of interoperability and management. The IETF drafted the Link Layer Discovery Protocol (LLDP) in IEEE 802.1AB. The protocol operates on the data link layer to exchange device information between directly connected devices.
Page 189 Table 21 Fields in an Ethernet II-encapsulated LLDPDU Field Description The MAC address to which the LLDPDU is advertised. It is fixed to Destination MAC address 0x0180-C200-000E, a multicast MAC address. The MAC address of the sending port. If the port does not have a MAC Source MAC address address, the MAC address of the sending bridge is used.
Page 190 An LLDPDU can carry up to 28 types of TLVs. Mandatory TLVs include Chassis ID TLV, Port ID TLV, Time To Live TLV, and End of LLDPDU TLV. Other TLVs are optional. TLVs TLVs are type, length, and value sequences that carry information elements. The type field identifies the type of information, the length field measures the length of the information field in octets, and the value field contains the information itself.
Page 191 NOTE: The Power Stateful Control TLV is defined in IEEE P802.3at D1.0. The later versions no longer support this TLV. H3C devices send this type of TLVs only after receiving them. LLDP-MED TLVs LLDP-MED TLVs provide multiple advanced applications for voice over IP (VoIP), such as basic configuration, network policy configuration, and address and directory management.
Page 192: How Lldp Works
Type Description Allows a network device or terminal device to advertise the VLAN ID of Network Policy the specific port, the VLAN type, and the priorities for specific applications. Allows a network device or terminal device to advertise power supply Extended Power-via-MDI capability.
Page 193: Protocols And Standards
A new neighbor is discovered. A new LLDPDU is received and carries device information new to the • local device. • The LLDP operating mode of the port changes from Disable or Rx to TxRx or Tx. This is the fast sending mechanism of LLDP. With this mechanism, a specific number of LLDPDUs are sent successively at 1-second intervals, to help LLDP neighbors discover the local device as soon as possible.
Page 194: Setting The Lldp Operating Mode
To do… Use the command… Remarks Enter system view system-view — Required Enable LLDP globally lldp enable By default, LLDP is globally enabled. Enter Layer 2 Ethernet interface interface-type Enter Ethernet interface view interface-number Required interface view or port group Use either command.
Page 195: Enabling Lldp Polling
Enabling LLDP polling With LLDP polling enabled, a device periodically searches for local configuration changes. On detecting a configuration change, the device sends LLDPDUs to inform neighboring devices of the change. Follow these steps to enable LLDP polling: To do… Use the command…...
Page 196: Setting Other Lldp Parameters
Follow these steps to configure a management address to be advertised and its encoding format on a port or group of ports: To do… Use the command… Remarks Enter system view system-view — Enter Layer 2 Enter interface interface-type Ethernet interface Ethernet interface-number Required...
Page 197: Setting An Encapsulation Format For Lldpdus
To do… Use the command… Remarks Set the number of LLDPDUs sent Optional each time fast LLDPDU transmission lldp fast-count count 3 by default. is triggered NOTE: To make sure that LLDP neighbors can receive LLDPDUs to update information about the current device •...
Page 198: Configuration Prerequisites
To make your device work with Cisco IP phones, you must enable CDP compatibility. If your LLDP-enabled device cannot recognize CDP packets, it does not respond to the requests of Cisco IP phones for the voice VLAN ID configured on the device. As a result, a requesting Cisco IP phone sends voice traffic without any tag to your device, and, as a result, your device cannot differentiate the voice traffic from other types of traffic.
Page 199: Configuring Lldp Trapping
Configuring LLDP trapping LLDP trapping notifies the network management system (NMS) of events such as newly-detected neighboring devices and link malfunctions. LLDP traps are sent periodically, and the interval is configurable. To prevent excessive LLDP traps from being sent when the topology is unstable, set a trap transmit interval for LLDP. Follow these steps to configure LLDP trapping: To do…...
Page 200: Lldp Configuration Examples
LLDP configuration examples Basic LLDP configuration example Network requirements As shown in Figure 62, the NMS and Switch A are located in the same Ethernet. An MED device and Switch B are connected to GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 of Switch A. Enable LLDP on the ports of Switch A and Switch B to monitor the link between Switch A and Switch B and the link between Switch A and the MED device on the NMS.
Page 201: Verify The Configuration
[SwitchB-GigabitEthernet1/0/1] quit Verify the configuration # Display the global LLDP status and port LLDP status on Switch A. [SwitchA] display lldp status Global status of LLDP: Enable The current number of LLDP neighbors: 2 The current number of CDP neighbors: 0 LLDP neighbor information last changed time: 0 days,0 hours,4 minutes,40 seconds Transmit interval : 30s...
Page 202: Cdp-Compatible Lldp Configuration Example
LLDP neighbor information last changed time: 0 days,0 hours,5 minutes,20 seconds Transmit interval : 30s Hold multiplier Reinit delay : 2s Transmit delay : 2s Trap interval : 5s Fast start times Port 1 [GigabitEthernet1/0/1]: Port status of LLDP : Enable Admin status : Rx_Only Trap flag...
Page 203 Figure 63 Network diagram Configuration procedure Configure a voice VLAN on Switch A. # Create VLAN 2. <SwitchA> system-view [SwitchA] vlan 2 [SwitchA-vlan2] quit # Set the link type of GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to trunk and enable voice VLAN on them.
Page 204 Port ID : Port 1 Sofrware version : P0030301MFG2 Platform : Cisco IP Phone 7960 Duplex : Full CDP neighbor-information of port 2[GigabitEthernet1/0/2]: CDP neighbor index : 2 Chassis ID : SEP00141CBCDBFF Port ID : Port 1 Sofrware version : P0030301MFG2 Platform : Cisco IP Phone 7960 Duplex...
Page 205: Index
Index A B C D E G I L M O P Q R S T V Assigning a port to the isolation group,51 Displaying and maintaining an Ethernet interface,15 Displaying and maintaining Ethernet link aggregation,45 BPDU tunneling configuration examples,105 Displaying and maintaining GVRP,158 Displaying and maintaining...
Page 206 LLDP configuration task list,181 QinQ configuration examples,170 QinQ configuration task list,167 MAC address table configuration example,26 MAC Information configuration example,30 MAC-based VLAN configuration,1 19 RSTP,60 MSTP,61 Setting speed options for auto negotiation on an Overview(MAC address table),20 Ethernet interface,3 Overview(MAC Information),28 Setting the MDI mode of an Ethernet interface,12...

H3C S5120-EI Configuration Manual

Quick Links

Need help?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for H3C S5120-EI

Summary of Contents for H3C S5120-EI

Table of Contents