Download Print this page

HP H3C S5100-SI Operation Manual

Ethernet switches.
Hide thumbs
   
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830

Advertisement

H3C S5100-SI/EI Series Ethernet Switches
Operation Manual
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Manual Version: 20100115-C-1.05
Product Version: Release 220X series

Advertisement

Table Of Contents

Troubleshooting

   Related Manuals for HP H3C S5100-SI

   Summary of Contents for HP H3C S5100-SI

  • Page 1

    H3C S5100-SI/EI Series Ethernet Switches Operation Manual Hangzhou H3C Technologies Co., Ltd. http://www.h3c.com Manual Version: 20100115-C-1.05 Product Version: Release 220X series...

  • Page 2

    Copyright © 2007-2010, Hangzhou H3C Technologies Co., Ltd. and its licensors All Rights Reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. Trademarks H3C, , Aolynk,...

  • Page 3: Table Of Contents

    About This Manual Organization H3C S5100-SI/EI Series Ethernet Switches Operation Manual is organized as follows: Part Contents Introduces the characteristics and implementations of the 0 Product Overview Ethernet switch. Introduces the ways to log into an Ethernet switch and CLI 1 Login related configuration.

  • Page 4

    Part Contents 25 Multicast Introduces IGMP snooping and the related configuration. 26 NTP Introduces NTP and the related configuration. 27 SSH Introduces SSH2.0 and the related configuration. 28 File System Management Introduces basic configuration for file system management. Introduces basic configuration for FTP, SFTP and TFTP, and 29 FTP-SFTP-TFTP the applications.

  • Page 5: Related Documentation, Obtaining Documentation

    Means a complementary description. Means techniques helpful for you to make configuration with ease. Related Documentation In addition to this manual, each H3C S5100-SI/EI Series Ethernet Switches documentation set includes the following: Manual Description H3C S5100-SI/EI Series Ethernet Switches It provides information for the system installation.

  • Page 6

    Documentation Feedback You can e-mail your comments about product documentation to info@h3c.com. We appreciate your comments.

  • Page 7: Product Overview

    Table of Contents 1 Obtaining the Documentation ··················································································································1-1 CD-ROM ·················································································································································1-1 H3C Website ···········································································································································1-1 Software Release Notes ·························································································································1-1 2 Correspondence Between Documentation and Software ·····································································2-1 Manual List··············································································································································2-1 Software Version·····································································································································2-1 3 Product Overview ······································································································································3-1 4 Networking Applications ··························································································································4-1 Convergence Layer Devices···················································································································4-1 Access Layer Devices·····························································································································4-1 Data Center Access ································································································································4-2...

  • Page 8: Software Release Notes, Obtaining The Documentation, H3c Website

    Obtaining the Documentation H3C Technologies Co., Ltd. provides various ways for you to obtain documentation, through which you can obtain the product documentations and those concerning newly added new features. The documentations are available in one of the following ways: CD-ROMs shipped with the devices H3C website Software release notes...

  • Page 9: Manual List, Software Version

    H3C S5100-SI/EI Series Ethernet Switches Command Manual-Release 220X Series Software Version H3C S5100-SI/EI Series Ethernet Switches Operation Manual-Release 220X Series and H3C S5100-SI/EI Series Ethernet Switches Command Manual-Release 220X Series are for the software version of Release2200, Release2201 and Release2203P08 of the S5100-SI/EI series products.

  • Page 10

    Software Added and Modified Features Compared With The Manual Version Earlier Version The tx-period-value argument of dot1x timer Modified 14-802.1x and tx-period command ranges from 1 to 120, features System Guard instead of 10 to 120(in seconds). The S5100-EI series Ethernet switches do not Deleted 17-IP Address and support to specify a secondary IP address of an...

  • Page 11

    For the convenience of users, units of Mega bps/1000 Mega bps in the following chapters are simplified as M/G. H3C S5100-SI/EI Series Ethernet Switches (hereinafter referred to as S5100-SI/EI series) are Gigabit Ethernet switching products developed by H3C Technologies Co., Ltd. H3C S5100-SI/EI series provide a variety of service features and powerful QACL functions.

  • Page 12

    Table 3-2 Mapping relations between the ports forming the Combo port 10/100/1000Base-T autosensing Model 1000Base-X SFP port Ethernet port S5100-16P-SI S5100-16P-EI S5100-16P-PWR-EI S5100-24P-SI S5100-24P-EI S5100-26C-EI S5100-26C-PWR-EI S5100-48P-SI S5100-48P-EI S5100-50C-EI S5100-50C-PWR-EI...

  • Page 13: Networking Applications, Convergence Layer Devices, Access Layer Devices

    Networking Applications S5100-SI/EI series Gigabit Ethernet switches are designed as convergence layer switches or access layer switches for enterprise networks and metropolitan area networks (MANs). S5100-SI/EI series provide 24 or 48 autosensing Gigabit Ethernet ports for connecting downstream devices. In addition, S5100-26C-EI and S5100-50C-EI also provide two 10GE extension slots to support flexible networking by means of optional XFP interface cards / XENPAK optical modules / dedicated stack cards for Gigabit Ethernet to the desktop (GTTD) access of enterprise networks, user access and convergence of carrier networks, and connection of data center server clusters.

  • Page 14: Data Center Access

    Figure 4-2 Application of S5100-EI series in the access layer Data Center Access In the networking of a data center, S5100-EI series are deployed on the core network to provide 10GE/GE access core network functions. The server cluster can be connected to the core network at the Gigabit Ethernet rate through S5100-EI series switches.

  • Page 15: Login

    Table of Contents 1 Logging In to an Ethernet Switch ············································································································1-1 Logging In to an Ethernet Switch ············································································································1-1 Introduction to the User Interface············································································································1-1 Supported User Interfaces ··············································································································1-1 Relationship Between a User and a User Interface ········································································1-2 User Interface Index ························································································································1-2 Common User Interface Configuration····························································································1-2 2 Logging In Through the Console Port·····································································································2-1 Introduction ·············································································································································2-1...

  • Page 16: Table Of Contents

    Switch Configuration························································································································4-2 Modem Connection Establishment ·········································································································4-2 5 CLI Configuration ······································································································································5-1 Introduction to the CLI·····························································································································5-1 Command Hierarchy ·······························································································································5-1 Command Level and User Privilege Level ······················································································5-1 Modifying the Command Level········································································································5-2 Switching User Level ·······················································································································5-3 CLI Views ················································································································································5-4 CLI Features ···········································································································································5-7 Online Help······································································································································5-7 Terminal Display······························································································································5-9 Command History····························································································································5-9 Error Prompts ··································································································································5-9...

  • Page 17: Logging In To An Ethernet Switch, Introduction To The User Interface, Supported User Interfaces

    Logging In to an Ethernet Switch Go to these sections for information you are interested in: Logging In to an Ethernet Switch Introduction to the User Interface Logging In to an Ethernet Switch To manage or configure an S5100-SI/EI Ethernet switch, you can log in to it in one of the following three methods: Command Line Interface Web-based Network Management Interface...

  • Page 18: Relationship Between A User And A User Interface, User Interface Index, Common User Interface Configuration

    Table 1-1 Description on user interface User interface Applicable user Port used Remarks Each switch can Users logging in through the Console port accommodate one AUX console port user. Each switch can Telnet users and SSH users Ethernet port accommodate up to five VTY users.

  • Page 19

    To do… Use the command… Remarks Optional Lock the current user Available in user view lock interface A user interface is not locked by default. Specify to send messages Optional to all user interfaces/a send { all | number | type number } Available in user view specified user interface Optional...

  • Page 20: Logging In Through The Console Port

    Logging In Through the Console Port Go to these sections for information you are interested in: Introduction Setting Up a Login Environment for Login Through the Console Port Console Port Login Configuration Console Port Login Configuration with Authentication Mode Being None Console Port Login Configuration with Authentication Mode Being Password Console Port Login Configuration with Authentication Mode Being Scheme Introduction...

  • Page 21

    Figure 2-1 Diagram for connecting to the console port of a switch If you use a PC to connect to the console port, launch a terminal emulation utility (such as Terminal in Windows 3.X or HyperTerminal in Windows 9X/Windows 2000/Windows XP. The following assumes that you are running Windows XP) and perform the configuration shown in Figure 2-2 through...

  • Page 22

    Figure 2-2 Create a connection Figure 2-3 Specify the port used to establish the connection Figure 2-4 Set port parameters Turn on the switch. You will be prompted to press the Enter key if the switch successfully completes POST (power-on self test). The prompt (such as <H3C>) appears after you press the Enter key, as shown in Figure 2-5.

  • Page 23: Console Port Login Configuration, Common Configuration

    Figure 2-5 HyperTerminal CLI You can then configure the switch or check the information about the switch by executing the corresponding commands. You can also acquire help by typing the ? character. Refer to related parts in this manual for information about the commands used for configuring the switch. Console Port Login Configuration Common Configuration Table 2-2 Common configuration of console port login...

  • Page 24

    Configuration Remarks Optional Set history command buffer By default, the history command buffer can contain up size to 10 commands. Optional Set the timeout time of a user interface The default timeout time is 10 minutes. The change to console port configuration takes effect immediately, so the connection may be disconnected when you log in through a console port and then configure this console port.

  • Page 25: Console Port Login Configurations For Different Authentication Modes

    To do… Use the command… Remarks Optional By default, the screen can contain up Set the maximum number of screen-length to 24 lines. lines the screen can contain screen-length You can use the screen-length 0 command to disable the function to display information in pages.

  • Page 26: Console Port Login Configuration With Authentication Mode Being None

    Changes made to the authentication mode for console port login takes effect after you quit the command-line interface and then log in again. Console Port Login Configuration with Authentication Mode Being None Configuration Procedure Follow these steps to configure console port login with the authentication mode being none: To do…...

  • Page 27: Console Port Login Configuration With Authentication Mode Being Password

    Network diagram GE1/0/1 Ethernet Configuration PC running Telnet Figure 2-6 Network diagram for AUX user interface configuration (with the authentication mode being none) Configuration procedure # Enter system view. <Sysname> system-view # Enter AUX user interface view. [Sysname] user-interface aux 0 # Specify not to authenticate users logging in through the console port.

  • Page 28: Configuration Example

    To do… Use the command… Remarks Enter system view system-view — Enter AUX user interface user-interface aux 0 — view Required By default, users logging in to a switch Configure to authenticate authentication-mode through the console port are not users using the local password authenticated;...

  • Page 29: Console Port Login Configuration With Authentication Mode Being Scheme

    # Enter AUX user interface view. [Sysname] user-interface aux 0 # Specify to authenticate users logging in through the console port using the local password. [Sysname-ui-aux0] authentication-mode password # Set the local password to 123456 (in plain text). [Sysname-ui-aux0] set authentication password simple 123456 # Specify commands of level 2 are available to users logging in to the AUX user interface.

  • Page 30

    To do… Use the command… Remarks Enter the Optional default ISP domain domain-name By default, the local AAA scheme domain view is applied. If you specify to apply the local scheme { local | none | AAA scheme, you need to Specify the AAA radius-scheme perform the configuration...

  • Page 31

    Set the authentication password of the local user to 123456 (in plain text). Set the service type of the local user to Terminal and the command level to 2. Configure to authenticate the users in the scheme mode. The baud rate of the console port is 19,200 bps. The screen can contain up to 30 lines.

  • Page 32

    [Sysname-ui-aux0] history-command max-size 20 # Set the timeout time of the AUX user interface to 6 minutes. [Sysname-ui-aux0] idle-timeout 6 After the above configuration, you need to modify the configuration of the terminal emulation utility running on the PC accordingly in the dialog box shown in Figure 2-4 to log in to the switch successfully.

  • Page 33: Logging In Through Telnet, Common Configuration To Control Telnet Access

    Logging In Through Telnet Go to these sections for information you are interested in: Introduction Telnet Configuration with Authentication Mode Being None Telnet Configuration with Authentication Mode Being Password Introduction S5100-SI/EI series Ethernet switches support Telnet. You can manage and maintain a switch remotely by Telnetting to the switch.

  • Page 34

    Configuration Description Optional Configure the protocols the By default, Telnet and SSH protocol are user interface supports supported. Optional Set the commands to be executed automatically after By default, no command is executed a user log in to the user automatically after a user logs into the VTY user interface successfully interface.

  • Page 35: Telnet Configurations For Different Authentication Modes

    To do… Use the command… Remarks Optional The default history command Set the history command buffer history-command buffer size is 10, that is, the history size max-size value command buffer of a user can store up to 10 commands by default.

  • Page 36: Telnet Configuration With Authentication Mode Being None

    To improve security and prevent attacks to the unused Sockets, TCP 23 and TCP 22, ports for Telnet and SSH services respectively, will be enabled or disabled after corresponding configurations. If the authentication mode is none, TCP 23 will be enabled, and TCP 22 will be disabled. If the authentication mode is password, and the corresponding password has been set, TCP 23 will be enabled, and TCP 22 will be disabled.

  • Page 37: Telnet Configuration With Authentication Mode Being Password

    Network diagram Figure 3-1 Network diagram for Telnet configuration (with the authentication mode being none) Configuration procedure # Enter system view. <Sysname> system-view # Enter VTY 0 user interface view. [Sysname] user-interface vty 0 # Configure not to authenticate Telnet users logging in to VTY 0. [Sysname-ui-vty0] authentication-mode none # Specify commands of level 2 are available to users logging in to VTY 0.

  • Page 38

    Configuration Example Network requirements Assume current user logins through the console port and the current user level is set to the administrator level (level 3). Perform the following configurations for users logging in to VTY 0 using Telnet. Authenticate users using the local password. Set the local password to 123456 (in plain text).

  • Page 39: Telnet Configuration With Authentication Mode Being Scheme

    Telnet Configuration with Authentication Mode Being Scheme Configuration Procedure Follow these steps to configure Telnet with the authentication mode being scheme: To do… Use the command… Remarks Enter system view system-view — Enter one or more VTY user user-interface vty —...

  • Page 40

    Refer to the AAA part of this manual for information about AAA, RADIUS, and HWTACACS. Configuration Example Network requirements Assume current user logins through the console port and the user level is set to the administrator level (level 3). Perform the following configurations for users logging in to VTY 0 using Telnet. Configure the local user name as guest.

  • Page 41: Telnetting To A Switch, Telnetting To A Switch From A Terminal

    # Set the maximum number of lines the screen can contain to 30. [Sysname-ui-vty0] screen-length 30 # Set the maximum number of commands the history command buffer can store to 20. [Sysname-ui-vty0] history-command max-size 20 # Set the timeout time to 6 minutes. [Sysname-ui-vty0] idle-timeout 6 Telnetting to a Switch Telnetting to a Switch from a Terminal...

  • Page 42

    Connect your PC/terminal and the Switch to an Ethernet, as shown in Figure 3-6. Make sure the port through which the switch is connected to the Ethernet belongs to VLAN 1 and the route between your PC and VLAN-interface 1 is reachable. Workstation Ethernet Switch Ethernet port...

  • Page 43: Telnetting To Another Switch From The Current Switch

    Telnetting to another Switch from the Current Switch You can Telnet to another switch from the current switch. In this case, the current switch operates as the client, and the other operates as the server. If the interconnected Ethernet ports of the two switches are in the same LAN segment, make sure the IP addresses of the two management VLAN interfaces to which the two Ethernet ports belong to are of the same network segment, or the route between the two VLAN interfaces is available.

  • Page 44: Logging In Using A Modem, Configuration On The Switch Side, Modem Configuration

    Logging In Using a Modem Go to these sections for information you are interested in: Introduction Configuration on the Switch Side Modem Connection Establishment Introduction The administrator can log in to the console port of a remote switch using a modem through public switched telephone network (PSTN) if the remote switch is connected to the PSTN through a modem to configure and maintain the switch remotely.

  • Page 45: Modem Connection Establishment, Switch Configuration

    You can verify your configuration by executing the AT&V command. The configuration commands and the output of different modems may differ. Refer to the user manual of the modem when performing the above configuration. Switch Configuration After logging in to a switch through its console port by using a modem, you will enter the AUX user interface.

  • Page 46

    Modem serial cable Telephone line Modem PSTN Modem Telephone number of the romote end: 82882285 Console port Figure 4-1 Establish the connection by using modems Launch a terminal emulation utility on the PC and set the telephone number to call the modem directly connected to the switch, as shown in Figure 4-2 through...

  • Page 47

    Figure 4-2 Create a connection Figure 4-3 Set the telephone number Figure 4-4 Call the modem If the password authentication mode is specified, enter the password when prompted. If the password is correct, the prompt (such as <Sysname>) appears. You can then configure or manage the switch.

  • Page 48

    If you perform no AUX user-related configuration on the switch, the commands of level 3 are available to modem users. Refer to the CLI part for information about command level.

  • Page 49: Cli Configuration, Introduction To The Cli, Command Hierarchy, Command Level And User Privilege Level

    CLI Configuration When configuring CLI, go to these sections for information you are interested in: Introduction to the CLI Command Hierarchy CLI Views CLI Features Introduction to the CLI A command line interface (CLI) is a user interface to interact with a switch. Through the CLI on a switch, a user can enter commands to configure the switch and check output information to verify the configuration.

  • Page 50: Modifying The Command Level

    System level (level 2): Commands at this level are mainly used to configure services. Commands concerning routing and network layers are at this level. These commands can be used to provide network services directly. Manage level (level 3): Commands at this level are associated with the basic operation modules and support modules of the system.

  • Page 51: Switching User Level

    It is recommended not to change the level of a command arbitrarily, for it may cause inconvenience to maintenance and operation. When you change the level of a command with multiple keywords, you should input the keywords one by one in the order they appear in the command syntax. Otherwise, your configuration will not take effect.

  • Page 52: Cli Views

    Switching to a specific user level Table 5-2 Switch to a specific user level Operation Command Remarks Required Switch to a specified user level super [ level ] Execute this command in user view. If no user level is specified in the super password command or the super command, level 3 is used by default.

  • Page 53

    Table 5-3 CLI views View Available operation Prompt example Enter method Quit method Display operation Execute the Enter user view status and statistical quit command User view <Sysname> once logging into information of the to log out of the the switch. switch switch.

  • Page 54

    View Available operation Prompt example Enter method Quit method Execute the sftp SFTP client Configure SFTP client sftp-client> command in Execute the view parameters system view. quit command to return to Execute the stp system view. MST region Configure MST region [Sysname-mst-re region-configurati Execute the...

  • Page 55: Cli Features, Online Help

    View Available operation Prompt example Enter method Quit method Execute the Configure HWTACACS [Sysname-hwtac hwtacacs scheme HWTACACS view acs-a123] command in parameters system view. Configure PoE profile Execute the parameters PoE profile [Sysname-poe-pr poe-profile Only S5100-PWR-EI view ofile-a123] command in series switches system view.

  • Page 56

    User view commands: backup Backup current configuration boot Set boot option Change current directory clock Specify the system clock cluster Run cluster command copy Copy from one file to another debugging Enable system debugging functions delete Delete a file List files on a file system display Display current system information <Other information is omitted>...

  • Page 57: Terminal Display, Command History, Error Prompts

    Terminal Display The CLI provides the screen splitting feature to have display output suspended when the screen is full. When display output pauses, you can perform the following operations as needed (see Table 5-4). Table 5-4 Display-related operations Operation Function Stop the display output and execution of the Press <Ctrl+C>...

  • Page 58: Command Edit

    Table 5-5 Common error messages Error message Remarks The command does not exist. The keyword does not exist. Unrecognized command The parameter type is wrong. The parameter value is out of range. Incomplete command The command entered is incomplete. Too many parameters The parameters entered are too many.

  • Page 59: Management Interface, Establishing An Http Connection

    Logging In Through the Web-based Network Management Interface Go to these sections for information you are interested in: Introduction Establishing an HTTP Connection Configuring the Login Banner Enabling/Disabling the WEB Server Introduction An S5100-SI/EI Ethernet switch has a Web server built in. It enables you to log in to an S5100-SI/EI Ethernet switch through a Web browser and then manage and maintain the switch intuitively by interacting with the built-in Web server.

  • Page 60: Configuring The Login Banner

    [Sysname-luser-admin] password simple admin Establish an HTTP connection between your PC and the switch, as shown in Figure 6-1. Figure 6-1 Establish an HTTP connection between your PC and the switch Log in to the switch through IE. Launch IE on the Web-based network management terminal (your PC) and enter the IP address of the management VLAN interface of the switch in the address bar.

  • Page 61: Enabling/disabling The Web Server

    Configuration Example Network requirements A user logs in to the switch through Web. The banner page is desired when a user logs into the switch. Network diagram Figure 6-3 Network diagram for login banner configuration Configuration Procedure # Enter system view. <Sysname>...

  • Page 62

    To do… Use the command… Remarks Required Enable the Web server ip http shutdown By default, the Web server is enabled. Disable the Web server undo ip http shutdown Required To improve security and prevent attack to the unused Sockets, TCP 80 port (which is for HTTP service) is enabled/disabled after the corresponding configuration.

  • Page 63: Connection Establishment Using Nms, Logging In Through Nms

    Logging In Through NMS Go to these sections for information you are interested in: Introduction Connection Establishment Using NMS Introduction You can also log in to a switch through a Network Management Station (NMS), and then configure and manage the switch through the agent software on the switch. Simple Network Management Protocol (SNMP) is applied between the NMS and the agent.

  • Page 64: Configuring Source Ip Address For Telnet Service Packets

    Configuring Source IP Address for Telnet Service Packets Go to these sections for information you are interested in: Overview Configuring Source IP Address for Telnet Service Packets Displaying Source IP Address Configuration Overview You can configure source IP address or source interface for the Telnet server and Telnet client. This provides a way to manage services and enhances security.

  • Page 65: Displaying Source Ip Address Configuration

    Operation Command Description Specify a source interface for telnet-server source-interface Optional Telnet server interface-type interface-number Specify source IP address for telnet source-ip ip-address Optional Telnet client Specify a source interface for telnet source-interface interface-type Optional Telnet client interface-number To perform the configurations listed in Table 8-1 Table 8-2, make sure that:...

  • Page 66: User Control, Controlling Telnet Users

    User Control Go to these sections for information you are interested in: Introduction Controlling Telnet Users Controlling Network Management Users by Source IP Addresses Controlling Web Users by Source IP Address Refer to the ACL part for information about ACL. Introduction You can control users logging in through Telnet, SNMP and WEB by defining Access Control List (ACL), as listed in...

  • Page 67: Controlling Telnet Users By Acl

    If no ACL is configured on the VTY user interface, users are not controlled when establishing a Telnet connection using this user interface. If an ACL is configured on the VTY user interface, there will be two possibilities: if the packets for establishing a Telnet connection match the ACL rule configured on the VTY user interface, the connection will be permitted or denied according to the ACL rule;...

  • Page 68: Controlling Network Management Users By Source Ip Addresses

    To do… Use the command… Remarks Apply a Required basic or advanced acl acl-number { inbound | Use either command ACL to outbound } Apply an The inbound keyword specifies to control ACL to filter the users trying to Telnet to Telnet users control the current switch.

  • Page 69

    Defining an ACL Applying the ACL to control users accessing the switch through SNMP To control whether an NMS can manage the switch, you can use this function. Prerequisites The controlling policy against network management users is determined, including the source IP addresses to be controlled and the controlling actions (permitting or denying).

  • Page 70: Controlling Web Users By Source Ip Address, Controlling Web Users By Source Ip Addresses

    Network diagram 10.110.100.46 Host A IP network Switch Host B 10.110.100.52 Figure 9-2 Network diagram for controlling SNMP users using ACLs Configuration procedure # Define a basic ACL. <Sysname> system-view [Sysname] acl number 2000 [Sysname-acl-basic-2000] rule 1 permit source 10.110.100.52 0 [Sysname-acl-basic-2000] quit # Apply the ACL to only permit SNMP users sourced from the IP addresses of 10.110.100.52 to access the switch.

  • Page 71: Logging Out A Web User

    To do… Use the command… Remarks As for the acl number Create a basic ACL or enter acl number acl-number command, the config keyword basic ACL view [ match-order { config | auto } ] is specified by default. rule [ rule-id ] { deny | permit } Define rules for the ACL Required [ rule-string ]...

  • Page 72

    # Apply ACL 2030 to only permit the Web users sourced from the IP address of 10.110.100.52 to access the switch. [Sysname] ip http acl 2030...

  • Page 73: Configuration File Management

    Table of Contents 1 Configuration File Management···············································································································1-1 Introduction to Configuration File ············································································································1-1 Configuration Task List ···························································································································1-2 Saving the Current Configuration ····································································································1-2 Erasing the Startup Configuration File ····························································································1-3 Specifying a Configuration File for Next Startup ·············································································1-4 Displaying Switch Configuration······································································································1-5...

  • Page 74: Configuration File Management, Introduction To Configuration File

    Configuration File Management When configuring configuration file management, go to these sections for information you are interested in: Introduction to Configuration File Configuration Task List Introduction to Configuration File A configuration file records and stores user configurations performed to a switch. It also enables users to check switch configurations easily.

  • Page 75: Configuration Task List, Saving The Current Configuration

    When saving the current configuration, you can specify the file to be a main or backup or normal configuration file. When removing a configuration file from a switch, you can specify to remove the main or backup configuration file. Or, if it is a file having both main and backup attribute, you can specify to erase the main or backup attribute of the file.

  • Page 76: Erasing The Startup Configuration File

    When you use the save safely command to save the configuration file, if the switch reboots or the power fails during the saving process, the switch initializes itself in the following two conditions when it starts up next time: If a configuration file with the extension .cfg exists in the Flash, the switch uses the configuration file to initialize itself when it starts up next time.

  • Page 77: Specifying A Configuration File For Next Startup

    You may need to erase the configuration file for one of these reasons: After you upgrade software, the old configuration file does not match the new software. The startup configuration file is corrupted or not the one you needed. The following two situations exist: While the reset saved-configuration [ main ] command erases the configuration file with main attribute, it only erases the main attribute of a configuration file having both main and backup attribute.

  • Page 78: Vlan, Displaying Switch Configuration

    The configuration file must use .cfg as its extension name and the startup configuration file must be saved at the root directory of the switch. If you select to skip the current configuration file to boot the device in the Boot ROM menu, it takes effect only once.

  • Page 79: Table Of Contents

    Table of Contents 1 VLAN Overview ··········································································································································1-1 VLAN Overview·······································································································································1-1 Introduction to VLAN ·······················································································································1-1 Advantages of VLANs ·····················································································································1-2 VLAN Fundamentals ·······················································································································1-2 VLAN Interface ································································································································1-4 VLAN Classification ·························································································································1-4 Port-Based VLAN····································································································································1-4 Link Types of Ethernet Ports ···········································································································1-5 Assigning an Ethernet Port to Specified VLANs ·············································································1-5 Configuring the Default VLAN ID for a Port·····················································································1-5 Protocol-Based VLAN ·····························································································································1-6 Introduction to Protocol-Based VLAN······························································································1-6...

  • Page 80: Vlan Overview

    VLAN Overview This chapter covers these topics: VLAN Overview Port-Based VLAN Protocol-Based VLAN VLAN Overview Introduction to VLAN The traditional Ethernet is a broadcast network, where all hosts are in the same broadcast domain and connected with each other through hubs or switches. Hubs and switches, which are the basic network connection devices, have limited forwarding functions.

  • Page 81: Advantages Of Vlans, Vlan Fundamentals

    Figure 1-1 A VLAN implementation Advantages of VLANs Compared with traditional Ethernet technology, VLAN technology delivers the following benefits: Confining broadcast traffic within individual VLANs. This saves bandwidth and improves network performance. Improving LAN security. By assigning user groups to different VLANs, you can isolate them at Layer 2.

  • Page 82

    Figure 1-3 Format of VLAN tag A VLAN tag comprises four fields: tag protocol identifier (TPID), priority, canonical format indicator (CFI), and VLAN ID. The 16-bit TPID field with a value of 0x8100 indicates that the frame is VLAN tagged. On the H3C series Ethernet switches, the default TPID is 0x8100.

  • Page 83: Management Vlan, Vlan Interface, Vlan Classification, Port-based Vlan

    VLAN are forwarded according to the MAC address forwarding table for the VLAN. Currently, the H3C S5100-SI/EI series Ethernet switches adopt the IVL mode only. For more information about the MAC address forwarding table, refer to the “MAC Address Forwarding Table Management”...

  • Page 84: Link Types Of Ethernet Ports, Assigning An Ethernet Port To Specified Vlans

    Ports on Ethernet switches have the three link types: access, trunk, and hybrid. For the three types of ports, the process of being added into a VLAN and the way of forwarding packets are different. Port-based VLANs are easy to implement and manage and applicable to hosts with relatively fixed positions.

  • Page 85: Protocol-based Vlan, Introduction To Protocol-based Vlan

    Table 1-1 Packet processing of an access port Processing of an incoming packet Processing of an outgoing packet For an untagged packet For a tagged packet If the VLAN ID is just the default VLAN Receive the packet and tag Strip the tag from the ID, receive the packet.

  • Page 86: Encapsulation Format Of Ethernet Data

    Encapsulation Format of Ethernet Data This section introduces the common encapsulation formats of Ethernet data for you to understand the procedure for the switch to identify the packet protocols. Ethernet II and 802.2/802.3 encapsulation There are two encapsulation types of Ethernet packets: Ethernet II defined by RFC 894 and 802.2/802.3 defined by RFC 1042.

  • Page 87

    Figure 1-7 802.2 LLC encapsulation format The DSAP field and the SSAP field in the 802.2 LLC encapsulation are used to identify the upper layer protocol. For example, if the two fields are both 0xE0, the upper layer protocol is IPX protocol. 802.2 Sub-Network Access Protocol (SNAP) encapsulation: encapsulates packets according to the 802.3 standard packet format, including the length, DSAP, SSAP, control, organizationally unique identifier (OUI), and protocol-ID (PID) fields.

  • Page 88: Procedure For The Switch To Judge Packet Protocol, Encapsulation Formats

    Procedure for the Switch to Judge Packet Protocol Figure 1-9 Protocol identification procedure Receive Receive packets packets Invalid packets Invalid packets Ethernet II Ethernet II Type(Length) Type(Length) that cannot be that cannot be 0x0600 to 0xFFFF 0x0600 to 0xFFFF 0x05DD to 0x05FF 0x05DD to 0x05FF encapsulation encapsulation...

  • Page 89: Implementation Of Protocol-based Vlan

    Implementation of Protocol-Based VLAN S5100-SI/EI series Ethernet switches assign the packet to the specific VLAN by matching the packet with the protocol template. The protocol template is the standard to determine the protocol to which a packet belongs. Protocol templates include standard templates and user-defined templates: The standard template adopts the RFC-defined packet encapsulation formats and values of some specific fields as the matching criteria.

  • Page 90: Vlan Configuration

    VLAN Configuration When configuring a VLAN, go to these sections for information you are interested in: VLAN Configuration Configuring a Port-Based VLAN Configuring a Protocol-Based VLAN VLAN Configuration VLAN Configuration Task List Complete the following tasks to configure VLAN: Task Remarks Basic VLAN Configuration Required...

  • Page 91: Basic Vlan Interface Configuration

    VLAN 1 is the system default VLAN, which needs not to be created and cannot be removed, either. The VLAN you created in the way described above is a static VLAN. On the switch, there are dynamic VLANs which are registered through GVRP. For details, refer to “GVRP” part of this manual.

  • Page 92: Displaying Vlan Configuration, Configuring A Port-based Vlan, Port-based Vlan Configuration Task List

    To do... Use the command... Remarks Optional By default, the VLAN interface is enabled. Disable the VLAN shutdown In this case, the VLAN interface’s status is interface determined by the status of the ports in the VLAN, that is, if all ports of the VLAN are down, the VLAN interface is down (disabled);...

  • Page 93: Assigning An Ethernet Port To A Vlan

    To do… Use the command… Remarks interface interface-type Enter Ethernet port view — interface-number Required port link-type { access | Configure the port link type The link type of an Ethernet port is hybrid | trunk } access by default. To change the link type of a port from trunk to hybrid or vice versa, you need to set the link type to access first.

  • Page 94: Configuring The Default Vlan For A Port, Displaying And Maintaining Port-based Vlan

    Use the To do… Remarks command… Assign the specified Required access port or ports to port interface-list By default, all ports belong to VLAN 1. the current VLAN Configuring the Default VLAN for a Port Because an access port can belong to its default VLAN only, there is no need for you to configure the default VLAN for an access port.

  • Page 95

    The devices within each VLAN can communicate with each other but that in different VLANs cannot communicate with each other directly. Network diagram Figure 2-1 Network diagram for VLAN configuration Configuration procedure Configure Switch A. # Create VLAN 101, specify its descriptive string as “DMZ”, and add GigabitEthernet1/0/1 to VLAN 101. <SwitchA>...

  • Page 96: Configuring A Protocol-based Vlan, Protocol-based Vlan Configuration Task List

    # Configure GigabitEthernet1/0/3 of Switch A. [SwitchA] interface GigabitEthernet 1/0/3 [SwitchA-GigabitEthernet1/0/3] port link-type trunk [SwitchA-GigabitEthernet1/0/3] port trunk permit vlan 101 [SwitchA-GigabitEthernet1/0/3] port trunk permit vlan 201 # Configure GigabitEthernet1/0/10 of Switch B. [SwitchB] interface GigabitEthernet 1/0/10 [SwitchB-GigabitEthernet1/0/10] port link-type trunk [SwitchB-GigabitEthernet1/0/10] port trunk permit vlan 101 [SwitchB-GigabitEthernet1/0/10] port trunk permit vlan 201 Configuring a Protocol-Based VLAN...

  • Page 97: Associating A Port With A Protocol-based Vlan

    Because the IP protocol is closely associated with the ARP protocol, you are recommended to configure the ARP protocol type when configuring the IP protocol type and associate the two protocol types with the same port to avoid that ARP packets and IP packets are not assigned to the same VLAN, which will cause IP address resolution failure.

  • Page 98: Displaying Protocol-based Vlan Configuration, Protocol-based Vlan Configuration Example

    Displaying Protocol-Based VLAN Configuration To do... Use the command... Remarks Display the information about the display vlan [ vlan-id [ to vlan-id ] | all | protocol-based VLAN dynamic | static] Display the protocol information and display protocol-vlan vlan { vlan-id [ to protocol indexes configured on the Available in vlan-id ] | all }...

  • Page 99

    [Sysname] vlan 200 [Sysname-vlan200] port GigabitEthernet 1/0/12 # Configure protocol templates for VLAN 200 and VLAN 100, matching AppleTalk protocol and IP protocol respectively. [Sysname-vlan200] protocol-vlan at [Sysname-vlan200] quit [Sysname] vlan 100 [Sysname-vlan100] protocol-vlan ip # To ensure the normal operation of IP network, you need to configure a user-defined protocol template for VLAN 100 to match the ARP protocol (assume Ethernet II encapsulation is adopted here).

  • Page 100

    transmission by matching the corresponding protocol templates, so as to realize the normal communication between workstations and servers. 2-11...

  • Page 101: Table Of Contents

    Table of Contents 1 Management VLAN Configuration ···········································································································1-1 Introduction to Management VLAN·········································································································1-1 Management VLAN ·························································································································1-1 Static Route ·····································································································································1-1 Default Route···································································································································1-1 Management VLAN Configuration ··········································································································1-2 Prerequisites····································································································································1-2 Configuring the Management VLAN································································································1-2 Configuration Example ····················································································································1-3 Displaying and Maintaining management VLAN configuration·······························································1-4...

  • Page 102: Management Vlan Configuration, Introduction To Management Vlan, Static Route, Default Route

    Management VLAN Configuration Introduction to Management VLAN Management VLAN To manage an Ethernet switch remotely through Telnet or the built-in Web server, the switch need to be assigned an IP address, and make sure that a route exists between the user and the switch. As for an H3C series Layer 2 Ethernet switch, only the management VLAN interface can be assigned an IP address.

  • Page 103: Configuring The Management Vlan

    If no default route exists and the destination address of the packet is not in the routing table, the packet is discarded, and an ICMP destination unreachable message is returned to the source. The default route can be configured through a static route and exists in the routing table as a route destined to the network 0.0.0.0 (with the mask 0.0.0.0).

  • Page 104

    Configuration Example Network requirements For a user to manage Switch A remotely through Telnet, these requirements are to be met: Switch A has an IP address, and the remote Telnet user is reachable. You need to configure the switch as follows: Assigning an IP address to the management VLAN interface on Switch A Configuring the default route Network diagram...

  • Page 105: Displaying And Maintaining Management Vlan Configuration

    [Sysname-Vlan-interface10] ip address 1.1.1.1 255.255.255.0 [Sysname-Vlan-interface10] quit # Configure the default route. [Sysname] ip route-static 0.0.0.0 0.0.0.0 1.1.1.2 Displaying and Maintaining management VLAN configuration Table 1-2 Displaying and Maintaining management VLAN configuration Operation Command Remarks Display the IP-related display ip interface [ brief ] information about a [ Vlan-interface [ vlan-id ] ] management VLAN interface...

  • Page 106: Voice Vlan

    Table of Contents 1 Voice VLAN Configuration························································································································1-1 Voice VLAN Overview·····························································································································1-1 How an IP Phone Works ·················································································································1-1 How S5100-EI Series Switches Identify Voice Traffic·····································································1-3 Setting the Voice Traffic Transmission Priority ···············································································1-4 Configuring Voice VLAN Assignment Mode of a Port ·····································································1-4 Support for Voice VLAN on Various Ports·······················································································1-4 Security Mode of Voice VLAN ·········································································································1-6 Voice VLAN Configuration ······················································································································1-6 Configuration Prerequisites ·············································································································1-6...

  • Page 107: Voice Vlan Configuration, Voice Vlan Overview

    Voice VLAN Configuration The contents of this chapter are only applicable to the S5100-EI series among S5100-SI/EI series switches. When configuring voice VLAN, go to these sections for information you are interested in: Voice VLAN Overview Voice VLAN Configuration Displaying and Maintaining Voice VLAN Voice VLAN Configuration Example Voice VLAN Overview Voice VLANs are VLANs configured specially for voice traffic.

  • Page 108

    Voice VLAN configuration Failover call routing Following describes the way an IP phone acquires an IP address. Figure 1-1 Network diagram for IP phones As shown in Figure 1-1, the IP phone needs to work in conjunction with the DHCP server and the NCP to establish a path for voice data transmission.

  • Page 109: How S5100-ei Series Switches Identify Voice Traffic

    After receiving the DHCP request, DHCP Server 2 residing in the voice VLAN assigns a new IP address to the IP phone and sends a tagged response message to the IP phone. After the IP phone receives the tagged response message, it sends voice data packets tagged with the voice VLAN tag to communicate with the voice gateway.

  • Page 110: Setting The Voice Traffic Transmission Priority, Configuring Voice Vlan Assignment Mode Of A Port

    Setting the Voice Traffic Transmission Priority In order to improve transmission quality of voice traffic, the switch by default re-marks the priority of the traffic in the voice VLAN as follows: Set the CoS (802.1p) priority to 6. Set the DSCP value to 46. Configuring Voice VLAN Assignment Mode of a Port A port can work in automatic voice VLAN assignment mode or manual voice VLAN assignment mode.

  • Page 111

    Table 1-2 Matching relationship between port types and voice devices capable of acquiring IP address and voice VLAN automatically Voice VLAN Voice assignment traffic Port type Supported or not mode type Access Not supported Supported Make sure the default VLAN of the port exists and is not Trunk Tagged a voice VLAN, and the access port permits the traffic of...

  • Page 112: Security Mode Of Voice Vlan

    Table 1-3 Matching relationship between port types and voice devices acquiring voice VLAN through manual configuration Voice VLAN Port type Supported or not assignment mode Access Not supported Supported Make sure the default VLAN of the port exists and is not a Trunk voice VLAN, and the access port permits the traffic of the Automatic...

  • Page 113

    To do… Use the command… Remarks Optional voice vlan mac-address oui By default, the switch Set an OUI address that can be mask oui-mask [ description determines the voice traffic identified by the voice VLAN text ] according to the default OUI address.

  • Page 114: Configuring The Voice Vlan To Operate In Manual Voice Vlan Assignment Mode

    Configuring the Voice VLAN to Operate in Manual Voice VLAN Assignment Mode Follow these steps to configure a voice VLAN to operate in manual voice VLAN assignment mode: To do… Use the command… Remarks — Enter system view system-view Optional voice vlan mac-address Set an OUI address that can be identified Without this address,...

  • Page 115: Displaying And Maintaining Voice Vlan

    The voice VLAN function can be enabled for only one VLAN at one time. If the Link Aggregation Control Protocol (LACP) is enabled on a port, voice VLAN feature cannot be enabled on it. Voice VLAN function can be enabled only for the static VLAN. A dynamic VLAN cannot be configured as a voice VLAN.

  • Page 116: Voice Vlan Configuration Example, Voice Vlan Configuration Example (automatic Mode)

    Voice VLAN Configuration Example Voice VLAN Configuration Example (Automatic Mode) Network requirements Create a voice VLAN and configure it to operate in automatic mode to enable the port to which an IP phone is connected to join or exit the voice VLAN automatically and voice traffic to be transmitted within the voice VLAN.

  • Page 117: Voice Vlan Configuration Example (manual Mode), Voice Vlan Configuration Example (manual Mode)

    # Configure GigabitEthernet 1/0/1 as a hybrid port. [DeviceA-GigabitEthernet1/0/1] port link-type hybrid # Configure VLAN 6 as the default VLAN of GigabitEthernet 1/0/1, and configure GigabitEthernet 1/0/1 to permit packets with the tag of VLAN 6. [DeviceA-GigabitEthernet1/0/1] port hybrid pvid vlan 6 [DeviceA-GigabitEthernet1/0/1] port hybrid vlan 6 tagged # Enable the voice VLAN function on GigabitEthernet 1/0/1.

  • Page 118

    # Configure GigabitEthernet 1/0/1 to operate in manual mode. [DeviceA] interface GigabitEthernet 1/0/1 [DeviceA-GigabitEthernet1/0/1] undo voice vlan mode auto # Configure GigabitEthernet 1/0/1 as a hybrid port. [DeviceA-GigabitEthernet1/0/1] port link-type hybrid # Configure the voice VLAN as the default VLAN of GigabitEthernet 1/0/1, and add the voice VLAN to the list of untagged VLANs whose traffic is permitted by the port.

  • Page 119: Gvrp

    Table of Contents 1 GVRP Configuration ··································································································································1-1 Introduction to GVRP ······························································································································1-1 GARP···············································································································································1-1 GVRP···············································································································································1-4 Protocol Specifications ····················································································································1-4 GVRP Configuration································································································································1-4 GVRP Configuration Tasks ·············································································································1-4 Enabling GVRP ·······························································································································1-4 Configuring GVRP Timers ···············································································································1-5 Configuring GVRP Port Registration Mode ·····················································································1-6 Displaying and Maintaining GVRP··········································································································1-6 GVRP Configuration Example ················································································································1-7 GVRP Configuration Example·········································································································1-7...

  • Page 120: Gvrp Configuration, Introduction To Gvrp

    GVRP Configuration When configuring GVRP, go to these sections for information you are interested in: Introduction to GVRP GVRP Configuration Displaying and Maintaining GVRP GVRP Configuration Example Introduction to GVRP GARP VLAN registration protocol (GVRP) is an implementation of generic attribute registration protocol (GARP).

  • Page 121

    GARP timers Timers determine the intervals of sending different types of GARP messages. GARP defines four timers to control the period of sending GARP messages. Hold: When a GARP entity receives a piece of registration information, it does not send out a Join message immediately.

  • Page 122

    Figure 1-1 Format of GARP packets The following table describes the fields of a GARP packet. Table 1-1 Description of GARP packet fields Field Description Value Protocol ID Protocol ID Each message consists of two Message parts: Attribute Type and —...

  • Page 123: Protocol Specifications, Gvrp Configuration Tasks, Enabling Gvrp

    GVRP As an implementation of GARP, GARP VLAN registration protocol (GVRP) maintains dynamic VLAN registration information and propagates the information to the other switches through GARP. With GVRP enabled on a device, the VLAN registration information received by the device from other devices is used to dynamically update the local VLAN registration information, including the information about the VLAN members, the ports through which the VLAN members can be reached, and so on.

  • Page 124: Configuring Gvrp Timers

    To do ... Use the command ... Remarks Enter system view system-view — Required Enable GVRP globally gvrp By default, GVRP is disabled globally. interface interface-type Enter Ethernet port view — interface-number Required Enable GVRP on the port gvrp By default, GVRP is disabled on the port.

  • Page 125: Displaying And Maintaining Gvrp, Configuring Gvrp Port Registration Mode

    Table 1-2 Relations between the timers Timer Lower threshold Upper threshold This upper threshold is less than or equal to one-half of the timeout time of Hold 10 centiseconds the Join timer. You can change the threshold by changing the timeout time of the Join timer.

  • Page 126: Gvrp Configuration Example

    To do … Use the command … Remarks Display the settings of the display garp timer [ interface GARP timers interface-list ] display gvrp statistics Display GVRP statistics [ interface interface-list ] Display the global GVRP status display gvrp status reset garp statistics Clear GARP statistics [ interface interface-list ]...

  • Page 127

    # Configure GigabitEthernet1/0/2 to be a trunk port and to permit the packets of all the VLANs. [SwitchA] interface GigabitEthernet 1/0/2 [SwitchA-GigabitEthernet1/0/2] port link-type trunk [SwitchA-GigabitEthernet1/0/2] port trunk permit vlan all # Enable GVRP on GigabitEthernet1/0/2. [SwitchA-GigabitEthernet1/0/2] gvrp [SwitchA-GigabitEthernet1/0/2] quit # Configure GigabitEthernet1/0/3 to be a trunk port and to permit the packets of all the VLANs.

  • Page 128

    The following dynamic VLANs exist: 5, 7, 8, # Display the VLAN information dynamically registered on Switch E. [SwitchE] display vlan dynamic Total 1 dynamic VLAN exist(s). The following dynamic VLANs exist: Configure GigabitEthernet1/0/1 on Switch E to operate in fixed GVRP registration mode and display the VLAN information dynamically registered on Switch A, Switch B, and Switch E.

  • Page 129

    1-10...

  • Page 130: Port Basic Configuration

    Table of Contents 1 Port Basic Configuration ··························································································································1-1 Ethernet Port Configuration ····················································································································1-1 Combo Port Configuration ···············································································································1-1 Initially Configuring a Port ···············································································································1-2 Configuring Port Auto-Negotiation Speed ·······················································································1-2 Limiting Traffic on individual Ports···································································································1-3 Enabling Flow Control on a Port······································································································1-4 Duplicating the Configuration of a Port to Other Ports ····································································1-4 Configuring Loopback Detection for an Ethernet Port·····································································1-5 Enabling Loopback Test··················································································································1-6 Enabling the System to Test Connected Cable ··············································································1-6...

  • Page 131: Port Basic Configuration, Ethernet Port Configuration, Combo Port Configuration

    Port Basic Configuration Ethernet Port Configuration Combo Port Configuration A Combo port can operate as either an optical port or an electrical port. Inside the device there is only one forwarding interface. For a Combo port, the electrical port and the corresponding optical port are TX-SFP multiplexed.

  • Page 132: Initially Configuring A Port, Configuring Port Auto-negotiation Speed

    Initially Configuring a Port Follow these steps to initially configure a port: To do... Use the command... Remarks Enter system view system-view — interface interface-type Enter Ethernet port view — interface-number Optional By default, the port is enabled. Enable the Ethernet port undo shutdown Use the shutdown command to disable the port.

  • Page 133: Limiting Traffic On Individual Ports

    If you expect that 10 Mbps and 1000 Mbps are the available auto-negotiation speeds of the port, you just need to configure speed auto 10 1000. Follow these steps to configure auto-negotiation speeds for a port: To do... Use the command... Remarks Enter system view —...

  • Page 134: Enabling Flow Control On A Port, Duplicating The Configuration Of A Port To Other Ports

    Enabling Flow Control on a Port Flow control is enabled on both the local and peer switches. If congestion occurs on the local switch: The local switch sends a message to notify the peer switch of stopping sending packets to itself or reducing the sending rate temporarily.

  • Page 135: Link Aggregation, Configuring Loopback Detection For An Ethernet Port

    Configuring Loopback Detection for an Ethernet Port Loopback detection is used to monitor if loopback occurs on a switch port. After you enable loopback detection on Ethernet ports, the switch can monitor if external loopback occurs on them. If there is a loopback port found, the switch will put it under control. If loopback is found on an access port, the system disables the port, sends a Trap message to the client and removes the corresponding MAC forwarding entry.

  • Page 136: Enabling Loopback Test, Enabling The System To Test Connected Cable

    Enabling Loopback Test You can configure the Ethernet port to run loopback test to check if it operates normally. The port running loopback test cannot forward data packets normally. The loopback test terminates automatically after a specific period. Follow these steps to enable loopback test: To do...

  • Page 137: Configuring The Interval To Perform Statistical Analysis On Port Traffic

    Optical port (including Combo optical port) does not support VCT (virtual-cable-test) function. Combo electrical port supports VCT function only when it is in UP condition (using undo shutdown command), normal Ethernet electrical port always supports this function. Configuring the Interval to Perform Statistical Analysis on Port Traffic By performing the following configuration, you can set the interval to perform statistical analysis on the traffic of a port.

  • Page 138: Configuring A Port Group

    To do... Use the command... Remarks Enter system view — system-view interface interface-type Enter Ethernet port view — interface-number Required Disable a port from generating undo enable log updown By default, UP/Down log output UP/Down log is enabled. Configuration examples # In the default conditions, where UP/DOWN log output is enabled, execute the shutdown command or the undo shutdown command on GigabitEthernet 1/0/1.

  • Page 139: Displaying And Maintaining Basic Port Configuration

    Only S5100-EI Series Ethernet Switches support Port Group feature. A port can not be added to a port group if it has been added to an aggregation group, and vice versa. Displaying and Maintaining Basic Port Configuration To do... Use the command... Remarks Display port configuration display interface [ interface-type |...

  • Page 140: Table Of Contents

    Table of Contents 1 Link Aggregation Configuration ··············································································································1-1 Overview ·················································································································································1-1 Introduction to Link Aggregation······································································································1-1 Introduction to LACP ·······················································································································1-1 Consistency Considerations for the Ports in Aggregation·······························································1-1 Link Aggregation Classification···············································································································1-2 Manual Aggregation Group ·············································································································1-2 Static LACP Aggregation Group······································································································1-3 Dynamic LACP Aggregation Group·································································································1-4 Aggregation Group Categories ···············································································································1-5 Link Aggregation Configuration···············································································································1-6 Configuring a Manual Aggregation Group·······················································································1-6...

  • Page 141: Link Aggregation Configuration

    Link Aggregation Configuration When configuring link aggregation, go to these sections for information you are interested in: Overview Link Aggregation Classification Aggregation Group Categories Link Aggregation Configuration Displaying and Maintaining Link Aggregation Configuration Link Aggregation Configuration Example Overview Introduction to Link Aggregation Link aggregation aggregates multiple physical Ethernet ports into one logical link, also called an aggregation group.

  • Page 142: Link Aggregation Classification, Manual Aggregation Group

    Table 1-1 Consistency considerations for ports in an aggregation Category Considerations State of port-level STP (enabled or disabled) Attribute of the link (point-to-point or otherwise) connected to the port Port path cost STP priority STP packet format Loop protection Root protection Port type (whether the port is an edge port) Rate limiting Priority marking...

  • Page 143: Static Lacp Aggregation Group

    In a manual aggregation group, the system sets the ports to selected or unselected state according to the following rules. Among the ports in an aggregation group that are in up state, the system determines the mater port with one of the following settings being the highest (in descending order) as the master port: full duplex/high speed, full duplex/low speed, half duplex/high speed, half duplex/low speed.

  • Page 144: Dynamic Lacp Aggregation Group

    There is a limit on the number of selected ports in an aggregation group. Therefore, if the number of the selected ports in an aggregation group exceeds the maximum number supported by the device, those with lower port numbers operate as the selected ports, and others as unselected ports. Dynamic LACP Aggregation Group Introduction to dynamic LACP aggregation group A dynamic LACP aggregation group is automatically created and removed by the system.

  • Page 145: Aggregation Group Categories

    Aggregation Group Categories Depending on whether or not load sharing is implemented, aggregation groups can be load-sharing or non-load-sharing aggregation groups. When load sharing is implemented, For IP packets, the system will implement load-sharing based on source IP address and destination IP address;...

  • Page 146: Configuring A Manual Aggregation Group

    Link Aggregation Configuration The commands of link aggregation cannot be configured with the commands of port loopback detection feature at the same time. The ports where the mac-address max-mac-count command is configured cannot be added to an aggregation group. Contrarily, the mac-address max-mac-count command cannot be configured on a port that has already been added to an aggregation group.

  • Page 147: Configuring A Static Lacp Aggregation Group

    If the aggregation group you are creating already exists but contains no port, its type will change to the type you set. If the aggregation group you are creating already exists and contains ports, the possible type changes may be: changing from dynamic or static to manual, and changing from dynamic to static; and no other kinds of type change can occur.

  • Page 148: Configuring A Dynamic Lacp Aggregation Group, Configuring A Description For An Aggregation Group

    Configuring a Dynamic LACP Aggregation Group A dynamic LACP aggregation group is automatically created by the system based on LACP-enabled ports. The adding and removing of ports to/from a dynamic aggregation group are automatically accomplished by LACP. You need to enable LACP on the ports which you want to participate in dynamic aggregation of the system, because, only when LACP is enabled on those ports at both ends, can the two parties reach agreement in adding/removing ports to/from dynamic aggregation groups.

  • Page 149: Displaying And Maintaining Link Aggregation Configuration, Link Aggregation Configuration Example, Ethernet Port Aggregation Configuration Example

    If you have saved the current configuration with the save command, after system reboot, the configuration concerning manual and static aggregation groups and their descriptions still exists, but that of dynamic aggregation groups and their descriptions gets lost. Displaying and Maintaining Link Aggregation Configuration To do…...

  • Page 150

    Configuration procedure The following only lists the configuration on Switch A; you must perform the similar configuration on Switch B to implement link aggregation. Adopting manual aggregation mode # Create manual aggregation group 1. <Sysname> system-view [Sysname] link-aggregation group 1 mode manual # Add GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to aggregation group 1.

  • Page 151

    [Sysname-GigabitEthernet1/0/3] lacp enable The three LACP-enabled ports can be aggregated into one dynamic aggregation group to implement load sharing only when they have the same basic configuration (such as rate, duplex mode, and so on). 1-11...

  • Page 152: Port Isolation

    Table of Contents 1 Port Isolation Configuration ·····················································································································1-1 Port Isolation Overview ···························································································································1-1 Port Isolation Configuration·····················································································································1-1 Displaying and Maintaining Port Isolation Configuration ········································································1-2 Port Isolation Configuration Example······································································································1-2...

  • Page 153: Port Isolation Configuration, Port Isolation Overview

    Port Isolation Configuration When configuring port isolation, go to these sections for information you are interested in: Port Isolation Overview Port Isolation Configuration Displaying and Maintaining Port Isolation Configuration Port Isolation Configuration Example Port Isolation Overview With the port isolation feature, you can add the ports to be controlled into an isolation group to isolate the Layer 2 and Layer 3 data between each port in the isolation group.

  • Page 154: Port Isolation Configuration Example, Displaying And Maintaining Port Isolation Configuration

    When a member port of an aggregation group joins/leaves an isolation group, the other ports in the same aggregation group will join/leave the isolation group at the same time. For ports that belong to an aggregation group and an isolation group simultaneously, removing a port from the aggregation group has no effect on the other ports.

  • Page 155: Configuration Procedure

    Configuration procedure # Add GigabitEthernet1/0/2, GigabitEthernet1/0/3, and GigabitEthernet1/0/4 to the isolation group. <Sysname> system-view System View: return to User View with Ctrl+Z. [Sysname] interface GigabitEthernet1/0/2 [Sysname-GigabitEthernet1/0/2] port isolate [Sysname-GigabitEthernet1/0/2] quit [Sysname] interface GigabitEthernet1/0/3 [Sysname-GigabitEthernet1/0/3] port isolate [Sysname-GigabitEthernet1/0/3] quit [Sysname] interface GigabitEthernet1/0/4 [Sysname-GigabitEthernet1/0/4] port isolate [Sysname-GigabitEthernet1/0/4] quit [Sysname] quit...

  • Page 156: Table Of Contents

    Table of Contents 1 Port Security Configuration······················································································································1-1 Port Security Overview····························································································································1-1 Introduction······································································································································1-1 Port Security Features·····················································································································1-1 Port Security Modes ························································································································1-1 Port Security Configuration Task List······································································································1-4 Enabling Port Security ·····················································································································1-4 Setting the Maximum Number of MAC Addresses Allowed on a Port ············································1-5 Setting the Port Security Mode········································································································1-6 Configuring Port Security Features ·································································································1-7 Ignoring the Authorization Information from the RADIUS Server····················································1-8 Configuring Security MAC Addresses ·····························································································1-8...

  • Page 157: Port Security Configuration, Port Security Overview, Port Security Features, Port Security Modes

    Port Security Configuration When configuring port security, go to these sections for information you are interested in: Port Security Overview Port Security Configuration Task List Displaying and Maintaining Port Security Configuration Port Security Configuration Example Port Security Overview Introduction Port security is a security mechanism for network access control. It is an expansion to the current 802.1x and MAC address authentication.

  • Page 158

    Table 1-1 Description of port security modes Security mode Description Feature In this mode, neither the In this mode, access to the port is not NTK nor the intrusion noRestriction restricted. protection feature is triggered. In this mode, the port automatically learns MAC addresses and changes them to security MAC addresses.

  • Page 159

    MAC-based 802.1x authentication is performed on the access user. The port is enabled only after the authentication succeeds. When the port is enabled, only the packets of the successfully authenticated user In any of these modes, the can pass through the port. device triggers the NTK In this mode, only one 802.1x-authenticated and Intrusion Protection...

  • Page 160: Port Security Configuration Task List, Enabling Port Security

    This mode is similar to the macAddressElseUs macAddressElseUserLoginSecure mode, erLoginSecureExt except that there can be more than one 802.1x-authenticated user on the port. In this mode, a port firstly performs MAC authentication for a user and then performs 802.1x authentication for the user if the user passes MAC authentication.

  • Page 161: Setting The Maximum Number Of Mac Addresses Allowed On A Port

    Enabling Port Security Follow these steps to enable port security: To do... Use the command... Remarks Enter system view system-view — Required Enable port security port-security enable Disabled by default Enabling port security resets the following configurations on the ports to the defaults (shown in parentheses below): 802.1x (disabled), port access control method (macbased), and port access control mode (auto) MAC authentication (disabled)

  • Page 162: Setting The Port Security Mode

    Setting the Port Security Mode Follow these steps to set the port security mode: To do... Use the command... Remarks Enter system view system-view — Optional In userLoginWithOUI mode, a Set the OUI value for user port-security oui OUI-value port supports one 802.1x user authentication index index-value plus one user whose source...

  • Page 163: Configuring Port Security Features

    Configuring Port Security Features Configuring the NTK feature Follow these steps to configure the NTK feature: To do... Use the command... Remarks Enter system view system-view — interface interface-type Enter Ethernet port view — interface-number Required port-security ntk-mode { ntkonly | By default, NTK is disabled on Configure the NTK feature ntk-withbroadcasts |...

  • Page 164: Ignoring The Authorization Information From The Radius Server, Configuring Security Mac Addresses

    If you configure the NTK feature and execute the port-security intrusion-mode blockmac command on the same port, the switch will be unable to disable the packets whose destination MAC address is illegal from being sent out that port; that is, the NTK feature configured will not take effect on the packets whose destination MAC address is illegal.

  • Page 165: Displaying And Maintaining Port Security Configuration

    If the amount of security MAC addresses has not yet reach the maximum number, the port will learn new MAC addresses and turn them to security MAC addresses; If the amount of security MAC addresses reaches the maximum number, the port will not be able to learn new MAC addresses and the port mode will be changed from autolearn to secure.

  • Page 166: Port Security Configuration Example

    Port Security Configuration Example Port Security Configuration Example Network requirements Implement access user restrictions through the following configuration on GigabitEthernet 1/0/1 of the switch. Allow a maximum of 80 users to access the port without authentication and permit the port to learn and add the MAC addresses of the users as security MAC addresses.

  • Page 167: Port Binding Overview, Port Binding Configuration, Displaying And Maintaining Port Binding Configuration

    Port Binding Configuration When configuring port binding, go to these sections for information you are interested in: Port Binding Overview Displaying and Maintaining Port Binding Configuration Port Binding Configuration Example Port Binding Overview Introduction Port binding enables the network administrator to bind the MAC address and IP address of a user to a specific port.

  • Page 168: Port Binding Configuration Example

    Port Binding Configuration Example Port Binding Configuration Example Network requirements It is required to bind the MAC and IP addresses of Host A to GigabitEthernet 1/0/1 on Switch A, so as to prevent malicious users from using the IP address they steal from Host A to access the network. Network diagram Figure 2-1 Network diagram for port binding configuration Configuration procedure...

  • Page 169: Dldp

    Table of Contents 1 DLDP Configuration ··································································································································1-1 Overview ·················································································································································1-1 DLDP Fundamentals·······························································································································1-2 DLDP packets··································································································································1-2 DLDP Status····································································································································1-4 DLDP Timers ···································································································································1-4 DLDP Operating Mode ····················································································································1-5 DLDP Implementation ·····················································································································1-6 DLDP Neighbor State ······················································································································1-7 Link Auto-recovery Mechanism ·······································································································1-7 DLDP Configuration ································································································································1-8 Performing Basic DLDP Configuration ····························································································1-8 Resetting DLDP State ·····················································································································1-9 Displaying and Maintaining DLDP·································································································1-10 DLDP Configuration Example ···············································································································1-10...

  • Page 170: Dldp Configuration

    DLDP Configuration When configuring DLDP, go to these sections for information you are interested in: Overview DLDP Fundamentals DLDP Configuration DLDP Configuration Example Overview Device link detection protocol (DLDP) is an H3C technology for dealing with unidirectional links that may occur in a network. If two switches, A and B, are connected via a pair of optical fiber cables, one used for sending from A to B, the other sending from B to A, it is a bidirectional link (two-way link).

  • Page 171: Dldp Fundamentals, Dldp Packets

    Figure 1-2 Fiber broken or not connected Device link detection protocol (DLDP) can detect the link status of an optical fiber cable or copper twisted pair (such as super category 5 twisted pair). If DLDP finds a unidirectional link, it disables the related port automatically or prompts you to disable it manually according to the configurations, to avoid network problems.

  • Page 172

    DLDP packet type Function Advertisement packet with the RSY flag set to 1. RSY advertisement RSY-Advertisement packets are sent to request synchronizing the neighbor information when packets (referred to as neighbor information is not locally available or a neighbor information RSY packets hereafter) entry ages out.

  • Page 173: Dldp Status, Dldp Timers

    DLDP Status A link can be in one of these DLDP states: initial, inactive, active, advertisement, probe, disable, and delaydown. Table 1-2 DLDP status Status Description Initial Initial status before DLDP is enabled. Inactive DLDP is enabled but the corresponding link is down Active DLDP is enabled, and the link is up or an neighbor entry is cleared All neighbors communicate normally in both directions, or DLDP...

  • Page 174: Dldp Operating Mode

    Timer Description When a new neighbor joins, a neighbor entry is created and the corresponding entry aging timer is enabled When an advertisement packet is received from a neighbor, the neighbor entry is updated and the corresponding entry aging timer is updated In the normal mode, if no packet is received from the neighbor when the entry Entry aging timer aging timer expires, DLDP sends an advertisement packet with an RSY tag,...

  • Page 175: Dldp Implementation

    In normal DLDP mode, only fiber cross-connected unidirectional links (as shown in Figure 1-1 ) can be detected. In enhanced DLDP mode, two types of unidirectional links can be detected. One is fiber cross-connected links (as shown in Figure 1-1). The other refers to fiber pairs with one fiber not connected or disconnected (as shown in Figure 1-2).

  • Page 176: Dldp Neighbor State, Link Auto-recovery Mechanism

    Packet type Processing procedure Sends echo packets Creates the neighbor entry if it does not exist on the local containing both device. Probe packet neighbor and its own Resets the aging timer of the entry if the neighbor entry information to the already exists on the local device.

  • Page 177: Performing Basic Dldp Configuration

    means that the unidirectional link is restored to a bidirectional link), it is brought up by DLDP. The detailed process is as follows. A port in the DLDP down state sends a recover probe packet every 2 seconds. Recover probe packets carry only the local port information.

  • Page 178: Resetting Dldp State

    To do … Use the command … Remarks Optional. dldp work-mode Set the DLDP operating mode By default, DLDP works in { enhance | normal } normal mode. Note the following when performing basic DLDP configuration. DLDP can detect unidirectional links only after the links are connected. Therefore, before enabling DLDP, make sure that optical fibers or copper twisted pairs are connected.

  • Page 179: Dldp Configuration Example, Displaying And Maintaining Dldp

    To do … Use the command … Remarks system-view Reset DLDP state for all the ports shut down by DLDP dldp reset Select either of the two. interface interface-type Reset the DLDP state for a port interface-number shut down by DLDP dldp reset Displaying and Maintaining DLDP To do …...

  • Page 180

    [SwitchA] interface gigabitethernet 1/0/50 [SwitchA-GigabitEthernet1/0/50] duplex full [SwitchA-GigabitEthernet1/0/50] speed 1000 [SwitchA-GigabitEthernet1/0/50] quit [SwitchA] interface gigabitethernet 1/0/51 [SwitchA-GigabitEthernet1/0/51] duplex full [SwitchA-GigabitEthernet1/0/51] speed 1000 [SwitchA-GigabitEthernet1/0/51] quit # Enable DLDP globally [SwitchA] dldp enable # Set the interval between sending DLDP packets to 15 seconds. [SwitchA] dldp interval 15 # Configure DLDP to work in enhanced mode [SwitchA] dldp work-mode enhance...

  • Page 181: Mac Address Table

    Table of Contents 1 MAC Address Table Management············································································································1-1 Overview ·················································································································································1-1 Introduction to MAC Address Table ································································································1-1 Introduction to MAC Address Learning ···························································································1-1 Managing MAC Address Table ·······································································································1-3 Configuring MAC Address Table Management ······················································································1-4 Configuration Task List····················································································································1-4 Configuring a MAC Address Entry ··································································································1-5 Setting the Aging Time of MAC Address Entries ············································································1-6 Setting the Maximum Number of MAC Addresses a Port Can Learn ·············································1-6 Disabling MAC Address learning for a VLAN ··················································································1-7...

  • Page 182: Mac Address Table Management, Introduction To Mac Address Table, Introduction To Mac Address Learning

    MAC Address Table Management This chapter describes the management of static, dynamic, and blackhole MAC address entries. For information about the management of multicast MAC address entries, refer to the part related to multicast protocol. Overview Introduction to MAC Address Table An Ethernet switch is mainly used to forward packets at the data link layer, that is, transmit the packets to the corresponding ports according to the destination MAC address of the packets.

  • Page 183

    Figure 1-1 MAC address learning diagram (1) Figure 1-2 MAC address table entry of the switch (1) After learning the MAC address of User A, the switch starts to forward the packet. Because there is no MAC address and port information of User B in the existing MAC address table, the switch forwards the packet to all ports except GigabitEthernet 1/0/1 to ensure that User B can receive the packet.

  • Page 184: Managing Mac Address Table

    Figure 1-4 MAC address learning diagram (3) At this time, the MAC address table of the switch includes two forwarding entries shown in Figure 1-5. When forwarding the response packet, the switch unicasts the packet instead of broadcasting it to User A through GigabitEthernet 1/0/1, because MAC-A is already in the MAC address table. Figure 1-5 MAC address table entries of the switch (2) After this interaction, the switch directly unicasts the communication packets between User A and User B based on the corresponding MAC address table entries.

  • Page 185: Configuring Mac Address Table Management

    Aging timer only takes effect on dynamic MAC address entries. Entries in a MAC address table Entries in a MAC address table fall into the following categories according to their characteristics and configuration methods: Static MAC address entry: Also known as permanent MAC address entry. This type of MAC address entries are added/removed manually and can not age out by themselves.

  • Page 186: Configuring A Mac Address Entry

    Configuring a MAC Address Entry You can add, modify, or remove a MAC address entry, remove all MAC address entries concerning a specific port, or remove specific type of MAC address entries (dynamic or static MAC address entries). You can add a MAC address entry in either system view or Ethernet port view. Adding a MAC address entry in system view Table 1-3 Add a MAC address entry in system view Operation...

  • Page 187: Setting The Aging Time Of Mac Address Entries

    Setting the Aging Time of MAC Address Entries Setting aging time properly helps effective utilization of MAC address aging. The aging time that is too long or too short affects the performance of the switch. If the aging time is too long, excessive invalid MAC address entries maintained by the switch may fill up the MAC address table.

  • Page 188: Displaying Mac Address Table Information, Disabling Mac Address Learning For A Vlan

    Operation Command Description Required Set the maximum number of mac-address max-mac-count By default, the number of the MAC addresses the port can count MAC addresses a port can learn learn is not limited. Disabling MAC Address learning for a VLAN You can disable a switch from learning MAC addresses in specific VLANs to improve stability and security for the users belong to these VLANs and prevent unauthorized accesses.

  • Page 189: Adding A Static Mac Address Entry Manually

    Configuration Example Adding a Static MAC Address Entry Manually Network requirements The server connects to the switch through GigabitEthernet 1/0/2. To prevent the switch from broadcasting packets destined for the server, it is required to add the MAC address of the server to the MAC address table of the switch, which then forwards packets destined for the server through GigabitEthernet 1/0/2.

  • Page 190: Mstp

    Table of Contents 1 MSTP Configuration ··································································································································1-1 Overview ·················································································································································1-1 Spanning Tree Protocol Overview···································································································1-1 Rapid Spanning Tree Protocol Overview ······················································································1-10 Multiple Spanning Tree Protocol Overview ···················································································1-10 MSTP Implementation on Switches ······························································································1-14 Protocols and Standards ···············································································································1-15 MSTP Configuration Task List ··············································································································1-15 Configuring Root Bridge························································································································1-17 Configuring an MST Region ··········································································································1-17 Specifying the Current Switch as a Root Bridge/Secondary Root Bridge·····································1-18 Configuring the Bridge Priority of the Current Switch····································································1-20...

  • Page 191: Table Of Contents

    Introduction····································································································································1-39 Configuring Digest Snooping·········································································································1-40 Configuring Rapid Transition ················································································································1-41 Introduction····································································································································1-41 Configuring Rapid Transition·········································································································1-43 Configuring VLAN-VPN Tunnel·············································································································1-44 Introduction····································································································································1-44 Configuring VLAN-VPN tunnel ······································································································1-44 MSTP Maintenance Configuration ········································································································1-45 Introduction····································································································································1-45 Enabling Log/Trap Output for Ports of MSTP Instance·································································1-45 Configuration Example ··················································································································1-45 Enabling Trap Messages Conforming to 802.1d Standard···································································1-46 Displaying and Maintaining MSTP ········································································································1-46 MSTP Configuration Example···············································································································1-47 VLAN-VPN Tunnel Configuration Example ··························································································1-49...

  • Page 192: Mstp Configuration, Spanning Tree Protocol Overview

    MSTP Configuration Go to these sections for information you are interested in: Overview MSTP Configuration Task List Configuring Root Bridge Configuring Leaf Nodes Performing mCheck Operation Configuring Guard Functions Configuring Digest Snooping Configuring Rapid Transition Configuring VLAN-VPN Tunnel MSTP Maintenance Configuration Enabling Trap Messages Conforming to 802.1d Standard Displaying and Maintaining MSTP MSTP Configuration Example...

  • Page 193

    STP identifies the network topology by transmitting BPDUs between STP compliant network devices, typically switches and routers. BPDUs contain sufficient information for the network devices to complete the spanning tree calculation. In STP, BPDUs come in two types: Configuration BPDUs, used to calculate spanning trees and maintain the spanning tree topology. Topology change notification (TCN) BPDUs, used to notify concerned devices of network topology changes, if any.

  • Page 194

    Figure 1-1 A schematic diagram of designated bridges and designated ports All the ports on the root bridge are designated ports. Bridge ID A bridge ID consists of eight bytes, where the first two bytes represent the bridge priority of the device, and the latter six bytes represent the MAC address of the device.

  • Page 195

    Port ID A port ID used on an H3C device consists of two bytes, that is, 16 bits, where the first six bits represent the port priority, and the latter ten bits represent the port number. The default priority of all Ethernet ports on H3C devices is 128. You can use commands to configure port priorities.

  • Page 196

    Table 1-2 Selection of the optimum configuration BPDU Step Description Upon receiving a configuration BPDU on a port, the device performs the following processing: If the received configuration BPDU has a lower priority than that of the configuration BPDU generated by the port, the device will discard the received configuration BPDU without doing any processing on the configuration BPDU of this port.

  • Page 197

    Step Description Based on the configuration BPDU and the path cost of the root port, the device calculates a designated port configuration BPDU for each of the rest ports. The root bridge ID is replaced with that of the configuration BPDU of the root port.

  • Page 198

    The following table shows the initial state of each device. Table 1-4 Initial state of each device Device Port name BPDU of port {0, 0, 0, AP1} Device A {0, 0, 0, AP2} {1, 0, 1, BP1} Device B {1, 0, 1, BP2} {2, 0, 2, CP1} Device C {2, 0, 2, CP2}...

  • Page 199

    BPDU of port after Device Comparison process comparison Port CP1 receives the configuration BPDU of Device A {0, 0, 0, AP2}. Device C finds that the received configuration BPDU is superior to the configuration BPDU of the local port {2, 0, 2, CP1}, and updates the configuration BPDU of CP1.

  • Page 200

    Figure 1-3 The final calculated spanning tree To facilitate description, the spanning tree calculation process in this example is simplified, while the actual process is more complicated. The BPDU forwarding mechanism in STP Upon network initiation, every switch regards itself as the root bridge, generates configuration BPDUs with itself as the root, and sends the configuration BPDUs at a regular interval of hello time.

  • Page 201: Rapid Spanning Tree Protocol Overview, Multiple Spanning Tree Protocol Overview

    For this reason, the protocol uses a state transition mechanism. Namely, a newly elected root port and the designated ports must go through a period, which is twice the forward delay time, before they transit to the forwarding state. The period allows the new configuration BPDUs to be propagated throughout the entire network.

  • Page 202

    MSTP supports mapping VLANs to Multiple Spanning Tree (MST) instances (MSTIs) by means of a VLAN-to-instance mapping table. MSTP introduces instances (which integrates multiple VLANs into a set) and can bind multiple VLANs to an instance, thus saving communication overhead and improving resource utilization.

  • Page 203

    MSTI A multiple spanning tree instance (MSTI) refers to a spanning tree in an MST region. Multiple spanning trees can be established in one MST region. These spanning trees are independent of each other. For example, each region in Figure 1-4 contains multiple spanning trees known as MSTIs.

  • Page 204

    A region boundary port is located on the boundary of an MST region and is used to connect one MST region to another MST region, an STP-enabled region or an RSTP-enabled region. An alternate port is a secondary port of a root port or master port and is used for rapid transition. With the root port or master port being blocked, the alternate port becomes the new root port or master port.

  • Page 205: Mstp Implementation On Switches

    Forwarding state. Ports in this state can forward user packets and receive/send BPDU packets. Learning state. Ports in this state can receive/send BPDU packets but do not forward user packets. Discarding state. Ports in this state can only receive BPDU packets. Port roles and port states are not mutually dependent.

  • Page 206: Mstp Configuration Task List

    In addition to the basic MSTP functions, H3C series switches also provide the following functions for users to manage their switches. Root bridge hold Root bridge backup Root guard BPDU guard Loop guard TC-BPDU attack guard BPDU packet drop Protocols and Standards MSTP is documented in: IEEE 802.1D: spanning tree protocol IEEE 802.1w: rapid spanning tree protocol...

  • Page 207

    Task Remarks Configuring the Timeout Time Factor Optional Optional Configuring the Maximum Transmitting Rate on the Current Port The default value is recommended. Configuring the Current Port as an Edge Optional Port Setting the Link Type of a Port to P2P Optional Required To prevent network topology jitter...

  • Page 208: Configuring Root Bridge, Configuring An Mst Region

    Configuring Root Bridge Configuring an MST Region Configuration procedure Follow these steps to configure an MST region: To do... Use the command... Remarks Enter system view — system-view Enter MST region view — stp region-configuration Required Configure the name of the MST region-name name The default MST region name of a region...

  • Page 209: Specifying The Current Switch As A Root Bridge/secondary Root Bridge

    MSTP-enabled switches are in the same region only when they have the same format selector (a 802.1s-defined protocol selector, which is 0 by default and cannot be configured), MST region name, VLAN-to-instance mapping table, and revision level. The H3C series support only the MST region name, VLAN-to-instance mapping table, and revision level.

  • Page 210

    Specify the current switch as the secondary root bridge of a spanning tree Follow these steps to specify the current switch as the secondary root bridge of a spanning tree: To do... Use the command... Remarks Enter system view — system-view stp [ instance instance-id ] root Specify the current switch as...

  • Page 211: Configuring The Bridge Priority Of The Current Switch

    Configuring the Bridge Priority of the Current Switch Root bridges are selected according to the bridge priorities of switches. You can make a specific switch be selected as a root bridge by setting a lower bridge priority for the switch. An MSTP-enabled switch can have different bridge priorities in different MSTIs.

  • Page 212: Configuring The Mstp Operation Mode

    To do... Use the command... Remarks Required By default, a port recognizes and sends Configure how a port stp interface interface-list MSTP packets in the automatic mode. recognizes and sends compliance { auto | dot1s | That is, it determines the format of MSTP packets legacy } packets to be sent according to the...

  • Page 213: Configuring The Maximum Hop Count Of An Mst Region

    To do... Use the command... Remarks Enter system view — system-view Required Configure the MSTP operation An MSTP-enabled switch stp mode { stp | rstp | mstp } mode operates in the MSTP mode by default. Configuration example # Specify the MSTP operation mode as STP-compatible. <Sysname>...

  • Page 214: Configuring The Network Diameter Of The Switched Network, Configuring The Mstp Time-related Parameters

    Configuring the Network Diameter of the Switched Network In a switched network, any two switches can communicate with each other through a specific path made up of multiple switches. The network diameter of a network is measured by the number of switches;...

  • Page 215

    To do... Use the command... Remarks Required Configure the max age stp timer max-age The max age parameter defaults to parameter centiseconds 2,000 centiseconds (namely, 20 seconds). All switches in a switched network adopt the three time-related parameters configured on the CIST root bridge.

  • Page 216

    Configuring the Timeout Time Factor When the network topology is stable, a non-root-bridge switch regularly forwards BPDUs received from the root bridge to its neighboring devices at the interval specified by the hello time parameter to check for link failures. Normally, a switch regards its upstream switch faulty if the former does not receive any BPDU from the latter in a period three times of the hello time and then initiates the spanning tree recalculation process.

  • Page 217: Configuring The Current Port As An Edge Port

    To do... Use the command... Remarks Enter system view — system-view interface interface-type Enter Ethernet port view — interface-number Required Configure the maximum The maximum transmitting rate stp transmit-limit packetnum transmitting rate of all Ethernet ports on a switch defaults to 10. As the maximum transmitting rate parameter determines the number of the configuration BPDUs transmitted in each hello time, set it to a proper value to prevent MSTP from occupying too many network resources.

  • Page 218

    To do... Use the command... Remarks interface interface-type Enter Ethernet port view — interface-number Required Configure the port as an edge By default, all the Ethernet stp edged-port enable port ports of a switch are non-edge ports. On a switch with BPDU guard disabled, an edge port becomes a non-edge port again once it receives a BPDU from another port.

  • Page 219: Enabling Mstp

    Setting the Link Type of a Port to P2P in Ethernet port view Follow these steps to specify whether the link connected to a port is point-to-point link in Ethernet port view: To do... Use the command... Remarks Enter system view —...

  • Page 220: Configuring Leaf Nodes, Configuring The Mst Region

    Use the To do... Remarks command... Optional By default, MSTP is enabled on all ports after you enable MSTP in system view. stp interface Disable MSTP on interface-list To enable a switch to operate more flexibly, you can specified ports disable disable MSTP on specific ports.

  • Page 221: Configuring A Port As An Edge Port, Configuring The Path Cost For A Port

    Configuring How a Port Recognizes and Sends MSTP Packets Refer to Configuring How a Port Recognizes and Sends MSTP Packets. Configuring the Timeout Time Factor Refer to Configuring the Timeout Time Factor. Configuring the Maximum Transmitting Rate on the Current Port Refer to Configuring the Maximum Transmitting Rate on the Current Port.

  • Page 222

    Operation mode Latency Rate 802.1D-1998 IEEE 802.1t (half-/full-duplex) standard Half-duplex/Full-duplex 200,000 Aggregated link 2 ports 100,000 100 Mbps Aggregated link 3 ports 66,666 Aggregated link 4 ports 50,000 Full-duplex 20,000 Aggregated link 2 ports 10,000 1,000 Mbps Aggregated link 3 ports 6,666 Aggregated link 4 ports 5,000...

  • Page 223: Configuring Port Priority

    Changing the path cost of a port may change the role of the port and put it in state transition. Executing the stp cost command with the instance-id argument being 0 sets the path cost on the CIST for the port. Configuration example (A) # Configure the path cost of GigabitEthernet 1/0/1 in MSTI 1 to be 2,000.

  • Page 224: Performing Mcheck Operation

    Configure port priority in Ethernet port view Follow these steps to configure port priority in Ethernet port view: To do... Use the command... Remarks Enter system view — system-view interface interface-type Enter Ethernet port view — interface-number Required. Configure port priority for the stp [ instance instance-id ] port port priority priority...

  • Page 225: Configuring Guard Functions, Configuring Bpdu Guard

    Configuration Prerequisites MSTP runs normally on the switch. Configuration Procedure You can perform the mCheck operation in the following two ways. Perform the mCheck operation in system view Follow these steps to perform the mCheck operation in system view: To do... Use the command...

  • Page 226: Configuring Root Guard

    Normally, no configuration BPDU will reach edge ports. But malicious users can attack a network by sending configuration BPDUs deliberately to edge ports to cause network jitter. You can prevent this type of attacks by utilizing the BPDU guard function. With this function enabled on a switch, the switch shuts down the edge ports that receive configuration BPDUs and then reports these cases to the administrator.

  • Page 227: Configuring Loop Guard

    You are recommended to enable root guard on the designated ports of a root bridge. Loop guard, root guard, and edge port settings are mutually exclusive. With one of these functions enabled on a port, any of the other two functions cannot take effect even if you have configured it on the port.

  • Page 228: Configuring Tc-bpdu Attack Guard

    period, the switch selects a new root port; the original root port becomes a designated port; and the blocked ports turns to the forwarding state. This may cause loops in the network. The loop guard function suppresses loops. With this function enabled, if link congestions or unidirectional link failures occur, both the root port and the blocked ports become designated ports and turn to the discarding state.

  • Page 229: Configuring Bpdu Dropping

    default) regardless of the number of the TC-BPDUs it receives. Such a mechanism prevents a switch from being busy in removing the MAC address table and ARP entries. You can use the stp tc-protection threshold command to set the maximum times for a switch to remove the MAC address table and ARP entries in a specific period.

  • Page 230: Configuring Digest Snooping

    Configuration Prerequisites MSTP runs normally on the switch. Configuration procedure Follow these steps to configure BPDU dropping: To do... Use the command... Remarks Enter system view — system-view Enter Ethernet port view — interface interface-name Required Enable BPDU dropping bpdu-drop any BPDU dropping is disabled by default.

  • Page 231

    Configuring Digest Snooping Configure the digest snooping feature on a switch to enable it to communicate with other switches adopting proprietary protocols to calculate configuration digests in the same MST region through MSTIs. Configuration prerequisites The switch to be configured is connected to another manufacturer's switch adopting a proprietary spanning tree protocol.

  • Page 232: Configuring Rapid Transition

    When the digest snooping feature is enabled on a port, the port state turns to the discarding state. That is, the port will not send BPDU packets. The port is not involved in the STP calculation until it receives BPDU packets from the peer port. The digest snooping feature is needed only when your switch is connected to another manufacturer’s switches adopting proprietary spanning tree protocols.

  • Page 233

    Figure 1-6 The RSTP rapid transition mechanism Upstream switch Downstream switch Proposal for rapid transition Root port blocks other non- edge ports, changes to forwarding state and sends Agreement to upstream device Designated port Root port changes to Designated port forwarding state Figure 1-7 The MSTP rapid transition mechanism Upstream switch...

  • Page 234

    Configuring Rapid Transition Configuration prerequisites As shown in Figure 1-8, a H3C series switch is connected to another manufacturer's switch. The former operates as the downstream switch, and the latter operates as the upstream switch. The network operates normally. The upstream switch is running a proprietary spanning tree protocol that is similar to RSTP in the way to implement rapid transition on designated ports.

  • Page 235: Configuring Vlan-vpn Tunnel

    The rapid transition feature can be enabled on only root ports or alternate ports. If you configure the rapid transition feature on a designated port, the feature does not take effect on the port. Configuring VLAN-VPN Tunnel Introduction The VLAN-VPN Tunnel function enables STP packets to be transparently transmitted between geographically dispersed customer networks through specified VLAN VPNs in service provider networks, through which spanning trees can be generated across these customer networks and are independent of those of the service provider network.

  • Page 236: Mstp Maintenance Configuration, Enabling Log/trap Output For Ports Of Mstp Instance

    To do... Use the command... Remarks Required Enable the VLAN-VPN vlan-vpn tunnel The VLAN-VPN tunnel function is tunnel function globally disabled by default. Make sure that you enter the Ethernet port view of the port for which you interface interface-type Enter Ethernet port view want to enable the VLAN-VPN tunnel interface-number...

  • Page 237: Displaying And Maintaining Mstp, Enabling Trap Messages Conforming To 802.1d Standard

    # Enable log/trap output for the ports of all instances. <Sysname> system-view [Sysname] stp portlog all Enabling Trap Messages Conforming to 802.1d Standard A switch sends trap messages conforming to 802.1d standard to the network management device in the following two cases: The switch becomes the root bridge of an instance.

  • Page 238: Mstp Configuration Example

    MSTP Configuration Example Network requirements Implement MSTP in the network shown in Figure 1-10 to enable packets of different VLANs to be forwarded along different MSTIs. The detailed configurations are as follows: All switches in the network belong to the same MST region. Packets of VLAN 10, VLAN 30, VLAN 40, and VLAN 20 are forwarded along MSTI 1, MSTI 3, MSTI 4, and MSTI 0 respectively.

  • Page 239

    # Specify Switch A as the root bridge of MSTI 1. [Sysname] stp instance 1 root primary Configure Switch B # Enter MST region view. <Sysname> system-view [Sysname] stp region-configuration # Configure the region name, VLAN-to-instance mapping table, and revision level for the MST region. [Sysname-mst-region] region-name example [Sysname-mst-region] instance 1 vlan 10 [Sysname-mst-region] instance 3 vlan 30...

  • Page 240: Vlan-vpn Tunnel Configuration Example

    VLAN-VPN Tunnel Configuration Example Network requirements S5100 switches operate as the access devices of the service provider network, that is, Switch C and Switch D in the network diagram. Switch A and Switch B are the access devices for the customer networks. Switch C and Switch D are connected to each other through the configured trunk ports of the switches.

  • Page 241

    [Sysname] vlan-vpn tunnel # Add GigabitEthernet 1/0/1 to VLAN 10. [Sysname] vlan 10 [Sysname-Vlan10] port GigabitEthernet 1/0/1 [Sysname-Vlan10] quit # Enable the VLAN VPN function on GigabitEthernet 1/0/1. [Sysname] interface GigabitEthernet 1/0/1 [Sysname-GigabitEthernet1/0/1] port access vlan 10 [Sysname-GigabitEthernet1/0/1] vlan-vpn enable [Sysname-GigabitEthernet1/0/1] quit # Configure GigabitEthernet 1/0/2 as a trunk port.

  • Page 242: Table Of Contents

    Table of Contents 1 802.1x Configuration ···································································································· 1-1 Introduction to 802.1x ································································································· 1-1 Architecture of 802.1x Authentication ···································································· 1-1 The Mechanism of an 802.1x Authentication System ·············································· 1-3 Encapsulation of EAPoL Messages ······································································· 1-4 802.1x Authentication Procedure··········································································· 1-6 Timers Used in 802.1x ·························································································· 1-9 802.1x Implementation on an S5100-SI/EI Series Switch ·····································...

  • Page 243

    Configuring the System-Guard Feature········································································ 4-1 Configuring the System-Guard Feature ································································· 4-1 Displaying and Maintaining System-Guard ··································································· 4-2...

  • Page 244: X Configuration, Introduction To 802.1x, Architecture Of 802.1x Authentication

    802.1x Configuration When configuring 802.1x, go to these sections for information you are interested in: Introduction to 802.1x Introduction to 802.1x Configuration Basic 802.1x Configuration Advanced 802.1x Configuration Displaying and Maintaining 802.1x Configuration Configuration Example Introduction to 802.1x The 802.1x protocol (802.1x for short) was developed by IEEE802 LAN/WAN committee to address security issues of wireless LANs.

  • Page 245

    Figure 1-1 Architecture of 802.1x authentication The supplicant system is an entity residing at one end of a LAN segment and is authenticated by the authenticator system at the other end of the LAN segment. The supplicant system is usually a user terminal device. An 802.1x authentication is triggered when a user launches client program on the supplicant system.

  • Page 246: The Mechanism Of An 802.1x Authentication System

    The uncontrolled port can always send and receive packets. It mainly serves to forward EAPoL packets to ensure that a supplicant system can send and receive authentication requests. The controlled port can be used to pass service packets when it is in authorized state. It is blocked when not in authorized state.

  • Page 247: Encapsulation Of Eapol Messages

    Encapsulation of EAPoL Messages The format of an EAPoL packet EAPoL is a packet encapsulation format defined in 802.1x. To enable EAP protocol packets to be transmitted between supplicant systems and authenticator systems through LANs, EAP protocol packets are encapsulated in EAPoL format. The following figure illustrates the structure of an EAPoL packet.

  • Page 248

    The format of an EAP packet For an EAPoL packet with the value of the Type field being EAP-packet, its Packet body field is an EAP packet, whose format is illustrated in Figure 1-4. Figure 1-4 The format of an EAP packet In an EAP packet: The Code field indicates the EAP packet type, which can be Request, Response, Success, or Failure.

  • Page 249: X Authentication Procedure

    Message-authenticator field. Otherwise, the packet is regarded as invalid and is discarded. Figure 1-7 The format of an Message-authenticator field 802.1x Authentication Procedure A H3C S5100-SI/EI series Ethernet switch can authenticate supplicant systems in EAP terminating mode or EAP relay mode. EAP relay mode This mode is defined in 802.1x.

  • Page 250

    Figure 1-8 802.1x authentication procedure (in EAP relay mode) EAPOL EAPOR Authenticator system RADUIS Supplicant system server EAPOL - Start EAP- Request / Identity RADIUS Access - Request EAP- Response / Identity (EAP- Response / Identity) RADIUS Access -Challenge EAP- Request / MD5 challenge ( EAP- Request / MD5 challenge) RADIUS Access - Request EAP- Response / MD5 challenge...

  • Page 251

    The RADIUS server compares the received encrypted password (contained in a RADIUS access-request packet) with the locally-encrypted password. If the two match, it will then send feedbacks (through a RADIUS access-accept packet and an EAP-success packet) to the switch to indicate that the supplicant system is authenticated.

  • Page 252: Timers Used In 802.1x

    Figure 1-9 802.1x authentication procedure (in EAP terminating mode) Supplicant RADIUS EAPOL Authenticator system RADIUS server system PAE EAPOL- Start EAP- Request /Identity EAP- Response/Identity EAP- Request/ MD5 Challenge EAP- Response/MD5 Challenge RADIUS Access-Request ( CHAP- Response/MD5 Challenge) RADIUS Access - Accept ( CHAP-Success) EAP- Success Port...

  • Page 253: X Implementation On An S5100-si/ei Series Switch

    Re-authentication timer (reauth-period). The switch initiates 802.1x re-authentication at the interval set by the re-authentication timer. RADIUS server timer (server-timeout). This timer sets the server-timeout period. After sending an authentication request packet to the RADIUS server, the switch sends another authentication request packet if it does not receive the response from the RADIUS server when this timer times out.

  • Page 254

    Supplicant systems logging on through IE proxies Whether or not a supplicant system logs in through more than one network adapters (that is, whether or not more than one network adapters are active in a supplicant system when the supplicant system logs in). In response to any of the three cases, a switch can optionally take the following measures: Only disconnects the supplicant system but sends no Trap packets.

  • Page 255

    The guest VLAN function The guest VLAN function enables supplicant systems that are not authenticated to access network resources in a restrained way. The guest VLAN function enables supplicant systems that do not have 802.1x client installed to access specific network resources. It also enables supplicant systems that are not authenticated to upgrade their 802.1x client programs.

  • Page 256: Introduction To 802.1x Configuration

    Figure 1-10 802.1x re-authentication Internet Switch RADIUS Server 802.1x re-authentication can be enabled in one of the following two ways: The RADIUS server has the switch perform 802.1x re-authentication of users. The RADIUS server sends the switch an Access-Accept packet with the Termination-Action attribute field of 1.

  • Page 257: Basic 802.1x Configuration, Configuring Basic 802.1x Functions

    Figure 1-11 802.1x configuration Local Local authentication authentication ISP domain ISP domain 802.1x 802.1x AAA scheme AAA scheme configuration configuration configuration configuration RADIUS RADIUS scheme scheme 802.1x users use domain names to associate with the ISP domains configured on switches Configure the AAA scheme (a local authentication scheme or a RADIUS scheme) to be adopted in the ISP domain.

  • Page 258

    To do… Use the command… Remarks quit dot1x port-control { authorized-force | In system unauthorized-force | view auto } [ interface interface-list ] Set port access Optional interface interface-type control interface-number By default, an 802.1x-enabled mode for port operates in the auto mode. specified dot1x port-control In port...

  • Page 259: Timer And Maximum User Number Configuration

    802.1x configurations take effect only after you enable 802.1x both globally and for specified ports. The settings of 802.1x and MAC address learning limit are mutually exclusive. Enabling 802.1x on a port will prevent you from setting the limit on MAC address learning on the port and vice versa.

  • Page 260: Advanced 802.1x Configuration, Configuring Proxy Checking

    To do… Use the command... Remarks Optional The settings of 802.1x timers dot1x timer are as follows. { handshake-period handshake-period-value: handshake-period-value | 15 seconds quiet-period quiet-period-value: quiet-period-value | seconds server-timeout Set 802.1x timers server-timeout-value: 100 server-timeout-value | seconds supp-timeout supp-timeout-value | supp-timeout-value: tx-period tx-period-value | seconds...

  • Page 261: Configuring Client Version Checking

    To do... Use the command... Remarks Required dot1x Enable proxy checking By default, the 802.1x proxy supp-proxy-check function globally checking function is globally { logoff | trap } disabled. dot1x supp-proxy-check In system { logoff | trap } view [ interface interface-list ] Required Enable proxy...

  • Page 262: Enabling Dhcp-triggered Authentication, Configuring Guest Vlan

    To do... Use the command... Remarks Optional Set the client version dot1x timer ver-period By default, the timer is set to checking period timer ver-period-value 30 seconds. As for the dot1x version-user command, if you execute it in system view without specifying the interface-list argument, the command applies to all ports.

  • Page 263: Configuring 802.1x Re-authentication, Configuring The 802.1x Re-authentication Timer

    The guest VLAN function is available only when the switch operates in the port-based authentication mode. Only one guest VLAN can be configured for each switch. The guest VLAN function cannot be implemented if you configure the dot1x dhcp-launch command on the switch to enable DHCP-triggered authentication. This is because the switch does not send authentication packets in that case.

  • Page 264: Displaying And Maintaining 802.1x Configuration, X Configuration Example

    During re-authentication, the switch always uses the latest re-authentication interval configured, no matter which of the above-mentioned two ways is used to determine the re-authentication interval. For example, if you configure a re-authentication interval on the switch and the switch receives an Access-Accept packet whose Termination-Action attribute field is 1, the switch will ultimately use the value of the Session-timeout attribute field as the re-authentication interval.

  • Page 265

    another packet to the RADIUS servers again if it sends a packet to the RADIUS server and does not receive response for 5 seconds, with the maximum number of retries of 5. And the switch sends a real-time accounting packet to the RADIUS servers once in every 15 minutes.

  • Page 266

    [Sysname-radius-radius1] primary accounting 10.11.1.2 # Assign IP addresses to the secondary authentication and accounting RADIUS server. [Sysname-radius-radius1] secondary authentication 10.11.1.2 [Sysname-radius-radius1] secondary accounting 10.11.1.1 # Set the password for the switch and the authentication RADIUS servers to exchange messages. [Sysname-radius-radius1] key authentication name # Set the password for the switch and the accounting RADIUS servers to exchange messages.

  • Page 267: Quick Ead Deployment Configuration, Introduction To Quick Ead Deployment, Quick Ead Deployment Overview

    In real applications, however, deploying EAD clients proves to be time consuming and inconvenient. To address the issue, the H3C S5100-SI/EI series provides the forcible deployment of EAD clients with 802.1x authentication, easing the work of EAD client deployment.

  • Page 268: Configuration Prerequisites, Configuring Quick Ead Deployment

    HTTP redirection In the HTTP redirection approach, when the terminal users that have not passed 802.1x authentication access the Internet through Internet Explorer, they are redirected to a predefined URL for EAD client download. The two functions ensure that all the users without an EAD client have downloaded and installed one from the specified server themselves before they can access the Internet, thus decreasing the complexity and effort that EAD client deployment may involve.

  • Page 269

    You must configure the URL for HTTP redirection before configuring a free IP range. A URL must start with http:// and the segment where the URL resides must be in the free IP range. Otherwise, the redirection function cannot take effect. You must disable the DHCP-triggered authentication function of 802.1x before configuring a free IP range.

  • Page 270: Displaying And Maintaining Quick Ead Deployment, Quick Ead Deployment Configuration Example

    Displaying and Maintaining Quick EAD Deployment To do... Use the command... Remarks Display configuration display dot1x [ sessions | information about quick statistics ] [ interface Available in any view EAD deployment interface-list ] Quick EAD Deployment Configuration Example Network requirements A user connects to the switch directly.

  • Page 271: Troubleshooting

    Configuration procedure Before enabling quick EAD deployment, be sure that: The Web server is configured properly. The default gateway of the user’s PC is configured as the IP address of the connected VLAN interface on the switch. # Configure the URL for HTTP redirection. <Sysname>...

  • Page 272: Introduction To Habp, Habp Server Configuration, Habp Configuration

    HABP Configuration When configuring HABP, go to these sections for information you are interested in: Introduction to HABP HABP Server Configuration HABP Client Configuration Displaying and Maintaining HABP Configuration Introduction to HABP When a switch is configured with the 802.1x function, 802.1x will authenticate and authorize 802.1x-enabled ports and allow only the authorized ports to forward packets.

  • Page 273: Habp Client Configuration, Displaying And Maintaining Habp Configuration

    To do... Use the command... Remarks Required By default, a switch operates as an Configure the HABP client after you enable HABP current switch to be habp server vlan vlan-id on the switch. If you want to use the an HABP server switch as a management switch, you need to configure the switch to be an HABP server.

  • Page 274: System-guard Configuration, System-guard Overview

    System-Guard Configuration System-Guard Overview At first, you must determine whether the CPU is under attack to implement system guard for the CPU. You should not determine whether the CPU is under attack just according to whether congestion occurs in a queue. Instead, you must do that in the following ways: According to the number of packets processed in the CPU in a time range.

  • Page 275

    Displaying and Maintaining System-Guard After the above configuration, execute the display command in any view to display the running status of the system-guard feature, and to verify the configuration. Table 4-2 Display and maintain system-guard Operation Command Display the record of detected attacks display system-guard attack-record Display the state of the system-guard feature display system-guard state...

  • Page 276: Table Of Contents

    Table of Contents 1 AAA Overview ············································································································································1-1 Introduction to AAA ·································································································································1-1 Authentication··································································································································1-1 Authorization····································································································································1-1 Accounting·······································································································································1-2 Introduction to ISP Domain ·············································································································1-2 Introduction to AAA Services ··················································································································1-2 Introduction to RADIUS ···················································································································1-2 Introduction to HWTACACS ············································································································1-7 2 AAA Configuration ····································································································································2-1 AAA Configuration Task List ···················································································································2-1 Creating an ISP Domain and Configuring Its Attributes ··································································2-2 Configuring an AAA Scheme for an ISP Domain ············································································2-3 Configuring Dynamic VLAN Assignment·························································································2-6...

  • Page 277: Table Of Contents

    AAA Configuration Examples················································································································2-27 Remote RADIUS Authentication of Telnet/SSH Users ·································································2-27 Local Authentication of FTP/Telnet Users·····················································································2-28 HWTACACS Authentication and Authorization of Telnet Users ···················································2-30 Troubleshooting AAA ····························································································································2-31 Troubleshooting RADIUS Configuration························································································2-31 Troubleshooting HWTACACS Configuration ················································································2-31 3 EAD Configuration·····································································································································3-1 Introduction to EAD ·································································································································3-1 Typical Network Application of EAD ·······································································································3-1 EAD Configuration ··································································································································3-2 EAD Configuration Example ···················································································································3-3...

  • Page 278: Aaa Overview, Introduction To Aaa

    AAA Overview Introduction to AAA AAA is the acronym for the three security functions: authentication, authorization and accounting. It provides a uniform framework for you to configure these three functions to implement network security management. Authentication: Defines what users can access the network, Authorization: Defines what services can be available to the users who can access the network, Accounting: Defines how to charge the users who are using network resources.

  • Page 279: Introduction To Aaa Services, Introduction To Isp Domain, Introduction To Radius

    Accounting AAA supports the following accounting methods: None accounting: No accounting is performed for users. Remote accounting: User accounting is performed on a remote RADIUS or TACACS server. Introduction to ISP Domain An Internet service provider (ISP) domain is a group of users who belong to the same ISP. For a username in the format of userid@isp-name or userid.isp-name, the isp-name following the "@"...

  • Page 280

    Clients: This database stores information about RADIUS clients (such as shared key). Dictionary: The information stored in this database is used to interpret the attributes and attribute values in the RADIUS protocol. Figure 1-1 Databases in a RADIUS server In addition, a RADIUS server can act as a client of some other AAA server to provide authentication or accounting proxy service.

  • Page 281

    The RADIUS server compares the received user information with that in the Users database to authenticate the user. If the authentication succeeds, the RADIUS server sends back to the RADIUS client an authentication response (Access-Accept), which contains the user’s authorization information. If the authentication fails, the server returns an Access-Reject response. The RADIUS client accepts or denies the user depending on the received authentication result.

  • Page 282

    Code Message type Message description Direction: server->client. The server transmits this message to the client if any Access-Reject attribute value carried in the Access-Request message is unacceptable (that is, the user fails the authentication). Direction: client->server. The client transmits this message to the server to request the server to start or end the accounting Accounting-Request (whether to start or to end the accounting is determined...

  • Page 283

    Type field Type field Attribute type Attribute type value value Service-Type Idle-Timeout Framed-Protocol Termination-Action Framed-IP-Address Called-Station-Id Framed-IP-Netmask Calling-Station-Id Framed-Routing NAS-Identifier Filter-ID Proxy-State Framed-MTU Login-LAT-Service Framed-Compression Login-LAT-Node Login-IP-Host Login-LAT-Group Login-Service Framed-AppleTalk-Link Login-TCP-Port Framed-AppleTalk-Network (unassigned) Framed-AppleTalk-Zone Reply-Message 40-59 (reserved for accounting) Callback-Number CHAP-Challenge Callback-ID NAS-Port-Type...

  • Page 284: Introduction To Hwtacacs

    Introduction to HWTACACS What is HWTACACS Huawei Terminal Access Controller Access Control System (HWTACACS) is an enhanced security protocol based on TACACS (RFC 1492). Similar to the RADIUS protocol, it implements AAA for different types of users (such as PPP, VPDN, and terminal users) through communicating with TACACS server in client-server mode.

  • Page 285

    Figure 1-6 AAA implementation procedure for a telnet user The basic message exchange procedure is as follows: A user sends a login request to the switch acting as a TACACS client, which then sends an authentication start request to the TACACS server. The TACACS server returns an authentication response, asking for the username.

  • Page 286

    After receiving the response indicating an authorization success, the TACACS client pushes the configuration interface of the switch to the user. 10) The TACACS client sends an accounting start request to the TACACS server. 11) The TACACS server returns an accounting response, indicating that it has received the accounting start request.

  • Page 287: Aaa Configuration, Aaa Configuration Task List

    AAA Configuration AAA Configuration Task List You need to configure AAA to provide network access services for legal users while protecting network devices and preventing unauthorized access and repudiation behavior. Complete the following tasks to configure AAA (configuring a combined AAA scheme for an ISP domain): Task Remarks...

  • Page 288: Creating An Isp Domain And Configuring Its Attributes

    Task Remarks Creating an ISP Domain and Configuring Its Required Attributes Configuring separate AAA schemes Required Required With separate AAA schemes, you can specify authentication, authorization and accounting Configuring an AAA Scheme for an ISP schemes respectively. Domain configuration You need to configure RADIUS or HWATACACS before performing RADIUS or HWTACACS authentication.

  • Page 289: Configuring An Aaa Scheme For An Isp Domain

    To do… Use the command… Remarks Optional Set the accounting-optional By default, the accounting optional switch accounting-optional switch is off. Optional messenger time { enable limit Set the messenger function By default, the messenger interval | disable } function is disabled. Optional Set the self-service server self-service-url { disable |...

  • Page 290

    To do… Use the command… Remarks Enter system view system-view — Create an ISP domain and enter its view, or enter the view domain isp-name Required of an existing ISP domain Required scheme { local | none | radius-scheme Configure an AAA scheme for radius-scheme-name [ local ] | By default, an ISP the ISP domain...

  • Page 291

    Authentication: RADIUS, local, or HWTACACS. Follow these steps to configure separate AAA schemes: To do… Use the command… Remarks Enter system view system-view — Create an ISP domain and enter its view, or enter the view Required domain isp-name of an existing ISP domain authentication Optional { radius-scheme...

  • Page 292: Configuring Dynamic Vlan Assignment

    Configuring Dynamic VLAN Assignment The dynamic VLAN assignment feature enables a switch to dynamically add the switch ports of successfully authenticated users to different VLANs according to the attributes assigned by the RADIUS server, so as to control the network resources that different users can access. Currently, the switch supports the following two types of assigned VLAN IDs: integer and string.

  • Page 293: Configuring The Attributes Of A Local User

    Configuring the Attributes of a Local User When local scheme is chosen as the AAA scheme, you should create local users on the switch and configure the relevant attributes. The local users are users set on the switch, with each user uniquely identified by a username. To make a user who is requesting network service pass local authentication, you should add an entry in the local user database on the switch for the user.

  • Page 294: Mac Address Authentication, Cutting Down User Connections Forcibly, Radius Configuration Task List

    The following characters are not allowed in the user-name string: /:*?<>. And you cannot input more than one “@” in the string. After the local-user password-display-mode cipher-force command is executed, any password will be displayed in cipher mode even though you specify to display a user password in plain text by using the password command.

  • Page 295

    Complete the following tasks to configure RADIUS (the switch functions as a RADIUS client): Task Remarks Creating a RADIUS Scheme Required Configuring RADIUS Authentication/Authorization Servers Required Configuring Ignorance of Assigned RADIUS Authorization Optional Attributes Configuring RADIUS Accounting Servers Required Configuring Shared Keys for RADIUS Messages Optional Configuring the Maximum Number of RADIUS Request Optional...

  • Page 296: Creating A Radius Scheme

    Task Remarks Configuring the RADIUS — Refer to the configuration of the RADIUS client client The RADIUS service configuration is performed on a RADIUS scheme basis. In an actual network environment, you can either use a single RADIUS server or two RADIUS servers (primary and secondary servers with the same configuration but different IP addresses) in a RADIUS scheme.

  • Page 297: Configuring Radius Authentication/authorization Servers, Configuring Ignorance Of Assigned Radius Authorization Attributes

    Configuring RADIUS Authentication/Authorization Servers Follow these steps to configure RADIUS authentication/authorization servers: To do… Use the command… Remarks Enter system view — system-view Required Create a RADIUS scheme and radius scheme By default, a RADIUS scheme enter its view radius-scheme-name named "system"...

  • Page 298: Configuring Radius Accounting Servers

    As shown in Figure 2-1, NAS 1 and NAS 2 are connected to the same RADIUS server for authentication. For easy management, the RADIUS server issues the same authorization attributes to all the users. However, users attached to NAS 1 need these attributes while users attached to NAS 2 do not want to use the assigned Attribute 28, idle-timeout.

  • Page 299

    To do… Use the command… Remarks Required Create a RADIUS radius scheme By default, a RADIUS scheme named scheme and enter its radius-scheme-name "system" has already been created in view the system. Required Set the IP address and By default, the IP address and UDP port port number of the primary accounting number of the primary accounting server...

  • Page 300: Configuring Shared Keys For Radius Messages, Configuring The Maximum Number Of Radius Request Transmission Attempts

    Configuring Shared Keys for RADIUS Messages Both RADIUS client and server adopt MD5 algorithm to encrypt RADIUS messages before they are exchanged between the two parties. The two parties verify the validity of the RADIUS messages received from each other by using the shared keys that have been set on them, and can accept and respond to the messages only when both parties have the same shared key.

  • Page 301: Configuring The Type Of Radius Servers To Be Supported, Configuring The Status Of Radius Servers

    Configuring the Type of RADIUS Servers to be Supported Follow these steps to configure the type of RADIUS servers to be supported: To do… Use the command… Remarks Enter system view system-view — Required Create a RADIUS scheme and radius scheme By default, a RADIUS scheme enter its view radius-scheme-name...

  • Page 302: Configuring The Attributes Of Data To Be Sent To Radius Servers

    Follow these steps to set the status of RADIUS servers: To do… Use the command… Remarks Enter system view system-view — Required Create a RADIUS scheme and radius scheme By default, a RADIUS scheme enter its view radius-scheme-name named "system" has already been created in the system.

  • Page 303: Configuring The Local Radius Server

    To do… Use the command… Remarks address is set; and the IP System view address of the corresponding outbound interface is used as radius nas-ip ip-address the source IP address. Generally, the access users are named in the userid@isp-name or userid.isp-name format. Here, isp-name after the “@”...

  • Page 304: Configuring Timers For Radius Servers

    adopt local RADIUS server function, port number authentication/authorization server must be 1645, the UDP port number of the accounting server must be 1646, and the IP addresses of the servers must be set to the addresses of this switch. The message encryption key set by the local-server nas-ip ip-address key password command must be identical with the authentication/authorization message encryption key set by the key authentication command in the RADIUS scheme view of the RADIUS scheme on the specified NAS that uses this switch as its authentication server.

  • Page 305: Enabling Sending Trap Message When A Radius Server Goes Down

    To do… Use the command… Remarks Optional Set the response timeout time timer response-timeout By default, the response of RADIUS servers seconds timeout time of RADIUS servers is three seconds. Optional Set the time that the switch waits before it try to By default, the switch waits five re-communicate with primary timer quiet minutes...

  • Page 306

    online when the user re-logs into the network before the CAMS performs online user detection, and the user cannot get authenticated. In this case, the user can access the network again only when the CAMS administrator manually removes the user's online information. The user re-authentication at restart function is designed to resolve this problem.

  • Page 307: Hwtacacs Configuration Task List, Creating A Hwtacacs Scheme, Configuring Tacacs Authentication Servers

    HWTACACS Configuration Task List Complete the following tasks to configure HWTACACS: Task Remarks Creating a HWTACACS Scheme Required Configuring TACACS Authentication Servers Required Configuring TACACS Authorization Servers Required Configuring the Configuring TACACS Accounting Servers Optional TACACS client Configuring Shared Keys for RADIUS Messages Optional Configuring the Attributes of Data to be Sent to TACACS Optional...

  • Page 308: Configuring Tacacs Authorization Servers

    To do… Use the command… Remarks Required Set the IP address and port By default, the IP address of primary authentication number of the primary the primary authentication ip-address [ port ] TACACS authentication server server is 0.0.0.0, and the port number is 0.

  • Page 309: Configuring Tacacs Accounting Servers, Configuring Shared Keys For Hwtacacs Messages

    You are not allowed to configure the same IP address for both primary and secondary authorization servers. If you do this, the system will prompt that the configuration fails. You can remove a server only when it is not used by any active TCP connection for sending authorization messages.

  • Page 310: Configuring The Attributes Of Data To Be Sent To Tacacs Servers

    The TACACS client and server adopt MD5 algorithm to encrypt HWTACACS messages before they are exchanged between the two parties. The two parties verify the validity of the HWTACACS messages received from each other by using the shared keys that have been set on them, and can accept and respond to the messages only when both parties have the same shared key.

  • Page 311: Configuring The Timers Regarding Tacacs Servers

    Generally, the access users are named in the userid@isp-name or userid.isp-name format. Where, isp-name after the “@” or “.” character represents the ISP domain name. If the TACACS server does not accept the usernames that carry ISP domain names, it is necessary to remove domain names from usernames before they are sent to TACACS server.

  • Page 312

    Displaying and Maintaining AAA Configuration Displaying and Maintaining AAA Configuration To do… Use the command… Remarks Display configuration information about one specific display domain [ isp-name ] or all ISP domains display connection [ access-type { dot1x | mac-authentication } | domain isp-name | interface interface-type interface-number | ip Display information about user Available in...

  • Page 313: Aaa Configuration Examples, Remote Radius Authentication Of Telnet/ssh Users

    To do… Use the command… Remarks Display buffered display stop-accounting-buffer non-response hwtacacs-scheme stop-accounting requests hwtacacs-scheme-name Clear HWTACACS message reset hwtacacs statistics { accounting | statistics authentication | authorization | all } Available in user reset stop-accounting-buffer view Delete buffered non-response hwtacacs-scheme stop-accounting requests hwtacacs-scheme-name...

  • Page 314: Local Authentication Of Ftp/telnet Users

    Network diagram Figure 2-2 Remote RADIUS authentication of Telnet users RADIUS server 10.110.91.164/16 Internet Telnet user Configuration procedure # Enter system view. <Sysname> system-view # Adopt AAA authentication for Telnet users. [Sysname] user-interface vty 0 4 [Sysname-ui-vty0-4] authentication-mode scheme [Sysname-ui-vty0-4] quit # Configure an ISP domain.

  • Page 315

    The configuration procedure for local authentication of FTP users is similar to that for Telnet users. The following text only takes Telnet users as example to describe the configuration procedure for local authentication. Network requirements In the network environment shown in Figure 2-3, you are required to configure the switch so that the Telnet users logging into the switch are authenticated locally.

  • Page 316: Hwtacacs Authentication And Authorization Of Telnet Users

    Change the server IP address, and the UDP port number of the authentication server to 127.0.0.1, and 1645 respectively in the configuration step "Configure a RADIUS scheme" in Remote RADIUS Authentication of Telnet/SSH Users. Enable the local RADIUS server function, set the IP address and shared key for the network access server to 127.0.0.1 and aabbcc, respectively.

  • Page 317: Troubleshooting Aaa, Troubleshooting Radius Configuration, Troubleshooting Hwtacacs Configuration

    [Sysname-isp-hwtacacs] scheme hwtacacs-scheme hwtac Troubleshooting AAA Troubleshooting RADIUS Configuration The RADIUS protocol operates at the application layer in the TCP/IP protocol suite. This protocol prescribes how the switch and the RADIUS server of the ISP exchange user information with each other.

  • Page 318: Ead Configuration, Introduction To Ead, Typical Network Application Of Ead

    EAD Configuration Only the S5100-EI series switches support the EAD configuration. Introduction to EAD Endpoint Admission Defense (EAD) is an attack defense solution. Using this solution, you can enhance the active defense capability of network endpoints, prevents viruses and worms from spreading on the network, and protects the entire network by limiting the access rights of insecure endpoints.

  • Page 319

    Figure 3-1 Typical network application of EAD After a client passes the authentication, the security Client (software installed on the client PC) interacts with the security policy server to check the security status of the client. If the client is not compliant with the security standard, the security policy server issues an ACL to the switch, which then inhibits the client from accessing any parts of the network except for the virus/patch server.

  • Page 320: Ead Configuration Example

    EAD Configuration Example Network requirements Figure 3-2: A user is connected to GigabitEthernet 1/0/1 on the switch. The user adopts 802.1x client supporting EAD extended function. You are required to configure the switch to use RADIUS server for remote user authentication and use security policy server for EAD control on users.

  • Page 321

    [Sysname-radius-cams] accounting optional [Sysname-radius-cams] key authentication expert [Sysname-radius-cams] server-type extended # Configure the IP address of the security policy server. [Sysname-radius-cams] security-policy-server 10.110.91.166 # Associate the domain with the RADIUS scheme. [Sysname-radius-cams] quit [Sysname] domain system [Sysname-isp-system] radius-scheme cams...

  • Page 322: Table Of Contents

    Table of Contents 1 MAC Address Authentication Configuration ··························································································1-1 MAC Address Authentication Overview ··································································································1-1 Performing MAC Address Authentication on a RADIUS Server ·····················································1-1 Performing MAC Address Authentication Locally ···········································································1-1 Related Concepts····································································································································1-2 MAC Address Authentication Timers ······························································································1-2 Quiet MAC Address·························································································································1-2 Configuring Basic MAC Address Authentication Functions ····································································1-2 MAC Address Authentication Enhanced Function Configuration ···························································1-4 MAC Address Authentication Enhanced Function Configuration Task List ····································1-4 Configuring a Guest VLAN ··············································································································1-4...

  • Page 323: Mac Address Authentication Configuration, Mac Address Authentication Overview

    MAC Address Authentication Configuration When configuring MAC address authentication, go to these sections for information you are interested: MAC Address Authentication Overview Related Concepts Configuring Basic MAC Address Authentication Functions MAC Address Authentication Enhanced Function Configuration Displaying and Maintaining MAC Address Authentication Configuration MAC Address Authentication Configuration Examples MAC Address Authentication Overview MAC address authentication provides a way for authenticating users based on ports and MAC...

  • Page 324: Related Concepts, Mac Address Authentication Timers, Quiet Mac Address, Configuring Basic Mac Address Authentication Functions

    used depends on your configuration). Hyphens must or must not be included depending on the format configured with mac-authentication authmode usernameasmacaddress usernameformat command; otherwise, the authentication will fail. In fixed mode, all users’ MAC addresses are automatically mapped to the configured local passwords and usernames.

  • Page 325

    quit Optional Set the user name in mac-authentication authmode By default, the MAC MAC address mode usernameasmacaddress [ usernameformat address of a user is for MAC address { with-hyphen | without-hyphen } { lowercase | used as the user authentication uppercase } | fixedpassword password ] name.

  • Page 326: Mac Address Authentication Enhanced Function Configuration, Mac Address Authentication Enhanced Function Configuration Task List

    MAC Address Authentication Enhanced Function Configuration MAC Address Authentication Enhanced Function Configuration Task List Complete the following tasks to configure MAC address authentication enhanced function: Task Remarks Configuring a Guest VLAN Optional Configuring the Maximum Number of MAC Address Authentication Users Optional Allowed to Access a Port Configuring a Guest VLAN...

  • Page 327

    After a port is added to a Guest VLAN, the switch will re-authenticate the first access user of this port (namely, the first user whose unicast MAC address is learned by the switch) periodically. If this user passes the re-authentication, this port will exit the Guest VLAN, and thus the user can access the network normally.

  • Page 328: Configuring The Maximum Number Of Mac Address Authentication Users Allowed To Access A Port

    If more than one client are connected to a port, you cannot configure a Guest VLAN for this port. When a Guest VLAN is configured for a port, only one MAC address authentication user can access the port. Even if you set the limit on the number of MAC address authentication users to more than one, the configuration does not take effect.

  • Page 329: Displaying And Maintaining Mac Address Authentication Configuration, Mac Address Authentication Configuration Examples

    If both the limit on the number of MAC address authentication users and the limit on the number of users configured in the port security function are configured for a port, the smaller value of the two configured limits is adopted as the maximum number of MAC address authentication users allowed to access this port.

  • Page 330

    # Set the user name in MAC address mode for MAC address authentication, requiring hyphened lowercase MAC addresses as the usernames and passwords. [Sysname] mac-authentication authmode usernameasmacaddress usernameformat with-hyphen lowercase # Add a local user. Specify the user name and password. [Sysname] local-user 00-0d-88-f6-44-c1 [Sysname-luser-00-0d-88-f6-44-c1] password simple 00-0d-88-f6-44-c1 Set the service type to lan-access.

  • Page 331: Table Of Contents

    Table of Contents 1 IP Addressing Configuration····················································································································1-1 IP Addressing Overview··························································································································1-1 IP Address Classes ·························································································································1-1 Special IP Addresses ······················································································································1-2 Subnetting and Masking ··················································································································1-2 Protocols and Standards ·················································································································1-3 Configuring IP Addresses ·······················································································································1-3 Displaying IP Addressing Configuration··································································································1-4 VLAN Interface IP Address Configuration Examples··············································································1-4 IP Address Configuration Example I ·······························································································1-4 IP Address Configuration Example II ······························································································1-5 2 IP Performance Optimization Configuration···························································································2-1...

  • Page 332: Ip Addressing Overview, Ip Addressing Configuration, Ip Address Classes

    IP Addressing Configuration The term IP address used throughout this chapter refers to IPv4 address. For details about IPv6 address, refer to IPv6 Management. When configuring IP addressing, go to these sections for information you are interested in: IP Addressing Overview Configuring IP Addresses Displaying IP Addressing Configuration VLAN Interface IP Address Configuration Examples...

  • Page 333: Special Ip Addresses, Subnetting And Masking

    Table 1-1 IP address classes and ranges Class Address range Remarks The IP address 0.0.0.0 is used by a host at bootstrap for temporary communication. This address is never a valid destination address. 0.0.0.0 to 127.255.255.255 Addresses starting with 127 are reserved for loopback test.

  • Page 334: Dhcp, Configuring Ip Addresses

    Figure 1-2 Subnet a Class B network In the absence of subnetting, some special addresses such as the addresses with the net ID of all zeros and the addresses with the host ID of all ones, are not assignable to hosts. The same is true for subnetting.

  • Page 335: Displaying Ip Addressing Configuration, Vlan Interface Ip Address Configuration Examples, Ip Address Configuration Example I

    You may assign an interface multiple IP addresses, one primary and multiple secondaries, to connect multiple logical subnets on the same physical subnet. Follow these steps to configure an IP address for an interface: To do… Use the command… Remarks Enter system view system-view ––...

  • Page 336: Ip Address Configuration Example Ii

    Network diagram Figure 1-3 Network diagram for IP address configuration Configuration procedure # Configure an IP address for VLAN-interface 1. <Switch> system-view [Switch] interface vlan-interface 1 [Switch-Vlan-interface1] ip address 129.2.2.1 255.255.255.0 IP Address Configuration Example II Network requirements As shown in Figure 1-4, a port in VLAN 1 on a S5100-SI is connected to a LAN comprising two segments: 172.16.1.0/24 and 172.16.2.0/24.

  • Page 337

    [S5100-SI] interface Vlan-interface 1 [S5100-SI-Vlan-interface1] ip address 172.16.1.1 255.255.255.0 [S5100-SI-Vlan-interface1] ip address 172.16.2.1 255.255.255.0 sub # Set the gateway address to 172.16.1.1 on the PCs attached to the subnet 172.16.1.0/24, and to 172.16.2.1 on the PCs attached to the subnet 172.16.2.0/24. # Ping a host on the subnet 172.16.1.0/24 from the S5100-SI to check the connectivity.

  • Page 338: Ip Performance Overview, Ip Performance Optimization Configuration, Configuring Ip Performance Optimization

    IP Performance Optimization Configuration When optimizing IP performance, go to these sections for information you are interested in: IP Performance Overview Configuring IP Performance Optimization Displaying and Maintaining IP Performance Optimization Configuration IP Performance Overview Introduction to IP Performance Configuration In some network environments, you can adjust the IP parameters to achieve best network performance.

  • Page 339: Disabling Sending Of Icmp Error Packets

    synwait timer: When sending a SYN packet, TCP starts the synwait timer. If no response packet is received within the synwait timer interval, the TCP connection cannot be created. finwait timer: When a TCP connection is changed into FIN_WAIT_2 state, the finwait timer is started.

  • Page 340: Displaying And Maintaining Ip Performance Optimization Configuration

    If the destination of a packet is local while the transport layer protocol of the packet is not supported by the local device, the device sends a “protocol unreachable” ICMP error packet to the source. When receiving a packet with the destination being local and transport layer protocol being UDP, if the packet’s port number does not match the running process, the device will send the source a “port unreachable”...

  • Page 341

    To do… Use the command… Remarks Display the current socket display ip socket [ socktype information of the system sock-type ] [ task-id socket-id ] Display the forwarding display fib information base (FIB) entries display fib ip_address1 Display the FIB entries [ { mask1 | mask-length1 } matching the destination IP [ ip_address2 { mask2 |...

  • Page 342: Table Of Contents

    Table of Contents 1 DHCP Overview··········································································································································1-1 Introduction to DHCP ······························································································································1-1 DHCP IP Address Assignment ···············································································································1-1 IP Address Assignment Policy ········································································································1-1 Obtaining IP Addresses Dynamically ······························································································1-2 Updating IP Address Lease·············································································································1-2 DHCP Packet Format······························································································································1-3 Protocol Specification······························································································································1-4 2 DHCP Relay Agent Configuration ············································································································1-1 Introduction to DHCP Relay Agent ··············································································&