Configuration Guide - IP Services (V300R007C00 02)

HUAWEI NetEngine5000E Core Router V300R007C00
Configuration Guide - IP Services

Issue Date 02 2009-12-10
HUAWEI TECHNOLOGIES CO., LTD.
Copyright Huawei Technologies Co., Ltd. 2009. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd.
Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.
Huawei Technologies Co., Ltd.

Address: Huawei Industrial Base Bantian, Longgang Shenzhen 518129 People's Republic of China http://www.huawei.com support@huawei.com
Website: Email:
Issue 02 (2009-12-10)
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.
HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services
About This Document
About This Document

Purpose
This document describes multiple IP services supported by the NE5000E and basic configurations of IP addresses, ARP, DNS, DHCP, IP performance, ACL, IPv6, ACL6, and IPv6 over IPv4 tunnel.
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The slot number is chassis ID/slot ID.
Related Versions
The following table lists the product versions related to this document. Product Name NE5000E Core Router Version V300R007C00
Intended Audience
This document is intended for:
l l l l
Commissioning Engineer Data Configuration Engineer Network Monitoring Engineer System Maintenance Engineer
Organization
This document is organized as follows.
Issue 02 (2009-12-10) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. iii
About This Document
Chapter 1 IP Addresses Configuration
Description This chapter describes the fundamentals of IP addresses, including its classes, methods and important characteristics. It also describes steps for configuring IP addresses and provides typical configuration examples. This chapter describes the principle of ARP and steps for configuring ARP, and provides typical configuration examples. This chapter describes the principle of DNS and steps for configuring DNS, and provides typical configuration examples. This chapter describes the principle of DHCP and steps for configuring DHCP, and provides typical configuration examples. This chapter describes basic concepts about IP performance and steps for configuring IP performance, and provides typical configuration examples. This chapter describes basic concepts about ACL and steps for configuring ACL, and provides typical configuration examples. This chapter describes basic concepts about IPv6 and steps for configuring IPv6, and provides typical configuration examples. This chapter describes basic IPv6 applications and steps for configuring IPv6 applications, and provides typical configuration examples. This chapter describes basic concepts about ACL6 and steps for configuring ACL6, and provides typical configuration examples. This chapter describes basic concepts about IPv6 over IPv4 tunnels and steps for configuring IPv6 over IPv4 tunnels, and provides typical configuration examples. This appendix collates frequently used glossaries in this document. This appendix collates frequently used acronyms and abbreviations in this document.
2 ARP Configuration
3 DNS Configuration
4 DHCP Configuration
5 IP Performance Configuration 6 ACL Configuration
7 Basic IPv6 Configuration
8 IPv6 DNS Configuration
9 ACL6 Configuration
10 IPv6 over IPv4 Tunnel Configuration A Glossary B Acronyms and Abbreviations
iv
Issue 02 (2009-12-10)
About This Document
Conventions
Symbol Conventions
The symbols that may be found in this document are defined as follows. Symbol Description Indicates a hazard with a high level of risk that, if not avoided, will result in death or serious injury.
Indicates a hazard with a medium or low level of risk which, if not avoided, could result in minor or moderate injury. Indicates a potentially hazardous situation that, if not avoided, could cause device damage, data loss, and performance degradation, or unexpected results. Provides additional information to emphasize or supplement important points of the main text. Indicates a tip that may help you solve a problem or save your time.
General Conventions
The general conventions that may be found in this document are defined as follows. Convention Times New Roman boldface Italic Courier New Description Normal paragraphs are in Times New Roman. Names of files, directories, folders, and users are in boldface. For example, log in as user root. Book titles are in italics. Terminal display is in Courier New.
Command Conventions
The command conventions that may be found in this document are defined as follows. Convention boldface Italic
Issue 02 (2009-12-10)
Description The keywords of a command line are in boldface. Command arguments are in italic.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. v
About This Document
Convention [] { x | y | ... } [ x | y | ... ] { x | y | ... }*
Description Items (keywords or arguments) in square brackets [ ] are optional. Alternative items are grouped in braces and separated by vertical bars. One is selected. Optional alternative items are grouped in square brackets and separated by vertical bars. One or none is selected. Alternative items are grouped in braces and separated by vertical bars. A minimum of one or a maximum of all can be selected. Optional alternative items are grouped in square brackets and separated by vertical bars. Many or none can be selected. This parameter before the & sign can be repeated 1 to n times. A line starting with the # sign is comments.
[ x | y | ... ]*
&<1-n> #
GUI Conventions
The GUI conventions that may be found in this document are defined as follows. Convention boldface > Description Buttons, menus, parameters, tabs, windows, and dialog titles are in boldface. For example, click OK. Multi-level menus are in boldface and separated by the ">" signs. For example, choose File > Create > Folder.
Keyboard Operations
The keyboard operations that may be found in this document are defined as follows. Format Key Key 1+Key 2 Description Press the key. For example, press Enter and press Tab. Press the keys concurrently. For example, pressing Ctrl +Alt+A means the three keys should be pressed concurrently. Press the keys in turn. For example, pressing Alt, A means the two keys should be pressed in turn.
Key 1, Key 2
vi
Issue 02 (2009-12-10)
About This Document
Mouse Operations
The mouse operations that may be found in this document are defined as follows. Action Click Double-click Drag Description Select and release the primary mouse button without moving the pointer. Press the primary mouse button twice continuously and quickly without moving the pointer. Press and hold the primary mouse button and move the pointer to a certain position.
Update History
Updates between document issues are cumulative. Therefore, the latest document issue contains all updates made in previous issues.
Updates in Issue 02 (2009-12-10)

Second commercial release.
Updates in Issue 01 (2009-09-05)

Initial commercial release.
Issue 02 (2009-12-10)
vii
Contents
Contents
About This Document...................................................................................................................iii 1 IP Addresses Configuration.....................................................................................................1-1
1.1 IP Addresses Overview...................................................................................................................................1-2 1.1.1 Introduction to IP Addresses..................................................................................................................1-2 1.1.2 Features of IP Addresses Supported by the NE5000E...........................................................................1-2 1.2 Configuring IP Addresses for Interfaces.........................................................................................................1-3 1.2.1 Establishing the Configuration Task......................................................................................................1-3 1.2.2 Configuring a Primary IP Address for an Interface............................................................................... 1-4 1.2.3 (Optional) Configuring a Secondary IP Address for an Interface..........................................................1-4 1.2.4 Checking the Configuration...................................................................................................................1-5 1.3 Configuring IP Address Negotiation on Interfaces.........................................................................................1-5 1.3.1 Establishing the Configuration Task......................................................................................................1-6 1.3.2 Configuring a Server to Assign an IP Address for a Client Through Negotiation.................................1-6 1.3.3 Configuring a Client to Obtain an IP Address Through Negotiation.....................................................1-8 1.3.4 Checking the Configuration...................................................................................................................1-9 1.4 Configuring IP Address Unnumbered for Interfaces....................................................................................1-10 1.4.1 Establishing the Configuration Task....................................................................................................1-10 1.4.2 Configuring the Primary IP Address of the Interface That Lends an IP Address................................1-11 1.4.3 Configuring an Interface That Borrows an IP Address from Another Interface..................................1-11 1.4.4 Checking the Configuration.................................................................................................................1-12 1.5 Maintaining IP Addresses.............................................................................................................................1-13 1.5.1 Monitoring Network Operation Status of IP Addresses.......................................................................1-13 1.6 Configuration Examples................................................................................................................................1-13 1.6.1 Example for Configuring Primary and Secondary IP Addresses.........................................................1-13 1.6.2 Example for Obtaining an IP Address Through Negotiation...............................................................1-15 1.6.3 Example for Configuring IP Address Unnumbered.............................................................................1-18 1.6.4 Example for Configuring IP Address Overlapping on the Same Device.............................................1-21 1.6.5 Example for Configuring an IP Address with a 31-bit Mask...............................................................1-25
2 ARP Configuration....................................................................................................................2-1
2.1 Introduction to ARP........................................................................................................................................2-3 2.1.1 Overview of ARP...................................................................................................................................2-3 2.1.2 Features of ARP Supported by the NE5000E........................................................................................2-3 Issue 02 (2009-12-10) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. ix
Contents
2.2 Configuring Static ARP.................................................................................................................................. 2-6 2.2.1 Establishing the Configuration Task......................................................................................................2-6 2.2.2 Configuring Common Static ARP Entries.............................................................................................2-7 2.2.3 Configuring Static ARP Entries in a VLAN..........................................................................................2-7 2.2.4 Configuring Static ARP Entries in a VPN Instance...............................................................................2-8 2.2.5 Checking the Configuration...................................................................................................................2-8 2.3 Optimizing Dynamic ARP..............................................................................................................................2-9 2.3.1 Establishing the Configuration Task......................................................................................................2-9 2.3.2 Modify the aging parameters of dynamic ARP....................................................................................2-10 2.3.3 Enabling ARP Suppression Function...................................................................................................2-10 2.3.4 Checking the Configuration.................................................................................................................2-11 2.4 Configuring Routed Proxy ARP...................................................................................................................2-12 2.4.1 Establishing the Configuration Task....................................................................................................2-12 2.4.2 Configure an IP Addresses for the Interface........................................................................................2-13 2.4.3 Enabling the Routed Proxy ARP Function..........................................................................................2-13 2.4.4 Checking the Configuration.................................................................................................................2-14 2.5 Configuring Proxy ARP Within a VLAN.....................................................................................................2-15 2.5.1 Establishing the Configuration Task....................................................................................................2-15 2.5.2 Configure an IP Addresses for the Interface........................................................................................2-16 2.5.3 Configuring the VLAN Associated with the Sub-interface.................................................................2-16 2.5.4 Enabling Proxy ARP Within a VLAN.................................................................................................2-17 2.5.5 Checking the Configuration.................................................................................................................2-17 2.6 Configuring Proxy ARP Between VLANs...................................................................................................2-19 2.6.1 Establishing the Configuration Task....................................................................................................2-19 2.6.2 Configuring an IP Addresses for the Interface.....................................................................................2-19 2.6.3 Configuring the VLAN Associated with the Sub-interface.................................................................2-20 2.6.4 Enabling Proxy ARP Between VLANs...............................................................................................2-21 2.6.5 Checking the Configuration.................................................................................................................2-21 2.7 Configuring ARPing-IP.................................................................................................................................2-22 2.7.1 Establishing the Configuration Task....................................................................................................2-22 2.7.2 Detecting the IP Address by Using the arp-ping ip Command............................................................2-23 2.8 Configuring ARPing-MAC...........................................................................................................................2-23 2.8.1 Establishing the Configuration Task....................................................................................................2-24 2.8.2 Detecting the MAC Address by Using the arp-ping mac Command...................................................2-24 2.9 Configuring the Association Between ARP and Interface Status.................................................................2-25 2.9.1 Establishing the Configuration Task....................................................................................................2-25 2.9.2 Configuring the Association Between ARP and Interface Status........................................................2-26 2.9.3 (Optional) Adjusting Parameters about the Association Between ARP and Interface Status..............2-27 2.10 Maintaining ARP.........................................................................................................................................2-28 2.10.1 Clearing ARP Statistics......................................................................................................................2-28 2.10.2 Monitoring Network Operation Status of ARP..................................................................................2-28 2.10.3 Debugging ARP.................................................................................................................................2-29 x Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 02 (2009-12-10)
Contents
2.11 Configuration Examples..............................................................................................................................2-29 2.11.1 Example for Configuring Routed Proxy ARP....................................................................................2-29 2.11.2 Example for Configuring Proxy ARP Within a VLAN.....................................................................2-32 2.11.3 Example for Configuring the Association Between ARP and Interface Status.................................2-34
3 DNS Configuration....................................................................................................................3-1
3.1 DNS Overview................................................................................................................................................3-2 3.1.1 Introduction to DNS...............................................................................................................................3-2 3.1.2 DNS Supported by the NE5000E...........................................................................................................3-2 3.2 Configuring DNS............................................................................................................................................ 3-2 3.2.1 Establishing the Configuration Task......................................................................................................3-2 3.2.2 Configuring Static DNS Entries.............................................................................................................3-3 3.2.3 Configuring Dynamic DNS....................................................................................................................3-4 3.2.4 Checking the Configuration...................................................................................................................3-4 3.3 Maintaining DNS............................................................................................................................................ 3-5 3.3.1 Clearing DNS Entries.............................................................................................................................3-6 3.3.2 Monitoring Network Operation Status of DNS......................................................................................3-6 3.3.3 Debugging DNS.....................................................................................................................................3-6 3.4 Configuration Examples..................................................................................................................................3-7 3.4.1 Example for Configuring DNS.............................................................................................................. 3-7
4 DHCP Configuration.................................................................................................................4-1
4.1 DHCP Overview............................................................................................................................................. 4-3 4.1.1 Introduction to DHCP............................................................................................................................ 4-3 4.1.2 DHCP Supported by the NE5000E........................................................................................................4-3 4.2 Configuring the Global Address Pool-based DHCP Server............................................................................4-3 4.2.1 Establishing the Configuration Task......................................................................................................4-4 4.2.2 Configuring the DHCP Global Address Pool........................................................................................ 4-5 4.2.3 Configure Static IP Address Binding.....................................................................................................4-6 4.2.4 Configuring DNS Services for the DHCP Client...................................................................................4-7 4.2.5 Configuring NetBIOS Services for the DHCP Client............................................................................4-7 4.2.6 Configuring Egress Gateway for the DHCP Client............................................................................... 4-8 4.2.7 Configuring DHCP Self-Defined Options............................................................................................. 4-9 4.2.8 Assigning IP Addresses in the Global Address Pool to the DHCP Clients on the Specified Interface .......................................................................................................................................................................4-10 4.2.9 Checking the Configuration.................................................................................................................4-11 4.3 Configuring the Interface Address Pool-based DHCP Server......................................................................4-13 4.3.1 Establishing the Configuration Task....................................................................................................4-13 4.3.2 Configuring the Interface Address Pool...............................................................................................4-14 4.3.3 Configuring DNS on the Interface Address Pool.................................................................................4-15 4.3.4 Configuring NetBIOS on the Interface Address Pool..........................................................................4-16 4.3.5 Configuring DHCP Self-Defined Options...........................................................................................4-17 4.3.6 Checking the Configuration.................................................................................................................4-18 4.4 Configuring the Sub-interface Address Pool-based DHCP Server...............................................................4-20 Issue 02 (2009-12-10) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. xi
Contents
HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services 4.4.1 Establishing the Configuration Task....................................................................................................4-20 4.4.2 Enabling Address Pools on Sub-interfaces..........................................................................................4-21 4.4.3 Configuring Address Pools on Ethernet Sub-interfaces.......................................................................4-22 4.4.4 Configuring DNS on Address Pools of Sub-interfaces........................................................................4-23 4.4.5 Configuring NetBIOS on Address Pools of Sub-interfaces.................................................................4-24 4.4.6 Configuring the DHCP Self-Defined Options for Address Pools of Sub-interfaces...........................4-25 4.4.7 Checking the Configuration.................................................................................................................4-26
4.5 Configuring the Security Function for DHCP...............................................................................................4-28 4.5.1 Establishing the Configuration Task....................................................................................................4-28 4.5.2 Starting the Detection of the Pseudo DHCP Server on a DHCP Server..............................................4-29 4.5.3 Avoiding Repetitive IP Address Assignment.......................................................................................4-29 4.5.4 Saving DHCP Data...............................................................................................................................4-30 4.5.5 Restoring DHCP Data..........................................................................................................................4-30 4.5.6 Checking the Configuration.................................................................................................................4-31 4.6 Configuring DHCP Relay.............................................................................................................................4-31 4.6.1 Establishing the Configuration Task....................................................................................................4-32 4.6.2 Configuring Relay................................................................................................................................4-32 4.6.3 Checking the Configuration.................................................................................................................4-34 4.7 Maintaining DHCP........................................................................................................................................4-35 4.7.1 Resetting DHCP...................................................................................................................................4-35 4.7.2 Releasing Conflicting IP Addresses.....................................................................................................4-36 4.7.3 (Optional) Requesting the DHCP Server to Release IP Addresses of the Client.................................4-36 4.7.4 Clearing DHCP Statistics.....................................................................................................................4-37 4.7.5 Monitoring Network Operation Status of DHCP.................................................................................4-38 4.7.6 Debugging DHCP................................................................................................................................4-38 4.8 Configuration Examples................................................................................................................................4-39 4.8.1 Example for Configuring the Global Address Pool-based DHCP Server............................................4-39 4.8.2 Example for Configuring the Interface Address Pool-based DHCP Server........................................4-43 4.8.3 Example for Configuring the Sub-interface Address Pool-based DHCP Server.................................4-45 4.8.4 Example for Configuring DHCP Relay...............................................................................................4-48 4.8.5 Example for Configuring the DHCP Option Association....................................................................4-51
5 IP Performance Configuration.................................................................................................5-1
5.1 IP Performance Overview...............................................................................................................................5-2 5.1.1 Introduction to IP Performance..............................................................................................................5-2 5.1.2 IP Performance Supported by the NE5000E..........................................................................................5-2 5.2 Improving IP Performance..............................................................................................................................5-3 5.2.1 Establishing the Configuration Task......................................................................................................5-3 5.2.2 Configuring the Maximum Transmission Unit of the Interface.............................................................5-4 5.2.3 Configuring ICMP Attributes.................................................................................................................5-5 5.2.4 Checking the Configuration...................................................................................................................5-5 5.3 Configuring TCP.............................................................................................................................................5-7 5.3.1 Establishing the Configuration Task......................................................................................................5-7 xii Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 02 (2009-12-10)
Contents
5.3.2 Configuring TCP Timer.........................................................................................................................5-8 5.3.3 Specifying the Size of a TCP Sliding Window......................................................................................5-8 5.3.4 Checking the Configuration...................................................................................................................5-9 5.4 Configuring Load Balancing for IP Packet Forwarding...............................................................................5-10 5.4.1 Establishing the Configuration Task....................................................................................................5-10 5.4.2 Configuring the Load Balancing Mode of IP Packet Forwarding........................................................5-11 5.4.3 Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding.............................5-11 5.4.4 Configuring Global Unequal-Cost Multiple Path During IP Packet Forwarding................................5-12 5.4.5 Checking the Configuration.................................................................................................................5-13 5.5 Maintaining IP Performance.........................................................................................................................5-14 5.5.1 Clearing IP Performance Statistics.......................................................................................................5-14 5.5.2 Monitoring Network Operation Status of IP Performance...................................................................5-15 5.5.3 Debugging IP Performance..................................................................................................................5-16 5.6 Configuration Examples................................................................................................................................5-17 5.6.1 Example for Limiting Transmission of ICMP Host-Unreachable Packets..........................................5-17 5.6.2 Example for Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding........5-19 5.6.3 Example for Configuring Global Unequal-Cost Load Balancing for IP Packet Forwarding..............5-25
6 ACL Configuration....................................................................................................................6-1
6.1 ACL Overview................................................................................................................................................6-2 6.1.1 Introduction to ACL...............................................................................................................................6-2 6.1.2 ACL Supported by the NE5000E...........................................................................................................6-2 6.2 Configuring an Interface-based ACL..............................................................................................................6-2 6.2.1 Establishing the Configuration Task......................................................................................................6-3 6.2.2 (Optional) Creating a Time Range.........................................................................................................6-3 6.2.3 Creating an Interface-based ACL...........................................................................................................6-4 6.2.4 (Optional) Configuring ACL Descriptions............................................................................................6-4 6.2.5 (Optional) Configuring ACL Step..........................................................................................................6-5 6.2.6 Checking the Configuration...................................................................................................................6-5 6.3 Configuring a Basic ACL................................................................................................................................6-6 6.3.1 Establishing the Configuration Task......................................................................................................6-6 6.3.2 (Optional) Creating a Time Range.........................................................................................................6-7 6.3.3 Creating a Basic ACL............................................................................................................................6-7 6.3.4 (Optional) Configuring ACL Descriptions............................................................................................6-8 6.3.5 (Optional) Configuring ACL Step..........................................................................................................6-8 6.3.6 Checking the Configuration...................................................................................................................6-9 6.4 Configuring an Advanced ACL....................................................................................................................6-10 6.4.1 Establishing the Configuration Task....................................................................................................6-10 6.4.2 (Optional) Creating a Time Range.......................................................................................................6-11 6.4.3 Creating an Advanced ACL.................................................................................................................6-11 6.4.4 (Optional) Configuring ACL Descriptions..........................................................................................6-12 6.4.5 (Optional) Configuring ACL Step........................................................................................................6-13 6.4.6 Checking the Configuration.................................................................................................................6-13 Issue 02 (2009-12-10) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. xiii
Contents
6.5 Configuring an ACL Based on the Ethernet Frame Header..........................................................................6-14 6.5.1 Establishing the Configuration Task....................................................................................................6-14 6.5.2 Creating an ACL Based on the Ethernet Frame Header...................................................................... 6-15 6.5.3 (Optional) Configuring ACL Descriptions.......................................................................................... 6-15 6.5.4 (Optional) Configuring ACL Step........................................................................................................6-16 6.5.5 Checking the Configuration.................................................................................................................6-16 6.6 Configuring a Named ACL...........................................................................................................................6-17 6.6.1 Establishing the Configuration Task....................................................................................................6-17 6.6.2 (Optional) Creating a Time Range.......................................................................................................6-18 6.6.3 Creating a Named ACL........................................................................................................................6-18 6.6.4 (Optional) Configuring named ACL Descriptions...............................................................................6-19 6.6.5 (Optional) Configuring named ACL Step............................................................................................6-20 6.6.6 Checking the Configuration.................................................................................................................6-20 6.7 Maintaining an ACL......................................................................................................................................6-21 6.7.1 Clearing ACL Statistics........................................................................................................................6-21 6.7.2 Monitoring Network Operation Status of ACL....................................................................................6-22 6.8 Configuration Examples................................................................................................................................6-22 6.8.1 Example for Configuring a Traffic Policy Based on Complex Traffic Classification.........................6-22 6.8.2 Example for Configuring the Security Function of Access Devices....................................................6-31 6.8.3 Example for Configuring an ACL Rule that Is Based on the VPN Instance....................................... 6-34
7 Basic IPv6 Configuration..........................................................................................................7-1

7.1 Basic IPv6 Overview.......................................................................................................................................7-2 7.1.1 Introduction to IPv6...............................................................................................................................7-2 7.1.2 IPv6 Supported by the NE5000E...........................................................................................................7-2 7.2 Configuring an IPv6 Address for an Interface................................................................................................7-3 7.2.1 Establishing the Configuration Task......................................................................................................7-4 7.2.2 Enabling IPv6 Packet Forwarding Capability........................................................................................7-5 7.2.3 Configuring an IPv6 Link-Local Address for an Interface....................................................................7-6 7.2.4 Configuring an IPv6 Global Unicast Address for an Interface..............................................................7-6 7.2.5 Checking the Configuration...................................................................................................................7-7 7.3 Configuring IPv6 Neighbor Discovery...........................................................................................................7-8 7.3.1 Establishing the Configuration Task......................................................................................................7-8 7.3.2 Configuring Static Neighbors.................................................................................................................7-9 7.3.3 Enabling RA Message Advertising......................................................................................................7-10 7.3.4 Setting the Interval for Advertising RA Messages...............................................................................7-10 7.3.5 Enabling Stateful Auto Configuration..................................................................................................7-11 7.3.6 Configuring the Address Prefixes to Be Advertised............................................................................7-11 7.3.7 Configuring Other Information to Be Advertised................................................................................7-12 7.3.8 Checking the Configuration.................................................................................................................7-13 7.4 Configuring PMTU.......................................................................................................................................7-14 7.4.1 Establishing the Configuration Task....................................................................................................7-15 7.4.2 Creating Static PMTU Entries..............................................................................................................7-15 xiv Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 02 (2009-12-10)
Contents
7.4.3 Configuring PMTU Aging Time..........................................................................................................7-16 7.4.4 Checking the Configuration.................................................................................................................7-16 7.5 Enabling the FIB Cache................................................................................................................................7-17 7.5.1 Establishing the Configuration Task....................................................................................................7-17 7.5.2 Enabling the FIB Cache.......................................................................................................................7-17 7.5.3 Checking the Configuration.................................................................................................................7-18 7.6 Configuring TCP6.........................................................................................................................................7-19 7.6.1 Establishing the Configuration Task....................................................................................................7-19 7.6.2 Configuring TCP6 Timers....................................................................................................................7-20 7.6.3 Configuring the Size of the TCP6 Sliding Window.............................................................................7-20 7.6.4 Checking the Configuration.................................................................................................................7-21 7.7 Maintaining IPv6...........................................................................................................................................7-22 7.7.1 Resetting IPv6......................................................................................................................................7-23 7.7.2 Monitoring Network Operation Status of IPv6....................................................................................7-23 7.7.3 Debugging IPv6....................................................................................................................................7-24 7.8 Configuration Examples................................................................................................................................7-24 7.8.1 Example for Configuring an IPv6 Address for an Interface................................................................7-25 7.8.2 Example for Configuring IPv6 Neighbor Discovery...........................................................................7-28
8 IPv6 DNS Configuration..........................................................................................................8-1

8.1 IPv6 DNS Overview........................................................................................................................................8-2 8.1.1 Introduction to IPv6 DNS......................................................................................................................8-2 8.1.2 IPv6 DNS Supported by the NE5000E..................................................................................................8-2 8.2 Configuring IPv6 DNS....................................................................................................................................8-2 8.2.1 Establishing the Configuration Task......................................................................................................8-2 8.2.2 Configuring a Static IPv6 DNS Entry....................................................................................................8-3 8.2.3 Configuring the Dynamic IPv6 DNS Services.......................................................................................8-3 8.2.4 Checking the Configuration...................................................................................................................8-4 8.3 Maintaining IPv6 DNS....................................................................................................................................8-5 8.3.1 Clearing IPv6 DNS Entries....................................................................................................................8-6 8.3.2 Monitoring Network Operation Status of IPv6 DNS.............................................................................8-6 8.4 Configuration Examples..................................................................................................................................8-6 8.4.1 Example for Configuring IPv6 DNS......................................................................................................8-7
9 ACL6 Configuration..................................................................................................................9-1
9.1 ACL6 Overview..............................................................................................................................................9-2 9.1.1 Introduction to ACL6.............................................................................................................................9-2 9.1.2 ACL6 Supported by the NE5000E.........................................................................................................9-2 9.2 Configuring an Interfaced-based ACL6..........................................................................................................9-2 9.2.1 Establishing the Configuration Task......................................................................................................9-2 9.2.2 (Optional) Configuring the Valid Time Range of ACL6.......................................................................9-3 9.2.3 Creating an Interfaced-based ACL6.......................................................................................................9-3 9.2.4 Checking the Configuration...................................................................................................................9-4 9.3 Configuring a Basic ACL6..............................................................................................................................9-5 Issue 02 (2009-12-10) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. xv
Contents
HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services 9.3.1 Establishing the Configuration Task......................................................................................................9-5 9.3.2 (Optional) Configuring the Valid Time Range of ACL6.......................................................................9-5 9.3.3 Creating a Basic ACL6..........................................................................................................................9-6 9.3.4 Checking the Configuration...................................................................................................................9-6
9.4 Configuring an Advanced ACL6....................................................................................................................9-7 9.4.1 Establishing the Configuration Task......................................................................................................9-7 9.4.2 (Optional) Configuring the Valid Time Range of ACL6.......................................................................9-8 9.4.3 Creating an Advanced ACL6.................................................................................................................9-8 9.4.4 Checking the Configuration...................................................................................................................9-9 9.5 Configuring a Named ACL6.........................................................................................................................9-10 9.5.1 Establishing the Configuration Task....................................................................................................9-10 9.5.2 (Optional) Configuring the Valid Time Range of ACL6.....................................................................9-11 9.5.3 Creating a Named ACL6......................................................................................................................9-12 9.5.4 Checking the Configuration.................................................................................................................9-13 9.6 Maintaining ACL6........................................................................................................................................ 9-13 9.6.1 Clearing ACL6 Statistics......................................................................................................................9-14 9.6.2 Monitoring Network Operation Status of ACL6..................................................................................9-14 9.7 Configuration Examples................................................................................................................................9-14 9.7.1 Example for Configuring an ACL6 to Filter IPv6 Packets..................................................................9-14
10 IPv6 over IPv4 Tunnel Configuration................................................................................10-1

10.1 IPv6 over IPv4 Tunnel Overview................................................................................................................10-2 10.1.1 Introduction to IPv6 over IPv4...........................................................................................................10-2 10.1.2 IPv6 over IPv4 Supported by the NE5000E.......................................................................................10-2 10.2 Configuring IPv4/IPv6 Dual Stacks............................................................................................................10-7 10.2.1 Establishing the Configuration Task..................................................................................................10-7 10.2.2 Enabling IPv6 Packet Forwarding......................................................................................................10-7 10.2.3 Configuring IPv4 and IPv6 Addresses for the Interface.................................................................... 10-8 10.3 Configuring an IPv6 over IPv4 Tunnel.......................................................................................................10-9 10.3.1 Establishing the Configuration Task................................................................................................10-10 10.3.2 Configuring an IPv6 over IPv4 Manual Tunnel...............................................................................10-10 10.3.3 Configuring an IPv6 over IPv4 Automatic Tunnel..........................................................................10-11 10.3.4 Configuring a 6to4 Tunnel...............................................................................................................10-12 10.3.5 Configuring Routes in the Tunnel....................................................................................................10-13 10.3.6 Checking the Configuration.............................................................................................................10-14 10.4 Configuring 6PE........................................................................................................................................10-14 10.4.1 Establishing the Configuration Task................................................................................................10-15 10.4.2 Configuring IPv4/IPv6 Dual Protocol Stacks..................................................................................10-15 10.4.3 Configuring MPLS...........................................................................................................................10-16 10.4.4 Enabling 6PE Peer............................................................................................................................10-17 10.5 Maintaining IPv6 over IPv4 Tunnels........................................................................................................10-18 10.5.1 Monitoring the Running Status of IPv6 over IPv4 Tunnel..............................................................10-18 10.5.2 Debugging IPv6 over IPv4 Tunnel...................................................................................................10-19 xvi Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 02 (2009-12-10)
Contents
10.6 Configuration Examples............................................................................................................................10-19 10.6.1 Example for Configuring an IPv6 over IPv4 Manual Tunnel..........................................................10-19 10.6.2 Example for Configuring an IPv6 over IPv4 Automatic Tunnel.....................................................10-23 10.6.3 Example for Configuring a 6to4 Tunnel..........................................................................................10-26 10.6.4 Example for Configuring 6to4 Relay...............................................................................................10-30 10.6.5 Example for Configuring 6PE..........................................................................................................10-33
A Glossary.....................................................................................................................................A-1 B Acronyms and Abbreviations.................................................................................................B-1
Issue 02 (2009-12-10)
xvii
Figures
Figures
Figure 1-1 Configuring primary and secondary IP addresses for an interface...................................................1-14 Figure 1-2 Networking diagram of allocating IP address through negotiation..................................................1-16 Figure 1-3 Networking diagram of an IP address unnumbered configuration...................................................1-19 Figure 1-4 Networking diagram of configuring IP address overlapping on the same device............................1-21 Figure 1-5 Networking diagram of configuring an IP address with a 31-bit mask............................................1-25 Figure 2-1 Implementation procedure of ARP-Ping IP........................................................................................2-4 Figure 2-2 Implementation procedure of ARP-Ping MAC..................................................................................2-5 Figure 2-3 Schematic diagram of transmission device existing between devices..............................................2-25 Figure 2-4 Networking diagram of configuring proxy ARP..............................................................................2-30 Figure 2-5 Networking diagram of configuring proxy ARP in a VLAN...........................................................2-33 Figure 2-6 Networking diagram of configuring the association between ARP and interface status................. 2-35 Figure 3-1 Networking diagram of DNS..............................................................................................................3-7 Figure 4-1 Networking diagram of the DHCP server and the client that are in the same network segment..... 4-40 Figure 4-2 Networking diagram of the DHCP server based on the address pool on the interface.................... 4-43 Figure 4-3 Networking diagram of the DCHP server based on the address pools on the sub-interfaces.......... 4-46 Figure 4-4 Networking diagram for configuring DHCP relay...........................................................................4-49 Figure 4-5 Networking diagram of configuring the DHCP option association..................................................4-52 Figure 5-1 Networking diagram of configuring ICMP host unreachable packets............................................. 5-17 Figure 5-2 Networking diagram of configuring UCMP.....................................................................................5-20 Figure 5-3 Networking diagram of configuring unequal-cost load balancing...................................................5-26 Figure 6-1 Diagram for configuring a traffic policy based on the complex traffic classification......................6-23 Figure 6-2 Networking of configuring the security function of access devices.................................................6-31 Figure 6-3 Typical networking of configuring an ACL rule..............................................................................6-34 Figure 7-1 Networking diagram of configuring an IPv6 address for an interface............................................. 7-25 Figure 7-2 Example for configuring IPv6 neighbor discovery.......................................................................... 7-28 Figure 8-1 DNS server connecting IPv4 and IPv6 networks...............................................................................8-3 Figure 8-2 Networking diagram of IPv6 DNS configurations.............................................................................8-7 Figure 9-1 Networking diagram of configuring an ACL6 to filter IPv6 packets...............................................9-15 Figure 10-1 Single stack and dual stack structures (Ethernet)...........................................................................10-2 Figure 10-2 Schematic diagram of IPv6 over IPv4 tunnel.................................................................................10-3 Figure 10-3 6to4 tunnel and 6to4 relay..............................................................................................................10-5 Figure 10-4 Networking diagram of 6PE...........................................................................................................10-6 Figure 10-5 Networking diagram of the IPv6 over IPv4 manual tunnel..........................................................10-20 Issue 02 (2009-12-10) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. xix
Figures
HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services Figure 10-6 Networking diagram of the IPv6 over IPv4 automatic tunnel......................................................10-24
Figure 10-7 Networking diagram of the 6to4 tunnel........................................................................................10-27 Figure 10-8 Networking diagram of accessing the IPv6 network through 6to4 relay.....................................10-31 Figure 10-9 Networking diagram of 6PE.........................................................................................................10-34
xx
Issue 02 (2009-12-10)
1 IP Addresses Configuration
1
About This Chapter
IP Addresses Configuration
This chapter describes the basic concepts and working mechanism of IP addresses. It also describes the procedure for configuring IP addresses and provides typical configuration examples. 1.1 IP Addresses Overview This section describes the concepts of IP addresses and how to use an IP address. 1.2 Configuring IP Addresses for Interfaces This section describes how to configure IP addresses for interfaces. 1.3 Configuring IP Address Negotiation on Interfaces This section describes how to configure the interface on the client to obtain the interface from the server through PPP negotiation. 1.4 Configuring IP Address Unnumbered for Interfaces This section describes how to configure an interface to borrow the IP address from other interfaces. 1.5 Maintaining IP Addresses This section describes how to view IP address configurations. 1.6 Configuration Examples This section provides several examples for configuring IP addresses.
Issue 02 (2009-12-10)
1-1
1.1 IP Addresses Overview

This section describes the concepts of IP addresses and how to use an IP address. 1.1.1 Introduction to IP Addresses 1.1.2 Features of IP Addresses Supported by the NE5000E
1.1.1 Introduction to IP Addresses

To communicate with each other on Internet Protocol (IP) networks, each host must be assigned an IP address. An IP address is a 32-bit number that is composed of two parts, namely, the network ID and host ID. The network ID identifies a network and the host ID identifies a host on the network. If the network IDs of hosts are the same, it indicates that the hosts are on the same network regardless of their physical locations.
1.1.2 Features of IP Addresses Supported by the NE5000E

The NE5000E supports IP address configuration through the following methods:
l l l
Manually configuring an IP address for an interface Obtaining an IP address through negotiation Borrowing an IP address from other interfaces
The NE5000E supports the space overlapping of network segment addresses to save the address space.
l
Different IP addresses in the overlapped network segments but not same can be configured on different interfaces of the same device. For example, after an interface on a device is configured with the IP address 20.1.1.1/16, if another interface is configured with the IP address 20.1.1.2/24, the system prompts a message. However, the configuration is still successful; if another interface is configured with the IP address 20.1.1.2/16, the system prompts an IP address conflict. The configuration fails. The primary IP address and the secondary IP address in the overlapped network segments but not same can be configured on the same interface. For example, after the interface is configured with a primary IP address 20.1.1.1/24, if the secondary IP address is 20.1.1.2/16 sub, the system prompts a message. However, the configuration is still successful. The primary IP address and the secondary IP address in the overlapped network segments but not same can be configured on different interfaces of the same device. However, the primary IP address and the secondary IP address cannot be the same. For example, after an interface on a device is configured with the IP address 20.1.1.1/16, if another interface is configured with the IP address 20.1.1.2/24 sub, the system prompts a message. However, the configuration is still successful.
The NE5000E supports 31-bit IP address masks. Therefore, there are only two IP addresses in a network segment, that is, the network address and broadcast address. The two IP addresses can be used as host addresses.
1-2 Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 02 (2009-12-10)
You can assign the IP addresses with 31-bit masks to Point-to-Point (P2P), broadcast, and loopback interfaces. For non-P2P interfaces, if a 31-bit mask is configured, the system prompts acknowledgement information to protect broadcast links. For example, if an Ethernet interface on a device is assigned an IP address with a 31-bit mask, this device can access only the host in the directly connected subnet. It cannot access all hosts in the subnet. In the backbone network of a broadcast link, if a P2P link exists, you can configure the IP addresses with 31-bit masks.
1.2 Configuring IP Addresses for Interfaces

This section describes how to configure IP addresses for interfaces. 1.2.1 Establishing the Configuration Task 1.2.2 Configuring a Primary IP Address for an Interface 1.2.3 (Optional) Configuring a Secondary IP Address for an Interface 1.2.4 Checking the Configuration
1.2.1 Establishing the Configuration Task

Applicable Environment
To start IP services on an interface, configure the IP address for the interface. You can assign several IP addresses to each interface. Among them, one is the primary IP address and the others are secondary IP addresses. Generally, you need to configure only a primary IP address for an interface. Secondary IP addresses, however, are required in some cases. For instance, when a device connects to a physical network through an interface, and computers on this network belong to two Class C networks, you need to configure a primary IP address and a secondary IP address for this interface to ensure that the device can communication with all computers on this network.
Pre-configuration Tasks
Before configuring an IP addresses for an interface, complete the following tasks:
l
Configuring the physical parameters for the interface and ensuring that the physical layer status of the interface is Up Configuring the link layer parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up
Data Preparation
To configure IP addresses for an interface, you need the following data. No. 1 2 3 Data Interface number Primary IP address and subnet mask of the interface (Optional) Secondary IP address and subnet mask of the interface
Issue 02 (2009-12-10)
1-3
1.2.2 Configuring a Primary IP Address for an Interface

Context
Do as follows on the router:
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 Run:

interface interface-type interface-number
The interface view is displayed. Step 3 Run:

ip address ip-address { mask | mask-length }
A primary IP address is configured. An interface has only one primary IP address. If the interface already has a primary IP address, the newly configured primary IP address replaces the original one. ----End
1.2.3 (Optional) Configuring a Secondary IP Address for an Interface

Context
Procedure
Step 1 Run:
system-view


ip address ip-address { mask | mask-length } sub
A secondary IP address is configured. A secondary IP address with a 31-bit mask can be configured for an interface. You can configure a maximum of 255 secondary IP addresses on an interface. ----End
1.2.4 Checking the Configuration

Prerequisite
The configurations of the IP addresses for the interface are complete.
Procedure
l l Run the display ip interface [ brief ] [ interface-type interface-number ] command to check the IP configuration on the interface. Run the display interface [ interface-type [ interface-number ] ] [ | { begin | exclude | include } regular-expression ] command to check interface information.
----End
Example
Run the display ip interface command to check that the physical status and link protocol status of the interface are Up.
<HUAWEI> display ip interface brief gigabitethernet 1/1/0 *down: administratively down !down: FIB overload down (l): loopback (s): spoofing Interface IP Address/Mask Physical GigabitEthernet1/1/0 172.16.13.2/24 up up
Protocol
Run the display interface command to check information about the IP address and subnet mask of the interface.
<HUAWEI> display interface gigabitethernet 1/1/0 GigabitEthernet1/1/0 current state : UP Line protocol current state : UP Last line protocol up time : 2007-11-16, 12:26:17 Description : GigabitEthernet1/1/0 Interface The Maximum Transmit Unit is 1500 bytes Internet Address is 172.16.13.2/24 Internet Address is 172.16.13.150/25 Sub Internet Address is 172.16.13.200/28 Sub IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 00e0-fc08-2b73 Media type is twisted pair, loopback not set, promiscuous mode not set 100Mbps-speed mode, full-duplex mode, link type is autonegotiation Last 300 seconds input rate 338 bits/sec, 0 packets/sec Last 300 seconds output rate 514 bits/sec, 0 packets/sec Input: 1065 packets, 1571513 bytes 0 broadcasts, 1065 multicasts 0 errors, 0 runts, 0 giants, 0 CRC, 0 collisions, 0 align errors, 0 other errors Output:2866 packets, 2708571 bytes 0 broadcasts, 2866 multicasts 0 errors, 0 underruns, 0 collisions 0 packets had been deferred
1.3 Configuring IP Address Negotiation on Interfaces

This section describes how to configure the interface on the client to obtain the interface from the server through PPP negotiation. 1.3.1 Establishing the Configuration Task
Issue 02 (2009-12-10) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 1-5
1.3.2 Configuring a Server to Assign an IP Address for a Client Through Negotiation 1.3.3 Configuring a Client to Obtain an IP Address Through Negotiation 1.3.4 Checking the Configuration

When devices are connected through the PPP link, the client interface can obtains the IP address from the server through PPP negotiation. This is usually applicable to the situation when the client connects to the Internet Service Provider (ISP) to access the Internet through the PPP link such as dial-up. In this case, the ISP device assigns an IP address to the client through PPP negotiation.
Before configuring IP addresses for interfaces through PPP negotiation, complete the following tasks:
l
Configuring physical parameters of the interface and the link layer protocol PPP on the server Configuring IP addresses for interfaces on the server and making the link layer protocol Up Configuring physical parameters on the interface and the link layer protocol PPP on the client
Data Preparation
To configure IP addresses for interfaces through PPP negotiation, you need the following data. No. 1 2 3 4 Data Number of the interface connecting the server to the client ID of the address pool on the server or IP address assigned to the client Range of IP addresses when an address pool is used Number of the interface connecting the client to the server
1.3.2 Configuring a Server to Assign an IP Address for a Client Through Negotiation

Context
Do as follows on the router functioning as a server:
Procedure
Step 1 Run:
system-view
The system view is displayed.

NOTE
If there is only one client, the address pool is unnecessary. In this case, skip Steps 2, 3, and 4, and do not use the keyword pool in Step 6. Instead, directly assign the specified IP address to the client.
Step 2 (Optional) Run:

aaa
The AAA view is displayed. Step 3 (Optional) Run:

ip pool pool-number start-address [ end-address ]
The local IP address pool is configured. Step 4 (Optional) Run: Quit the AAA view. Step 5 Run:
The interface view is displayed. Obtaining an IP address through negotiation is applied to only the interface encapsulated with PPP. Step 6 Run:
remote address { ip-address | pool [ pool-number ] }
An IP address is assigned to the client. Step 7 Run:

restart
The interface is restarted. ----End
Postrequisite
During preceding configurations, the address pool can also be configured in the domain view. For details, see the HUAWEI NetEngine5000E Core Router Configuration Guide - Security.
l
If the server authenticates the client, the address is selected from the address pool of the domain that the client belongs to by default. If the server does not authenticate the client and needs to assign an IP address to the client, the address is selected from the system address pool.
The IP address or the address pool assigned to the peer must differ from the IP address of the local device.
1.3.3 Configuring a Client to Obtain an IP Address Through Negotiation

Context
Do as follows on the router working as a client:
Procedure
Step 1 Run:
system-view

The interface view is displayed. Obtaining an IP address through negotiation is applied to only the interface encapsulated with PPP. Step 3 Run:
ip address ppp-negotiate
The client is configured to obtain an IP address through negotiation. ----End
Postrequisite
If an interface without an IP address supports PPP while the remote peer is configured with an IP address, enable IP address negotiation on the local interface. This enables the local interface to obtain an IP address that is generated through PPP negotiation and is assigned by the remote peer. When you configure to obtain an IP address through negotiation on the interface, note the following:
l
You can configure IP address negotiation on only the PPP-encapsulated interface. When the status of the PPP protocol is Down, the IP address generated through negotiation is deleted. After IP address negotiation is configured on the interface, the configuration of IP address for this interface is not needed any more. You can obtain a new IP address through negotiation, and the original IP address configured before the IP address negotiation is deleted. You cannot configure a secondary IP address for the interface configured with IP address negotiation. If you re-configure negotiation on this interface, the IP address generated through the previous negotiation is deleted and a new IP address is obtained. If the address generated through negotiation is deleted, the interface is in the non-address state.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 02 (2009-12-10)
1-8

Prerequisite
The configurations of IP address negotiation on interfaces are complete.
Procedure
----End
Example
Run the display ip interface command to check that the physical status and link protocol status of the interface are Up.
<HUAWEI> display ip interface brief gigabitethernet 1/1/0 *down: administratively down !down: FIB overload down (l): loopback (s): spoofing Interface IP Address/Mask Physical Protocol GigabitEthernet1/1/0 192.168.1.10/24 up up
Run the display interface command to check information about the IP address and subnet mask of the interface.
<HUAWEI> display interface pos 1/0/0 Pos1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2007-11-07, 11:44:08 Description : Pos1/0/0 Interface Route Port,The Maximum Transmit Unit is 4470 bytes, Hold timer is 10(sec) Internet Address is 192.168.1.10/24 Link layer protocol is PPP LCP opened, IPCP opened The Vendor PN is FTRJ1321P1BTL Port BW: 2.5G, Transceiver max BW: 2.5G, Transceiver Mode: SingleMode WaveLength: 1310nm, Transmission Distance: 5km Rx Power: -2.81dBm, Tx Power: -1.91dBm Physical layer is Packet Over SDH Scramble enabled, clock master, CRC-32, loopback: none Flag J0 "NetEngine " Flag J1 "NetEngine " Flag C2 22(0x16) SDH alarm: section layer: none line layer: none path layer: none SDH error: section layer: B1 61575 line layer: B2 12002824 REI 16835916 path layer: B3 65535 Statistics last cleared:never Last 300 seconds input rate 16 bits/sec, 0 packets/sec Last 300 seconds output rate 40 bits/sec, 0 packets/sec Input: 3510 packets, 57372 bytes Input error: 0 shortpacket, 0 longpacket, 4 CRC, 0 lostpacket Output: 7270 packets, 344198 bytes
Issue 02 (2009-12-10)
1-9
Output error: 0 lostpackets Output error: 0 overrunpackets, 0 underrunpackets
1.4 Configuring IP Address Unnumbered for Interfaces

This section describes how to configure an interface to borrow the IP address from other interfaces. 1.4.1 Establishing the Configuration Task 1.4.2 Configuring the Primary IP Address of the Interface That Lends an IP Address 1.4.3 Configuring an Interface That Borrows an IP Address from Another Interface 1.4.4 Checking the Configuration

To save IP address resources in some cases, configure the IP address unnumbered on the interface. You can also perform this configuration for an interface that is occasionally used rather than making the interface occupy an IP address constantly. Restrictions on configuring IP address unnumbered on an interface are as follows:
l l l l
The interface of IP address borrower can not be an Ethernet interface. The interface of IP address lender cannot be IP address from other. Multiple interfaces can borrow the IP address from the interface of IP address lender. If the interface of IP address lender has multiple IP addresses, the IP address lender can only be the primary IP address. If the interface of IP address borrower borrows an IP address from the interface with no IP address, the IP address borrower gets the IP adderss 0.0.0.0. The IP address of the virtual loopback interface can be borrowed by other interfaces. The loopback interface, however, cannot borrow the IP address from other interfaces.
Before configuring IP address unnumbered on an interface, complete the following tasks:
l l
Configuring physical attributes for the IP address borrower and lender Configuring link layer protocols for the IP address borrower and lender
Data Preparation
To configure IP address unnumbered on an interface, you need the following data. No. 1 Data Number, IP address, and mask of the interface that lends the IP address to other interfaces
1-10
No. 2
Data Number of the interface that borrows an IP address from another interface
NOTE
The configuration here only describes how to configure an unnumbered interface to borrow an IP address. Dynamic routing protocols cannot be enabled on an interface without an IP address. Therefore, you need to manually configure a static route to the remote network segment to realize communication between devices.
1.4.2 Configuring the Primary IP Address of the Interface That Lends an IP Address
Context
Procedure
Step 1 Run:
system-view


The primary IP address of the interface is configured. An interface can also obtain the primary IP address through PPP negotiation. ----End
1.4.3 Configuring an Interface That Borrows an IP Address from Another Interface

Context
Procedure
Step 1 Run:
system-view
Issue 02 (2009-12-10)
1-11


ip address unnumbered interface interface-type interface-number
The interface is configured to borrow an IP address from the specified interface. The tunnel interface, and the interface encapsulated with PPP or HDLC can borrow the IP address from an Ethernet interface or other interfaces. ----End

Prerequisite
The configurations of IP address unnumbered are complete.
Procedure
----End
Example
Run the display ip interface command. If the physical status and link protocol status of the interface are Up, it means that the configuration succeeds. Run the display interface command. If information about the IP address and mask of the interface is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display interface pos 6/0/0 Pos6/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2008-01-30, 12:06:08 Description: Pos6/0/0 Interface Route Port,The Maximum Transmit Unit is 4470, Hold timer is 10(sec) Internet Address is unnumbered, using address of GigabitEthernet3/0/9(120.1.1.1/ 24) Link layer protocol is PPP LCP opened, IPCP opened The Vendor PN is FTRJ1321P1BTL Port BW: 2.5G, Transceiver max BW: 2.5G, Transceiver Mode: SingleMode WaveLength: 1310nm, Transmission Distance: 5km Rx Power: -7.19dBm, Tx Power: -5.76dBm Physical layer is Packet Over SDH Scramble enabled, clock master, CRC-32, loopback: none Flag J0 "NetEngine " Flag J1 "NetEngine " Flag C2 22(0x16) SDH alarm: section layer: none
1-12
Issue 02 (2009-12-10)
line layer: none path layer: none SDH error: section layer: B1 0 line layer: B2 0 REI 1370245 path layer: B3 0 REI 56395 Statistics last cleared:never Last 300 seconds input rate 24 bits/sec, 0 packets/sec Last 300 seconds output rate 24 bits/sec, 0 packets/sec Input: 1420 packets, 23131 bytes Input error: 2 shortpacket, 0 longpacket, 1 CRC, 0 lostpacket Output: 1421 packets, 23150 bytes Output error: 0 lostpackets Output error: 0 overrunpackets, 0 underrunpackets
1.5 Maintaining IP Addresses

This section describes how to view IP address configurations. 1.5.1 Monitoring Network Operation Status of IP Addresses
1.5.1 Monitoring Network Operation Status of IP Addresses

Context
In routine maintenance, you can run the following commands in any view to check the operation of IP addresses.
Procedure
l l Run the display ip interface [ brief ] [ interface-type interface-number ] command in any view to check the IP address configuration on the interface. Run the display interface [ interface-type [ interface-number ] ] [ | { begin | exclude | include } regular-expression ] command in any view to check information about the interface.
----End
1.6 Configuration Examples

This section provides several examples for configuring IP addresses. 1.6.1 Example for Configuring Primary and Secondary IP Addresses 1.6.2 Example for Obtaining an IP Address Through Negotiation 1.6.3 Example for Configuring IP Address Unnumbered 1.6.4 Example for Configuring IP Address Overlapping on the Same Device 1.6.5 Example for Configuring an IP Address with a 31-bit Mask
1.6.1 Example for Configuring Primary and Secondary IP Addresses

Networking Requirements
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The slot number must be specified along with the chassis ID. As shown in Figure 1-1, GE 1/0/1 of the device connects to a LAN in which computers belong to one of the two network segments: 172.16.1.0/24 and 172.16.2.0/24. It is required that the device can communicate with the two network segments. At the same time, the hosts of the two network segments cannot communicate with each other. Figure 1-1 Configuring primary and secondary IP addresses for an interface 172.16.1.0/24
Router
GE1/0/1 172.16.1.1/24 172.16.2.1/24 sub
172.16.2.0/24
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. Analyze the address of the network segment to which the interface connects. Configure the primary IP address for the interface and then configure one or more secondary IP addresses for the interface.
NOTE
The primary IP address and the secondary IP address in the overlapped network segments but not same can be configured on the same interface. The secondary IP addresses of an interface cannot be in the same network segment.
Data Preparation
To complete the configuration, you need the following data:
l l
Primary IP address and subnet mask of the interface Secondary IP address and subnet mask of the interface
1-14
Procedure
Step 1 Configure the device. # Configure the primary and secondary IP addresses for GE 1/0/1 of the device.
<HUAWEI> system-view [HUAWEI] sysname Router [Router] interface gigabitethernet 1/0/1 [Router-GigabitEthernet1/0/1] ip address 172.16.1.1 255.255.255.0 [Router-GigabitEthernet1/0/1] ip address 172.16.2.1 255.255.255.0 sub [Router-GigabitEthernet1/0/1] undo shutdown [Router-GigabitEthernet1/0/1] quit
Step 2 Verify the configuration. # Ping the host on the network segment 172.16.1.0 from the device. The ping succeeds.
[Router] ping 172.16.1.2 PING 172.16.1.2: 56 data bytes, press CTRL_C to break Reply from 172.16.1.2: bytes=56 Sequence=1 ttl=128 time=25 Reply from 172.16.1.2: bytes=56 Sequence=2 ttl=128 time=27 Reply from 172.16.1.2: bytes=56 Sequence=3 ttl=128 time=26 Reply from 172.16.1.2: bytes=56 Sequence=4 ttl=128 time=26 Reply from 172.16.1.2: bytes=56 Sequence=5 ttl=128 time=26 --- 172.16.1.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/26/27 ms
ms ms ms ms ms
# Ping the host on the segment 172.16.2.0 from the device. The ping succeeds.
[Router] ping 172.16.2.2 PING 172.16.2.2: 56 data bytes, press CTRL_C to break Reply from 172.16.2.2: bytes=56 Sequence=1 ttl=128 time=25 Reply from 172.16.2.2: bytes=56 Sequence=2 ttl=128 time=26 Reply from 172.16.2.2: bytes=56 Sequence=3 ttl=128 time=26 Reply from 172.16.2.2: bytes=56 Sequence=4 ttl=128 time=26 Reply from 172.16.2.2: bytes=56 Sequence=5 ttl=128 time=26 --- 172.16.2.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/25/26 ms
ms ms ms ms ms
# The hosts of the two network segments cannot ping through each other. ----End
Configuration Files
The following lists the configuration file of the device:
# sysname Router # interface GigabitEthernet1/0/1 undo shutdown ip address 172.16.1.1 255.255.255.0 ip address 172.16.2.1 255.255.255.0 sub # return
1.6.2 Example for Obtaining an IP Address Through Negotiation

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 1-2, Router A allocates an IP address for POS 1/0/0 on Router B through PPP negotiation. Figure 1-2 Networking diagram of allocating IP address through negotiation
Ethernet
POS 1/0/0 192.168.1.1/24 POS 1/0/0
Ethernet
RouterA
RouterB
The configuration roadmap is as follows: 1. 2. 3. 4. Configure a local IP address pool. Configure an IP address for the local interface. Specify an IP address or address pool for the remote end. Enable obtaining an IP address through negotiation on the remote end.
Data Preparation
l l
IP address and subnet mask of the local interface The range of the IP address to be allocated to the remote end
Procedure
Step 1 Configure Router A. # Configure a local IP address pool.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] aaa [RouterA-aaa] ip pool 1 192.168.1.10 192.168.1.20 [RouterA-aaa] quit
# Configure an IP address for POS 1/0/0.

[RouterA] interface pos 1/0/0
1-16
Issue 02 (2009-12-10)

[RouterA-Pos1/0/0] ip address 192.168.1.1 255.255.255.0
# Configure POS 1/0/0 to allocate an IP address to the remote end.

[RouterA-Pos1/0/0] [RouterA-Pos1/0/0] [RouterA-Pos1/0/0] [RouterA-Pos1/0/0] remote address pool 1 shutdown undo shutdown quit
Step 2 Configure Router B. # Enable obtaning an IP address of the interface through PPP negotiation.
<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] interface pos 1/0/0 [RouterB-Pos1/0/0] ip address ppp-negotiate [RouterB-Pos1/0/0] undo shutdown [RouterB-Pos1/0/0] quit
Step 3 Verify the configuration. Router B can ping through POS 1/0/0 on Router A.
[RouterB] ping 192.168.1.1 PING 192.168.1.1: 56 data bytes, press CTRL_C to break Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=255 time=156 ms Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=255 time=63 ms Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=255 time=62 ms Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=255 time=63 ms Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=255 time=63 ms --- 192.168.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 62/81/156 ms
# View the status of POS 1/0/0 on Router B.

[RouterB] display interface pos 1/0/0 Pos1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2007-12-07, 17:12:39 Description : Pos1/0/0 Interface Route Port,The Maximum Transmit Unit is 4470, Hold timer is 10(sec) Internet Address is negotiated, 192.168.1.10/32 Link layer protocol is PPP LCP opened, IPCP opened The Vendor PN is FTRJ1321P1BTL Port BW: 2.5G, Transceiver max BW: 2.5G, Transceiver Mode: SingleMode WaveLength: 1310nm, Transmission Distance: 5km Rx Power: -2.81dBm, Tx Power: -1.91dBm Physical layer is Packet Over SDH Scramble enabled, clock master, CRC-32, loopback: none Flag J0 "NetEngine " Flag J1 "NetEngine " Flag C2 22(0x16) SDH alarm: section layer: none line layer: none path layer: none SDH error: section layer: B1 61575 line layer: B2 12002824 REI 16835916 path layer: B3 65535 Statistics last cleared:never Last 300 seconds input rate 16 bits/sec, 0 packets/sec Last 300 seconds output rate 40 bits/sec, 0 packets/sec Input: 3510 packets, 57372 bytes Input error: 0 shortpacket, 0 longpacket, 4 CRC, 0 lostpacket
Issue 02 (2009-12-10)
1-17
Output: 7270 packets, 344198 bytes Output error: 0 lostpackets Output error: 0 overrunpackets, 0 underrunpackets
If the information "Internet Address is negotiated, 192.168.1.10/32" is displayed, it means that the address negotiation succeeds. ----End
Configuration Files
l
Configuration file of Router A

# sysname RouterA # aaa ip pool 1 192.168.1.10 192.168.1.20 # interface Pos1/0/0 link-protocol ppp undo shutdown remote address pool 1 ip address 192.168.1.1 255.255.255.0 # return
Configuration file of Router B

# sysname RouterB # interface Pos1/0/0 link-protocol ppp undo shutdown ip address ppp-negotiate # return
1.6.3 Example for Configuring IP Address Unnumbered

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 1-3, an enterprise builds its intranet through the ISDN. Router A and Router B connect to a local LAN through the GE interfaces. The devices connect to each other through the dialing ports. Each device connects to the LAN through GE 1/0/0 and connects to the ISDN through POS 2/0/0. To save IP address resources, the dialing ports are planed to borrow the IP addresses from the GE interfaces.
1-18
Issue 02 (2009-12-10)
Figure 1-3 Networking diagram of an IP address unnumbered configuration
RouterA Ethernet
GE1/0/0 POS 2/0/0 172.16.10.1/24
RouterB ISDN Ethernet

POS 2/0/0 GE1/0/0 172.16.20.1/24
The configuration roadmap is as follows: 1. 2. Configure IP addresses to be borrowed. Configure the interfaces to borrow IP addresses from other interfaces.
Data Preparation
l l
IP address of the interface that lends an IP address Number of the interface that lends an IP address
Procedure
Step 1 Configure Router A. # Configure an IP address for GE 1/0/0.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 172.16.10.1 255.255.255.0 [RouterA-GigabitEthernet1/0/0] undo shutdown [RouterA-GigabitEthernet1/0/0] quit
# Configure the POS interface to borrow an IP address from the GE interface.

[RouterA] interface pos 2/0/0 [RouterA-Pos2/0/0] ip address unnumbered interface gigabitethernet 1/0/0 [RouterA-Pos2/0/0] link-protocol ppp [RouterA-Pos2/0/0] undo shutdown [RouterA-Pos2/0/0] quit
# Configure an Ethernet route to Router B.

[RouterA] ip route-static 172.16.20.0 255.255.255.0 pos 2/0/0
Step 2 Configure Router B. # Configure an IP address for GE 1/0/0.

<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] ip address 172.16.20.1 255.255.255.0 [RouterB-GigabitEthernet1/0/0] undo shutdown
Issue 02 (2009-12-10)
1-19
[RouterB-GigabitEthernet1/0/0] quit
# Configure the POS interface to borrow an IP address from the GE interface.

[RouterB] interface pos 2/0/0 [RouterB-Pos2/0/0] ip address unnumbered interface gigabitethernet 1/0/0 [RouterB-Pos2/0/0] link-protocol ppp [RouterB-Pos2/0/0] undo shutdown [RouterB-Pos2/0/0] quit
# Configure an Ethernet route to Router A.

[RouterB] ip route-static 172.16.10.0 255.255.255.0 pos 2/0/0
Step 3 Verify the configuration. # Router A can ping through the address of the host connected to Router B.
[RouterA] ping 172.16.20.2 PING 172.16.20.2: 56 data bytes, press CTRL_C to break Reply from 172.16.20.2: bytes=56 Sequence=1 ttl=254 time=25 Reply from 172.16.20.2: bytes=56 Sequence=2 ttl=254 time=25 Reply from 172.16.20.2: bytes=56 Sequence=3 ttl=254 time=26 Reply from 172.16.20.2: bytes=56 Sequence=4 ttl=254 time=26 Reply from 172.16.20.2: bytes=56 Sequence=5 ttl=254 time=26 --- 172.16.20.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/25/26 ms
ms ms ms ms ms
----End
Configuration Files
l

# sysname RouterA # interface Pos2/0/0 link-protocol ppp undo shutdown ip address unnumbered interface GigabitEthernet1/0/0 # interface GigabitEthernet1/0/0 undo shutdown ip address 172.16.10.1 255.255.255.0 # ip route-static 172.16.20.0 255.255.255.0 Pos2/0/0 # return

# sysname RouterB # interface Pos2/0/0 link-protocol ppp undo shutdown ip address unnumbered interface GigabitEthernet1/0/0 # interface GigabitEthernet1/0/0 undo shutdown ip address 172.16.20.1 255.255.255.0 # ip route-static 172.16.10.0 255.255.255.0 Pos2/0/0 # return
1-20
Issue 02 (2009-12-10)
1.6.4 Example for Configuring IP Address Overlapping on the Same Device

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 1-4, Network A and Network B are independent from each other. They access the Internet through different paths. Using the same Layer 2 network provided by ISP 1, Network A and Network B can access each other. It is required to use Router B to connect Network A and Network B to the Layer 2 network provided by ISP 1 by using the IP addresses 192.168.1.11/24 and 192.168.1.12/24. Figure 1-4 Networking diagram of configuring IP address overlapping on the same device
GE1/0/0 192.168.1.1/24
Layer2 network r2 GE3/0/0 192.168.1.12/24 POS4/0/0 20.1.1.1/24 POS4/0/0 20.1.1.2/24
RouterA
AS:100
r1 GE1/0/0 192.168.1.11/24 POS2/0/0 10.1.1.1/24
POS2/0/0 10.1.1.2/24
RouterB
ISP1 AS:200
RouterC
Network A
RouterD
Network B
Procedure
Step 1 Configure a VPN instance. # On Router B, create a VPN instance for Network A, and bind the VPN instance to the upstream interface GE 1/0/0 and the downstream interface POS 2/0/0.
<HUAWEI> system-view [HUAWEI] sysname B
Issue 02 (2009-12-10)
1-21
[RouterB] ip vpn-instance r1 [RouterB-vpn-instance-r1] route-distinguisher 100:1 [RouterB-vpn-instance-r1] quit [RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] ip binding vpn-instance r1 [RouterB-GigabitEthernet1/0/0] ip address 192.168.1.11 24 [RouterB-GigabitEthernet1/0/0] undo shutdown [RouterB-GigabitEthernet1/0/0] quit [RouterB] interface pos 2/0/0 [RouterB-Pos2/0/0] ip binding vpn-instance r1 [RouterB-Pos2/0/0] ip address 10.1.1.1 24 [RouterB-Pos2/0/0] undo shutdown [RouterB-Pos2/0/0] quit
# On Router B, create a VPN instance for Network B, and bind the VPN instance to the upstream interface GE 3/0/0 and the downstream interface POS 4/0/0.
[RouterB] ip vpn-instance r2 [RouterB-vpn-instance-r2] route-distinguisher 100:2 [RouterB-vpn-instance-r2] quit [RouterB] interface gigabitethernet 3/0/0 [RouterB-GigabitEthernet3/0/0] ip binding vpn-instance r2 [RouterB-GigabitEthernet3/0/0] ip address 192.168.1.12 24 [RouterB-GigabitEthernet3/0/0] undo shutdown [RouterB-GigabitEthernet3/0/0] quit [RouterB] interface pos 4/0/0 [RouterB-Pos4/0/0] ip binding vpn-instance r2 [RouterB-Pos4/0/0] ip address 20.1.1.1 24 [RouterB-Pos4/0/0] undo shutdown [RouterB-Pos4/0/0] quit
# On Router B, configure static routes for the two VPN instances.

[RouterB] ip route-static vpn-instance r1 0.0.0.0 0 192.168.1.1 [RouterB] ip route-static vpn-instance r2 0.0.0.0 0 192.168.1.1
Step 2 Set up the EBGP neighbor relationship between Router A and the two upstream interfaces on Router B respectively. # Configure Router B.
[RouterB] bgp 200 [RouterB-bgp] router-id 100.1.1.1 [RouterB-bgp] ipv4-family vpn-instance r1 [RouterB-bgp-r1] peer 192.168.1.1 as-number 100 [RouterB-bgp-r1] import-route direct [RouterB-bgp-r1] quit [RouterB-bgp] ipv4-family vpn-instance r2 [RouterB-bgp-r2] peer 192.168.1.1 as-number 100 [RouterB-bgp-r2] import-route direct [RouterB-bgp-r2] quit
# Configure Router A.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 192.168.1.1 24 [RouterA-GigabitEthernet1/0/0] undo shutdown [RouterA-GigabitEthernet1/0/0] quit [RouterA] bgp 100 [RouterA-bgp] peer 192.168.1.11 as-number 200 [RouterA-bgp] peer 192.168.1.12 as-number 200 [RouterA-bgp] quit
Step 3 Configure IP addresses and static routes for Router C and Router D on the local network. # Configure the IP address and static route for Router C.
<HUAWEI> system-view
1-22
Issue 02 (2009-12-10)

[HUAWEI] sysname RouterC [RouterC] interface pos 2/0/0 [RouterC-Pos2/0/0] ip address 10.1.1.2 24 [RouterC-Pos2/0/0] undo shutdown [RouterC-Pos2/0/0] quit [RouterC] ip route-static 0.0.0.0 0 10.1.1.1
# Configure the IP address and static route for Router D.

<HUAWEI> system-view [HUAWEI] sysname RouterD [RouterD] interface pos 4/0/0 [RouterD-Pos4/0/0] ip address 20.1.1.2 24 [RouterD-Pos4/0/0] undo shutdown [RouterD-Pos4/0/0] quit [RouterD] ip route-static 0.0.0.0 0 20.1.1.1
Step 4 Verify the configuration. # After the configurations, view the private routing table on Router B. The routes of the two local networks connected to Router B belong to two VPN instances (r1 and r2) respectively. This indicates that the routes are isolated.
[RouterB] display ip routing-table vpn-instance r1 Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: r1 Destinations : 6 Routes : 6 Destination/Mask 0.0.0.0/0 10.1.1.0/24 10.1.1.1/32 10.1.1.2/32 192.168.1.0/24 192.168.1.11/32 Proto Static Direct Direct Direct Direct Direct Pre 60 0 0 0 0 0 Cost 0 0 0 0 0 0 Flags RD D D D D D NextHop 192.168.1.1 10.1.1.1 127.0.0.1 10.1.1.2 192.168.1.11 127.0.0.1 Interface GigabitEthernet1/0/0 Pos2/0/0 InLoopBack0 Pos2/0/0 GigabitEthernet1/0/0 InLoopBack0
[RouterB] display ip routing-table vpn-instance r2 Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: r2 Destinations : 6 Routes : 6 Destination/Mask 0.0.0.0/0 20.1.1.0/24 20.1.1.1/32 20.1.1.2/32 192.168.1.0/24 192.168.1.12/32 Proto Static Direct Direct Direct Direct Direct Pre 60 0 0 0 0 0 Cost 0 0 0 0 0 0 Flags RD D D D D D NextHop 192.168.1.1 20.1.1.1 127.0.0.1 20.1.1.2 192.168.1.12 127.0.0.1 Interface GigabitEthernet3/0/0 Pos4/0/0 InLoopBack0 Pos4/0/0 GigabitEthernet3/0/0 InLoopBack0
# Run the display ip routing-table command on Router A. The command output shows that the public routing table on Router A contains routes to the two local networks.
[RouterA] display ip routing-table Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: Public Destinations : 8 Routes : 8 Destination/Mask 10.1.1.0/24 10.1.1.2/32 20.1.1.0/24 20.1.1.2/32 Proto BGP BGP BGP BGP Pre 255 255 255 255 Cost 0 0 0 0 Flags D D D D NextHop 192.168.1.11 192.168.1.11 192.168.1.12 192.168.1.12 Interface GigabitEthernet1/0/0 GigabitEthernet1/0/0 GigabitEthernet1/0/0 GigabitEthernet1/0/0
Issue 02 (2009-12-10)
1-23
127.0.0.0/8 127.0.0.1/32 192.168.1.0/24 192.168.1.1/32 Direct Direct Direct Direct 0 0 0 0 0 0 0 0 D D D D

127.0.0.1 127.0.0.1 192.168.1.1 127.0.0.1 InLoopBack0 InLoopBack0 GigabitEthernet1/0/0 InLoopBack0
Network A and Network B can ping through each other. ----End
Configuration Files
l

# sysname RouterA # interface GigabitEthernet1/0/0 undo shutdown ip address 192.168.1.1 255.255.255.0 # bgp 100 peer 192.168.1.11 as-number 200 peer 192.168.1.12 as-number 200 # ipv4-family unicast undo synchronization peer 192.168.1.11 enable peer 192.168.1.12 enable # return
Configuration file of Router B.

# sysname RouterB # ip vpn-instance r1 route-distinguisher 100:1 # ip vpn-instance r2 route-distinguisher 100:2 # interface GigabitEthernet1/0/0 undo shutdown ip binding vpn-instance r1 ip address 192.168.1.11 255.255.255.0 # interface GigabitEthernet3/0/0 undo shutdown ip binding vpn-instance r2 ip address 192.168.1.12 255.255.255.0 # interface Pos2/0/0 link-protocol ppp undo shutdown ip binding vpn-instance r1 ip address 10.1.1.1 255.255.255.0 # interface Pos4/0/0 link-protocol ppp undo shutdown ip binding vpn-instance r2 ip address 20.1.1.1 255.255.255.0 # bgp 200 router-id 100.1.1.1 # ipv4-family unicast undo synchronization #
1-24
Issue 02 (2009-12-10)
ipv4-family vpn-instance r1 peer 192.168.1.1 as-number 100 import-route direct # ipv4-family vpn-instance r2 peer 192.168.1.1 as-number 100 import-route direct # ip route-static vpn-instance r1 0.0.0.0 0.0.0.0 192.168.1.1 ip route-static vpn-instance r2 0.0.0.0 0.0.0.0 192.168.1.1 # return l
Configuration file of Router C

# sysname RouterC # interface pos 2/0/0 link-protocol ppp undo shutdown ip address 10.1.1.2 255.255.255.0 # ip route-static 0.0.0.0 0.0.0.0 10.1.1.1 # return
Configuration file of Route D

# sysname RouterD # interface pos 4/0/0 link-protocol ppp undo shutdown ip address 20.1.1.2 255.255.255.0 # ip route-static 0.0.0.0 0.0.0.0 20.1.1.1 # Return
1.6.5 Example for Configuring an IP Address with a 31-bit Mask

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 1-5, Router A and Router B are connected through a PPP link. Figure 1-5 Networking diagram of configuring an IP address with a 31-bit mask POS1/0/0 10.1.1.1/31 POS1/0/0 10.1.1.0/31
RouterA
Issue 02 (2009-12-10)
RouterB
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 1-25
The configuration roadmap is as follows: 1. 2. Configure an IP address with a 31-bit mask for POS 1/0/0 on Router A. Configure an IP address with a 31-bit mask for POS 1/0/0 on Router B.
Data Preparation
l l
IP address and mask of POS 1/0/0 on Router A IP address and mask of POS 1/0/0 on Router B
Procedure
Step 1 Configure an IP address for each interface. # Configure an IP address for POS 1/0/0 on Router A.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] interface pos 1/0/0 [RouterA-Pos1/0/0] ip address 10.1.1.1 31 [RouterA-Pos1/0/0] undo shutdown [RouterA-Pos1/0/0] quit
# Configure an IP address for POS 1/0/0 on Router B.

<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] interface pos 1/0/0 [RouterB-Pos1/0/0] ip address 10.1.1.0 31 [RouterB-Pos1/0/0] undo shutdown [RouterB-Pos1/0/0] quit
Step 2 Verify the configuration. # After the preceding configurations, you can check the routing table on Router A. You can find that in the routing table, the network address and the broadcast address of the network segment are both used as host addresses.
[RouterA] display ip routing-table Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: Public Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.1.0/31 Direct 0 0 D 10.1.1.1 Pos1/0/0 10.1.1.0/32 Direct 0 0 D 10.1.1.0 Pos1/0/0 10.1.1.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
# After the preceding configurations, you can check the routing table on Router B. You can find that in the routing table, the network address and the broadcast address of the network segment are both used as host addresses.
[RouterB] display ip routing-table Route Flags: R - relay, D - download to fib
1-26
Issue 02 (2009-12-10)
-----------------------------------------------------------------------------Routing Tables: Public Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.1.0/31 Direct 0 0 D 10.1.1.0 Pos1/0/0 10.1.1.0/32 Direct 0 0 D 127.0.0.1 InLoopBack0 10.1.1.1/32 Direct 0 0 D 10.1.1.1 Pos1/0/0 127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
----End
Configuration Files
l

# sysname RouterA # interface Pos1/0/0 link-protocol ppp undo shutdown ip address 10.1.1.1 255.255.255.254 # return

# sysname RouterB # interface Pos1/0/0 link-protocol ppp undo shutdown ip address 10.1.1.0 255.255.255.254 # return
Issue 02 (2009-12-10)
1-27
2 ARP Configuration
2
About This Chapter
ARP Configuration
This chapter describes the principle of ARP and the procedure for configuring ARP, and provides typical configuration examples. 2.1 Introduction to ARP This section describes the basic principle and concepts of the Address Resolution Protocol (ARP). 2.2 Configuring Static ARP This section describes how to configure static ARP. 2.3 Optimizing Dynamic ARP 2.4 Configuring Routed Proxy ARP This section describes how to configure routed proxy ARP to make different sub-networks communicate with each other. 2.5 Configuring Proxy ARP Within a VLAN This section describes how to implement communication between hosts in the same VLAN configured with user isolation. 2.6 Configuring Proxy ARP Between VLANs This section describes how to implement communication between hosts in different VLANs. 2.7 Configuring ARPing-IP This section describes how to configure ARPing-IP. 2.8 Configuring ARPing-MAC This section describes how to configure ARPing-MAC. 2.9 Configuring the Association Between ARP and Interface Status This section describes how to control the protocol status of the interface through ARP probes. 2.10 Maintaining ARP This section describes how to display ARP configurations, clear ARP statistics and debug ARP. 2.11 Configuration Examples
Issue 02 (2009-12-10)
2-1
2 ARP Configuration
This section provides some configurations example, such as Routed Proxy ARP, Proxy ARP Within a VLAN and Proxy ARP Between VLANs.
2-2
Issue 02 (2009-12-10)
2 ARP Configuration
2.1 Introduction to ARP

This section describes the basic principle and concepts of the Address Resolution Protocol (ARP). 2.1.1 Overview of ARP 2.1.2 Features of ARP Supported by the NE5000E
2.1.1 Overview of ARP

Each host or device on the Local Area Network (LAN) has a 32-bit IP address to communicate with others. The assigned IP address is independent of the hardware address. On the Ethernet, a host or a device transmits and receives Ethernet frames according to a 48-bit Medium Access Control (MAC) address. The MAC address is also called the physical address or the hardware address, which is assigned to an Ethernet interface when an equipment is produced. Therefore, on an interconnected network, an address resolution mechanism is required to provide the mapping between MAC addresses and IP addresses. The Address Resolution Protocol (ARP) maps an IP address to the corresponding MAC address.
2.1.2 Features of ARP Supported by the NE5000E

ARP is classified into dynamic ARP and static ARP. The NE5000E supports dynamic ARP, static ARP, and proxy ARP.
Introduction to ARPing
ARPing consists of ARP-Ping IP and ARP-Ping MAC. ARPing is developed to maintain the deployed Layer 2 features.
Introduction to ARP-Ping IP
ARP-Ping IP uses ARP packets to check whether an IP address is used by another device on the LAN. Before configuring an IP address for a device, you need to check that the IP address is not used by another device on the network by sending ARP packets. You can also run the ping command to check whether the IP address is used by another device on the network. If enabled with the firewall function that does not reply to Ping packets, the destination host and device do not reply to Ping packets and think that the IP address is not in use. ARP is a Layer 2 protocol. In most cases, ARP packets can pass through the firewall. In this way, the preceding situation does not occur.
Principles of ARP-Ping IP
ARP-Ping IP sends ARP Request packets. The following describes how to implement ARP-Ping IP:
2 ARP Configuration
1. 2. 3.
After setting the specified IP address through command lines, you can send ARP Request packets and start the timeout timer. After receiving an ARP Request packet, each device or host on the LAN replies with an ARP Reply packet. After receiving the ARP Reply packet, the source device compares the source IP address contained in the Reply packet with the IP address input in the command line. If they are consistent, the MAC address corresponding to the input IP address is displayed and the timeout timer of ARP Reply packets is disabled. The operation finishes. If the timeout timer of ARP Reply packets times out, it means that the IP address is not in use.
As shown in Figure 2-1, Router A and Gigabitethernet A are directly connected. You can run the arp-ping ip command on Router A to check whether the IP address 10.1.1.2 is in use. Figure 2-1 Implementation procedure of ARP-Ping IP
Host B
Host A
10.1.1.3/32 10.1.1.2/32 GE1/0/0 10.1.1.1/24
RouterA Gigabitethernet A
Run the arp-ping ip 10.1.1.2 command on Router A. After receiving the ARP Reply packet from Host A 10.1.1.2 on the network, Router A displays the MAC address of Host A. Through the command output, you can know whether the IP address is used by another host on the network.
NOTE
The arp-ping ip command is applicable to the outgoing interface in one of the following types: the Gigabit Ethernet interface, and Eth-Trunk interface.
Introduction to ARP-Ping MAC

ARP-Ping MAC uses ICMP packets to check whether a MAC address is used by another device on the LAN. When you know a specific MAC address on a network segment but do not know the corresponding IP address, you can obtain the IP address corresponding to the MAC address by sending the broadcast Internet Control Messages Protocol (ICMP) packets through ARP-Ping MAC. In this way, you can query the IP address corresponding to the specific MAC address on the network segment.
2-4
Issue 02 (2009-12-10)
2 ARP Configuration
Principles of ARP-Ping MAC

ARP-Ping MAC sends broadcast ICMP Echo Request packets. The following describes how to implement ARP-Ping MAC: 1. 2. 3. After setting the specified MAC address through the command line, you can send broadcast ICMP Echo Request packets and start the timeout timer. After receiving an ICMP Echo Request packet, each device or host on the LAN replies with an ICMP Echo Reply packet. After receiving the ICMP Echo Reply packet, the source device compares the source MAC address contained in the Echo Reply packet with the MAC address input in the command line. If they are consistent, the IP address of the Echo Reply packet is displayed. Then the source device prompts you that the MAC address is in use and disables the timeout timer. The operation finishes. If the timeout timer of the ICMP Echo Reply packets times out, it means that the MAC address is not in use.
NOTE
If the system denies the request for replying with the network segment address, the sender cannot receive the ICMP Echo Reply packet.
As shown in Figure 2-2, Router A and Gigabitethernet A are directly connected. You can run the arp-ping mac command on Router A to check whether the MAC address 0013-46E7-2EF5 is in use. Figure 2-2 Implementation procedure of ARP-Ping MAC
Host A
0013-46E7-2EF5 GE1/0/0 10.1.1.1/24
RouterA Gigabitethernet A
The following describes how to implement ARP-Ping MAC on Router A: Run the arp-ping mac 0013-46E7-2EF5 10.1.1.0 or arp-ping mac 0013-46E7-2EF5 gigabitethernet 1/0/0 command on Router A. After receiving the ICMP Reply packets replied by all the hosts on the network, Router A displays the IP address of the host with the MAC address 0013-46E7-2EF5. Through the command output, you can obtain the IP address corresponding to the MAC address.
NOTE
The arp-ping mac command is applicable to the outgoing interface in one of the following types: Gigabit Ethernet interface, and Eth-Trunk interface.
Issue 02 (2009-12-10)
2-5
2 ARP Configuration
2.2 Configuring Static ARP

This section describes how to configure static ARP. 2.2.1 Establishing the Configuration Task 2.2.2 Configuring Common Static ARP Entries 2.2.3 Configuring Static ARP Entries in a VLAN 2.2.4 Configuring Static ARP Entries in a VPN Instance 2.2.5 Checking the Configuration

Static ARP is used in the following situations:
l
For the packets whose destination IP address is on another network segment, static ARP can help these packets traverse a gateway of the local network segment so that the gateway can forward the packets to their destination. When you need to filter out some packets with illegitimate destination IP addresses, static ARP can bind these illegitimate addresses to a nonexistent MAC address.
Before configuring ARP, complete the following tasks:
l
Configuring physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring link layer protocol parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up Configuring the network layer protocol for the interface
Data Preparation
To configure ARP, you need the following data. No. 1 2 Data IP address and MAC address of the static ARP entry VPN instance name and VLAN ID to which the static ARP entry belongs
2-6
Issue 02 (2009-12-10)
2 ARP Configuration
2.2.2 Configuring Common Static ARP Entries

Context
Procedure
Step 1 Run:
system-view

arp static ip-address mac-address
Configure common static ARP entries.

NOTE
Static ARP entries keep valid when a device works normally.
----End
2.2.3 Configuring Static ARP Entries in a VLAN

Context
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 Configure static ARP entries in a Virtual Local Area Network (VLAN). To configure static ARP entries in a Virtual Local Area Network (VLAN), do as follows:
l
Run the arp static ip-address mac-address vid vlan-id interface interface-type interfacenumber command. If the interface corresponding to the VLAN is bound to a Virtual Private Network (VPN), the device can automatically associate the configured static ARP entry with the VPN. This command is applicable to port-based VLANs.
Run the arp static ip-address mac-address [ vpn-instance vpn-instance-name ] vid vlanid command. This command is applicable to the sub-interface that supports VLAN and can be bound to the VPN.
NOTE
----End
2 ARP Configuration
2.2.4 Configuring Static ARP Entries in a VPN Instance

Context
Procedure
Step 1 Run:
system-view

arp static ip-address mac-address vpn-instance vpn-instance-name
Configure static ARP entries in a VPN instance.

NOTE
----End

Prerequisite
The configurations of the ARP function are complete.
Procedure
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask ] ] [ dynamic | static ] [ | { begin | exclude | include } regular-expression] command to check information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on VPN instances. Run the display arp statistics { all | slot slot-id } command to check the statistics for ARP entries.
----End
Example
Run the display arp interface command. If all the ARP entries of the interface are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp interface gigabitethernet 1/0/0 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC ------------------------------------------------------------------------------
2-8
Issue 02 (2009-12-10)
2 ARP Configuration
192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 15 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:2 Dynamic:1 Static:0 Interface:1
Run the display arp slot command. If all the ARP entries of the interface board are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.12 0000-0a41-0202 I GE1/0/1 r2 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/1 r2 192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:4 Dynamic:2 Static:0 Interface:2
Run the display arp vpn-instance command. If all the ARP entries of the VPN instance are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp vpn-instance r1 slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 12 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:2 Dynamic:1 Static:0 Interface:1
Run the display arp statistics { all | slot slot-id } command. If the statistics for ARP entries are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp statistics all Dynamic:20 Static:10
2.3 Optimizing Dynamic ARP

2.3.1 Establishing the Configuration Task 2.3.2 Modify the aging parameters of dynamic ARP 2.3.3 Enabling ARP Suppression Function 2.3.4 Checking the Configuration

Dynamic ARP is one of functions owned by a device or host. You do not need to run a command to enable dynamic ARP but you can modify some parameters of dynamic ARP.
None
2 ARP Configuration
Data Preparation
Optimizing dynamic ARP, you need the following data. No. 1 2 3 Data ID of the Ethernet interface to which the dynamic ARP entry belongs Aging detection times of the dynamic ARP entry Aging time of the dynamic ARP entry
2.3.2 Modify the aging parameters of dynamic ARP

Context
Procedure
Step 1 Run:
system-view

The Ethernet interface view is displayed. Step 3 Run:

arp detect-times detect-times
The number of aging detection times of the dynamic ARP entries is configured. Step 4 Run:
arp expire-time expire-times
The timeout period for aging dynamic ARP entries is configured. By default, the aging detection times of the dynamic ARP entries is three, and the aging timeout period is 1200 seconds. ----End
2.3.3 Enabling ARP Suppression Function

Context
2 ARP Configuration
Procedure
Step 1 Run:
system-view

arp-suppress enable
ARP suppression is enabled on the current device. The ARP suppression function can be enabled only on the Eth-Trunk interface. ----End

Prerequisite
The configurations of the ARP function are complete.
Procedure
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask ] ] [ dynamic | static ] [ | { begin | exclude | include } regular-expression] command to check information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on VPN instances. Run the display arp statistics { all | slot slot-id } command to check the statistics for ARP entries.
----End
Example
<HUAWEI> display arp interface gigabitethernet 1/0/0 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 15 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:2 Dynamic:1 Static:0 Interface:1
<HUAWEI> display arp slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VLAN/CEVLAN PVC VPN-INSTANCE
Issue 02 (2009-12-10)
2-11
2 ARP Configuration
-----------------------------------------------------------------------------192.168.1.12 0000-0a41-0202 I GE1/0/1 r2 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/1 r2 192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:4 Dynamic:2 Static:0 Interface:2
Run the display arp statistics { all | slot slot-id } command. If the statistics for ARP entries are displayed, it means that the configuration succeeds. For example:
2.4 Configuring Routed Proxy ARP

This section describes how to configure routed proxy ARP to make different sub-networks communicate with each other. 2.4.1 Establishing the Configuration Task 2.4.2 Configure an IP Addresses for the Interface 2.4.3 Enabling the Routed Proxy ARP Function 2.4.4 Checking the Configuration

The two physical networks of an enterprise are in different subnets of the same IP network, and are separated by a device. You need to enable the proxy ARP on the device interface connected to the physical networks. This enables communication between the two networks. Network IDs of subnet hosts must be the same. You need not configure default gateways for hosts.
Before configuring routed proxy ARP, complete the following tasks:
l
Configuring the physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up
2-12
2 ARP Configuration
Data Preparation
To configure routed proxy ARP, you need the following data. No. 1 2 Data Number of the interface to be enabled with routed proxy ARP IP address of the interface to be enabled with routed proxy ARP
2.4.2 Configure an IP Addresses for the Interface

Context
Procedure
Step 1 Run:
system-view

The interface view is displayed. The interfaces supporting routed proxy ARP include GE interfaces, GE sub-interfaces, EthTrunk interfaces, and Eth-Trunk sub-interfaces. Step 3 Run:
The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the LAN connected with this interface. ----End
2.4.3 Enabling the Routed Proxy ARP Function

Context
Procedure
Step 1 Run:
system-view
Issue 02 (2009-12-10)
2-13
2 ARP Configuration


arp-proxy enable
The routed proxy ARP function is enabled on the interface. After routed proxy ARP is enabled, you must reduce the aging time of ARP entries in the host so that the number of packets received but cannot be forwarded by the device is decreased. To configure the aging time of ARP entries, run the arp expire-time expire-time command. ----End

Prerequisite
The configurations of the routed proxy ARP function are complete.
Procedure
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask ] ] [ dynamic | static ] [ | { begin | exclude | include } regular-expression] command to check information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on VPN instances. Run the display arp statistics { all | slot slot-id } command to check statistics about ARP entries.
----End
Example
<HUAWEI> display arp slot 1
2-14
Issue 02 (2009-12-10)

IP ADDRESS MAC ADDRESS
2 ARP Configuration
EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.12 0000-0a41-0202 I GE1/0/1 r2 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/1 r2 192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:4 Dynamic:2 Static:0 Interface:2
Run the display arp statistics { all | slot slot-id } command. If statistics about ARP entries are displayed, it means that the configuration succeeds. For example:
2.5 Configuring Proxy ARP Within a VLAN

This section describes how to implement communication between hosts in the same VLAN configured with user isolation. 2.5.1 Establishing the Configuration Task 2.5.2 Configure an IP Addresses for the Interface 2.5.3 Configuring the VLAN Associated with the Sub-interface 2.5.4 Enabling Proxy ARP Within a VLAN 2.5.5 Checking the Configuration

If two users are in the same VLAN but they are isolated from each other, to ensure the two users can communicate, you need to enable proxy ARP within the VLAN on the interface associated with the VLAN.
Before configuring proxy ARP within a VLAN, complete the following tasks:
l
Configuring physical attributes for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the VLAN
Issue 02 (2009-12-10)
2 ARP Configuration
l
Configuring user isolation in the VLAN
Data Preparation
To configure proxy ARP within a VLAN, you need the following data. No. 1 2 3 Data Number of the interface to be enabled with proxy ARP in a VLAN IP address of the interface to be enabled with proxy ARP in a VLAN VLAN ID associated with the interface to be enabled with proxy ARP in a VLAN
2.5.2 Configure an IP Addresses for the Interface

Context
Procedure
Step 1 Run:
system-view

interface { gigabitethernet | eth-trunk } interface-number.sub-interface-number
The interface view is displayed. The interfaces supporting routed proxy ARP in a VLAN include GE sub-interfaces, and EthTrunk sub-interfaces. Step 3 Run:
The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the VLAN associated with this interface. ----End
2.5.3 Configuring the VLAN Associated with the Sub-interface

Context
NOTE
This step is required when you enable proxy ARP in a VLAN on the GE sub-interfaces, or Eth-Trunk subinterfaces.
2-16
Issue 02 (2009-12-10)
2 ARP Configuration
Do as follows on the router that uses sub-interfaces to implement interworking in a VLAN:
Procedure
Step 1 Run:
system-view

The sub-interface view is displayed. Step 3 Run:

vlan-type low-vid
The Ethernet sub-interface is encapsulated with 802.1Q and the VLAN ID associated with the sub-interface is configured. In the NE5000E, one sub-interface can be associated with one VLAN. By default, the sub-interface is not encapsulated and the associated VLAN ID is not configured. ----End
2.5.4 Enabling Proxy ARP Within a VLAN

Context
Procedure
Step 1 Run:
system-view


arp-proxy inner-sub-vlan-proxy enable
Proxy ARP within a VLAN is enabled. ----End

Prerequisite
The configurations of the proxy ARP within a VLAN function are complete.
2 ARP Configuration
Procedure
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask ] ] [ dynamic | static ] [ | { begin | exclude | include } regular-expression] command to check information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on VPN instances. Run the display arp statistics { all | slot slot-id } command to check statistics about ARP entries.
----End
Example
2-18
Issue 02 (2009-12-10)
2 ARP Configuration
2.6 Configuring Proxy ARP Between VLANs

This section describes how to implement communication between hosts in different VLANs. 2.6.1 Establishing the Configuration Task 2.6.2 Configuring an IP Addresses for the Interface 2.6.3 Configuring the VLAN Associated with the Sub-interface 2.6.4 Enabling Proxy ARP Between VLANs 2.6.5 Checking the Configuration

If two users belong to different VLANs and they need to communicate, you need to enable proxy ARP between VLANs on the sub-interface associated with the VLAN. IP addresses of hosts in a VLAN must be in the same network segment.
Before configuring proxy ARP between VLANs, complete the following tasks:
l
Configuring physical attributes for the interface and ensuring that the status of the physical layer of the interface is Up Configuring VLAN aggregation
Data Preparation
To configure proxy ARP between VLANs, you need the following data. No. 1 2 3 Data Number of the interface to be enabled with proxy ARP between VLANs IP address of the interface to be enabled with proxy ARP between VLANs VLAN ID associated with the interface to be enabled with proxy ARP between VLANs
2.6.2 Configuring an IP Addresses for the Interface

Context
2 ARP Configuration
Procedure
Step 1 Run:
system-view

interface { gigabitethernet } interface-number.sub-interface-number
The interface view is displayed. The interfaces supporting routed proxy ARP between VLANs include GE sub-interfaces, and Eth-Trunk sub-interfaces. Step 3 Run:
The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the VLAN associated with this interface. ----End
2.6.3 Configuring the VLAN Associated with the Sub-interface

Context
NOTE
This step is required when you enable proxy ARP between VLANs on the GE sub-interfaces, or Eth-Trunk sub-interfaces.
Do as follows on the router that uses sub-interfaces to implement interworking between VLANs:
Procedure
Step 1 Run:
system-view

The sub-interface view is displayed. Step 3 Run:

vlan-type low-vid
The Ethernet sub-interface is encapsulated with 802.1Q and the VLAN ID associated with the sub-interface is configured. In the NE5000E, one sub-interface can be associated with one VLAN. By default, the sub-interface is not encapsulated and the associated VLAN ID is not configured. ----End
2 ARP Configuration
2.6.4 Enabling Proxy ARP Between VLANs

Context
Procedure
Step 1 Run:
system-view

interface { gigabitethernet } interface-number.sub-interface-number
The interface view is displayed. The interfaces supporting routed proxy ARP between VLANs include Eth-Trunk sub-interfaces, and GE sub-interfaces. Step 3 Run:
arp-proxy inter-sub-vlan-proxy enable
Proxy ARP between VLANs is enabled. ----End

Prerequisite
The configurations of Proxy ARP Between VLANs are complete.
Procedure
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask ] ] [ dynamic | static ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] [ | { begin | exclude | include } regular-expression ] command to check information about ARP mapping tables based on VPN instances. Run the display arp statistics { all | slot slot-id } command to check statistics about ARP entries.
----End
Example
2 ARP Configuration
2.7 Configuring ARPing-IP

This section describes how to configure ARPing-IP. 2.7.1 Establishing the Configuration Task 2.7.2 Detecting the IP Address by Using the arp-ping ip Command

In the LAN, to configure an IP address for a device, you need to use the arp-ping ip command to check whether this IP address is used by another device in the network.
Before configuring ARPing-IP, complete the following tasks:

l
2 ARP Configuration
Configuring parameters of the link layer protocol and IP addresses for the interfaces and ensuring that the status of the link layer protocol on the interfaces is Up.
Data Preparation
To configure ARPing-IP, you need the following data. No. 1 Data IP address to be checked
2.7.2 Detecting the IP Address by Using the arp-ping ip Command

Context
Do as follows on the device:
Procedure
Step 1 Run:
arp-ping ip ip-address [ interface interface-type interface-number ]
Check whether the IP address is in use. The following information is displayed:

l
If the following information is displayed, it means that the IP address is not in use.
[HUAWEI] arp-ping ip 110.1.1.2 ARP-Pinging 110.1.1.2: Request timed out Request timed out Request timed out The IP address is not used by anyone!
If the following information is displayed, it means that the IP address is in use.

[HUAWEI] arp-ping ip 128.1.1.1 ARP-Pinging 128.1.1.1: 128.1.1.1 is used by 00e0-517d-f202
----End
2.8 Configuring ARPing-MAC

This section describes how to configure ARPing-MAC. 2.8.1 Establishing the Configuration Task 2.8.2 Detecting the MAC Address by Using the arp-ping mac Command
Issue 02 (2009-12-10)
2-23
2 ARP Configuration

To check whether a MAC address is in use or query the IP address through the MAC address, you can use the arp-ping mac command.
Before configuring ARPing-MAC, complete the following tasks:
l
Configuring parameters of the link layer protocol and IP addresses for the interfaces and ensuring that the status of the link layer protocol on the interfaces is Up.
Data Preparation
To configure ARPing-MAC, you need the following data. No. 1 Data MAC address to be checked
2.8.2 Detecting the MAC Address by Using the arp-ping mac Command
Context
Do as follows on the device:
Procedure
Step 1 Run:
arp-ping mac mac-address { ip-address [ vpn-instance vpn-instance-name ] | interface interface-type interface-number }
Check whether the MAC address is in use. Alternatively, you can query the IP address through the MAC address. The following information is displayed:
l
If the following information is displayed, it means that the MAC address is not in use.
[HUAWEI] arp-ping mac 00e0-517d-f201 interface gigabitethernet 1/0/0 OutInterface: GigabitEthernet1/0/0 MAC[00-E0-51-7D-F2-01], press CTRL_C to break Request timed out Request timed out Request timed out ----- ARP-Ping MAC statistics ----3 packet(s) transmitted 0 packet(s) received MAC[00-E0-51-7D-F2-01] not be used
If the following information is displayed, it means that the MAC address is in use.
2-24
2 ARP Configuration
[HUAWEI] arp-ping mac 00e0-517d-f202 interface gigabitethernet 1/0/0 OutInterface: GigabitEthernet1/0/0 MAC[00-E0-51-7D-F2-02], press CTRL_C to break ----- ARP-Ping MAC statistics ----1 packet(s) transmitted 1 packet(s) received IP ADDRESS MAC ADDRESS 128.1.1.1 00-E0-51-7D-F2-02
----End
2.9 Configuring the Association Between ARP and Interface Status

This section describes how to control the protocol status of the interface through ARP probes. 2.9.1 Establishing the Configuration Task 2.9.2 Configuring the Association Between ARP and Interface Status 2.9.3 (Optional) Adjusting Parameters about the Association Between ARP and Interface Status

If transmission devices exist over a link (between devices in the diagram), the actual physical path is segmented by the transmission devices although communication ends and transmission devices are directly connected at the network layer. In such a case, if the link or remote end fails, the local end must take a long time to detect the fault. To solve the preceding problem, configure the association between the Bidirectional Forwarding Detection (BFD) status and the interface status. For details, refer to the chapter "BFD Configuration" in the HUAWEI NetEngine5000E Core Router Configuration Guide Reliability. For the device that does not support the BFD function, the NE5000E provides the ARP and interface status association function so that local interfaces can correctly judge the forwarding status of the remote end and change its protocol status accordingly (Up or Down). Fast convergence of routes is thus triggered. Figure 2-3 Schematic diagram of transmission device existing between devices
RouterA
RouterB
Pre-configuration Task
Before configuring the association between ARP and interface status, complete the following tasks:
2 ARP Configuration
l
Configuring physical parameters for interfaces to make the physical statuses of interfaces Up. Configuring link layer parameters and IP addresses for interfaces to make the link protocol status of interfaces Up.
Data Preparation
To configure the association between ARP and interface status, you need the following data. No. 1 2 3 4 Data Destination IP address of an ARP probe packet Interval for sending ARP probe packets Maximum times that no response is received for the continually sent ARP probe packets before the protocol status of an interface turns Down Probe mode
2.9.2 Configuring the Association Between ARP and Interface Status

Context
Do as follows on the router to perform probes:
Procedure
Step 1 Run:
system-view

The view of the interface to be enabled with the association between ARP and interface status is displayed.
NOTE
The association between ARP and interface status can be configured only on Gigabit Ethernet interfaces, and Gigabit Ethernet sub-interfaces.
Step 3 Run:
arp status-detect ip-address
The association between ARP and interface status and the destination IP address of the probe are configured. The probed IP address must be the IP address of the directly-connected device. The device to be probed need not be configured. ----End
2 ARP Configuration
2.9.3 (Optional) Adjusting Parameters about the Association Between ARP and Interface Status
Context
Do as follows on the router to perform probes:
Procedure
Step 1 Run:
system-view

The view of the interface to be enabled with the association between ARP and interface status is displayed. Step 3 Run:
arp status-detect interval detect-interval
The interval for sending ARP probe packets is set. By default, the interval is 1000 ms. Step 4 Run:
arp status-detect times detect-times
The maximum times that no response is received for the continually sent ARP probe packets before the protocol status of an interface turns Down are set. By default, the maximum times are 3. Step 5 Run:
arp status-detect mode loose
The probe mode is set to loose. By default, the probe mode is strict.
l
In loose mode, probe packets are sent only when the protocol status turns Up. The remote end declares the protocol to be Up when receiving any types of legal ARP packets. In strict mode, probe packets are sent no matter the protocol status is Up or Down. The device declares the protocol to be Up only when receiving legal ARP response packets.
NOTE
When you configure ARP probe on both ends, configure the strict mode at least on one end. That is, two ends cannot be configured with the loose mode concurrently. .This is because when the interface on one end is Down, the protocol status of the remote end turns Down because of a timeout probe. If the probe mode is set to loose, both ends never send probe packets actively, which results in the deadlock state.
----End
Postrequisite
The device to be probed need not be configured.
2 ARP Configuration
2.10 Maintaining ARP

This section describes how to display ARP configurations, clear ARP statistics and debug ARP. 2.10.1 Clearing ARP Statistics 2.10.2 Monitoring Network Operation Status of ARP 2.10.3 Debugging ARP
2.10.1 Clearing ARP Statistics

Context
CAUTION
The mapping between the IP and MAC addresses is deleted after you clear ARP statistics. So, confirm the action before you use the command.
Procedure
Step 1 Run the reset arp { all | dynamic | interface interface-type interface-number | slot slot-id | static } command in the user view to clear the ARP entries in the ARP mapping table. ----End
2.10.2 Monitoring Network Operation Status of ARP

Context
In routine maintenance, you can run the following command in any view to check the operation of ARP.
Procedure
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] [ | { begin | exclude | include } regular-expression ] command in any view to check the information about the ARP mapping table based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask ] ] [ dynamic | static ] [ | { begin | exclude | include } regular-expression ] command in any view to check the information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] [ | { begin | exclude | include } regular-expression ] command in any view to check the information about ARP mapping tables based on VPN instances.
----End
2 ARP Configuration
2.10.3 Debugging ARP

Context
CAUTION
Debugging affects the performance of the system. Thus, after debugging, run the undo debugging all command to disable debugging immediately. When the CPU usage is close to 100%, debugging ARP may cause the board resetting. So, confirm the action before you use the command. When faults occur during ARP operation, run the following debugging command in the user view to debug ARP and locate the fault. For more information, see chapter "Information Center Configuration" in the HUAWEI NetEngine5000E Core Router Configuration Guide-System Management. For descriptions about the debugging commands, see the HUAWEI NetEngine5000E Core Router Debugging Reference.
Procedure
l l Run the debugging arp packet [ interface interface-type interface-number | slot slot-id ] command in the user view to debug ARP. Run the debugging arp-proxy [ inner-sub-vlan-proxy | inter-sub-vlan-proxy ] [ interface interface-type interface-number ] command in the user view to debug proxy ARP.
----End

This section provides some configurations example, such as Routed Proxy ARP, Proxy ARP Within a VLAN and Proxy ARP Between VLANs. 2.11.1 Example for Configuring Routed Proxy ARP 2.11.2 Example for Configuring Proxy ARP Within a VLAN 2.11.3 Example for Configuring the Association Between ARP and Interface Status
2.11.1 Example for Configuring Routed Proxy ARP
Issue 02 (2009-12-10)
2-29
2 ARP Configuration
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 2-4, two devices are connected through serial lines. Each device has a GE 1/0/0 interface connecting with a local network. The network segment of the two local networks is 172.16.0.0/16. No default gateways are specified for Host A and Host B. The device should be configured with proxy ARP, enabling hosts in two local networks to communicate with each other. Figure 2-4 Networking diagram of configuring proxy ARP 172.16.1.2/16 0000-5e33-ee20 GE1/0/0 172.16.1.1/24 RouterA 00e0-fc39-80aa POS2/0/0 172.17.3.1/24
Host A
172.16.2.2/16 0000-5e33-ee10
Host B
RouterB 172.16.2.1/24
POS2/0/0 172.17.3.2/24
GE1/0/0
00e0-fc39-80bb
Ethernet A
Ethernet B
The configuration roadmap is as follows: 1. 2. 3. Configure IP addresses for interfaces. Enable proxy ARP on interfaces. Configure the default routes.
Data Preparation
l l l
IP address for related interfaces Default routes IP address of the host
Procedure
Step 1 Configure Router A. # Configure an IP address for GE 1/0/0.
2 ARP Configuration
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 172.16.1.1 255.255.255.0
# Enable proxy ARP.

[RouterA-GigabitEthernet1/0/0] arp-proxy enable [RouterA-GigabitEthernet1/0/0] undo shutdown [RouterA-GigabitEthernet1/0/0] quit
# Configure a static route.

[RouterA] ip route-static 0.0.0.0 0 pos 2/0/0 172.17.3.2

[RouterA] interface pos 2/0/0 [RouterA-Pos2/0/0] ip address 172.17.3.1 255.255.0.0 [RouterA-Pos2/0/0] undo shutdown [RouterA-Pos2/0/0] quit
Step 2 Configure Router B. # Configure an IP address for GE 1/0/0.

<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] ip address 172.16.2.1 255.255.255.0
# Enable proxy ARP.

[RouterB-GigabitEthernet1/0/0] arp-proxy enable [RouterB-GigabitEthernet1/0/0] undo shutdown [RouterB-GigabitEthernet1/0/0] quit

[RouterB] ip route-static 0.0.0.0 0 pos 2/0/0 172.17.3.1

[RouterB] interface pos 2/0/0 [RouterB-Pos2/0/0] ip address 172.17.3.2 255.255.0.0 [RouterB-Pos2/0/0] undo shutdown [RouterB-Pos2/0/0] quit
Step 3 Configure the host. # Configure the IP address of Host A to 172.16.1.2/16. # Configure the IP address of Host B to 172.16.2.2/16. Step 4 Verify the configuration. # Host A can ping through Host B. # The ARP table of Host A shows that the MAC address of Host B is the MAC address of GE1/0/0 on Router A.
C:\Documents and Settings\Administrator> arp -a Interface: 172.16.1.2 --- 0x2 Internet Address Physical Address Type 172.16.2.2 00e0-fc39-80aa dynamic
----End
2 ARP Configuration
Configuration Files
l

# sysname RouterA # interface GigabitEthernet1/0/0 undo shutdown ip address 172.16.1.1 255.255.255.0 arp-proxy enable # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 172.17.3.1 255.255.255.0 # ip route-static 0.0.0.0 0 Pos2/0/0 172.17.3.2 # return

# sysname RouterB # interface GigabitEthernet1/0/0 undo shutdown ip address 172.16.2.1 255.255.255.0 arp-proxy enable # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 172.17.3.2 255.255.255.0 # ip route-static 0.0.0.0 0 Pos2/0/0 172.17.3.1 # return
2.11.2 Example for Configuring Proxy ARP Within a VLAN

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 2-5, DSLAM is connected to the sub-interface Eth-Trunk1.10 of the device. Eth-Trunk1.10 is associated with VLAN 10. PC A and PC B are two users connected with DSLAM. On DSLAM, the interfaces connected with PC A and PC B belong to the same VLAN. User isolation in a VLAN is configured on DSLAM. To implement communication between PC A and PC B, enable proxy ARP within a VLAN on Eth-Trunk1.10 of the device.
2 ARP Configuration
Figure 2-5 Networking diagram of configuring proxy ARP in a VLAN
Router
Eth-trunk 1.10(Proxy ARP) 100.1.1.12/24
DSLAM
PC A
PC B VLAN 10
The configuration roadmap is as follows: 1. 2. 3. Configure an IP addresses for Eth-Trunk1.10. Configure the VLAN associated with the sub-interface. Enable proxy ARP in a VLAN on Eth-Trunk1.10.
Data Preparation
l l
IP address of Eth-Trunk1.10 VLAN ID associated with Eth-Trunk1.10
Procedure
Step 1 Configure an IP address for Eth-Trunk1.10.
<HUAWEI> system-view [HUAWEI] sysname router [router] interface eth-trunk 1 [router-Eth-Trunk] undo shutdown [router-Eth-Trunk] quit [router] interface eth-trunk 1.10 [router-Eth-Trunk1.10] ip address 100.1.1.12 255.255.255.0 [router-Eth-Trunk1.10] undo shutdown [router-Eth-Trunk1.10] quit
Step 2 Configure IP addresses for PCs. # Configure IP addresses for PCs. The IP addresses must be in the same network segment with the IP address of Eth-Trunk1.10.
2 ARP Configuration
# After the configurations, PCs and the device can ping through each other but PCs cannot ping through each other. Step 3 Associate Eth-Trunk1.10 with VLAN 10.
[router] interface eth-trunk 1.10 [router-Eth-Trunk1.10] vlan-type dot1q 10
Step 4 Enable proxy ARP in VLAN 10 on Eth-Trunk1.10.

[router-Eth-Trunk1.10] arp-proxy inner-sub-vlan-proxy enable [router-Eth-Trunk1.10] quit
Step 5 Verify the configuration. # PC A and PC B can ping through each other. ----End
Configuration Files
The configuration file of the device is as follows:
# sysname router # interface Eth-Trunk1 undo shutdown mac-address 00e0-271e-f652 # interface Eth-Trunk1.10 undo shutdown vlan-type dot1q 10 ip address 100.1.1.12 255.255.255.0 arp-proxy inner-sub-vlan-proxy enable # return
2.11.3 Example for Configuring the Association Between ARP and Interface Status
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 2-6, two devices are connected through a Layer 2 switch. If a fault occurs on the GE interface of Router A but the GE interface of Router B is Up because the link between the switch and Router B works normally. The protocol status of the GE interface of Router B is also Up. It is required to configure the association between ARP and interface status on Router B to probe the status of the GE interface of Router A. Router B can then rapidly change its protocol status according to the interface status change of Router A.
2 ARP Configuration
Figure 2-6 Networking diagram of configuring the association between ARP and interface status
GE 1/0/0 10.1.1.1/24
GE 1/0/0 10.1.1.2/24
RouterA
Switch
RouterB
The configuration roadmap is as follows: 1. 2. 3. Configure an IP address for each interface. Enable the association between ARP and interface status on the interface. Adjust parameters about the association between ARP and interface status to optimize performance.
Data Preparation
l l l l
IP addresses of the interfaces Destination IP address of an ARP probe packet Interval for sending ARP probe packets Maximum times that no response is received for the continually sent ARP probe packets before the protocol of an interface turns Down
Procedure
Step 1 Configuring an IP address for each interface # Configure Router A.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 10.1.1.1 24 [RouterA-GigabitEthernet1/0/0] undo shutdown [RouterA-GigabitEthernet1/0/0] quit
# Configure Router B.
<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] ip address 10.1.1.2 24 [RouterB-GigabitEthernet1/0/0] undo shutdown [RouterB-GigabitEthernet1/0/0] quit
# Ping Router A on Router B. The ping succeeds. Run the display interface command on Router A and Router B to view statuses of the GE interfaces. You can find that the physical status and protocol status of the GE interfaces are Up.
[RouterB] ping 10.1.1.1 PING 10.1.1.1: 56 data bytes, press CTRL_C to break Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=255 time=110 ms
Issue 02 (2009-12-10)
2-35
2 ARP Configuration
Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=255 time=60 ms Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=255 time=100 ms Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=255 time=70 ms Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=255 time=70 ms --- 10.1.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 60/82/110 ms [RouterA] display interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2007-12-22, 16:52:54 Description : GigabitEthernet1/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1500 bytes Internet Address is 10.1.1.1/24 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0000-5e13-0101 The Vendor PN is SCP6F86-GL-CWH Port BW: 1G, Transceiver max BW: 1G, Transceiver Mode: MultiMode WaveLength: 850nm, Transmission Distance: 300m Rx Power: -8.00dBm, Tx Power: -5.13dBm Loopback:none, full-duplex mode, negotiation: disable, Pause Flowcontrol:Receive Enable and Send Enable Last physical up time : 2007-12-22, 16:52:54 Last physical down time : 2007-12-22, 16:52:54 Statistics last cleared:never Last 300 seconds input rate: 208 bits/sec, 0 packets/sec Last 300 seconds output rate: 544 bits/sec, 1 packets/sec Input: 882114 bytes, 10877 packets Output: 2147780 bytes, 31585 packets Input: Unicast: 0 packets, Multicast: 7368 packets Broadcast: 3509 packets, JumboOctets: 0 packets CRC: 0 packets, Symbol: 0 packets Overrun: 0 packets InRangeLength: 0 packets LongPacket: 0 packets, Jabber: 0 packets, Alignment: 0 packets Fragment: 0 packets, Undersized Frame: 0 packets RxPause: 0 packets Output: Unicast: 0 packets, Multicast: 0 packets Broadcast: 31585 packets, JumboOctets: 0 packets Lost: 0 packets, Overflow: 0 packets, Underrun: 0 packets TxPause: 0 packets [RouterB] display interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2007-12-22, 16:53:41 Description : GigabitEthernet1/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1500 bytes Internet Address is 10.1.1.2/24 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0000-5e13-0100 The Vendor PN is SCP6F86-GL-CWH Port BW: 1G, Transceiver max BW: 1G, Transceiver Mode: MultiMode WaveLength: 850nm, Transmission Distance: 300m Rx Power: -8.00dBm, Tx Power: -5.13dBm Loopback:none, full-duplex mode, negotiation: disable, Pause Flowcontrol:Receive Enable and Send Enable Last physical up time : 2007-12-22, 16:53:41 Last physical down time : 2007-12-22, 16:53:41 Statistics last cleared:never Last 300 seconds input rate: 208 bits/sec, 0 packets/sec Last 300 seconds output rate: 544 bits/sec, 1 packets/sec Input: 882114 bytes, 10877 packets Output: 2147780 bytes, 31585 packets Input: Unicast: 0 packets, Multicast: 7368 packets Broadcast: 3509 packets, JumboOctets: 0 packets CRC: 0 packets, Symbol: 0 packets
2-36
Issue 02 (2009-12-10)
2 ARP Configuration
Overrun: 0 packets InRangeLength: 0 packets LongPacket: 0 packets, Jabber: 0 packets, Alignment: 0 packets Fragment: 0 packets, Undersized Frame: 0 packets RxPause: 0 packets Output: Unicast: 0 packets, Multicast: 0 packets Broadcast: 31585 packets, JumboOctets: 0 packets Lost: 0 packets, Overflow: 0 packets, Underrun: 0 packets
Step 2 Run the shutdown command on the GE interface of Router A to simulate a fault.
[RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] shutdown
# Run the display interface command on Router B to view the status of the GE interfaces. You can find that the physical status and protocol status of the GE interfaces are Up. Router B, however, cannot ping through Router A.
[RouterB] display interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2007-12-22, 16:53:41 Description : GigabitEthernet1/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1500 bytes Internet Address is 10.1.1.2/24 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0000-5e13-0100 The Vendor PN is SCP6F86-GL-CWH Port BW: 1G, Transceiver max BW: 1G, Transceiver Mode: MultiMode WaveLength: 850nm, Transmission Distance: 300m Rx Power: -8.00dBm, Tx Power: -5.13dBm Loopback:none, full-duplex mode, negotiation: disable, Pause Flowcontrol:Receive Enable and Send Enable Last physical up time : 2007-12-22, 16:53:41 Last physical down time : 2007-12-22, 16:53:41 Statistics last cleared:never Last 300 seconds input rate: 208 bits/sec, 0 packets/sec Last 300 seconds output rate: 544 bits/sec, 1 packets/sec Input: 882114 bytes, 10877 packets Output: 2147780 bytes, 31585 packets Input: Unicast: 0 packets, Multicast: 7368 packets Broadcast: 3509 packets, JumboOctets: 0 packets CRC: 0 packets, Symbol: 0 packets Overrun: 0 packets InRangeLength: 0 packets LongPacket: 0 packets, Jabber: 0 packets, Alignment: 0 packets Fragment: 0 packets, Undersized Frame: 0 packets RxPause: 0 packets Output: Unicast: 0 packets, Multicast: 0 packets Broadcast: 31585 packets, JumboOctets: 0 packets Lost: 0 packets, Overflow: 0 packets, Underrun: 0 packets [RouterB] ping 10.1.1.1 PING 10.1.1.1: 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out --- 10.1.1.1 ping statistics --5 packet(s) transmitted 0 packet(s) received 100.00% packet loss
Step 3 Enable the association between ARP and interface status on Router B. # Specify the IP address of the GE interface of Router A as the destination IP address of the probe.
2 ARP Configuration
[RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] arp status-detect 10.1.1.1
Step 4 Adjust parameters about the association between ARP and interface status on Router B. # Set the interval for sending ARP probe packets to 3 seconds.
[RouterB-GigabitEthernet1/0/0] arp status-detect interval 3000
# Set the probe times to five.

[RouterB-GigabitEthernet1/0/0] arp status-detect times 5 [RouterB-GigabitEthernet1/0/0] quit
# After about 15 seconds (three seconds x five times), the GE interface status of Router B is Up and the protocol status turns Down.
[RouterB] Sep 16 2007 15:37:45 RouterB %%01IFNET/4/LINK_STATE(l): Line protocol on interfa ce GigabitEthernet1/0/0 has turned into DOWN state. [RouterB] display interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP Line protocol current state : DOWN Description : GigabitEthernet1/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1500 bytes Internet Address is 10.1.1.2/24 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0000-5e13-0100 The Vendor PN is SCP6F86-GL-CWH Port BW: 1G, Transceiver max BW: 1G, Transceiver Mode: MultiMode WaveLength: 850nm, Transmission Distance: 300m Rx Power: -8.00dBm, Tx Power: -5.13dBm Loopback:none, full-duplex mode, negotiation: disable, Pause Flowcontrol:Receive Enable and Send Enable Last physical up time : 2007-12-22, 16:54:41 Last physical down time : 2007-12-22, 16:53:41 Statistics last cleared:never Last 300 seconds input rate: 208 bits/sec, 0 packets/sec Last 300 seconds output rate: 544 bits/sec, 1 packets/sec Input: 882114 bytes, 10877 packets Output: 2147780 bytes, 31585 packets Input: Unicast: 0 packets, Multicast: 7368 packets Broadcast: 3509 packets, JumboOctets: 0 packets CRC: 0 packets, Symbol: 0 packets Overrun: 0 packets InRangeLength: 0 packets LongPacket: 0 packets, Jabber: 0 packets, Alignment: 0 packets Fragment: 0 packets, Undersized Frame: 0 packets RxPause: 0 packets Output: Unicast: 0 packets, Multicast: 0 packets Broadcast: 31585 packets, JumboOctets: 0 packets Lost: 0 packets, Overflow: 0 packets, Underrun: 0 packets
----End
Configuration Files
l

# sysname RouterA # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 # return
2-38
Issue 02 (2009-12-10)

l
2 ARP Configuration

# sysname RouterB # interface GigabitEthernet1/0/0 undo shutdown arp status-detect 10.1.1.1 arp status-detect times 5 arp status-detect interval 3000 ip address 10.1.1.2 255.255.255.0 # return
Issue 02 (2009-12-10)
2-39
3 DNS Configuration
3
About This Chapter
DNS Configuration
This chapter describes the static and dynamic DNS concepts and their configuration steps, along with typical examples. 3.1 DNS Overview This section describes the basic principle and concepts of Domain Name System (DNS). 3.2 Configuring DNS This section describes how to use the domain name to communicate with other devices. 3.3 Maintaining DNS This section describes how to clear DNS entries and debug DNS. 3.4 Configuration Examples This section provides a configuration example of DNS.
Issue 02 (2009-12-10)
3-1
3 DNS Configuration
3.1 DNS Overview

This section describes the basic principle and concepts of Domain Name System (DNS). 3.1.1 Introduction to DNS 3.1.2 DNS Supported by the NE5000E
3.1.1 Introduction to DNS

The Domain Name System (DNS) is a host naming mechanism provided by TCP/IP, with which hosts can be named in the form of character string. This system assumes a hierarchical naming structure. It designates a meaningful name for the device in the Internet and associates the name with the IP address through a domain name resolution server. In this manner, you can use domain names that are easy to remember instead of memorizing complex IP addresses.
3.1.2 DNS Supported by the NE5000E

DNS has two resolution modes: dynamic DNS resolution and static DNS resolution. To resolve a domain name, the system first uses static DNS resolution. If this mode fails, the system uses dynamic DNS resolution. To improve resolution efficiency, you can put common domain names in a static domain name resolution table. The NE5000E supports static resolution and dynamic resolution.
3.2 Configuring DNS

This section describes how to use the domain name to communicate with other devices. 3.2.1 Establishing the Configuration Task 3.2.2 Configuring Static DNS Entries 3.2.3 Configuring Dynamic DNS 3.2.4 Checking the Configuration

If local users accessing devices need to communicate with other devices by using domain names, you can configure DNS on the device. An DNS entry is an mapping between a domain name and an IP address. If local users communicate with other devices hardly through the domain name or if the DNS server is unavailable, configure static DNS. Prior to configuring static DNS, you must know the mapping between the domain name and the IP address. In case of a change in the mapping, you must modify the DNS entry manually.
3 DNS Configuration
You can configure dynamic DNS on the device if local users frequently use domain names for communicating with other devices and the DNS server is available.
Before configuring DNS, complete the following tasks:
l
Configuring physical attributes of the interface and ensuring that the physical layer status of the interface is Up Configuring parameters of the link layer protocol of the interface and ensuring that the link layer protocol status of the interface is Up Configuring routes between the local device and the DNS server Configuring the DNS server
l l
Data Preparation
To configure DNS, you need the following data. No. 1 2 3 Data Domain name and the corresponding IP address in a static DNS entry IP address of a DNS server Domain name or the domain name list of a dynamic DNS entry
3.2.2 Configuring Static DNS Entries

Context
You can configure a maximum of 50 static DNS entries. Do as follows on the router:
Procedure
Step 1 Run:
system-view

ip host host-name ip-address
The IP address corresponding to the host name is configured. A host name corresponds to only one IP address. When you configure an IP address for a host for several times, only the IP address configured at the latest is valid. To resolve several host names, repeat Step 2. ----End
3 DNS Configuration
3.2.3 Configuring Dynamic DNS

Context
Procedure
Step 1 Run:
system-view

dns resolve
Dynamic domain name resolution is enabled. Step 3 Run:

dns server ip-address
A DNS server is specified. Step 4 (Optional) Run:

dns server source-ip source-ip-address
The IP address of the local device is specified. The local device uses the specified IP address to communicate with the DNS server, which ensures communication security. Step 5 Run:
dns domain domain-name
The suffix of the domain name is added. ----End
Postrequisite
The system supports the configuration of a maximum of 6 domain name servers, 1 source address, and 10 domain name suffixes. To configure more than one domain name server, repeat Step 3. To configure more than one domain name suffix, repeat Step 5.

Prerequisite
The configurations of the DNS function are complete.
3 DNS Configuration
Procedure
l l l l Run the display ip host command to check the information about the static DNS entry table. Run the display dns server command to check the configurations about DNS servers. Run the display dns domain command to check the configurations about domain name suffixes. Run the display dns dynamic-host command to check the information about dynamic DNS entries in the domain name cache.
----End
Example
Run the display ip host command. If static DNS entries including the mappings between host names and IP addresses, are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ip host Host Age Flags hw 0 static gww 0 static Address 10.1.1.1 192.168.1.1
Run the display dns server command. If IP addresses of all domain servers are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns server IPv4 Dns Servers : Domain-server IpAddress 1 172.16.1.1 2 172.16.1.2 IPv6 Dns Servers : No configured servers.
Run the display dns domain command. If the list of suffixes of domain names is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns domain No Domain-name 1 com 2 net
Run the display dns dynamic-host command. If information about the dynamic domain name cache is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns dynamic-host No Domain-name IpAddress 1 www.huawei.com 91.1.1.1 2 www.huawei.com.cn 87.1.1.1 TTL 3521 3000 Alias
3.3 Maintaining DNS

This section describes how to clear DNS entries and debug DNS. 3.3.1 Clearing DNS Entries 3.3.2 Monitoring Network Operation Status of DNS 3.3.3 Debugging DNS
3 DNS Configuration
3.3.1 Clearing DNS Entries

Context
CAUTION
DNS entries cannot be restored after being cleared. So, confirm the action before you use this command.
Procedure
Step 1 Run the reset dns dynamic-host command in the user view to clear dynamic DNS entries statistics in the domain name cache. ----End
3.3.2 Monitoring Network Operation Status of DNS

Context
In routine maintenance, you can run the following command in any view to check the operation of DNS.
Procedure
l l l l Run the display ip host command to check the information about the static DNS entry table. Run the display dns server command to check configurations about DNS servers. Run the display dns domain command to check configurations about domain name suffixes. Run the display dns dynamic-host command to check the information about dynamic DNS entries in the domain name cache.
----End
3.3.3 Debugging DNS

Context
CAUTION
Debugging affects the performance of the system. So after debugging, run the undo debugging all command to disable it immediately. Run the following debugging command in the user view to debug DNS and locate the fault.
3 DNS Configuration
For more information, refer to the chapter "Information Center Configuration" in the HUAWEI NetEngine5000E Core Router Configuration Guide - System Management. For descriptions about the debugging commands, refer to the HUAWEI NetEngine5000E Core Router Debugging Reference.
Procedure
Step 1 Run the debugging dns command in the user view to debug dynamic DNS. ----End

This section provides a configuration example of DNS. 3.4.1 Example for Configuring DNS
3.4.1 Example for Configuring DNS

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 3-1, Router A acts as a DNS client, being required to access the host 2.1.1.3/16 by using the domain name huawei.com. You need to configure domain name suffixes "com" and "net". On Router A, configure static DNS entries of Router B and Router C so that Router A can communicate with them by using domain names. Figure 3-1 Networking diagram of DNS Loopback0 4.1.1.1/32 GE1/0/0 RouterB 1.1.1.2/16 Loopback0 4.1.1.2/32
RouterC
GE1/0/0 2.1.1.1/16
GE1/0/1 3.1.1.1/16 GE1/0/0 DNS Server 2.1.1.2/16 3.1.1.2/16
DNS Client RouterA
GE1/0/1 1.1.1.1/16
huawei.com
2.1.1.3/16
3 DNS Configuration
The configuration roadmap is as follows: 1. 2. 3. 4. Configure static DNS entries. Enable DNS resolution. Configure an IP address for the DNS server. Configure suffixes of domain names.
Data Preparation
l l l
Domain names of Router B and Router C IP address of the DNS server Suffixes of domain names
Procedure
Step 1 Configure Router A. # Configure static DNS entries.
<RouterA> system-view [RouterA] ip host RouterB 4.1.1.1 [RouterA] ip host RouterC 4.1.1.2
# Enable DNS resolution.

[RouterA] dns resolve
# Configure an IP address for the DNS server.

[RouterA] dns server 3.1.1.2
# Configure a domain name suffix "net".

[RouterA] dns domain net
# Configure a domain name suffix "com".

[RouterA] dns domain com [RouterA] quit
NOTE
To complete DNS resolution, configuring routes from Router A to the DNS server is mandatory. For procedures for configuring routes, refer to the NE5000E Core Router Configuration Guide - IP Routing.
Step 2 Verify the configuration. # Run the ping huawei command on Router A to ping the IP address 2.1.1.3. The ping succeeds.
<RouterA> ping huawei.com Trying DNS server (3.1.1.2) PING huawei.com (2.1.1.3): 56 Reply from 2.1.1.3: bytes=56 Reply from 2.1.1.3: bytes=56 Reply from 2.1.1.3: bytes=56 Reply from 2.1.1.3: bytes=56
data bytes, press CTRL_C to break Sequence=1 ttl=126 time=6 ms Sequence=2 ttl=126 time=4 ms Sequence=3 ttl=126 time=4 ms Sequence=4 ttl=126 time=4 ms
3-8
Issue 02 (2009-12-10)

Reply from 2.1.1.3: bytes=56 Sequence=5 ttl=126 time=4 ms --- huawei.com ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 4/4/6 ms
3 DNS Configuration
# Run the display ip host command on Router A to view static DNS entries, including mappings between host names and IP addresses.
<RouterA> display ip host Host Age RouterB 0 RouterC 0 Flags Address static 4.1.1.1 static 4.1.1.2
# Run the display dns dynamic-host command on Router A to view dynamic DNS entries in the domain name cache.
<RouterA> display dns dynamic-host No Domain-name IpAddress 1 huawei.com 2.1.1.3
NOTE
TTL 3579
Alias
TTL value in the above display indicates the lifetime of an entry. It is in seconds.
----End
Configuration Files
l

# sysname RouterA # ip host RouterB 4.1.1.1 ip host RouterC 4.1.1.2 # dns resolve dns server 3.1.1.2 dns domain net dns domain com # interface GigabitEthernet1/0/0 undo shutdown ip address 1.1.1.2 255.255.0.0 # rip 1 network 1.0.0.0 # return

# sysname RouterB # interface GigabitEthernet1/0/0 undo shutdown ip address 2.1.1.1 255.255.0.0 # interface GigabitEthernet1/0/1 undo shutdown ip address 1.1.1.1 255.255.0.0 # interface LoopBack0 ip address 4.1.1.1 255.255.255.255 # rip 1 network 2.0.0.0
Issue 02 (2009-12-10)
3-9
3 DNS Configuration
network 1.0.0.0 network 4.0.0.0 # return l

# sysname RouterC # interface GigabitEthernet1/0/0 undo shutdown ip address 2.1.1.2 255.255.0.0 # interface GigabitEthernet1/0/1 undo shutdown ip address 3.1.1.1 255.255.0.0 # interface LoopBack0 ip address 4.1.1.2 255.255.255.255 # rip 1 network 2.0.0.0 network 3.0.0.0 network 4.0.0.0 # return
3-10
Issue 02 (2009-12-10)
4
About This Chapter
DHCP Configuration
This chapter describes the DHCP fundamentals including DHCP service, DHCP server, and relay agent. It also includes configuration steps for DHCP Server based on different parameters, DHCP relay agent, and security functions in DHCP service, along with typical examples. 4.1 DHCP Overview This section describes the principle and concepts of Dynamic Host Configuration Protocol (DHCP). 4.2 Configuring the Global Address Pool-based DHCP Server If a large number of clients need to be assigned with IP addresses, a global address pool-based DHCP server is usually configured on the network segment where the clients reside. Configuring a relay agent on the same network segment to forward packets between the clients and DHCP servers is an alternative method of configuring a global address pool-based DHCP server. In this manner, the communications between the clients and DHCP servers on other network segments can be realized. This saves bandwidths and facilitates the centralized management of IP addresses by the DHCP server. 4.3 Configuring the Interface Address Pool-based DHCP Server If a few clients need to be assigned with IP addresses, an interface address pool-based DHCP server is usually configured on the network segment where the clients reside. 4.4 Configuring the Sub-interface Address Pool-based DHCP Server This section describes how to assign IP addresses by using address pools on Ethernet subinterfaces to reduce repeated configurations. 4.5 Configuring the Security Function for DHCP This section describes how to enhance the security of the DHCP service. 4.6 Configuring DHCP Relay This section describes how to enable DHCP relay so that DHCP relay can forward DHCP requests from local clients to the DHCP server on other networks. 4.7 Maintaining DHCP This section describes how to clear the statistics about DHCP and debug DHCP. 4.8 Configuration Examples
This section provides several configuration examples of the DHCP server and DHCP relay.
4-2
Issue 02 (2009-12-10)
4.1 DHCP Overview

This section describes the principle and concepts of Dynamic Host Configuration Protocol (DHCP). 4.1.1 Introduction to DHCP 4.1.2 DHCP Supported by the NE5000E
4.1.1 Introduction to DHCP

With the rapid growth in network scale and complexity, network configuration becomes more difficult. The location of hosts changes (such as laptops and wireless network) and the number of hosts has exceeded that of the available IP addresses. The Dynamic Host Configuration Protocol (DHCP) is developed to solve these problems.
4.1.2 DHCP Supported by the NE5000E

The NE5000E supports the following DHCP applications, ensures the security of DHCP services, and provides the DHCP relay agent function.
l l
Global address pool Address pool on the physical interface

NOTE
The NE5000E supports the configuration of the DHCP address pools containing the IP addresses with 31bit masks. This configuration, however, is not recommended because the IP addresses with 31-bit masks currently cannot be assigned to users.
4.2 Configuring the Global Address Pool-based DHCP Server

If a large number of clients need to be assigned with IP addresses, a global address pool-based DHCP server is usually configured on the network segment where the clients reside. Configuring a relay agent on the same network segment to forward packets between the clients and DHCP servers is an alternative method of configuring a global address pool-based DHCP server. In this manner, the communications between the clients and DHCP servers on other network segments can be realized. This saves bandwidths and facilitates the centralized management of IP addresses by the DHCP server. 4.2.1 Establishing the Configuration Task 4.2.2 Configuring the DHCP Global Address Pool 4.2.3 Configure Static IP Address Binding 4.2.4 Configuring DNS Services for the DHCP Client 4.2.5 Configuring NetBIOS Services for the DHCP Client 4.2.6 Configuring Egress Gateway for the DHCP Client
4.2.7 Configuring DHCP Self-Defined Options 4.2.8 Assigning IP Addresses in the Global Address Pool to the DHCP Clients on the Specified Interface 4.2.9 Checking the Configuration

In a large network, hosts in the network may not be directly connected with the device through Ethernet interfaces. To obtain IP addresses from the device dynamically, you need to configure a global address pool-based DHCP server. The global address pool-based DHCP server usually works together with the DHCP relay agent.
Before configuring the global address pool-based DHCP server, complete the following tasks:
l l l l l
Configuring the interface of the device Configuring the egress gateway for the client (Optional) Configuring the DNS server (Optional) Configuring the NetBIOS server (If the DNS server and the NetBIOS server are not configured, you do not need to configure the routes.) Configuring the routes to the DNS server and the NetBIOS server (Optional) Configuring the DHCP customized option
Data Preparation
To configure the global address pool-based DHCP server, you need the following data. No. 1 2 3 4 5 6 7 Data Name and the address range of the address pool, which is configured based on the number of clients Range of the IP addresses that cannot be dynamically assigned to hosts IP addresses and the MAC addresses that need to be bound statically Lease of the IP address (Optional) IP address of the DNS server and the domain name of the DHCP client (Optional) IP address of the NetBIOS server and the NetBIOS node type of the DHCP client (Optional) Coding of the DHCP self-defined options and the corresponding ASCII strings or hexadecimal number or IP address
4-4
Issue 02 (2009-12-10)
4.2.2 Configuring the DHCP Global Address Pool

Context
Procedure
Step 1 Run:
system-view

dhcp enable
DHCP is enabled. Step 3 Run:

dhcp server ip-pool pool-name
A DHCP address pool is created and the DHCP address pool view is displayed.
NOTE
Each DHCP server can be configured with a maximum of 128 global address pools.
Step 4 Run:
network ip-address [ mask { mask | mask-length } ]
The address pool range is configured.

NOTE
Currently, an address pool can be configured with only one address segment and the address range is set through the mask. NE5000E supports the configuration of the DHCP address pools containing the IP addresses with 31-bit masks. This configuration, however, is not recommended because the IP addresses with 31-bit masks currently cannot be assigned to users.
Step 5 Run:
expired { day day [ hour hour [ minute minute ] ] | unlimited }
The lease of the IP addresses dynamically assigned to hosts is configured. By default, the IP lease is one day.
NOTE
The DHCP server can specify the IP lease for each address pool. The IP lease may vary with address pools. The addresses in the same DHCP address pool, however, have the same IP lease.
Step 6 Run:
quit
Back to the system view. Step 7 Run:

dhcp server forbidden-ip start-ip-address [ end-ip-address ]
The range of IP addresses that cannot be dynamically assigned is configured.

NOTE
After repeatedly running the dhcp server forbidden-ip command, you can configure multiple IP address segments that cannot be automatically assigned. When using the undo dhcp server forbidden-ip command to delete the setting, ensure that the specified parameters are consistent with the previously configured parameters. That is, you cannot delete only partial originally configured addresses.
----End
4.2.3 Configure Static IP Address Binding

Context
Based on the clients' needs, you can adopt either static address binding or dynamic address assignation. However, you cannot configure the same DHCP address pool with these two modes at the same time. Dynamic address distribution needs specification of the address range for assignment, while static address binding can be regarded as a special DHCP address pool with only one address. Do as follows on the router:
Procedure
Step 1 Run:
system-view

A DHCP address pool is created and the DHCP address pool view is displayed. Step 3 Run:
static-bind ip-address ip-address [ mask { mask | mask-length } ]
Certain IP addresses are statically bound.

NOTE
The NE5000E supports the statically bound address pools to be assigned the IP addresses with 31-bit masks. This configuration, however, is not recommended because the IP addresses with 31-bit masks currently cannot be assigned to users.
Step 4 Run:
static-bind mac-address mac-address
MAC addresses of certain clients are statically bound. ----End
Postrequisite
Some clients may need fixed IP addresses that are bound with their MAC addresses. When the client with a specific MAC address uses DHCP to apply for an IP address, the DHCP server finds out the fixed IP address bound with the MAC address and assigns it to the client.

NOTE
The static-bind ip-address command must be used together with the static-bind mac-address command. The new configuration supersedes the previous one when you use the two commands for several times
4.2.4 Configuring DNS Services for the DHCP Client

Context
The configurition is optional. Do as follows on the router:
Procedure
Step 1 Run:
system-view

The DHCP address pool view is displayed. Step 3 Run:

domain-name domain-name
The domain name of the DHCP client is configured. Step 4 Run:

dns-list ip-address &<1-8>
The IP address of the DNS server of the DHCP client is configured. ----End
Postrequisite
On the DHCP server, designate a domain name for the client per address pool basis. When a host accesses the Internet by using the domain name, the DNS server resolves the domain name into an IP address. Therefore, to ensure that the client can successfully access the Internet, the DHCP server also needs to specify the DNS server address for the client when it assigns IP addresses. To perform load balancing and improve the network reliability, you can configure several DNS servers and egress gateways.
4.2.5 Configuring NetBIOS Services for the DHCP Client

Context
Procedure
Step 1 Run:
system-view


nbns-list ip-address &<1-8>
The IP address of the NetBIOS server of the DHCP client is configured. Step 4 Run:
netbios-type { b-node | h-node | m-node | p-node }
The NetBIOS node type of the DHCP client is configured. By default, the node type of the DHCP client is not specified. ----End
Postrequisite
For the client using the OS of Microsoft, Windows Internet Naming Service (WINS) server provides resolution from the host name to the IP address. This is given to the host that uses NetBIOS protocol for communication. Most of the Windows clients need to be configured with WINS. When a DHCP client communicates in a WAN by adopting the NetBIOS protocol, a mapping between the host name and the IP address should be set up. The following lists the types of NetBIOS nodes for obtaining mappings:
l
Type b nodes (b-node): "b" stands for broadcast; that is, type b nodes obtain the mapping relation by means of broadcast. Type p nodes (p-node): "p" stands for peer-to-peer, namely, type p nodes obtain the mapping relation by means of communicating with NetBIOS servers. Type m nodes (m-node): "m" stands for mixed. Type m nodes are the type p nodes owning part of the broadcasting features. Type h nodes (h-node): "h" stands for hybrid. Type h nodes are type b nodes owning the "peer-to-peer" communicating mechanism.
4.2.6 Configuring Egress Gateway for the DHCP Client

Context
Procedure
Step 1 Run:

system-view


gateway-list ip-address &<1-8>
The egress gateway of the DHCP client is configured. When a DHCP client wants to access a server (or host) that is not on the local network, an egress gateway needs to be configured on the local network. To perform load balancing and improve the network reliability, you can configure several DNS servers and egress gateways. ----End
4.2.7 Configuring DHCP Self-Defined Options

Context
NOTE
Configuring DHCP self-defined options are optional. Services, such as DNS on the client, NETBIOS, and IP lease cannot be configured through this command but through the commands early mentioned.
Procedure
Step 1 Run:
system-view


option code { ascii ascii-string | hex hex-string | ip-address ip-address &<1-8> }
The DHCP self-defined options are configured. ----End
Postrequisite
The Option field in DHCP packets carries the control information and parameters that are not defined in some common protocols. If the DHCP server is configured with Option, the DHCP client gets the configuration information saved in the Option filed of DHCP response packets. You need to add the options to the attribute tables of the DHCP servers. For example,
l
To configure the IP address of a log server to 10.110.204.1, use the command option 7 ipaddress 10.110.204.1. To configure the TTL of the client packet to 64, use the command option 23 hex 40.
NOTE
Using the option command, you can specify the options to be included in the DHCP response packets. Before using this command, you need to know the function of each option: Option 77 identifies user types or applications of DHCP client. Based on User Class in the Option field, the DHCP server selects the proper address pool and configuration parameters. Option77 usually is configured on the client.
4.2.8 Assigning IP Addresses in the Global Address Pool to the DHCP Clients on the Specified Interface
Context
Procedure
l Assigning IP addresses to the clients on the current interface 1. Run:
system-view
The system view is displayed. 2. Perform the following as required.
Run:
The interface view is displayed.
Run:
interface gigabitethernet interface-number.sub-interface-number
The sub-interface view is displayed. 3. Run:

dhcp select global
The IP addresses in the global address pool are assigned.

NOTE
For the DHCP implementation on the NE5000E, the address pool specified for the Ethernet sub-interface is applied to allocating IP addresses for users in the VLAN.
Assigning IP addresses to the clients on multiple interfaces 1. Run:

system-view
The system view is displayed. 2. Perform the following as required to specify a global address pool:
Run:
dhcp select global interface interface-type interface-number
The global address pool is specified for an interface.

Run:
dhcp select global interface gigabitethernet interface-number.subinterface-number1 [ to gigabitethernet interface-number.sub-interfacenumber2 ]
The global address pool is specified for multiple Ethernet sub-interfaces.

NOTE
If multiple Ethernet sub-interfaces are specified, all sub-interfaces must be on the same physical interface.
Run:
dhcp select global all
The global address pool is specified for all interfaces. This command is used to specify a global address pool for all the GE interface, and GE sub-interfaces that are configured with IP addresses. ----End

Prerequisite
The configurations of the global address pool-based DHCP server are complete.
Procedure
l l Run the display dhcp server free-ip command to check the available address information in the DHCP address pool. Run the display dhcp server expired { all | interface [ interface-type interface-number ] | ip ip-address | pool [ pool-name ] } command to check the expired lease in the DHCP address pool. Run the display dhcp server ip-in-use { all | interface [ interface-type interfacenumber ] | ip ip-address | pool [ pool-name ] } command to check the address binding information. Run the display dhcp server statistics command to check the statistics of DHCP server. Run the display dhcp server tree { all | interface [ interface-type interface-number ] | pool [ pool-name ] } command to check the information on the tree-structure of the DHCP address pool.
l l
----End
Example
Run the display dhcp server free-ip command. If there are unused IP addresses in the address pool, it means that the configuration succeeds.
<HUAWEI> IP Range IP Range IP Range display dhcp server free-ip from 5.5.5.1 to from 202.38.160.1 to from 202.38.160.4 to 5.5.5.254 202.38.160.1 202.38.160.126
Run the display dhcp server expired command. If information about the expired leases of IP addresses in DHCP address pools is displayed, it means that the configuration succeeds.
<HUAWEI> display dhcp server expired all Global pool:
Issue 02 (2009-12-10)
4-11
IP address Hardware address 2.2.2.2 44444-4444-4444 Interface pool: IP address Hardware address

Lease expiration NOT Used Lease expiration Type Manual Type
Run the display dhcp server ip-in-use command. If the binding information of IP address, such as the hardware address and the IP lease, is displayed, it means that the configuration succeeds.
<HUAWEI> display dhcp server ip-in-use all Global pool: IP address Hardware address Lease expiration 2.2.2.2 4444-4444-4444 NOT Used Interface pool: IP address Hardware address Lease expiration 5.5.5.1 0050-ba28-930a Jul 5 2006 13: 00:10 PM
Type Manual Type Auto:COMMITED
Run the display dhcp server statistics command. If statistics of the DHCP server, including the number of DHCP address pools, the number of the automatic binding, the manual binding and the expired binding and the number of DHCP packets is displayed, it means that the configuration succeeds.
<HUAWEI> display dhcp Global Pool: Pool Number: Binding Auto: Manual: Expire: Interface Pool: Pool Number: Binding Auto: Manual: Expire: Boot Request: Dhcp Discover: Dhcp Request: Dhcp Decline: Dhcp Release: Dhcp Inform: Boot Reply: Dhcp Offer: Dhcp Ack: Dhcp Nak: Bad Messages: HA Message: BatchBackup send BatchBackup recv BatchBackup send BatchBackup recv server statistics 5 0 1 0 1 1 0 0 6 1 4 0 1 0 4 1 3 0 0 msg: msg: lease: lease: 0 0 0 0
Run the display dhcp server tree command. If the tree structure of the DHCP address pool, including DNS, the IP lease and Option parameters, is displayed, it means that the configuration succeeds.
<HUAWEI> display dhcp server tree all Global pool: Pool name: 5 network 10.10.1.0 255.255.255.0 Child node:6 Sibling node:7 option 1 ip-address 255.0.0.0 expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C Pool name: 6 host 10.10.1.2 255.0.0.0 hardware-address 1111.2222.3333 gigabitethernet Parent node:5 option 1 ip-address 255.255.0.0
4-12
Issue 02 (2009-12-10)

expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C Interface pool: Pool name: GigabitEthernet11/2/0 network 5.5.5.0 mask 255.255.255.0 option 1 ip-address 255.255.255.0 gateway-list 5.5.5.5 expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C
4.3 Configuring the Interface Address Pool-based DHCP Server

If a few clients need to be assigned with IP addresses, an interface address pool-based DHCP server is usually configured on the network segment where the clients reside. 4.3.1 Establishing the Configuration Task 4.3.2 Configuring the Interface Address Pool 4.3.3 Configuring DNS on the Interface Address Pool 4.3.4 Configuring NetBIOS on the Interface Address Pool 4.3.5 Configuring DHCP Self-Defined Options 4.3.6 Checking the Configuration

In a small network, some hosts are connected to a device through the Ethernet interface. You can configure the DHCP server on the Ethernet interface of the device. This will enable the hosts to obtain IP addresses from the router dynamically. For the interface address pool-based DHCP server, single address pool and egress gateway need not be configured. After you configure an IP address on the Ethernet interface of the device, all the addresses of the network segment which this IP address is on are assignable and this IP address is also the address of the egress gateway of this network segment.
Before configuring the interface address pool-based DHCP server, complete the following tasks:
l l l l
Configuring the Ethernet interface of the device (Optional) Configuring the DNS server (Optional) Configuring the NetBIOS server (If the DNS server and the NetBIOS server are not configured, you do not need to configure the routes.) Configuring the routes to the DNS server and the NetBIOS server (Optional) Configuring the DHCP customized option
Issue 02 (2009-12-10)
Data Preparation
To configure the interface address pool-based DHCP server, you need the following data. No. 1 2 3 4 5 6 Data Number, IP address and the subnet mask of the Ethernet interface of the device IP addresses and the MAC addresses that need to be bound statically Lease of the IP address (It can be some days, hours, or minutes) (Optional) IP address of the DNS server and the domain name of the DHCP client (Optional) IP address of the NetBIOS server and the NetBIOS node type of the DHCP client (Optional) Coding of the DHCP self-defined options and the corresponding ASCII strings or hexadecimal number or IP address
4.3.2 Configuring the Interface Address Pool

Context
Procedure
Step 1 Run:
system-view

dhcp enable

The Ethernet interface view is displayed. Step 4 Run:

The IP address of the interface is configured. The address pool on an interface actually is the network segment to which the interface belongs, and such an interface address pool takes effect only on this interface.
4-14
Issue 02 (2009-12-10)

NOTE
You can configure address pools on GE interfaces, GE sub-interfaces, Eth-Trunk interfaces,NE5000E supports the address pools on these interfaces to be assigned the IP addresses with 31-bit masks. This configuration, however, is not recommended because the IP addresses with 31-bit masks currently cannot be assigned to users.
Step 5 Run:
dhcp select interface
The interface address pool is enabled. Step 6 Run:

dhcp server static-bind ip-address ip-address mac-address mac-address
Certain IP addresses and MAC addresses are bound with the address pool. Step 7 Perform the following as required.
l
To configure the IP lease, run:

dhcp server expired { day day [ hour hour [ minute minute ] ] | unlimited }
By default, the IP lease is one day.

l
To configure the IP lease of an interface, run the quit command to return to the system view. Then run:
dhcp server expired { day day [ hour hour [ minute minute ] ] | unlimited } interface interface-type interface-number
The lease of the IP address of an interface is configured. By default, the IP lease is one day. ----End
Postrequisite
The interface address pool has a higher priority than the global address pool. If an address pool is configured on an interface, clients obtain IP addresses preferentially from the interface address pool though a global address pool is configured. Similarly, although a global address pool and the IP lease have been configured on a device and clients have obtained IP addresses from the global address pool, the leases of IP addresses in the global address pool are deleted once the interfaces connecting the device to the clients are configured with address pools in the same network segment with the global address pool. Then after the leases of the IP addresses obtained from the global address pool expire, the clients obtain IP addresses preferentially from the interface address pool.
4.3.3 Configuring DNS on the Interface Address Pool

Context
Procedure
Step 1 Run:
system-view


dhcp server domain-name domain-name
The domain name of the DHCP client is configured. Step 4 Run:

dhcp server dns-list ip-address &<1-8>
The IP address of the DNS server is specified for the DHCP client. ----End
4.3.4 Configuring NetBIOS on the Interface Address Pool

Context
Procedure
Step 1 Run:
system-view


dhcp server nbns-list ip-address &<1-8>
The IP address of the NetBIOS server is specified for the DHCP client. Step 4 Run:
dhcp server netbios-type { b-node | h-node | m-node | p-node }
The NetBIOS node type of the DHCP client is configured. By default, the NetBIOS node type is not specified for the DHCP client. ----End
Postrequisite
For the client using the OS of Microsoft, WINS server provides the resolution from the host name to the IP address for the host that uses the NetBIOS protocol to communicate. In this way, most of the Windows network clients need to be configured with WINS. When a DHCP client communicates in a WAN, by adopting NetBIOS protocol, a mapping between the host name and the IP address should be set. The types of NetBIOS nodes for obtaining mappings are as follows:
l
Type b nodes (b-node): "b" stands for broadcast; that is, type b nodes obtain the mapping relation by means of broadcast. Type p nodes (p-node): "p" stands for peer-to-peer; that is, type p nodes obtain the mapping relation by means of communicating with NetBIOS servers. Type m nodes (m-node): "m" stands for mixed. Type m nodes are the type p nodes owning part of the broadcasting features. Type h nodes (h-node): "h" stands for hybrid. Type h nodes are type b nodes owning the "peer-to-peer" communicating mechanism.
4.3.5 Configuring DHCP Self-Defined Options

Context
NOTE
Configuring DHCP self-defined options is optional. Services, such as DNS on the client, NETBIOS and IP lease cannot be configured through this command but through the related command described above.
Procedure
Step 1 Run:
system-view


dhcp server option code { ascii ascii-string | hex hex-string | ip-address ipaddress &<1-8> }
Postrequisite
The Option field in DHCP packets carries the control information and parameters that are not defined in some common protocols. If the DHCP server is configured with Option, the DHCP client gets the configuration information saved in Option filed of DHCP response packets.
You can add new options to the attribute list of the DHCP server by manual definition. For example,
l
To configure the IP address of the log server to 10.110.204.1, run the dhcp server option 7 ip-address 10.110.204.1 command. To configure the TTL of the client packet to 64, run the dhcp server option 23 hex 40 command.

Prerequisite
The configurations of the interface address pool-based DHCP server are complete.
Procedure
l l
----End
Example
<HUAWEI> display dhcp server expired all Global pool: IP address Hardware address Lease expiration 2.2.2.2 44444-4444-4444 NOT Used Interface pool: IP address Hardware address Lease expiration
Type Manual Type
<HUAWEI> display dhcp server ip-in-use all Global pool: IP address Hardware address Lease expiration 2.2.2.2 4444-4444-4444 NOT Used
Type Manual
4-18
Issue 02 (2009-12-10)

Interface pool: IP address Hardware address 5.5.5.1 0050-ba28-930a Jul
Lease expiration 5 2006 13: 00:10 PM
Type Auto:COMMITED
<HUAWEI> display dhcp server tree all Global pool: Pool name: 5 network 10.10.1.0 255.255.255.0 Child node:6 Sibling node:7 option 1 ip-address 255.0.0.0 expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C Pool name: 6 host 10.10.1.2 255.0.0.0 hardware-address 1111.2222.3333 gigabitethernet Parent node:5 option 1 ip-address 255.255.0.0 expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C Interface pool: Pool name: GigabitEthernet11/2/0 network 5.5.5.0 mask 255.255.255.0 option 1 ip-address 255.255.255.0 gateway-list 5.5.5.5 expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C
Issue 02 (2009-12-10)
4-19
4.4 Configuring the Sub-interface Address Pool-based DHCP Server

This section describes how to assign IP addresses by using address pools on Ethernet subinterfaces to reduce repeated configurations. 4.4.1 Establishing the Configuration Task 4.4.2 Enabling Address Pools on Sub-interfaces 4.4.3 Configuring Address Pools on Ethernet Sub-interfaces 4.4.4 Configuring DNS on Address Pools of Sub-interfaces 4.4.5 Configuring NetBIOS on Address Pools of Sub-interfaces 4.4.6 Configuring the DHCP Self-Defined Options for Address Pools of Sub-interfaces 4.4.7 Checking the Configuration

For the interface address pool-based DHCP server, single address pool and egress gateway need not be configured. After you configure an IP address on the Ethernet interface of the device, all the addresses of the network segment which this IP address is on are assignable and this IP address is also the address of the egress gateway of this network segment. In the NE5000E, Ethernet sub-interfaces are applied only to implementing communication between different VLANs. Therefore, to configure a DHCP server that is based on the address pool on the Ethernet sub-interface, encapsulate the sub-interface with 802.1Q first.
Before configuring the sub-interface address pool-based DHCP server, complete the following tasks:
l l l l
Configuring the Ethernet sub-interfaces of the device (Optional) Configuring the DNS server (Optional) Configuring the NetBIOS server (If the DNS server and the NetBIOS server are not configured, you do not need to configure the routes.) Configuring the routes to the DNS server and the NetBIOS server (Optional) Configuring the DHCP customized option
Data Preparation
To configure the sub-interface address pool-based DHCP server, you need the following data.
4-20
Issue 02 (2009-12-10)
No. 1 2 3 4 5 6
Data Number, IP address and the subnet mask of the Ethernet sub-interface of the device IP addresses and the MAC addresses that need to be bound statically Lease of the IP address (It can be some days, hours, or minutes) (Optional) IP address of the DNS server and the domain name of the DHCP client (Optional) IP address of the NetBIOS server and the NetBIOS node type of the DHCP client (Optional) Coding of the DHCP self-defined options and the corresponding ASCII strings or hexadecimal number or IP address
4.4.2 Enabling Address Pools on Sub-interfaces

Context
Do as follows on the DHCP server:
Procedure
l Enabling address pools in the sub-interface view 1. Run:
system-view
The system view is displayed. 2. Run:

interface interface-type interface-number.sub-interface-number
The Ethernet sub-interface view is displayed. 3. Run:

The IP address of the Ethernet sub-interface is displayed. 4. Run:

dhcp select interface
The address pool on the sub-interface is enabled to allocate IP addresses to clients. l Enabling address pools on one sub-interface or multiple sub-interfaces in the system view 1. Run:
system-view
The system view is displayed. 2. Perform the following as required:
Run:
dhcp select interface interface interface-type interface-number.subinterface-number
Issue 02 (2009-12-10)
4-21
The address pool on one sub-interface is enabled to allocate IP addresses to clients.
Run:
dhcp select interface interface interface-type interface-number.subinterface-number1 to interface-type interface-number.sub-interfacenumber2
The address pools on multiple sub-interfaces are enabled to allocate IP addresses to clients.
NOTE
Before configuring this command, you need to create sub-interfaces and configure IP addresses for them. Running this command in the system view equals configuring the dhcp select interface command in each sub-interface view.
----End
4.4.3 Configuring Address Pools on Ethernet Sub-interfaces

Context
Procedure
Step 1 Run:
system-view

dhcp enable

The Ethernet sub-interface view is displayed. Step 4 Run:

vlan-type vlan-id1
The sub-interface is encapsulated with 802.1Q. Step 5 Run:

dhcp server static-bind ip-address ip-address mac-address mac-address
Certain IP addresses and MAC addresses are bound with the address pool. Step 6 The following steps are optional, so perform them as required. Run:
dhcp server expired { day day [ hour hour [ minute minute ] ] | unlimited }
The IP lease of the sub-interface is configured. By default, the IP lease is one day. Or
Run:
quit
Return to the system view. Run:

dhcp server expired { day day [ hour hour [ minute minute ] ] | unlimited } { interface interface-type interface-number.sub-interface-number1 [ to interfacetype interface-number.sub-interface-number2 ] | all }
The leases of the IP addresses of several sub-interfaces are configured. By default, the IP lease is one day. ----End
Postrequisite
The IP address and its mask of the Ethernet sub-interface determine the range of the sub-interface address pool. If you need to configure the address pool for multiple Ethernet sub-interfaces, repeat Steps 3, 4, 5, and 6.
4.4.4 Configuring DNS on Address Pools of Sub-interfaces

Context
The configurition is optional. Do as follows on the DHCP server:
Procedure
l Configuring DNS on sub-interfaces 1. Run:
system-view

The Ethernet sub-interface view is displayed. 3. Run:

dhcp server domain-name domain-name
Domain names are configured for the clients of the sub-interface. 4. Run:
dhcp server dns-list ip-address &<1-8>
The IP address of the DNS server is specified for the clients of the sub-interface. l Configuring DNS on one or multiple sub-interfaces 1. Run:
system-view

2.
Run:
dhcp server domain-name domain-name { all | interface interface-type interface-number sub-interface-number1 [ to interface-type interfacenumber.sub-interface-number2 ] }
The domain name of the DHCP client is configured. 3. Run:

dhcp server dns-list ip-address &<1-8> { all | interface interface-type interface-number sub-interface-number1 [ to interface-type interfacenumber.sub-interface-number2 ] }
The IP address of the DNS server is specified for the DHCP client. ----End
4.4.5 Configuring NetBIOS on Address Pools of Sub-interfaces

Context
The configurition is optional. Do as follows on the DHCP server:
Procedure
l Configuring NetBIOS on sub-interfaces 1. Run:
system-view

The sub-interface view is displayed. 3. Run:

dhcp server nbns-list ip-address &<1-8>
The IP address of the NetBIOS server is specified for the DHCP clients of the subinterface. 4. Run:
dhcp server netbios-type { b-node | h-node | m-node | p-node }
The NetBIOS node type is specified for the DHCP clients of the sub-interface. l Configuring NetBIOS on one or multiple sub-interfaces 1. Run:
system-view

dhcp server nbns-list ip-address &<1-8> { all | interface interface-type interface-number.sub-interface-number1 [ to interface-type interfacenumber.sub-interface-number2 ] }
The IP address of the NetBIOS server is specified on the DHCP client.

3.
Run:
dhcp server netbios-type { b-node | h-node | m-node | p-node } { all | interface interface-type interface-number.sub-interface-number1 [ to interface-type interface-number.sub-interface-number2 ] }
The NetBIOS node type is specified for the DHCP client. By default, the node type of the client is not specified. ----End
Postrequisite
For the client using the OS of Microsoft, WINS server provides the resolution from the host name to the IP address. This is given to the host that uses the NetBIOS protocol to communicate. Thus, most of the Windows network clients need to be configured with WINS. When a DHCP client communicates in a WAN by adopting the NetBIOS protocol, a mapping between the host name and the IP address should be set up. There are four types of NetBIOS nodes for obtaining mappings:
l
Type b nodes (b-node): "b" stands for broadcast; that is, type b nodes obtain the mapping by means of broadcast. Type p nodes (p-node): "p" stands for peer-to-peer; that is, type p nodes obtain the mapping relation by means of communicating with NetBIOS servers. Type m nodes (m-node): "m" stands for mixed. Type m nodes are the type p nodes owning part of the broadcasting features. Type h nodes (h-node): "h" stands for hybrid. Type h nodes are type b nodes owning the "peer-to-peer" communicating mechanism.
4.4.6 Configuring the DHCP Self-Defined Options for Address Pools of Sub-interfaces
Context
NOTE
Configuring DHCP self-defined options is optional. Services, such as DNS on the client, NETBIOS and IP lease cannot be configured through this command but through the related command described above.
Procedure
Step 1 Run:
system-view

dhcp server option code { ascii ascii-string | hex hex-string | ip-address ipaddress &<1-8>} { all | interface interface-type interface-number.sub-interfacenumber1 [ to interface-type interface-number.sub-interface-number2 ] }

Postrequisite
The Option field in DHCP packets carries the control information and parameters that are not defined in some common protocols. If the DHCP server is configured with Option, the DHCP client gets the configuration information saved in Option filed of DHCP response packets. You can add new options to the attribute list of the DHCP server by manual definition. For example,
l
To configure the IP address of the log server to 10.110.204.1, run the dhcp server option 7 ip-address 10.110.204.1 command. To configure the TTL of the client packet to 64, run the dhcp server option 23 hex 40 command.
NOTE
Using the option command, you can specify the options that need be included in the DHCP response packets. Before using this command, you need to know the function of each option: Option 77 identifies user types or applications of the DHCP client. Based on User Class in the Option field, the DHCP server selects the proper address pool and configuration parameters. Option77 usually is configured on the client.

Prerequisite
The configurations of the sub-interface address pool-based DHCP server are complete.
Procedure
l l
----End
Example

<HUAWEI> display dhcp server expired all Global pool: IP address Hardware address Lease expiration 2.2.2.2 44444-4444-4444 NOT Used Interface pool: IP address Hardware address Lease expiration
Type Manual Type
<HUAWEI> display dhcp server ip-in-use all Global pool: IP address Hardware address Lease expiration 2.2.2.2 4444-4444-4444 NOT Used Interface pool: IP address Hardware address Lease expiration 5.5.5.1 0050-ba28-930a Jul 5 2006 13: 00:10 PM
Type Manual Type Auto:COMMITED
<HUAWEI> display dhcp server tree all Global pool: Pool name: 5 network 10.10.1.0 255.255.255.0 Child node:6 Sibling node:7 option 1 ip-address 255.0.0.0 expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C Pool name: 6 host 10.10.1.2 255.0.0.0 hardware-address 1111.2222.3333 gigabitethernet
Issue 02 (2009-12-10)
4-27
Parent node:5 option 1 ip-address 255.255.0.0 expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C Interface pool: Pool name: GigabitEthernet11/2/0 network 5.5.5.0 mask 255.255.255.0 option 1 ip-address 255.255.255.0 gateway-list 5.5.5.5 expired 1 0 0 option 58 hex 00 00 A8 C0 option 59 hex 00 00 00 3C
4.5 Configuring the Security Function for DHCP

This section describes how to enhance the security of the DHCP service. 4.5.1 Establishing the Configuration Task 4.5.2 Starting the Detection of the Pseudo DHCP Server on a DHCP Server 4.5.3 Avoiding Repetitive IP Address Assignment 4.5.4 Saving DHCP Data 4.5.5 Restoring DHCP Data 4.5.6 Checking the Configuration

After configuring the DHCP server, you need configure the security function of the DHCP service. This enhances security of the DHCP service and prevents other pseudo DHCP servers from allocating invalid IP addresses for clients. By viewing logs, the administrator determines whether invalid DHCP servers allocate invalid IP addresses for clients.
l
Before configuring the security function of DHCP, complete the DHCP server configuration.
Data Preparation
To configure the security function of DHCP service, you need the following data. No. 1 2 Data Interval at which ping packets are sent and the number of ping packets Interval for saving the DHCP data
4-28
Issue 02 (2009-12-10)
4.5.2 Starting the Detection of the Pseudo DHCP Server on a DHCP Server
Context
If a private DHCP server exists in the network, users cannot obtain correct IP addresses and thus cannot log in to the network because this private DHCP server will interact with the DHCP client during address application. Such a private DHCP server is called a pseudo DHCP server. The logs contain IP addresses of all the DHCP servers that allocate IP addresses for clients. By viewing these logs, the administrator can determine whether a pseudo DHCP servers exists. Do as follows on the DHCP server:
Procedure
Step 1 Run:
system-view

dhcp server detect
Detecting the pseudo DHCP server is enabled on the DHCP server. By default, this function is disabled. ----End
4.5.3 Avoiding Repetitive IP Address Assignment

Context
Procedure
Step 1 Run:
system-view

dhcp server ping timeout milliseconds
The time for waiting the response after the ping packets is sent by the DHCP server is configured. Step 3 Run:
dhcp server ping packets number
The maximum number of ping packets sent by the DHCP server is configured.
By default, the maximum number of ping packets being sent is 2 and the longest waiting time for ping response packets is 500 ms. ----End
Postrequisite
Before assigning addresses to a client, the DHCP server should detect the IP address to avoid address collision. Using the ping command, you can check if there is a ping response of the address to be assigned within the specific time. If there is no response after a specific time, the DHCP server re-sends ping packets to this address until it reaches the maximum number of ping packets allowed to be sent. If there is still no response, it indicates that the IP address is not in use. In this way, it is ensured that a unique IP address is assigned to the client.
4.5.4 Saving DHCP Data

Context
Procedure
Step 1 Run:
system-view

dhcp server database enable
Saving the DHCP data to the hard disk is enabled. Step 3 Run:
dhcp server database write-delay seconds
The time delay for saving the data is set. By default, DHCP data cannot be saved to the hard disk. If the function is enabled, the default interval for saving the current DHCP data is 300 seconds, and the new data overwrites the previous data. ----End
Postrequisite
The system can save the current DHCP data to the hard disk and restore the data from the hard disk when the device fails. The DHCP data is saved with a fixed file name on the hard disk. Normally, the IP leasing information is saved in lease.txt file and the address collision information is saved in conflict.txt file. Back up these two files to other directories because they are replaced regularly.
4.5.5 Restoring DHCP Data

Context
Procedure
Step 1 Run:
system-view

dhcp server database recover
DHCP data is restored on the hard disk. ----End

Prerequisite
The configurations of the security function for DHCP are complete.
Procedure
l l Run the display dhcp server conflict { all | ip ip-address } command to check the statistics of DHCP address collisions. Run the display dhcp server database command to check the storage path and file information of the DHCP database.
----End
Example
Run the display dhcp server conflict command. If the conflicted IP address and the time when the conflict occurs are displayed, it means that the configuration succeeds.
<HUAWEI> display dhcp server conflict all Address Discover Time 10.110.1.2 Jan 11 2003 11:57: 7 PM
Run the display dhcp server database command. If the saved path of the DHCP data is displayed, it means that the configuration succeeds.
<HUAWEI> display dhcp server database Status: disable Recover from files after reboot: disable File saving lease items: hda1:/dhcp/lease.txt File saving conflict items: hda1:/dhcp/conflict.txt Save Interval: 300 (seconds)
4.6 Configuring DHCP Relay

This section describes how to enable DHCP relay so that DHCP relay can forward DHCP requests from local clients to the DHCP server on other networks.
Issue 02 (2009-12-10)
4-31
4.6.1 Establishing the Configuration Task 4.6.2 Configuring Relay 4.6.3 Checking the Configuration

When there is no DHCP server configured on the local network, enable the DHCP relay function on the other devices in the network. Thus, the DHCP relay can forward the DHCP requests from local clients to the DHCP server on the other network. To ensure that the client can normally obtain the IP address, the server must be the DHCP server based on the global address pool.That is, the interface connecting the DHCP server to the DHCP relay must not be configured with any interface address pool.
NOTE
The relay between the server and the client cannot exceed four. Otherwise, the DHCP packet is discarded.
Before configuring the DHCP relay, complete the following tasks:
l l l
Configuring the DHCP server Configuring the interface of the relay Configuring the routes from the relay to the DHCP server
Data Preparation
To configure the DHCP relay, you need the following data. No. 1 2 3 4 5 Data IP address of the DHCP server Number of the interface to be enabled the DHCP relay function Number of the VLAN to be enabled the DHCP relay function (Option) IP address to be released and the corresponding MAC address DHCP option that needs to be associated with the DHCP server address and the relay agent address.
4.6.2 Configuring Relay

Context
When a client and a DHCP server are not on the same network segment, you can configure the address of the interface that functions as the DHCP relay agent of the DHCP server. In this
manner, the client can send a Request packet that is forwarded by the DHCP replay agent to the DHCP server, and then the client can be assigned with an IP address. On the relay device, you can also configure the association between the DHCP option and the DHCP server address and the association between the DHCP option and the relay agent address. According to the option field in the DHCP Request packet, the relay agent can identify the type of the client and thus forward the Request packet to the corresponding DHCP server. This helps the DHCP server assign the IP addresses of different network segments to the clients with different services. If no DHCP option is configured to associate with either the DHCP server address or the relay agent address, the relay device needs to check whether a DHCP server address is configured on the interface (that is, the interface functions as the relay agent of the DHCP server). If the interface is configured with the relay function, the relay agent forwards packets to the corresponding DHCP server; otherwise, the packets are discarded. You can configure relay in the interface view and system view.
NOTE
Because the DHCP client may send broadcast packets during DHCP configuration, the interface where IP relay is enabled should support the broadcast mode. This IP address must be in the same network segment with the IP addresses in the address pool on the DHCP server. The number of address of the DHCP server for which the interface functions as the relay agent is up to 20.
Do as follows on the router acting as the DHCP relay:
Procedure
l Configure DHCP relay function in the interface view. 1. Run: system-view The system view is displayed. 2. Run: interface interface-type interface-number The interface view is displayed. 3. Run: ip address ip-address { mask | mask-length } The primary IP address of the interface is configured. 4. (Optional) Run: ip address ip-address { mask | mask-length } sub The secondary IP address of the interface is configured. 5. Run: dhcp select relay The DHCP relay function is enabled. 6. Run: ip relay address ip-address [ dhcp-option { 60 [ option-text ] | code } ]
The address of the DHCP server for which the interface functions as the relay agent is configured. It is optional to associate the DHCP option with the DHCP server address. 7. (Optional) Run: ip relay giaddr ip-address [ dhcp-option { 60 [ option-text ] | code } ] The DHCP option is configured to associate with the primary or secondary IP address of the interface. By default, the primary IP address of the interface on the relay device functions as the relay agent address. l Configuring the DHCP relay function in the system view. 1. Run: system-view The system view is displayed. 2. Run: dhcp select relay { all | interface interface-type interface-number.sub-interfacenumber1 [ to interface-type interface-number.sub-interface-number2 ] | interface interface-type interface-number &<1-10> } The DHCP relay function is enabled globally. 3. Run: ip relay address ip-address { all | interface interface-type interface-number.subinterface-number1 [ to interface-type interface-number.sub-interface-number2 ] | interface interface-type interface-number } The IP address of the DHCP server for which the multiple interfaces function as the relay agent are configured. ----End

Prerequisite
The configurations of the DHCP relay are complete.
Procedure
l l Run the display dhcp relay statistics command to check the related statistics of the DHCP relay. Run the display dhcp relay address { all | interfaceinterface-type interface-number } command to check the DHCP configuration of the interface enabled with the DHCP relay function.
----End
Example
Run the display dhcp relay address command to view the DHCP configurations of all interfaces.
<HUAWEI> display dhcp relay address all
4-34
Issue 02 (2009-12-10)

** GigabitEthernet1/0/0 DHCP Relay Address ** *:option is none, (*):option-text is none Dhcp Option Relay Agent IP Server IP * 10.1.1.1 70.1.1.2 101.40.1.2 45 20.1.1.1 101.40.1.2 60(*) 30.1.1.1 202.40.1.2 60(abc) 40.1.1.1 202.40.1.2
Run the display dhcp relay statistics command. If statistics of DHCP relay, such as the number of wrong DHCP packets and the number of various DHCP packet, is displayed, it means that the configuration succeeds.
<HUAWEI> display dhcp relay statistics Bad Packets received: DHCP packets received from clients: DHCP DISCOVER packets received: DHCP REQUEST packets received: DHCP INFORM packets received: DHCP DECLINE packets received: DHCP packets received from servers: DHCP OFFER packets received: DHCP ACK packets received: DHCP NAK packets received: DHCP packets sent to servers: DHCP packets sent to clients: Unicast packets sent to clients: Broadcast packets sent to clients: 0 2 1 1 0 0 2 1 1 0 1 1 0 0
4.7 Maintaining DHCP

This section describes how to clear the statistics about DHCP and debug DHCP. 4.7.1 Resetting DHCP 4.7.2 Releasing Conflicting IP Addresses 4.7.3 (Optional) Requesting the DHCP Server to Release IP Addresses of the Client 4.7.4 Clearing DHCP Statistics 4.7.5 Monitoring Network Operation Status of DHCP 4.7.6 Debugging DHCP
4.7.1 Resetting DHCP

Context
CAUTION
Resetting DHCP binding through the reset dhcp command interrupts the operation of the DHCP server. Please confirm that before you want to clear the information of DHCP binding.
Issue 02 (2009-12-10)
4-35
Procedure
l l l Run the reset dhcp server ip-in-use ip-address command in the user view to reset the information about the binding of the specified IP address. Run the reset dhcp server ip-in-use pool [ pool-name ] command in the user view to reset the information about the dynamic address bindings of the global address pool. Run the reset dhcp server ip-in-use interface [ interface-type interface-number ] command in the user view to reset the information about the dynamic address bindings of the interface address pool. Run the reset dhcp server ip-in-use all command in the user view to reset the information about the dynamic address bindings of all the address pools.
----End
4.7.2 Releasing Conflicting IP Addresses

Context
The DHCP server detects the conflicting IP addresses through the ping command while the DHCP client detects the conflicting IP address through sending ARP packets.
CAUTION
After the conflicting IP addresses are released, they can be reallocated by the DHCP server.
Procedure
l l Run the reset dhcp server conflict ip ip-address command to release the conflicting IP addresses in the specified address pool. Run the reset dhcp server conflict all command to release all conflicting IP addresses.
----End
4.7.3 (Optional) Requesting the DHCP Server to Release IP Addresses of the Client
Context
Do as follows on the router acting as the DHCP relay:
Procedure
l Requesting all the DHCP servers to release an IP address. 1. Run:
system-view

dhcp relay release client-ip-address mac-address
4-36
Issue 02 (2009-12-10)
The DHCP servers are required to release the IP address which is applied by the client. l Requesting the specified DHCP server to release an IP address. 1. Run:
system-view

dhcp relay release client-ip-address mac-address server-ip-address
The specified DHCP server is required to release the IP address which is applied by the client. l Requesting the DHCP server connected with the interface to release an IP address. 1. Run:
system-view

The interface view is displayed. 3. Run:

dhcp relay release client-ip-address mac-address [ server-ip-address ]
The DHCP server connected with the interface on the DHCP relay is required to release the IP address which is applied by the client. ----End
4.7.4 Clearing DHCP Statistics

Context
CAUTION
DHCP statistics cannot be restored after you clear it. So, confirm the action before you use the command.
Procedure
l l Run the reset dhcp server statistics command in the user view to clear the DHCP server statistics. Run the reset dhcp relay statistics command in the user view to clear the DHCP relay statistics.
----End
Issue 02 (2009-12-10)
4-37
4.7.5 Monitoring Network Operation Status of DHCP

Context
In routine maintenance, you can run the following command in any view to check the operation of DHCP.
Procedure
l l Run the display dhcp server free-ip command in any view to check the information about available IP addresses in the DHCP address pool. Run the display dhcp server expired { all | interface [ interface-type interface-number ] | ip ip-address | pool [ pool-name ] } command in any view to check the information about the IP addresses with expired leases in the DHCP address pool. Run the display dhcp server ip-in-use { all | interface [ interface-type interfacenumber ] | ip ip-address | pool [ pool-name ] } command in any view to check the information about address bindings. Run the display dhcp server statistics command in any view to check the statistics about the DHCP server. Run the display dhcp server tree { all | interface [ interface-type interface-number ] | pool [ pool-name ] } command in any view to check the information about the tree structure of the DHCP address pool. Run the display dhcp server conflict { all | ip ip-address } command in any view to check the information about the conflict addresses in the DHCP address pool. Run the display dhcp server database command in any view to check the path at which DHCP database is saved and file information about the database. Run the display interface [ interface-type interface-number ] command in any view to check the relay address of the interface. Run the display dhcp relay address { all | interface interface-type interface-number } command in any view to check configurations about the DHCP relay address.
l l
l l l l
----End
4.7.6 Debugging DHCP

Context
CAUTION
Debugging affects the performance of the system. So after debugging, run the undo debugging all command to disable it immediately. Run the following debugging commands in the user view to debug DHCP and locate the fault. For the procedure for displaying the debugging information, refer to the chapter "Information Center Configuration" in the NE5000E Core Router Configuration Guide - System Management.
For descriptions about the debugging command, refer to the NE5000E Core Router Debugging Reference.
Procedure
l l Run the debugging dhcp server { all | error | event | packet } command in the user view to debug DHCP server. Run the debugging dhcp relay { all | error | event | packet [ client mac mac-address ] } command in the user view to debug DHCP relay.
----End

This section provides several configuration examples of the DHCP server and DHCP relay. 4.8.1 Example for Configuring the Global Address Pool-based DHCP Server 4.8.2 Example for Configuring the Interface Address Pool-based DHCP Server 4.8.3 Example for Configuring the Sub-interface Address Pool-based DHCP Server 4.8.4 Example for Configuring DHCP Relay 4.8.5 Example for Configuring the DHCP Option Association
4.8.1 Example for Configuring the Global Address Pool-based DHCP Server
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 4-1, a DHCP server dynamically assigns the IP addresses to a client in the same network segment. The address pool segment 10.1.1.0/24 is divided into two segments: 10.1.1.0/25 and 10.1.1.128/25. The IP addresses of the two Ethernet interfaces on the DHCP server are 10.1.1.1/25 and 10.1.1.129/25. The IP lease of the segment 10.1.1.0/25 is 10 days and 12 hours, with domain name as huawei.com, DNS address as 10.1.1.2, egress device address as 10.1.1.126 and without the NetBIOS address. The IP lease of the segment 10.1.1.128/25 is 5 days, with DNS address as 10.1.1.2, egress device address as 10.1.1.254, and NetBIOS address as 10.1.1.4.
Issue 02 (2009-12-10)
4-39
Figure 4-1 Networking diagram of the DHCP server and the client that are in the same network segment
NetBIOS server
DHCP client
DHCP client
DHCP client
GE1/0/0 10.1.1.1/25
GE1/0/1 10.1.1.129/25
DHCP server
DNS DHCP server client

Network: 10.1.1.0/25
DHCP client
DHCP client
Network: 10.1.1.128/25
The configuration roadmap is as follows: 1. 2. 3. 4. Enable DHCP. Configure the IP addresses that need not be assigned automatically, such as IP addresses of the DNS server, the NetBIOS server and the egress gateway. Configure an address pool, including the address range and the domain name, and configure the IP address of the DNS server. Configure related attributes for the address pool, such as the address range, the egress gateway, the IP address of the NetBIOS server and the IP lease. This example covers the configurations of three address pools. Address pool 0 is configured with the common attribute of all client; address pool 1 and address pool 2 are configured with different attributes of various clients. In this example, you can configure only address pool 1 and address pool 2. They cannot adopt configurations of the root address pool. You need to configure attributes for them respectively.
Data Preparation
l l
IP address that need not be assigned automatically Address pool number
Procedure
Step 1 Configure the DHCP server.
# Enable DHCP on the device.

<HUAWEI> system-view [HUAWEI] sysname HUAWEI [HUAWEI] dhcp enable
# Configure the IP addresses that do not participate in auto-allocation, including addresses of the DNS server, the NetBIOS server and the egress gateway.
[HUAWEI] [HUAWEI] [HUAWEI] [HUAWEI] dhcp dhcp dhcp dhcp server server server server forbidden-ip forbidden-ip forbidden-ip forbidden-ip 10.1.1.2 10.1.1.4 10.1.1.126 10.1.1.254
# Configure general attributes of DHCP address pool 0, including the address pool range, domain name and the IP address of the DNS server.
[HUAWEI] dhcp server ip-pool 0 [HUAWEI-dhcp-0] network 10.1.1.0 mask 255.255.255.0 [HUAWEI-dhcp-0] domain-name huawei.com [HUAWEI-dhcp-0] dns-list 10.1.1.2 [HUAWEI-dhcp-0] quit
# Configure attributes of DHCP address pool 1, including the address pool range, egress gateway and the IP lease.
[HUAWEI] dhcp server ip-pool 1 [HUAWEI-dhcp-1] network 10.1.1.0 mask 255.255.255.128 [HUAWEI-dhcp-1] expired day 10 hour 12 [HUAWEI-dhcp-1] gateway-list 10.1.1.126 [HUAWEI-dhcp-1] quit
# Configure attributes of DHCP address pool 2, including the address pool range, egress gateway, the IP address of the NetBIOS server and the IP lease.
[HUAWEI] dhcp server ip-pool 2 [HUAWEI-dhcp-2] network 10.1.1.128 mask 255.255.255.128 [HUAWEI-dhcp-2] expired day 5 [HUAWEI-dhcp-2] nbns-list 10.1.1.4 [HUAWEI-dhcp-2] gateway-list 10.1.1.254 [HUAWEI-dhcp-2] quit
# Configure the clients of the GE 1/0/0 to obtain their IP addresses from the global address pool.
[HUAWEI] interface gigabitethernet 1/0/0 [HUAWEI-GigabitEthernet1/0/0] ip address 10.1.1.1 255.255.255.128 [HUAWEI-GigabitEthernet1/0/0] dhcp select global [HUAWEI-GigabitEthernet1/0/0] undo shutdown [HUAWEI-GigabitEthernet1/0/0] quit
# Configure the clients of the GE 1/0/1 to obtain their IP addresses from the global address pool.
[HUAWEI] interface gigabitethernet 1/0/1 [HUAWEI-GigabitEthernet1/0/1] ip address 10.1.1.129 255.255.255.128 [HUAWEI-GigabitEthernet1/0/1] dhcp select global [HUAWEI-GigabitEthernet1/0/1] undo shutdown [HUAWEI-GigabitEthernet1/0/1] quit
Step 2 Verify the configuration. After the configuration, run the display dhcp server tree command on the DHCP server. If the tree structure information of DHCP address pools, including DNS, IP lease, and Option parameters, is displayed, it means that the configuration succeeds.
[HUAWEI] display dhcp server tree all Global pool: Pool name: 0 Child node:1
Issue 02 (2009-12-10)
4-41
network 10.1.1.0 mask 255.255.255.0 dns-list 10.1.1.2 domain-name huawei.com expired day 1 hour 0 minute 0 Pool name: 1 Parent node:0 Sibling node:2 network 10.1.1.0 mask 255.255.255.128 gateway-list 10.1.1.126 dns-list 10.1.1.2 domain-name huawei.com expired day 10 hour 12 minute 0 Pool name: 2 Parent node:0 PrevSibling node:1 network 10.1.1.128 mask 255.255.255.128 gateway-list 10.1.1.254 dns-list 10.1.1.2 domain-name huawei.com nbns-list 10.1.1.4 expired day 5 hour 0 minute 0
----End
Configuration File
The configuration file of HUAWEI is as follows:
# sysname HUAWEI # dhcp server ip-pool 0 network 10.1.1.0 mask 255.255.255.0 dns-list 10.1.1.2 domain-name huawei.com # dhcp server ip-pool 1 network 10.1.1.0 mask 255.255.255.128 gateway-list 10.1.1.126 expired day 10 hour 12 # dhcp server ip-pool 2 network 10.1.1.128 mask 255.255.255.128 gateway-list 10.1.1.254 nbns-list 10.1.1.4 expired day 5 # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.255.128 # interface GigabitEthernet1/0/1 undo shutdown ip address 10.1.1.129 255.255.255.128 # dhcp server forbidden-ip 10.1.1.2 dhcp server forbidden-ip 10.1.1.4 dhcp server forbidden-ip 10.1.1.126 dhcp server forbidden-ip 10.1.1.254 # return
NOTE
By default, IP addresses in the global address pool are assigned. So, the configuration file does not contain the dhcp select global command.
4-42
Issue 02 (2009-12-10)
4.8.2 Example for Configuring the Interface Address Pool-based DHCP Server
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 4-2, the network 10.1.1.0/24 is of a smaller size. GE 1/0/0 connects with two DHCP clients and two servers. To assign IP addresses for the clients dynamically, configure a DHCP server based on the address pool on GE 1/0/0. After GE 1/0/0 is configured with the IP address 10.1.1.1/24, addresses from 10.1.1.2/24 to 10.1.1.254/24 can be assigned to the clients. Figure 4-2 Networking diagram of the DHCP server based on the address pool on the interface
NetBIOS server
10.1.1.3/24
DHCP client Router
GE1/0/0 10.1.1.1/24
DHCP server DNS server

10.1.1.2/24
DHCP client
The configuration roadmap is as follows: 1. 2. 3. 4. 5. Enable DHCP. Configure the IP addresses that need not be assigned automatically, such as IP addresses of the DNS server, the NetBIOS server and the egress gateway. Configure IP address of the interfaces and the DNS server and the domain name. Enable the address pool on the interface. (Optional) Configure related attributes for the address pool, such as, the egress gateway, the IP address of the NetBIOS server, the IP lease, and the security function.
Issue 02 (2009-12-10)
Data Preparation
l l
IP address that need not be assigned automatically IP Address of the interface
Procedure
Step 1 Configure the DHCP server. # Enable DHCP on the device.
# Configure the IP addresses that do not participate in auto-allocation, including IP addresses of the DNS server and the NetBIOS server.
[HUAWEI] dhcp server forbidden-ip 10.1.1.2 [HUAWEI] dhcp server forbidden-ip 10.1.1.3
# Configure the IP address of GE 1 /0/0.

[HUAWEI] interface gigabitethernet 1/0/0 [HUAWEI-GigabitEthernet1/0/0] ip address 10.1.1.1 24
# Enable the address pool on the interface.

[HUAWEI-GigabitEthernet1/0/0] dhcp select interface
# Configure the domain name and IP addresses of the DNS server and NetBIOS server.
[HUAWEI-GigabitEthernet1/0/0] [HUAWEI-GigabitEthernet1/0/0] [HUAWEI-GigabitEthernet1/0/0] [HUAWEI-GigabitEthernet1/0/0] dhcp dhcp dhcp dhcp server server server server domain-name huawei.com dns-list 10.1.1.2 nbns-list 10.1.1.3 netbios-type b-node
# (optional) Configure the IP lease and detection of pseudo DHCP server.

[HUAWEI-GigabitEthernet1/0/0] dhcp server expired day 10 hour 12 [HUAWEI-GigabitEthernet1/0/0] undo shutdown [HUAWEI-GigabitEthernet1/0/0] quit [HUAWEI] dhcp server detect
[HUAWEI] display dhcp server tree all Interface pool: Pool name: GigabitEthernet2/0/3 network 10.1.1.0 mask 255.255.255.0 gateway-list 10.1.1.1 dns-list 10.1.1.2 domain-name huawei.com nbns-list 10.1.1.3 netbios-type b-node expired day 10 hour 12 minute 0
----End
Configuration File
The configuration file of HUAWEI is as follows:
# sysname HUAWEI # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 dhcp select interface dhcp server dns-list 10.1.1.2 dhcp server domain-name huawei.com dhcp server nbns-list 10.1.1.3 dhcp server netbios-type b-node dhcp server expired day 10 hour 12 # dhcp server forbidden-ip 10.1.1.2 dhcp server forbidden-ip 10.1.1.3 dhcp server detect # return
4.8.3 Example for Configuring the Sub-interface Address Poolbased DHCP Server
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The slot number is chassis ID/slot ID. As shown in Figure 4-3, GE 1/0/0 has two sub-interfaces. To be more effective, configure address pools on several sub-interfaces so that the PCs that are in the same VLAN with the subinterfaces can dynamically obtain their IP addresses from the address pool. VALN10 and VLAN20 are connected with the switch, as shown in the following diagram. On the switch, set GE0/0/4 that is connected with the device to be a Trunk interface. Configure the interfaces on the device to allow frame from VLAN10 and VLAN20 to pass. Configure the interfaces that connect the switch with PCs to join the corresponding default VLANs.
Issue 02 (2009-12-10)
4-45
Figure 4-3 Networking diagram of the DCHP server based on the address pools on the subinterfaces
NetBIOS server
10.1.1.3/24
DHCP client VLAN 20

GE0/0/4
DHCP GE1/0/0.1 server

10.1.1.1/24 GE1/0/0.2 10.1.2.1/24
VLAN 10 DNS server

10.1.2.2/24
DHCP client
The configuration roadmap is as follows: 1. 2. 3. 4. 5. Enable DHCP. Configure the IP addresses that need not be assigned automatically, such as IP addresses of the DNS server, the NetBIOS server and the egress gateway. Create sub-interfaces, configure IP addresses for them and encapsulate them with 802.1Q. Enable the address pool for the sub-interfaces. Configure related attributes for the address pool, such as the domain name, IP addresses of the NetBIOS server and the DNS server, and the IP lease.
Data Preparation
l l
IP address that need not be assigned automatically IP address of the interface
Procedure
Step 1 Configure the DHCP server. # Enable DHCP on the device.
# Configure the IP addresses that do not participate in auto-allocation, including IP addresses of the DNS server and NetBIOS server.

[HUAWEI] dhcp server forbidden-ip 10.1.2.2 [HUAWEI] dhcp server forbidden-ip 10.1.1.3
# Create sub-interface GE 1/0/0.1, configure its IP address, and encapsulate it with 802.1Q.
[HUAWEI] interface gigabitethernet 1/0/0.1 [HUAWEI-GigabitEthernet1/0/0.1] vlan-type dot1q 20 [HUAWEI-GigabitEthernet1/0/0.1] ip address 10.1.1.1 24 [HUAWEI-GigabitEthernet1/0/0.1] undo shutdown [HUAWEI-GigabitEthernet1/0/0.1] quit
# Create sub-interface GE 1/0/0.2, configure its IP address, and encapsulate it with 802.1Q.
[HUAWEI] interface gigabitethernet 1/0/0.2 [HUAWEI-GigabitEthernet1/0/0.2] vlan-type dot1q 10 [HUAWEI-GigabitEthernet1/0/0.2] ip address 10.1.2.1 24 [HUAWEI-GigabitEthernet1/0/0.2] undo shutdown [HUAWEI-GigabitEthernet1/0/0.2] quit
# Enable the address pool that is based on sub-interfaces.

[HUAWEI] dhcp select interface interface gigabitethernet 1/0/0.1 to gigabitethernet 1/0/0.2
# Configure the domain name and IP addresses of the DNS server and NetBIOS server.
[HUAWEI] dhcp server domain-name huawei.com interface gigabitethernet 1/0/0.1 to gigabitethernet 1/0/0.2 [HUAWEI] dhcp server dns-list 10.1.2.2 interface gigabitethernet 1/0/0.1 to gigabitethernet 1/0/0.2 [HUAWEI] dhcp server nbns-list 10.1.1.3 interface gigabitethernet 1/0/0.1 to gigabitethernet 1/0/0.2 [HUAWEI] dhcp server netbios-type b-node interface gigabitethernet 1/0/0.1 to gigabitethernet 1/0/0.2
# Configure the IP lease for the address pool.

[HUAWEI] dhcp server expired day 10 hour 12 interface gigabitethernet 1/0/0.1 to gigabitethernet 1/0/0.2
[HUAWEI] display dhcp server tree all Interface pool: Pool name: GigabitEthernet1/0/0.1 network 10.1.1.0 mask 255.255.255.0 gateway-list 10.1.1.1 dns-list 10.1.2.2 domain-name huawei.com nbns-list 10.1.1.3 netbios-type b-node expired day 10 hour 12 minute 0 Pool name: GigabitEthernet1/0/0.2 network 10.1.2.0 mask 255.255.255.0 gateway-list 10.1.2.1 dns-list 10.1.2.2 domain-name huawei.com nbns-list 10.1.1.3 netbios-type b-node expired day 10 hour 12 minute 0
After the preceding configurations, PCs in VLAN 10 and VLAN 20 can obtain IP addresses in the address pools of the sub-interfaces. PCs in two VLANs can ping through each other. ----End
Configuration File
The configuration file of router is as follows:
# interface GigabitEthernet1/0/0.1 undo shutdown ip address 10.1.1.1 255.255.255.0 vlan-type dot1q 20 dhcp select interface dhcp server dns-list 10.1.2.2 dhcp server domain-name huawei.com dhcp server nbns-list 10.1.1.3 dhcp server netbios-type b-node dhcp server expired day 10 hour 12 # interface GigabitEthernet 1/0/0.2 undo shutdown ip address 10.1.2.1 255.255.255.0 vlan-type dot1q 10 dhcp select interface dhcp server dns-list 10.1.2.2 dhcp server domain-name huawei.com dhcp server nbns-list 10.1.1.3 dhcp server netbios-type b-node dhcp server expired day 10 hour 12 # dhcp server forbidden-ip 10.1.2.2 dhcp server forbidden-ip 10.1.1.3 # return
4.8.4 Example for Configuring DHCP Relay

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 4-4, the DHCP client is in the network segment 10.110.0.0/16, while the DHCP server is in the network segment 202.40.0.0/16. A DHCP relay device is needed to forward DHCP packets so that the DHCP client obtains the IP addresses from the DHCP server. The DHCP server is assigned with an address pool in the network segment 10.100.0.0/16. The IP address of the DNS server is 10.100.1.2/16, the IP address of the NetBIOS server is 10.100.1.3/16, and the IP address of the gateway is 10.100.1.4. On the DHCP server, the routing table must contain at least one reachable a route to the network segment 10.110.0.0.
4-48
Issue 02 (2009-12-10)
Figure 4-4 Networking diagram for configuring DHCP relay
DNS server
10.100.1.2/16
NetBIOS server
10.100.1.3/16
DHCP Relay GE1/0/0 RouterA

10.100.1.1/16 POS2/0/0 202.40.1.1/16
DHCP server RouterB

POS1/0/0 202.40.1.2/16
DHCP client
DHCP client
The configuration roadmap is as follows: 1. 2. 3. 4. 5. 6. 7. Enable DHCP on Router A that acts as the DHCP relay. Configure POS 2/0/0 that needs to implement the DHCP relay function. Configure the the address of the DHCP server for which the interface functions as the relay agent for GE 1/0/0 and enable DHCP relay on GE 1/0/0. Configure a route from the DHCP server Router B to GE 1/0/0 of Router A. Enable DHCP on Router B. Configure the clients attached to POS 1/0/0 to obtain IP addresses through the global address pool. Configure a global address pool on Router B.
Data Preparation
To complement the configuration, you need the following data:
l l
IP address of the interface that need to be enabled with DHCP relay IP address of the DHCP server
Procedure
Step 1 Configure the DHCP relay. # Enable DHCP on the device.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] dhcp enable

[RouterA] interface pos 2/0/0
Issue 02 (2009-12-10)
4-49
[RouterA-Pos2/0/0] ip address 202.40.1.1 255.255.0.0 [RouterA-Pos2/0/0] undo shutdown [RouterA-Pos2/0/0] quit
# Enter the view of the interface that needs to be enabled with DHCP relay. Configure the IP address and mask of the interface, which should be in the same network segment with that of the DHCP client.
[RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 10.100.1.1 255.255.0.0 [RouterA-GigabitEthernet1/0/0] ip relay address 202.40.1.2 [RouterA-GigabitEthernet1/0/0] dhcp select relay [RouterA-GigabitEthernet1/0/0] undo shutdown [RouterA-GigabitEthernet1/0/0] quit
Step 2 Configure the DHCP server. # On Router B, configure routes to GE 1/0/0 that connects Router A and its client.
<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] ip route-static 10.100.0.0 255.255.0.0 202.40.1.1
# Enable DHCP.
[RouterB] dhcp enable
# Configure the clients of POS 1/0/0 to obtain the IP addresses from the global address pool.
[RouterB] interface pos 1/0/0 [RouterB-Pos1/0/0] ip address 202.40.1.2 255.255.0.0 [RouterB-Pos1/0/0] dhcp select global [RouterB-Pos1/0/0] undo shutdown [RouterB-Pos1/0/0] quit
# Configure the IP addresses that do not participate in auto-allocation, including IP addresses of the DNS server, the NetBIOS server and the egress gateway.
[RouterB] dhcp server forbidden-ip 10.100.1.2 [RouterB] dhcp server forbidden-ip 10.100.1.3 [RouterB] dhcp server forbidden-ip 10.100.1.4
# Configure attributes of DHCP address pool 1, including the address pool range, domain name, egress gateway, the IP address of the DNS server and IP lease.
[RouterB] dhcp server ip-pool 1 [RouterB-dhcp-1] network 10.100.0.0 mask 255.255.0.0 [RouterB-dhcp-1] domain-name huawei.com [RouterB-dhcp-1] dns-list 10.100.1.2 [RouterB-dhcp-1] nbns-list 10.100.1.3 [RouterB-dhcp-1] gateway-list 10.100.1.4 [RouterB-dhcp-1] expired day 10 hour 12 [RouterB-dhcp-1] quit
Step 3 Verify the configuration. Run the display dhcp server tree command on the DHCP server. If the tree structure information of DHCP address pools, including DNS, IP lease, and Option parameters, is displayed, it means that the configuration succeeds.
[RouterB] display dhcp server tree all Global pool: Pool name: 1 network 10.100.0.0 mask 255.255.0.0 gateway-list 10.100.1.4 dns-list 10.100.1.2 domain-name huawei.com nbns-list 10.100.1.3
4-50
Issue 02 (2009-12-10)

expired day 10 hour 12 minute 0
Run the display dhcp relay address command on the DHCP relay device to view configurations of the relay IP address.
[RouterA] display dhcp relay address all ** GigabitEthernet1/0/0 DHCP Relay Address Dhcp Option Relay Agent IP * ** Server IP 202.40.1.2
----End
Configuration Files
l

# sysname RouterA # interface GigabitEthernet1/0/0 undo shutdown ip address 10.100.1.1 255.255.0.0 ip relay address 202.40.1.2 dhcp select relay # interface Pos 2/0/0 link-protocol ppp undo shutdown ip address 202.40.1.1 255.255.0.0 # return

# sysname RouterB # dhcp server ip-pool 1 network 10.100.0.0 mask 255.255.0.0 gateway-list 10.100.1.4 dns-list 10.100.1.2 domain-name huawei.com nbns-list 10.100.1.3 expired day 10 hour 12 # interface Pos 1/0/0 link-protocol ppp undo shutdown ip address 202.40.1.2 255.255.0.0 # dhcp server forbidden-ip 10.100.1.2 dhcp server forbidden-ip 10.100.1.3 dhcp server forbidden-ip 10.100.1.4 # ip route-static 10.100.0.0 255.255.0.0 202.40.1.1 # return
4.8.5 Example for Configuring the DHCP Option Association

As shown in Figure 4-5, the four DHCP clients transmit different types of services. After the DHCP option is configured to associate with the addresses of the DHCP server and relay agent, packets from clients can be forwarded to the corresponding DHCP server. In this manner, configuration information such as the IP address can be provided for different clients.
As a DHCP server, Router B is configured with two global address pools of two network segments being 10.1.0.0/16 and 20.1.0.0/16 respectively. In addition, Router B is configured with the route to the relay device Router A. On the network segment 10.1.0.0/16, 10.1.1.1/16 is the address of the DNS server, NetBIOS server, and egress gateway. On the network segment 20.1.0.0/16, 20.1.1.1/16 is the address of the DNS server, NetBIOS server, and egress gateway. As a DHCP server, Router C is configured with two global address pools of two network segments being 30.1.0.0/16 and 40.1.0.0/16 respectively. In addition, Router C is configured with the route to the relay device Router A. On the network segment 30.1.0.0/16, 30.1.1.1/16 is the address of the DNS server, NetBIOS server, and egress gateway. On the network segment 40.1.0.0/16, 40.1.1.1/16 is the address of the DNS server, NetBIOS server, and egress gateway. Figure 4-5 Networking diagram of configuring the DHCP option association
DHCP clientA
DHCP clientB
POS1/0/0 101.40.1.2/16
DHCP Server RouterB
DHCP Relay POS2/0/0 RouterA
101.40.1.1/16 POS3/0/0 202.40.1.1/16
DHCP clientC
DHCP clientD
GE1/0/0 DSLAM 10.1.1.1/16 20.1.1.1/16 sub 30.1.1.1/16 sub 40.1.1.1/16 sub
POS1/0/0 202.40.1.2/16
DHCP Server RouterC
The configuration roadmap is as follows: 1. 2. 3. Configure the association between the DHCP option and the IP address of each interface on Router A. Configure the DHCP function and address pools on Router B. Configure the DHCP function and address pools on Router C.
Data Preparation
l l
Primary and secondary IP addresses of the interface that functions as the DHCP relay agent IP address of each DHCP server
4-52

l
DHCP option
Procedure
Step 1 Do as follows on the relay device: # Enable DHCP.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] dhcp enable
# Configure the IP address of POS 2/0/0.

# Configure the IP address of POS 3/0/0.

# Enter the view of the interface to be configured with the DHCP relay function. Configure the IP address and DHCP option association for the interface.
[RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 10.1.1.1 255.255.0.0 [RouterA-GigabitEthernet1/0/0] ip address 20.1.1.1 255.255.0.0 sub [RouterA-GigabitEthernet1/0/0] ip address 30.1.1.1 255.255.0.0 sub [RouterA-GigabitEthernet1/0/0] ip address 40.1.1.1 255.255.0.0 sub [RouterA-GigabitEthernet1/0/0] ip relay address 101.40.1.2 [RouterA-GigabitEthernet1/0/0] ip relay address 101.40.1.2 dhcp-option [RouterA-GigabitEthernet1/0/0] ip relay address 202.40.1.2 dhcp-option [RouterA-GigabitEthernet1/0/0] ip relay address 202.40.1.2 dhcp-option [RouterA-GigabitEthernet1/0/0] ip relay giaddr 10.1.1.1 [RouterA-GigabitEthernet1/0/0] ip relay giaddr 20.1.1.1 dhcp-option 45 [RouterA-GigabitEthernet1/0/0] ip relay giaddr 30.1.1.1 dhcp-option 60 [RouterA-GigabitEthernet1/0/0] ip relay giaddr 40.1.1.1 dhcp-option 60 [RouterA-GigabitEthernet1/0/0] dhcp select relay [RouterA-GigabitEthernet1/0/0] undo shutdown [RouterA-GigabitEthernet1/0/0] quit
45 60 60 abc
abc
Step 2 Do as follows on Router B functioning as a DHCP server: # Configure the routes from Router B to Router A.
<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] ip route-static 10.1.0.0 255.255.0.0 101.40.1.1 [RouterB] ip route-static 20.1.0.0 255.255.0.0 101.40.1.1
# Enable DHCP on RouterB.

[RouterB] dhcp enable
# Configure the clients connected to POS 1/0/0 to obtain IP addresses from the global address pool.
[RouterB] interface pos 1/0/0 [RouterB-Pos1/0/0] ip address 101.40.1.2 255.255.0.0 [RouterB-Pos1/0/0] dhcp select global [RouterB-Pos1/0/0] undo shutdown [RouterB-Pos1/0/0] quit
Issue 02 (2009-12-10)
4-53
# Configure the IP addresses that cannot be automatically allocated, including the DNS server address, NetBIOS address, and egress gateway address.
[RouterB] dhcp server forbidden-ip 10.1.1.1 10.1.1.2 [RouterB] dhcp server forbidden-ip 20.1.1.1
# Configure the attributes for DHCP address pool 1, including the address pool range, domain name, egress gateway, DNS address, and address lease.
[RouterB] dhcp server ip-pool 1 [RouterB-dhcp-1] network 10.1.0.0 mask 255.255.0.0 [RouterB-dhcp-1] domain-name abc.com [RouterB-dhcp-1] dns-list 10.1.1.1 [RouterB-dhcp-1] nbns-list 10.1.1.1 [RouterB-dhcp-1] gateway-list 10.1.1.1 [RouterB-dhcp-1] expired day 10 hour 12 [RouterB-dhcp-1] quit
[RouterB] dhcp server ip-pool 2 [RouterB-dhcp-2] network 20.1.0.0 mask 255.255.0.0 [RouterB-dhcp-2] domain-name def.com [RouterB-dhcp-2] dns-list 20.1.1.1 [RouterB-dhcp-2] nbns-list 20.1.1.1 [RouterB-dhcp-2] gateway-list 20.1.1.1 [RouterB-dhcp-2] expired day 10 hour 12 [RouterB-dhcp-2] quit
Step 3 Do as follows on Router C functioning as a DHCP server: # Configure the route from Router C to Router A.
<HUAWEI> system-view [HUAWEI] sysname RouterC [RouterC] ip route-static 30.1.0.0 255.255.0.0 202.40.1.1 [RouterC] ip route-static 40.1.0.0 255.255.0.0 202.40.1.1
# Enable DHCP on RouterC.

[RouterC] dhcp enable
# Configure the clients connected to POS 1/0/0 to obtain IP addresses from the global address pool.
[RouterC] interface pos 1/0/0 [RouterC-Pos1/0/0] ip address 202.40.1.2 255.255.0.0 [RouterC-Pos1/0/0] dhcp select global [RouterC-Pos1/0/0] undo shutdown [RouterC-Pos1/0/0] quit
# Configure the IP addresses that do not participate in the auto-allocation, including the DNS server address, NetBIOS address, and egress gateway address.
[RouterC] dhcp server forbidden-ip 30.1.1.1 [RouterC] dhcp server forbidden-ip 40.1.1.1
[RouterC] dhcp server ip-pool 1 [RouterC-dhcp-1] network 30.1.0.0 mask 255.255.0.0 [RouterC-dhcp-1] domain-name ghi.com [RouterC-dhcp-1] dns-list 30.1.1.1 [RouterC-dhcp-1] nbns-list 30.1.1.1 [RouterC-dhcp-1] gateway-list 30.1.1.1 [RouterC-dhcp-1] expired day 10 hour 12
4-54
Issue 02 (2009-12-10)

[RouterC-dhcp-1] quit
[RouterC] dhcp server ip-pool 2 [RouterC-dhcp-2] network 40.1.0.0 mask 255.255.0.0 [RouterC-dhcp-2] domain-name jkl.com [RouterC-dhcp-2] dns-list 40.1.1.1 [RouterC-dhcp-2] nbns-list 40.1.1.1 [RouterC-dhcp-2] gateway-list 40.1.1.1 [RouterC-dhcp-2] expired day 10 hour 12 [RouterC-dhcp-2] quit
Step 4 Verify the configuration. Run the display dhcp relay address all command on Router A. You can view the configuration of the interface enabled with the DHCP relay function.
[RouterA] display dhcp relay address all ** GigabitEthernet1/0/0 DHCP Relay Address ** DHCP Option Relay Agent IP Server IP * 10.1.1.1 101.40.1.2 45 20.1.1.1 101.40.1.2 60(*) 30.1.1.1 202.40.1.2 60(abc) 40.1.1.1 202.40.1.2
Run the display dhcp server tree command on Router B. You can view information about DHCP address pools in a tree structure, including DNS, IP address lease, and parameters such as the option.
[RouterB] display dhcp server tree all Global pool: Pool name: 1 network 10.1.0.0 mask 255.255.0.0 gateway-list 10.1.1.1 dns-list 10.1.1.1 domain-name abc.com nbns-list 10.1.1.1 expired day 10 hour 12 minute 0 Pool name: 2 network 20.1.0.0 mask 255.255.0.0 gateway-list 20.1.1.1 dns-list 20.1.1.1 domain-name def.com nbns-list 20.1.1.1 expired day 10 hour 12 minute 0
Run the display dhcp server tree command on Router C. You can view information about DHCP address pools in a tree structure, including DNS, IP address lease, and parameters such as the option.
[RouterC] display dhcp server tree all Global pool: Pool name: 1 network 30.1.0.0 mask 255.255.0.0 gateway-list 30.1.1.1 dns-list 30.1.1.1 domain-name ghi.com nbns-list 30.1.1.1 expired day 10 hour 12 minute 0 Pool name: 2 network 40.1.0.0 mask 255.255.0.0 gateway-list 40.1.1.1 dns-list 40.1.1.1 domain-name jkl.com nbns-list 40.1.1.1 expired day 10 hour 12 minute 0
Issue 02 (2009-12-10)
4-55
----End
Configuration Files
l

# sysname RouterA # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.0.0 ip address 20.1.1.1 255.255.0.0 sub ip address 30.1.1.1 255.255.0.0 sub ip address 40.1.1.1 255.255.0.0 sub ip relay address 101.40.1.2 ip relay address 101.40.1.2 dhcp-option ip relay address 202.40.1.2 dhcp-option ip relay address 202.40.1.2 dhcp-option ip relay giaddr 10.1.1.1 ip relay giaddr 20.1.1.1 dhcp-option 45 ip relay giaddr 30.1.1.1 dhcp-option 60 ip relay giaddr 40.1.1.1 dhcp-option 60 dhcp select relay # interface Pos 1/0/0 undo shutdown ip address 101.40.1.1 255.255.0.0 # return # interface Pos 2/0/0 undo shutdown ip address 202.40.1.1 255.255.0.0 # return
45 60 60 abc
abc

# sysname RouterB # dhcp server ip-pool 1 network 10.1.0.0 mask 255.255.0.0 gateway-list 10.1.1.1 dns-list 10.1.1.1 domain-name abc.com nbns-list 10.1.1.1 expired day 10 hour 12 # # dhcp server ip-pool 2 network 20.1.0.0 mask 255.255.0.0 gateway-list 20.1.1.1 dns-list 20.1.1.1 domain-name def.com nbns-list 20.1.1.1 expired day 10 hour 12 # interface Pos 1/0/0 undo shutdown ip address 101.40.1.2 255.255.0.0 # dhcp server forbidden-ip 10.1.1.1 10.1.1.2 dhcp server forbidden-ip 20.1.1.1 # ip route-static 10.1.0.0 255.255.0.0 101.40.1.1 ip route-static 20.1.0.0 255.255.0.0 101.40.1.1 #
4-56
Issue 02 (2009-12-10)

return l

# sysname RouterC # dhcp server ip-pool 1 network 30.1.0.0 mask 255.255.0.0 gateway-list 30.1.1.1 dns-list 30.1.1.1 domain-name ghi.com nbns-list 30.1.1.1 expired day 10 hour 12 # # dhcp server ip-pool 2 network 40.1.0.0 mask 255.255.0.0 gateway-list 40.1.1.1 dns-list 40.1.1.1 domain-name jkl.com nbns-list 40.1.1.1 expired day 10 hour 12 # interface Pos 1/0/0 undo shutdown ip address 202.40.1.2 255.255.0.0 # dhcp server forbidden-ip 30.1.1.1 dhcp server forbidden-ip 40.1.1.1 # ip route-static 30.1.0.0 255.255.0.0 202.40.1.1 ip route-static 40.1.0.0 255.255.0.0 202.40.1.1 # return
Issue 02 (2009-12-10)
4-57
5 IP Performance Configuration
5
About This Chapter
IP Performance Configuration
This chapter describes the parameters and function required for IP performance optimization and provides procedures and examples for optimizing IP performance. 5.1 IP Performance Overview This section describes the parameters and concepts concerning IP performance. 5.2 Improving IP Performance This section describes how to enhance the performance of a specified network through setting some IP parameters. 5.3 Configuring TCP This section describes how to configure a TCP timer and specify the size of a sliding window. 5.4 Configuring Load Balancing for IP Packet Forwarding This section describes how to configure the load balancing mode for IP packet forwarding and how to configure the Unequal Cost Multipath Protocol (UCMP). 5.5 Maintaining IP Performance This section describes how to clear IP/TCP/UDP statistics and debug IP/TCP/UDP. 5.6 Configuration Examples This section provides several configuration examples of the IP performance.
Issue 02 (2009-12-10)
5-1
5.1 IP Performance Overview

This section describes the parameters and concepts concerning IP performance. 5.1.1 Introduction to IP Performance 5.1.2 IP Performance Supported by the NE5000E
5.1.1 Introduction to IP Performance

IP performance optimization should be performed on the basis of configurations of some parameters and enablement of related functions, for example, the interface MTU, ICMP attributes, and TCP attributes. Internet Control Message Protocol (ICMP) messages are used by either the IP layer or the higher layer protocol (TCP or UDP). ICMP communicates error messages or other information that require attention.
5.1.2 IP Performance Supported by the NE5000E

ICMP
l
ICMP Host Unreachable messages When forwarding packets, the device discards the packets and returns an ICMP host unreachable message to the source to notify that the source must stop sending packets to this destination if the device encounters the following situations:

There is no route to the destination. The packet is not for itself.
ICMP Redirection messages During packet forwarding, if the device finds the following situations, the device needs to send an ICMP redirection message to the source device and notices the host to reselect a correct device to send packets.

The interfaces to receive and forward packets are the same. The selected route is not created or modified by the ICMP redirection packet. The selected route is not the route destined for the destination 0.0.0.0. The subnet mask bit of the source address is the same as that of the outgoing interface.
ICMP packet sending switches In normal circumstance, ICMP host unreachable and redirection messages can ensure normal packet transmission. However, when devices encounter the preceding conditions frequently, network traffic becomes heavy because devices send a large number of ICMP messages. This increases the traffic burden. In the case of malicious attacks, network congestion becomes worse. To solve this problem, the ICMP host unreachable function can be deployed on the outbound interface. If this function is disabled, the device does not send out ICMP host unreachable messages and as a result the traffic burden of the network is released and malicious attacks to the network is prevented.
5-2
Issue 02 (2009-12-10)
Unequal-Cost Load Balancing

The NE5000E supports Unequal-Cost Multiple Path (UCMP) among all equal-cost routes to the same destination. UCMP supports only flow-based IP packet forwarding. UCMP applies to only equal-cost routes. It is independent of routing protocols. That is, it does not concern whether the Interior Gateway Protocol (IGP) or the Border Gateway Protocol (BGP) is used. Among the paths that perform UCMP, the bandwidth of each path must not be lower than 1/16 of the total bandwidth; otherwise, the path does not participate in UCMP. The unequal-cost load balancing is classified into interface unequal-cost load balancing and global unequal-cost load balancing. The differences between these two modes are described as follows:
l
For the interface unequal-cost load balancing, you need to enable the unequal-cost load balancing on all the outgoing interfaces that can forward packets. For the global unequalcost load balancing, you need to enable the unequal-cost load balancing only in the system view. After the interface unequal-cost load balancing is enabled, you need to restart any interface to trigger the delivery FIB entries. After the global unequal-cost load balancing is enabled, FIB entries can be delivered automatically.
The interface unequal-cost load balancing and the global unequal-cost load balancing are mutually exclusive. You cannot enable both of them.
5.2 Improving IP Performance

This section describes how to enhance the performance of a specified network through setting some IP parameters. 5.2.1 Establishing the Configuration Task 5.2.2 Configuring the Maximum Transmission Unit of the Interface 5.2.3 Configuring ICMP Attributes 5.2.4 Checking the Configuration

In some special network environments, you must adjust the IP parameters to achieve the best performance. Improving IP performance involves configurations of a series of parameters.
Before improving IP performance, complete the following tasks:
l
Configuring the physical parameters for related interfaces and ensuring that the status of the physical layer of the interface is Up
Issue 02 (2009-12-10)
l
Configuring the link layer protocol for related interfaces and ensuring that the status of the link layer protocol on the interface is Up Configuring the IP addresses for related interfaces
Data Preparation
To improve IP performance, you need the following data. No. 1 2 3 4 5 Data Number and MTU value of the interface Number of the interface which needs source address verification Number of the interface which needs to forward broadcast packets and ACL number Number of the interface which needs to clear the DF Number of the interface which needs to configure ICMP host-unreachable
5.2.2 Configuring the Maximum Transmission Unit of the Interface

Context
Procedure
Step 1 Run:
system-view


mtu mtu
The maximum transmission unit of the interface is configured. ----End
Postrequisite
The MTU of the interface has the effects on whether to fragment the packets on the interface. The default MTU value varies with the interface type. Use the display interface command to find out the value used.

NOTE
After configuring the MTU on an interface, you must restart the interface; otherwise, the configuration cannot take effect. To restart the interface, run the restart command or the shutdown and then undo shutdown commands.
5.2.3 Configuring ICMP Attributes

Context
By default, sending unreachable packets is enabled.
CAUTION
l
If the transmission of ICMP host unreachable messages is disabled, the device no longer sends the ICMP host unreachable message.
Procedure
Step 1 Run:
system-view


icmp host-unreachable send
Sending ICMP host unreachable packets is enabled. ----End

Prerequisite
The configurations of the improving IP performance function are complete.
Procedure
l l Run the display udp statistics command to check the UDP traffic statistics. Run the display ip interface [ interface-type interface-number ] command or display ip interface brief [ interface-type [ interface-number ] | slot slot-id [ card card-number ] ] command to check the table information of the IP layer interface. Run the display ip statistics [ slot slot-id ] command to check the IP traffic statistics. Run the display icmp statistics [ slot slot-id ] command to check the ICMP traffic statistics.
l l
Issue 02 (2009-12-10)
l l
Run the display rawlink statistics command to check the Rawlink statistics. Run the display ip socket [ monitor ] [ task-id task-id socket-id socket-id | sock-type sock-type ] command to check all the current socket API information.
----End
Example
Run the display udp statistics command. If the UDP traffic statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display udp statistics Received packets: Total: 0 Total(64bit high-capacity counter): 0 checksum error: 0 shorter than header: 0, data length larger than packet: 0 unicast(no socket on port): 0 broadcast/multicast(no socket on port): 0 not delivered, input socket full: 0 input packets missing pcb cache: 0 Sent packets: Total: 0 Total(64bit high-capacity counter): 0
Run the display ip interface command. If the information about IP interfaces is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ip interface gigabitethernet 2/0/2 GigabitEthernet2/0/2 current state : UP Line protocol current state : UP The Maximum Transmit Unit : 1500 bytes input packets : 1338, bytes : 117744, multicasts : 1338 output packets : 1336, bytes : 106884, multicasts : 1336 Directed-broadcast packets: received packets: 0, sent packets: forwarded packets: 0, dropped packets: ARP packet input number: 0 Request packet: 0 Reply packet: 0 Unknown packet: 0 Internet Address is 120.1.1.1/24 Broadcast address : 120.1.1.255 TTL being 1 packet number: 0 TTL invalid packet number: 0 ICMP packet input number: 0 Echo reply: 0 Unreachable: 0 Source quench: 0 Routing redirect: 0 Echo request: 0 Router advert: 0 Router solicit: 0 Time exceed: 0 IP header bad: 0 Timestamp request: 0 Timestamp reply: 0 Information request: 0 Information reply: 0 Netmask request: 0 Netmask reply: 0 Unknown type: 0 DHCP packet deal mode: global
0 0
Run the display ip statistics command. If the IP traffic statistics are displayed, it means that the configuration succeeds. For example:

<HUAWEI> display ip statistics
Run the display icmp statistics command. If the ICMP traffic statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display icmp statistics Input: bad formats 0 echo 0 source quench 0 echo reply 0 timestamp 0 mask requests 0 time exceeded 0 Mping request 0 Output:echo 0 source quench 0 echo reply 0 timestamp 0 mask requests 0 time exceeded 0 Mping request 0 bad checksum destination unreachable redirects parameter problem information request mask replies Mping reply destination unreachable redirects parameter problem information reply mask replies Mping reply 0 0 0 0 0 0 0 0 0 0 0 0 0
Run the display rawlink statistics command. If the Rawlink statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display rawlink statistics Received packets: Total: 1771645 ifnet is null: 0 input packets missing pcb cache: 1181096 not pass multicast: 0 no join multicast: 0 full sock and pstMBuf to be freed: 0 full sock and nothing to be freed: 0 full sock and other reason: 0 Send packets: Total: 125850
5.3 Configuring TCP

This section describes how to configure a TCP timer and specify the size of a sliding window. 5.3.1 Establishing the Configuration Task 5.3.2 Configuring TCP Timer 5.3.3 Specifying the Size of a TCP Sliding Window 5.3.4 Checking the Configuration

None.
None.
Data Preparation
To configure TCP, you need the following data. No. 1 Data SYN-WAIT timer, FIN-WAIT timer, receiving and sending buffer size of the socket
5.3.2 Configuring TCP Timer

Context
The types of TCP timers are shown as follows:
l
The SYN-Wait timer: On sending SYN packets, the TCP starts the SYN-Wait timer. If response packets are not received before the SYN-Wait timer timeout, the TCP connection is terminated. The SYN-Wait timer timeout ranges from 2 seconds to 600 seconds, and the default value is 75 seconds. The FIN-Wait timer: When the TCP connection status turns from FIN_WAIT_1 to FIN_WAIT_2, the FIN-Wait timer starts. If FIN packets are not received before the FINWait timer timeout, the TCP connection is terminated. The FIN-Wait timer timeout ranges from 76 seconds to 3600 seconds, and the default value is 675 seconds.
Procedure
Step 1 Run:
system-view

tcp timer syn-timeout interval
The SYN-Wait timer of setting up TCP connections is configured. Step 3 Run:

tcp timer fin-timeout interval
The FIN_WAIT_2 timer of setting TCP connections is configured. ----End
5.3.3 Specifying the Size of a TCP Sliding Window

Context
Procedure
Step 1 Run:
system-view

tcp window window-size
The receiving/sending buffer size of the TCP socket is configured. The receiving and sending window-size of the connection-oriented socket: It ranges from 1K bytes to 32K bytes, and the default value is 8K bytes. ----End

Prerequisite
The configurations of TCP function are complete.
Procedure
l Run the display tcp status [ [ task-id task-id ] [ socket-id socket-id ] | [ local-ip ipv4address ] [ local-port local-port-number ] [ remote-ip ipv4-address ] [ remote-port remote-port-number ] ] command to check the TCP connection status. Run the display tcp statistics command to check the TCP traffic statistics.
----End
Example
Run the display tcp status command. If the information about the TCP connection status is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display tcp status TCPCB Tid/Soid Local Add:port 0a5d560c 30 /1 0.0.0.0:23 Foreign Add:port 0.0.0.0:0 VPNID State 14849 Listening
Run the display tcp statistics command. If the TCP traffic statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display tcp statistics Received packets: Total: 0 Total(64bit high-capacity counter): 0 packets in sequence: 0 (0 bytes) window probe packets: 0, window update packets: 0 checksum error: 0, offset error: 0, short error: 0 duplicate packets: 0 (0 bytes),partially duplicate packets: 0 (0 bytes) out-of-order packets: 0 (0 bytes) packets of data after window: 0 (0 bytes) packets received after close: 0 ACK packets: 0 (0 bytes) duplicate ACK packets: 0, too much ACK packets: 0 Sent packets:
Issue 02 (2009-12-10)
5-9
Total: 0 Total(64bit high-capacity counter): 0 urgent packets: 0 control packets: 0 (including 0 RST) window probe packets: 0, window update packets: 0 data packets: 0 (0 bytes),data packets retransmitted: 0 (0 bytes) ACK-only packets: 0 (0 delayed) Other information: Retransmitted timeout: 0, connections dropped in retransmitted timeout: 0 Keep alive timeout: 0, keep alive probe: 0, Keep alive timeout, so connections d isconnected : 0 Initiated connections: 0, accepted connections: 0, established connections: 0 Closed connections: 0 (dropped: 0, initiated dropped: 0) Packets dropped with MD5 authentication: 0 Packets permitted with MD5 authentication: 0
5.4 Configuring Load Balancing for IP Packet Forwarding

This section describes how to configure the load balancing mode for IP packet forwarding and how to configure the Unequal Cost Multipath Protocol (UCMP). 5.4.1 Establishing the Configuration Task 5.4.2 Configuring the Load Balancing Mode of IP Packet Forwarding 5.4.3 Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding 5.4.4 Configuring Global Unequal-Cost Multiple Path During IP Packet Forwarding 5.4.5 Checking the Configuration

The Equal Cost Multipath Protocol (ECMP) involves evenly distributing traffic among multiple equal-cost paths, regardless of the difference in path bandwidth. This, however, usually leads to the traffic congestion on the low-bandwidth path. The Unequal Cost Multipath Protocol (UCMP) involves proportionally distributing traffic among multiple equal-cost paths by considering the difference in path bandwidth. This can achieve more reasonable load balancing because traffic is proportionally distributed among paths.
Before configuring load balancing for IP packet forwarding, complete the following tasks:
l
Connecting interfaces and setting physical parameters for interfaces to ensure that the physical layer status of each interface is Up Setting parameters of the link layer protocol for interfaces to ensure that the status of the link layer protocol on each interface is Up
Data Preparation
To configure load balancing for IP packet forwarding, you need the following data.
No. 1 2
Data Interface type and interface number IP address and subnet mask for the interface
5.4.2 Configuring the Load Balancing Mode of IP Packet Forwarding

Context
Load balancing can be enable during IP packet forwarding. When flow-based load balancing is carried out, the device considers the protocol type, source IP address and mask, destination IP and mask, source port range, and destination port range and then adopts the hash algorithm to calculate a value. Based on the calculated value, it chooses a link to forward the packets. When packet-based load balancing is carried out, choose diverse links based on packets from multiple links to forward packets. By default, flow-based load balancing is adopted. Do as follows on the router:
Procedure
Step 1 Run:
system-view

l load-balance { flow | packet } [ all | slot slot-id ]
Packets on the device are load balanced.

l
No operation is required if load balancing is performed on received packets. The device performs load balancing in flow-by-flow mode on the received packets according to the source and destination IP addresses.
----End
5.4.3 Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding

Context
Do as follows on the router to implement the interface UCMP:
Procedure
Step 1 Run:
system-view

The interface view is displayed.

NOTE
The interface must be outgoing interfaces of equal-cost routes. The interface UCMP can be realized among paths only after all outgoing interfaces of equal-cost routes on the device are enabled with UCMP and FIB entry delivery is triggered; if one outgoing interface is not enabled with UCMP, Equal-Cost Multiple Path (ECMP) is performed among paths though FIB entry delivery is triggered.
Interface UCMP cannot be enabled globally or on logical interfaces. It can be enabled only on physical main interfaces. Step 3 Run:
load-balance unequal-cost enable
Interface UCMP is enabled for IP packet forwarding. Route recalculation and FIB entry delivery are not triggered at once after UCMP is enabled or disabled on the interface through command lines. FIB entry delivery is performed only after UCMP configurations are validated. Step 4 Run:
shutdown
The interface where UCMP is enabled is shut down. Step 5 Run:

undo shutdown
The interface is restarted for validating UCMP configurations. You can reset the interface where UCMP is enabled or disabled to trigger route recalculation and FIB entry delivery so that UCMP configurations can be validated.
NOTE
Restarting the interface is one method to trigger FIB entry delivery. You can also change the IP address of the interface to trigger FIB entry delivery and hence validate UCMP configurations.
----End
5.4.4 Configuring Global Unequal-Cost Multiple Path During IP Packet Forwarding

Context
Do as follows on the router to implement global UCMP:
Procedure
Step 1 Run:
system-view

load-balance unequal-cost enable
Global UCMP is enabled for IP packet forwarding. By default, global UCMP is disabled.
NOTE
l l
The interfaces that support the UCMP function are Ethernet interfaces, Gigabit Ethernet interfaces, POS interfaces, Eth-Trunk interfaces, and IP-Trunk interfaces. Frequent enabling and then disabling UCMP on an interface greatly degrades the system performance. Therefore, the interval from enabling UCMP to disabling UCMP or from disabling UCMP to enabling UCMP must be equal to or longer than 5 minutes.
----End

Prerequisite
All the load balancing configurations for IP packet forwarding are complete.
Procedure
l l l l Run the display fib [ slot-id ] command to check the FIB table of the interface board. Run the display fib acl acl-number [ verbose ] command to check the filtered FIB information. Run the display fib [ slot-id ] destination-address1 [ desinationt-mask1 ] [ longer ] [ verbose ] command to check the FIB entry which matches a destination address. Run the display fib [ slot-id ] destination-address1 destination-mask1 destinationaddress2 destination-mask2 [ verbose ] command to check the FIB entry whose destination address is in the range of destination-address1 destination-mask1 to destination-address2 destination-mask2. Run the display fib ip-prefix prefix-name [ verbose ] command to check the FIB entries that have passed filtering in a certain format according to the input IP prefix name. Run the display fib interface interface-type interface-number command to check the FIB entries that have passed filtering in a certain format according to the input interface type and interface number. Run the display fib next-hop ip-address command to check the FIB entries that have passed filtering in a certain format according to the input next hop address. Run the display fib [ slot-id ] statistics command to check the total number of FIB entries. Run the display fib [ slot-id ] [ | { begin | exclude | include } regular-expression ] command to check the summary of the FIB.
l l
l l l
----End
Example
Run the display fib command. If the brief information about the FIB is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display fib FIB Table: Total number of Routes : 3 Destination/Mask Nexthop Flag 169.254.0.0/16 2.1.1.1 U 2.0.0.0/16 2.1.1.1 U 127.0.0.0/8 127.0.0.1 U <HUAWEI> display fib acl 2010 Route entry matched by access-list 2010: Summary counts: 1 Destination/Mask Nexthop Flag 127.0.0.0/8 127.0.0.1 U
TimeStamp t[0] t[0] t[0]
Interface GE1/0/0 GE1/0/0 InLoop0
TunnelID 0x0 0x0 0x0
TimeStamp t[0]
Interface InLoop0
TunnelID 0x0
5.5 Maintaining IP Performance

This section describes how to clear IP/TCP/UDP statistics and debug IP/TCP/UDP. 5.5.1 Clearing IP Performance Statistics 5.5.2 Monitoring Network Operation Status of IP Performance 5.5.3 Debugging IP Performance
5.5.1 Clearing IP Performance Statistics

Context
CAUTION
IP/TCP/UDP statistics cannot be restored after you clear it. So, confirm the action before you use the command.
Procedure
l l l l l Run the reset ip statistics [ interface interface-type interface-number | slot slot-id ] command in the user view to clear the IP statistics. Run the reset ip socket monitor [ task-id task-id socket-id socket-id ] command in the user view to clear information on the socket monitor. Run the reset tcp statistics command in the user view to clear the TCP traffic statistics. Run the reset udp statistics command in the user view to clear the UDP traffic statistics. Run the reset rawlink statistics command in the user view to clear the Rawlink statistics.
----End
5-14
Issue 02 (2009-12-10)
5.5.2 Monitoring Network Operation Status of IP Performance

Context
In routine maintenance, you can run the following command in any view to check the operation of IP performance.
Procedure
l Run the display tcp status [ [ task-id task-id ] [ socket-id socket-id ] | [ local-ip ipv4address ] [ local-port local-port-number ] [ remote-ip ipv4-address ] [ remote-port remote-port-number ] ] command in any view to check TCP connection status. Run the display tcp statistics command in any view to check statistics about TCP traffic. Run the display udp statistics command in any view to check statistics about UDP traffic. Run the display ip interface [ interface-type interface-number ] command or display ip interface brief [ interface-type [ interface-number ] | slot slot-id [ card card-number ] ] command in any view to check information about IP interfaces. Run the display ip statistics [ slot slot-id ] command in any view to check statistics about IP traffic. Run the display icmp statistics [ slot slot-id ] command in any view to check statistics about ICMP traffic. Run the display rawlink statistics command in any view to check statistics about Rawlink. Run the display fib [ slot-id ] command in any view to check the FIB on the specified interface board. Run the display fib acl acl-number [ verbose ] command in any view to check the FIB information selectively through filtering. Run the display fib [ slot-id ] destination-address1 [ desinationt-mask1 ] [ longer ] [ verbose ] command in any view to filter FIB entries by matching destination IP addresses. Run the display fib [ slot-id ] destination-address1 destination-mask1 destinationaddress2 destination-mask2 [ verbose ] command in any view to check the FIB entries with the destination IP addresses in the range from destination-address1 destinationmask1 to destination-address2 destination-mask2. Run the display fib ip-prefix prefix-name [ verbose ] command in any view to check the FIB entries that have passed filtering in a certain format according to the input IP prefix name. Run the display fib interface interface-type interface-number command in any view to check the FIB entries that have passed filtering in a certain format according to the input interface type and interface number. Run the display fib next-hop ip-address command in any view to check the FIB entries that have passed filtering in a certain format according to the input next hop address. Run the display fib [ slot-id ] statistics command in any view to check the total number of FIB entries. Run the display fib [ slot-id ] [ | { begin | exclude | include } regular-expression ] command in any view to check brief information about the forwarding table. Run the display ip socket [ monitor ] [ task-id task-id socket-id socket-id | sock-type sock-type ] command in any view to check information about all the socket interfaces of the system.
l l l
l l l l l l l
l l l l
----End
5.5.3 Debugging IP Performance

Context
CAUTION
Debugging affects the performance of the system. So after debugging, run the undo debugging all command to disable it immediately. Run the following debugging commands in the user view to debug IP/TCP/UDP/RAWIP/ RAWLINK and locate the fault. For the procedure for displaying the debugging information, refer to chapter "Information Center Configuration" in the NE5000E Core Router Configuration Guide - System Management. For descriptions about the debugging commands, refer to the NE5000E Core Router Debugging Reference.
Procedure
l l l Run the debugging ip packet [ error ] [ acl acl-number ] [ verbose ] command in the user view to debug IP packets. Run the debugging ip icmp [ verbose ] command in the user view to debug ICMP. Run the debugging udp packet [ src-ip src-address ] [ src-port src-port ] [ dest-ip destaddress ] [ dest-port dest-port ] command or debugging udp packet [ task-id task-id ] [ socket-id socket-id ] command in the user view to debug UDP packets. Run the debugging tcp packet [ src-ip src-address ] [ src-port src-port ] [ dest-ip destaddress ] [ dest-port dest-port ] [ flag flag-number ] command or debugging tcp packet [ task-id task-id ] [ socket-id socket-id ] [ flag flag-number ] command in the user view to debug TCP packets. Run the debugging tcp event [ local-ip local-address ] [ local-port local-port ] [ remoteip remote-address ] [ remote-port remote-port ] command or debugging tcp event [ taskid task-id ] [ socket-id socket-id ] command in the user view to debug TCP event. Run the debugging tcp md5 [ src-ip src-address ] [ src-port src-port ] [ dest-ip destaddress ] [ dest-port dest-port ] command or debugging tcp md5 [ task-id task-id ] [ socket-id socket-id ] command in the user view to debug TCP MD5 authentication. Run the debugging rawip packet [ src-ip src-address ] [ dest-ip dest-address ] [ protocol protocol-number ] [ verbose verbose-number ] command or debugging rawip packet [ task-id task-id ] [ socket-id socket-id ] [ verbose verbose-number ] command in the user view to debug RAWIP packets. Run the debugging rawlink packet [ src-mac src-mac ] [ dest-mac dest-mac ] [ verbose verbose-number ] command or debugging rawlink packet [ task-id task-id ] [ socket-id socket-id ] [ verbose verbose-number ] command in the user view to debug RAWLINK packets.
----End
5-16
Issue 02 (2009-12-10)

This section provides several configuration examples of the IP performance. 5.6.1 Example for Limiting Transmission of ICMP Host-Unreachable Packets 5.6.2 Example for Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding 5.6.3 Example for Configuring Global Unequal-Cost Load Balancing for IP Packet Forwarding
5.6.1 Example for Limiting Transmission of ICMP HostUnreachable Packets

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 5-1, Router A, Router B and Router C are connected with each other through their Ethernet ports to test limiting transmission of host-unreachable packets. Figure 5-1 Networking diagram of configuring ICMP host unreachable packets
RouterA
GE 1/0/0 1.1.1.1/24
Internet
GE 1/0/0 2.2.2.2/24 GE 1/0/0 1.1.1.2/24
RouterC
RouterB
The configuration roadmap is as follows:
1. 2. 3.
Configure IP addresses for the interfaces on devices. Configure static routes between devices that are not directly connected. Enable limiting transmission of ICMP Host-unreachable packets.
Data Preparation
l l
Static routes between devices that are not directly connected IP addresses for the interfaces
Procedure
Step 1 Configure Router A. # Configure static routes on Router A.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] ip route-static 2.2.2.2 24 1.1.1.2
# Configure an IP address for GE 1/0/0.

[RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 1.1.1.1 24 [RouterA-GigabitEthernet1/0/0] undo shutdown [RouterA-GigabitEthernet1/0/0] quit
Step 2 Configure Router B. # Disable sending ICMP host unreachable packets on Router B and configure an IP address for GE 1/0/0.
<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] undo icmp host-unreachable send [RouterB-GigabitEthernet1/0/0] ip address 1.1.1.2 24 [RouterB-GigabitEthernet1/0/0] undo shutdown [RouterB-GigabitEthernet1/0/0] quit [RouterB] quit
Step 3 Configure Router C. # Configure an IP address for GE 1/0/0 on Router C.

<HUAWEI> system-view [HUAWEI] sysname RouterC [RouterC] interface gigabitethernet 1/0/0 [RouterC-GigabitEthernet1/0/0] ip address 2.2.2.2 24 [RouterC-GigabitEthernet1/0/0] undo shutdown [RouterC-GigabitEthernet1/0/0] quit
Step 4 Verify the configuration. # Enable the debugging of the ICMP packets of Router B.
<RouterB> debugging ip icmp
# Run the ping 2.2.2.2 command on Router A. If you can view that Router B does not send the host unreachable packets, it means that the configuration succeeds. For example:

[RouterA] ping 2.2.2.2
----End
Configuration Files
l

# sysname RouterA # interface GigabitEthernet1/0/0 undo shutdown ip address 1.1.1.1 255.255.255.0 # ip route-static 2.2.2.0 255.255.255.0 1.1.1.2 # return

# sysname RouterB # interface GigabitEthernet1/0/0 undo shutdown ip address 1.1.1.2 255.255.255.0 undo icmp host-unreachable send # return

# sysname RouterC # interface GigabitEthernet1/0/0 undo shutdown ip address 2.2.2.2 255.255.255.0 # return
5.6.2 Example for Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The slot number is chassis ID/slot ID. As shown in Figure 5-2, three paths exist between Router A and Router E. The three paths respectively travel through Router B, Router C, and Router D. It is required that the three paths between Router A and Router E perform UCMP during IP packet forwarding. In the example, the unequal-cost load balancing refers to the interface unequal-cost load balancing.
Issue 02 (2009-12-10)
5-19
Figure 5-2 Networking diagram of configuring UCMP

RouterB POS1/0/0 POS2/0/0
POS4/0/0 POS4/0/0 RouterC RouterA RouterE GE3/0/0 GE1/0/0 GE2/0/0 GE3/0/0 GE1/0/0 GE1/0/0 10.1.1.1/24 20.1.1.1/24 GE2/0/0 GE2/0/0 RouterD GE1/0/0
router RouterA Interface POS4/0/0 GE3/0/0 GE2/0/0 RouterB RouterC RouterD RouterE POS1/0/0 POS2/0/0 GE1/0/0 GE2/0/0 GE1/0/0 GE2/0/0 POS4/0/0 GE3/0/0 GE2/0/0
GE2/0/0
IP address 30.1.1.1/24 40.1.1.1/24 50.1.1.1/24 30.1.1.2/24 60.1.1.2/24 40.1.1.2/24 70.1.1.2/24 50.1.1.2/24 80.1.1.2/24 60.1.1.1/24 70.1.1.1/24 80.1.1.1/24
The configuration roadmap is as follows: 1. 2. Configure IGP on each device. Here, Intermediate System to Intermediate System (IS-IS) is taken as an example. Enable the UCMP function on each interface of Router A so that the three paths between Router A and Router E can perform UCMP during IP packet forwarding.
Data Preparation
l l l
Interface type and number IP address of the interface IS-IS area ID and IS-IS level of each device
5-20
Issue 02 (2009-12-10)
Procedure
Step 1 Configure an IP address for each interface. The detailed configuration procedure is not mentioned here. Step 2 Configure basic IS-IS functions. # Configure Router A.
[RouterA] isis 1 [RouterA-isis-1] is-level level-1 [RouterA-isis-1] network-entity 10.0000.0000.0001.00 [RouterA-isis-1] quit [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] isis enable 1 [RouterA-GigabitEthernet1/0/0] quit [RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] isis enable 1 [RouterA-GigabitEthernet2/0/0] quit [RouterA] interface pos 4/0/0 [RouterA-Pos4/0/0] isis enable 1 [RouterA-Pos4/0/0] quit [RouterA] interface gigabitethernet 3/0/0 [RouterA-GigabitEthernet3/0/0] isis enable 1 [RouterA-GigabitEthernet3/0/0] quit
[RouterB] isis 1 [RouterB-isis-1] is-level level-1 [RouterB-isis-1] network-entity 10.0000.0000.0002.00 [RouterB-isis-1] quit [RouterB] interface pos 1/0/0 [RouterB-Pos1/0/0] isis enable 1 [RouterB-Pos1/0/0] quit [RouterB] interface pos 2/0/0 [RouterB-Pos2/0/0] isis enable 1 [RouterB-Pos2/0/0] quit
# Configure Router C.
[RouterC] isis 1 [RouterC-isis-1] is-level level-1 [RouterC-isis-1] network-entity 10.0000.0000.0003.00 [RouterC-isis-1] quit [RouterC] interface gigabitethernet 1/0/0 [RouterC-GigabitEthernet1/0/0] isis enable 1 [RouterC-GigabitEthernet1/0/0] quit [RouterC] interface gigabitethernet 2/0/0 [RouterC-GigabitEthernet2/0/0] isis enable 1 [RouterC-GigabitEthernet2/0/0] quit
# Configure Router D.
[RouterD] isis 1 [RouterD-isis-1] is-level level-1 [RouterD-isis-1] network-entity 10.0000.0000.0004.00 [RouterD-isis-1] quit [RouterD] interface gigabitethernet 1/0/0 [RouterD-GigabitEthernet1/0/0] isis enable 1 [RouterD-GigabitEthernet1/0/0] quit [RouterD] interface gigabitethernet 2/0/0 [RouterD-GigabitEthernet2/0/0] isis enable 1 [RouterD-GigabitEthernet2/0/0] quit
# Configure Router E.
[RouterE] isis 1 [RouterE-isis-1] is-level level-1
Issue 02 (2009-12-10)
5-21
[RouterE-isis-1] network-entity 10.0000.0000.0005.00 [RouterE-isis-1] quit [RouterE] interface gigabitethernet 1/0/0 [RouterE-GigabitEthernet1/0/0] isis enable 1 [RouterE-GigabitEthernet1/0/0] quit [RouterE] interface gigabitethernet 2/0/0 [RouterE-GigabitEthernet2/0/0] isis enable 1 [RouterE-GigabitEthernet2/0/0] quit [RouterE] interface pos 4/0/0 [RouterE-Pos4/0/0] isis enable 1 [RouterE-Pos4/0/0] quit [RouterE] interface gigabitethernet 3/0/0 [RouterE-GigabitEthernet3/0/0] isis enable 1 [RouterE-GigabitEthernet3/0/0] quit
Step 3 Check basic IS-IS configurations. # View IS-IS routing information on Router A.
[RouterA] display isis route Route information for ISIS(1) ----------------------------ISIS(1) Level-1 Forwarding Table -------------------------------IPV4 Destination IntCost ExtCost ExitInterface NextHop Flags -------------------------------------------------------------------------------10.1.1.0/24 10 NULL GE1/0/0 Direct D/-/ L/-/20.1.1.0/24 30 NULL GE3/0/0 40.1.1.2 A/-/-/-/ C GE2/0/0 50.1.1.2 Pos4/0/0 30.1.1.2 30.1.1.0/24 10 NULL Pos4/0/0 Direct D/L/40.1.1.0/24 10 NULL GE3/0/0 Direct D/L/50.1.1.0/24 10 NULL GE2/0/0 Direct D/L/60.1.1.0/24 20 NULL Pos4/0/0 30.1.1.2 R/-/70.1.1.0/24 20 NULL GE3/0/0 40.1.1.2 A/-/-/-/80.1.1.0/24 20 NULL GE2/0/0 50.1.1.2 R/-/Flags: D-Direct, A-Added to URT, L-Advertised in LSPs, S-IGP Shortcut, U-Up/Down Bit Set, C-In Computing
# Ping 20.1.1.1 from Router A. By viewing the display on the Network Management Station (NM Station), you can find that equal-cost load balancing is implemented among outgoing interfaces.
<RouterA> ping 20.1.1.1 PING 20.1.1.1: 56 data bytes, press CTRL_C to break Reply from 20.1.1.1: bytes=56 Sequence=1 ttl=254 time=16 ms Reply from 20.1.1.1: bytes=56 Sequence=2 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=3 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=4 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=5 ttl=254 time=64 ms --- 20.1.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/16/64 ms
Step 4 Enable UCMP on each outgoing interface of Router A.

[RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] load-balance unequal-cost enable [RouterA-GigabitEthernet2/0/0] quit [RouterA] interface pos 4/0/0 [RouterA-Pos4/0/0] load-balance unequal-cost enable [RouterA-Pos4/0/0] quit
5-22
Issue 02 (2009-12-10)
[RouterA] interface gigabitethernet 3/0/0 [RouterA-GigabitEthernet3/0/0] load-balance unequal-cost enable [RouterA-GigabitEthernet3/0/0] quit
Step 5 Re-enable GigabitEthernet2/0/0, GigabitEthernet3/0/0, and POS4/0/0 to validate UCMP configurations on Router A.
[RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] shutdown [RouterA-GigabitEthernet2/0/0] undo shutdown [RouterA-GigabitEthernet2/0/0] quit [RouterA] interface gigabitethernet 3/0/0 [RouterA-GigabitEthernet3/0/0] shutdown [RouterA-GigabitEthernet3/0/0] undo shutdown [RouterA-GigabitEthernet3/0/0] quit [RouterA]interface pos 4/0/0 [RouterA-Pos4/0/0] shutdown [RouterA-Pos4/0/0] undo shutdown
Step 6 Verify the configuration. # Ping 20.1.1.1 from Router A. By viewing the display on the NM Station, you can find that UCMP is realized among outgoing interfaces.
<RouterA> ping 20.1.1.1 PING 20.1.1.1: 56 data bytes, press CTRL_C to break Reply from 20.1.1.1: bytes=56 Sequence=1 ttl=254 time=16 ms Reply from 20.1.1.1: bytes=56 Sequence=2 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=3 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=4 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=5 ttl=254 time=64 ms --- 20.1.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/16/64 ms
----End
Configuration Files
l

# sysname RouterA # isis 1 is-level level-1 network-entity 10.0000.0000.0001.00 # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 isis enable 1 # interface GigabitEthernet2/0/0 undo shutdown load-balance unequal-cost enable ip address 50.1.1.1 255.255.255.0 isis enable 1 # interface GigabitEthernet3/0/0 undo shutdown load-balance unequal-cost enable ip address 40.1.1.1 255.255.255.0 isis enable 1 # interface Pos4/0/0
Issue 02 (2009-12-10)
5-23
link-protocol ppp undo shutdown load-balance unequal-cost enable ip address 30.1.1.1 255.255.255.0 isis enable 1 # return l

# sysname RouterB # isis 1 is-level level-1 network-entity 10.0000.0000.0002.00 # interface Pos1/0/0 undo shutdown link-protocol ppp ip address 30.1.1.2 255.255.255.0 isis enable 1 # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 60.1.1.2 255.255.255.0 isis enable 1 # return

# sysname RouterC # isis 1 is-level level-1 network-entity 10.0000.0000.0003.00 # interface GigabitEthernet1/0/0 undo shutdown ip address 40.1.1.2 255.255.255.0 isis enable 1 # interface GigabitEthernet2/0/0 undo shutdown ip address 70.1.1.2 255.255.255.0 isis enable 1 # return
Configuration file of Router D

# sysname RouterD # isis 1 is-level level-1 network-entity 10.0000.0000.0004.00 # interface GigabitEthernet1/0/0 undo shutdown ip address 50.1.1.2 255.255.255.0 isis enable 1 # interface GigabitEthernet2/0/0 undo shutdown ip address 80.1.1.2 255.255.255.0 isis enable 1 # return
5-24
Issue 02 (2009-12-10)

l
Configuration file of Router E

# sysname RouterE # isis 1 is-level level-1 network-entity 10.0000.0000.0005.00 # interface GigabitEthernet1/0/0 undo shutdown ip address 20.1.1.1 255.255.255.0 isis enable 1 # interface GigabitEthernet2/0/0 undo shutdown ip address 80.1.1.1 255.255.255.0 isis enable 1 # interface GigabitEthernet3/0/0 undo shutdown ip address 70.1.1.1 255.255.255.0 isis enable 1 # interface Pos4/0/0 link-protocol ppp undo shutdown ip address 60.1.1.1 255.255.255.0 isis enable 1 # return
5.6.3 Example for Configuring Global Unequal-Cost Load Balancing for IP Packet Forwarding
CAUTION
For the NE5000E, an interface is numbered in the format of slot number/card number/interface number. For the NE5000E cluster, an interface is numbered in the format of chassis ID/slot number/card number/interface number. If the slot number is specified, the chassis ID of the slot must also be specified. As shown in Figure 5-3, Router A and Router C are connected through two links.
l l
GE 2/0/0 on Router A and GE 2/0/0 on Router B are connected through a physical link. Eth-Trunk1 interface on Router A has two member interfaces, GE 3/0/0 and GE 4/0/0; EthTrunk1 interface on Router B has two member interfaces, GE 3/0/0 and GE 4/0/0.
Eth-Trunk1 interface has two GE interfaces, and thus the bandwidth of Eth-Trunk1 interface is twice that of a single physical link. It is aimed to perform unequal-cost load balancing for IP packet forwarding in the two links between Router A and Router C. In the example, unequalcost load balancing refers to global unequal-cost load balancing.
Issue 02 (2009-12-10)
5-25
Figure 5-3 Networking diagram of configuring unequal-cost load balancing
RouterA GE2/0/0 GE3/0/0 GE10/0 10.1.1.1/24

Device Name Router A Router B
Eth-Trunk1
RouterB GE2/0/0 GE3/0/0 GE4/0/0
RouterC GE2/0/2 GE1/0/0 20.1.1.1/24
GE4/0/0
Interface Name GE 2/0/0 Eth-Trunk1 GE 2/0/0 Eth-Trunk1 GE 2/0/2
GE2/0/2
IP Address 30.1.1.1/24 40.1.1.1/24 30.1.1.2/24 40.1.1.2/24 50.1.1.1/24 50.1.1.2/24
Router C
GE 2/0/2
The configuration roadmap is as follows: 1. 2. Configure a static route on each device. Enable unequal-cost load balancing on Router B so that the two links between Router A and Router C can perform unequal-cost load balancing for IP packet forwarding.
Data Preparation
l l l
Interface type and number IP address of each interface Number of the Eth-Trunk
Procedure
Step 1 Configure an IP address for each interface. The configuration details are not mentioned here. Step 2 Configure a static route. # Configure Router A.
[RouterA] [RouterA] [RouterA] [RouterA] ip ip ip ip route-static route-static route-static route-static 20.1.1.0 20.1.1.0 50.1.1.0 50.1.1.0 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 gigabitethernet2/0/0 30.1.1.2 eth-trunk1 40.1.1.2 gigabitethernet2/0/0 30.1.1.2 eth-trunk1 40.1.1.2
[RouterB] ip route-static 10.1.1.0 255.255.255.0 gigabitethernet2/0/0 30.1.1.1 [RouterB] ip route-static 10.1.1.0 255.255.255.0 eth-trunk1 40.1.1.1 [RouterB] ip route-static 20.1.1.0 255.255.255.0 gigabitethernet2/0/2 50.1.1.2
# Configure Router C.
[RouterC] ip route-static 10.1.1.0 255.255.255.0 gigabitethernet2/0/2 50.1.1.1
5-26
Issue 02 (2009-12-10)
[RouterC] ip route-static 30.1.1.0 255.255.255.0 gigabitethernet2/0/2 50.1.1.1 [RouterC] ip route-static 40.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.1
Step 3 Enable unequal-cost load balancing on Router B.

[RouterB] load-balance unequal-cost enable
Step 4 Verify the configuration. # Router C can ping through 10.1.1.1. Run the display fib verbose command to view bandwidth information of the outbound interface. The command output shows that the bandwidth of EthTrunk1 interface is twice that of GE 2/0/0. This indicates that unequal-cost load balancing is enabled.
[RouterC] ping -c 100 -t 10 -m 10 10.1.1.1 PING 10.1.1.1: 56 data bytes, press CTRL_C to break Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=254 time=3 ms Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=254 time=1 ms Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=254 time=1 ms ... --- 10.1.1.1 ping statistics --100 packet(s) transmitted 99 packet(s) received 1.00% packet loss round-trip min/avg/max = 1/1/6 ms [RouterB] display fib 10.1.1.1 verbose Route Entry Count: 2 Destination: 10.1.1.0 Mask : 255.255.255.0 Nexthop : 30.1.1.1 OutIf : GigabitEthernet2/0/2 LocalAddr : 30.1.1.2 LocalMask: 0.0.0.0 Flags : GSU Age : 11128sec ATIndex : 0 Slot : 2 LspFwdFlag : 0 LspToken : 0x0 InLabel : NULL OriginAs : 0 BGPNextHop : 0.0.0.0 PeerAs : 0 QosInfo : 0x0 OriginQos: 0x0 NexthopBak : 0.0.0.0 OutIfBak : [No Intf] LspTokenBak: 0x0 InLabelBak : NULL LspToken_ForInLabelBak : 0x0 EntryRefCount : 0 VlanId : 0x0 LspType : 0 Label_ForLspTokenBak : 0 MplsMtu : 0 Gateway_ForLspTokenBak : 0 NextToken : 0x0 IfIndex_ForLspTokenBak : 0 Label_NextToken : 0 Label : 0 LspBfdState : 0 OutIfSpeed(Kbits/sec) : 1000000 Destination: 10.1.1.0 Nexthop : 40.1.1.1 LocalAddr : 40.1.1.2 Flags : GSU ATIndex : 0 LspFwdFlag : 0 InLabel : NULL BGPNextHop : 0.0.0.0 QosInfo : 0x0 NexthopBak : 0.0.0.0 LspTokenBak: 0x0 LspToken_ForInLabelBak : 0x0 EntryRefCount : 0 VlanId : 0x0 LspType : 0 MplsMtu : 0 NextToken : 0x0 Label_NextToken : 0 LspBfdState : 0 OutIfSpeed(Kbits/sec) : 2000000 Mask : OutIf : LocalMask: Age : Slot : LspToken : OriginAs : PeerAs : OriginQos: OutIfBak : InLabelBak 255.255.255.0 Eth-Trunk1 0.0.0.0 11128sec 0 0x0 0 0 0x0 [No Intf] : NULL
Label_ForLspTokenBak : 0 Gateway_ForLspTokenBak : 0 IfIndex_ForLspTokenBak : 0 Label : 0
----End
Configuration Files
l

# sysname RouterA # interface Eth-Trunk1 ip address 40.1.1.1 255.255.255.0 # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 # interface GigabitEthernet2/0/0 undo shutdown ip address 30.1.1.1 255.255.255.0 # interface GigabitEthernet3/0/0 undo shutdown eth-trunk 1 # interface GigabitEthernet4/0/0 undo shutdown eth-trunk 1 # ip route-static 20.1.1.0 255.255.255.0 ip route-static 20.1.1.0 255.255.255.0 ip route-static 50.1.1.0 255.255.255.0 ip route-static 50.1.1.0 255.255.255.0 #
GigabitEthernet2/0/0 30.1.1.2 Eth-Trunk1 40.1.1.2 GigabitEthernet2/0/0 30.1.1.2 Eth-Trunk1 40.1.1.2

# sysname RouterB # load-balance unequal-cost enable # interface Eth-Trunk1 ip address 40.1.1.2 255.255.255.0 # interface GigabitEthernet2/0/0 undo shutdown ip address 30.1.1.2 255.255.255.0 # interface GigabitEthernet2/0/2 undo shutdown ip address 50.1.1.1 255.255.255.0 # interface GigabitEthernet3/0/0 undo shutdown eth-trunk 1 # interface GigabitEthernet4/0/0 undo shutdown eth-trunk 1 # ip route-static 10.1.1.0 255.255.255.0 GigabitEthernet2/0/0 30.1.1.1 ip route-static 10.1.1.0 255.255.255.0 Eth-Trunk1 40.1.1.1 ip route-static 20.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.2 # return

# sysname RouterC # ip route-static 10.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.1 ip route-static 30.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.1 ip route-static 40.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.1
5-28
Issue 02 (2009-12-10)

# interface GigabitEthernet1/0/0 undo shutdown ip address 20.1.1.1 255.255.255.0 # interface GigabitEthernet2/0/2 undo shutdown ip address 50.1.1.2 255.255.255.0 # return
Issue 02 (2009-12-10)
5-29
6 ACL Configuration
6
About This Chapter
ACL Configuration
This chapter describes the fundamentals of ACL along with its types such as basic, advanced and interface based ACL. It also includes basic ACL configuration steps, along with typical examples. 6.1 ACL Overview This section describes basic concepts and parameters of Access Control List (ACL). 6.2 Configuring an Interface-based ACL This section describes how to configure an Interface-based ACL. 6.3 Configuring a Basic ACL This section describes how to configure basic ACL. 6.4 Configuring an Advanced ACL This section describes how to configure the Advanced ACL. 6.5 Configuring an ACL Based on the Ethernet Frame Header This section describes how to configure the Ethernet frame header-based ACL. 6.6 Configuring a Named ACL This section describes how to configure the Named ACL. 6.7 Maintaining an ACL This section describes how to Maintain an ACL. 6.8 Configuration Examples This section provides a configuration example of ACL.
Issue 02 (2009-12-10)
6-1
6 ACL Configuration
6.1 ACL Overview

This section describes basic concepts and parameters of Access Control List (ACL). 6.1.1 Introduction to ACL 6.1.2 ACL Supported by the NE5000E
6.1.1 Introduction to ACL

To enable a device to filter the passing packets, you can configure a series of rules on the device to determine what kinds of packets can pass filtering. The rules configured on the device are called Access Control List (ACL) rules. An ACL includes a group of orderly rules that consist of rule { deny | permit } clauses. The rules are described with some parameters, such as based on the source address, the destination address, and the port number of data packets. The ACL classifies data packets according to these rules. After these rules are applied to the device, the device can determine whether to receive or deny packets. The ACL is classified into these types:
l l
Basic ACL: classifies packets based on the source address. Advanced ACL: classifies packets more detailedly based on the source address, destination address, source port number, destination port number, and protocol type. Interface-based ACL: classifies packets based on the interface from which the packets are received. Ethernet Frame Header ACL: classifies packets more detailedly based on the source MAC address and destination MAC address.
NOTE
Actually, an ACL is a group of rules used to define classes of packets. It cannot be used to filter packet. For detailed processing methods of packets, you need to import detailed functions of ACL. In the NE5000E, the ACL must be in conjunction with some functions, such as policy-based routing (PBR), firewall, and traffic classification to filter packets. The default action defined in the ACL rule is deny. Therefore, to allow the subsequent flows to pass, you need to specify the action in the ACL rule to permit.
6.1.2 ACL Supported by the NE5000E

The NE5000E supports an interface-based ACLs, basic ACLs, advanced ACLs, Ethernet frame header-based ACLs.
6.2 Configuring an Interface-based ACL

This section describes how to configure an Interface-based ACL. 6.2.1 Establishing the Configuration Task 6.2.2 (Optional) Creating a Time Range 6.2.3 Creating an Interface-based ACL
6 ACL Configuration
6.2.4 (Optional) Configuring ACL Descriptions 6.2.5 (Optional) Configuring ACL Step 6.2.6 Checking the Configuration

An ACL can be applied to various services such as route policies and packet filtering. It distinguishes different kinds of packets for different processing.
None.
Data Preparation
To configure an ACL, you need the following data. No. 1 2 3 4 5 Data (Optional) Name of the time range in which the Interface-based ACL takes effect and the start time and end time of the time range Rule ID of the Interface-based ACL, permit or deny rule Interface type and Interface number of the interfac in which the Interface-based ACL takes effect (Optional) Description of the Interface-based ACL (Optional) Step of the Interface-based ACL
6.2.2 (Optional) Creating a Time Range

Context
Procedure
Step 1 Run:
system-view

time-range time-name { start-time to end-time days | from time1 date1 [ to time2 date2 ] }
An ACL time range is created.

6 ACL Configuration
You can configure multiple time ranges at the same name. ----End
6.2.3 Creating an Interface-based ACL

Context
The range of acl-number of an interface-based ACL is 1000 to 1999. Do as follows on the router:
Procedure
Step 1 Run:
system-view

acl [ number ] acl-number [ match-order { auto | config } ]
An interface-based ACL is created. Step 3 Run:

rule [ rule-id ] { deny | permit } interface { interface-type interface-number | any } [ logging | time-range time-name ] *
ACL rules are defined. interface-type interface-number indicates the specified interface type and interface number. any indicates any interface. logging takes effect on only software-based forwarding such as the application of a routing policy. ----End
6.2.4 (Optional) Configuring ACL Descriptions

Context
Procedure
Step 1 Run:
system-view

acl acl-number
The ACL view is displayed. Step 3 Run:

description text
6-4
Issue 02 (2009-12-10)
6 ACL Configuration
ACL description is created. The ACL description covers the function of ACL rules. Its length should be less than 127 characters. ----End
6.2.5 (Optional) Configuring ACL Step

Context
Procedure
Step 1 Run:
system-view


step step
ACL step is configured. Note the following when modifying ACL configurations:
l l
The undo step command restores the step to the default and realigns ACL rules. The default step of the ACL rule is 5.
----End

Prerequisite
The configurations of the ACL function are complete.
Procedure
l l Run the display acl { acl-number | all } command to check the configured ACL rule. Run the display statistics acl { acl-number | all }control-plane [ | { begin | include | exclude } regular-expression ] command to check the statistics about the packets matching the ACL rule in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
6 ACL Configuration
Example
Run the display acl command. If the ACL number, the number of rules, and detailed step description, and ACL rules are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display acl 1200 Interface Based ACL 1200, 1 rule Acl's step is 5 rule 5 permit interface Pos4/0/0
Using the display statistics acl control-plane command, you can view the statistics about the packets matching the ACL rule in soft forwarding.
<HUAWEI> display statistics acl 1000 control-plane Interface Based ACL 1000, 1 rule Acl's step is 5 rule 5 deny interface any (10 times matched)
Run the display time-range command. If the configuration and status of the current time range are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display time-range all Current time is 14:19:16 3-15-2006 Wednesday Time-range : time1 ( Inactive ) 10:00 to 12:00 daily Time-range : time2 ( Inactive ) from 13:00 2006/4/1 to 23:59 2099/12/31 Time-range : active1 ( Active ) 14:00 to 00:00 daily
6.3 Configuring a Basic ACL

This section describes how to configure basic ACL. 6.3.1 Establishing the Configuration Task 6.3.2 (Optional) Creating a Time Range 6.3.3 Creating a Basic ACL 6.3.4 (Optional) Configuring ACL Descriptions 6.3.5 (Optional) Configuring ACL Step 6.3.6 Checking the Configuration

An ACL can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types. When defining rules for a basic ACL, you need to specify source IP addresses.
None.
6 ACL Configuration
Data Preparation
To configure a basic ACL, you need the following data. No. 1 2 3 4 5 Data (Optional) Name of the time range in which the basic ACL takes effect and the start time and end time of the time range Number of the basic ACL Rule ID of the basic ACL, permit or deny rule, and source IP address (Optional) Description of the basic ACL (Optional) Step of the basic ACL

Context
Procedure
Step 1 Run:
system-view

An ACL time range is created. You can configure multiple time ranges at the same name. ----End
6.3.3 Creating a Basic ACL

Context
The range of acl-number of a basic ACL is 2000 to 2999. Do as follows on the router:
Procedure
Step 1 Run:
system-view
Issue 02 (2009-12-10)
6-7
6 ACL Configuration

A basic ACL is created. Step 3 Run:

rule [ rule-id ] { deny | permit } [ fragment-type fragment-type-name | source { source-ip-address soucer-wildcard | any } | time-range time-name | vpn-instance vpn-instance-name ]*
ACL rules are defined. ----End

Context
Procedure
Step 1 Run:
system-view

acl acl-number

description text

Context
Procedure
Step 1 Run:
system-view

6 ACL Configuration
Step 2 Run:

step step
l l
----End

Prerequisite
Procedure
----End
Example
<HUAWEI> display acl 2000 Basic ACL 2000, 1 rule Acl's step is 5 rule 5 deny source 10.1.1.1 0
<HUAWEI> display statistics acl 2000 control-plane Basic ACL 2000, 1 rule Acl's step is 5 rule 5 deny source 10.1.1.1 0 (234 times matched)
<HUAWEI> display time-range all Current time is 14:19:16 3-15-2006 Wednesday Time-range : time1 ( Inactive ) 10:00 to 12:00 daily Time-range : time2 ( Inactive ) from 13:00 2006/4/1 to 23:59 2099/12/31
Issue 02 (2009-12-10)
6-9
6 ACL Configuration
Time-range : active1 ( Active ) 14:00 to 00:00 daily
6.4 Configuring an Advanced ACL

This section describes how to configure the Advanced ACL. 6.4.1 Establishing the Configuration Task 6.4.2 (Optional) Creating a Time Range 6.4.3 Creating an Advanced ACL 6.4.4 (Optional) Configuring ACL Descriptions 6.4.5 (Optional) Configuring ACL Step 6.4.6 Checking the Configuration

Application Environment
An ACL can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types. When defining rules for an advanced ACL, you need to specify the source IP address, destination IP address, IP bearer protocol type, TCP source port, TCP destination port, or ICMP message type and code.
None.
Data Preparation
To configure an advanced ACL, you need the following data. No. 1 2 3 4 Data (Optional) Name of the time range in which the advanced ACL takes effect and the start time and end time of the time range Number of the advanced ACL Rule ID of the advanced ACL, permit or deny rule IP bearer protocol type, source and destination ports, source and destination IP address, and source IP address fragmented or not, or ICMP message type and code, packet priority, ToS, and timeout period of the ACL rule (Optional) Description of the advanced ACL (Optional) Step of the advanced ACL
5 6
6-10
Issue 02 (2009-12-10)
6 ACL Configuration

Context
Procedure
Step 1 Run:
system-view

6.4.3 Creating an Advanced ACL

Context
The range of acl-number of an advanced ACL is 3000 to 3999. Do as follows on the router:
Procedure
Step 1 Run:
system-view

An advanced ACL is created. Step 3 Perform the following as required.

l
When protocol is specified as TCP or UDP Run:

rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipaddress destination-wildcard | any } | destination-port operator port | fragmenttype fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag | time-range time-name | | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipaddress destination-wildcard | any } | destination-port operator port | fragmenttype fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag | time-range time-name | | precedence precedence | tos tos ] *
Issue 02 (2009-12-10)
6-11
6 ACL Configuration
ACL rules are defined. syn-flag syn-flag applies to TCP only.

l
When protocol is specified as ICMP Run:

rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipaddress destination-wildcard | any } | fragment-type fragment-type-name | icmptype { icmp-name | icmp-type icmp-code } | source { source-ip-address sourcewildcard | any } | time-range time-name | | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipaddress destination-wildcard | any } | fragment-type fragment-type-name | icmptype { icmp-name | icmp-type icmp-code } | source { source-ip-address sourcewildcard | any } | time-range time-name | | precedence precedence | tos tos ]
*
ACL rules are defined.

l
When protocol is specified as other protocol except TCP, UDP or ICMP Run:
rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipaddress destination-wildcard | any } | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipaddress destination-wildcard | any } | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | time-range time-name | precedence precedence | tos tos ] * |
ACL rules are defined. Configure different advanced ACLs on the device for different protocols over IP. Different protocols have different parameters combination. For example, TCP and UDP have optional parameter [ source-port operator port ] [ destination-port operator port ] while other protocols do not. ----End

Context
Procedure
Step 1 Run:
system-view

acl acl-number

description text
ACL description is created.

6 ACL Configuration
The ACL description covers the function of ACL rules. Its length should be less than 127 characters. ----End

Context
Procedure
Step 1 Run:
system-view


step step
l l
----End

Prerequisite
Procedure
----End
Example
6 ACL Configuration
<HUAWEI> display acl 3000 Advanced ACL 3000, 1 rule Acl's step is 5 rule 5 deny ip source 10.1.1.1 0
<HUAWEI> display statistics acl 3000 control-plane Advanced ACL 3000, 1 rule Acl's step is 5 rule 5 permit ip (1305 times matched)
6.5 Configuring an ACL Based on the Ethernet Frame Header

This section describes how to configure the Ethernet frame header-based ACL. 6.5.1 Establishing the Configuration Task 6.5.2 Creating an ACL Based on the Ethernet Frame Header 6.5.3 (Optional) Configuring ACL Descriptions 6.5.4 (Optional) Configuring ACL Step 6.5.5 Checking the Configuration

An ACL can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types.The rules of an ACL based on the Ethernet frame header are defined on the basis of source MAC addresses, destination MAC addresses, and protocol type of packets.
None.
Data Preparation
To configure an Ethernet frame header-based ACL, you need the following data.
6 ACL Configuration
No. 1 2 3 4
Data Number of the Ethernet frame header-based ACL Source MAC addresses, destination MAC addresses, and protocol type (Optional) Description of the Ethernet frame header-based ACL (Optional) Step of the Ethernet frame header-based ACL
6.5.2 Creating an ACL Based on the Ethernet Frame Header

Context
The acl-number, based on the Ethernet frame header, ranges from 4000 to 4099. Do as follows on the router:
Procedure
Step 1 Run:
system-view

An Ethernet frame header-based ACL is created. Step 3 Run:

rule [ rule-id ] { deny | permit } [ type type type-mask | source-mac source-mac sourcemac-mask | dest-mac dest-mac destmac-mask ]
ACL rules are defined. ----End

Context
Procedure
Step 1 Run:
system-view

acl acl-number
Issue 02 (2009-12-10)
6-15
6 ACL Configuration

description text

Context
Procedure
Step 1 Run:
system-view


step step
l l
----End

Prerequisite
The configurations of the Ethernet frame header-based ACL function are complete.
Procedure
l l Run the display acl { acl-number | all } command to check the configured ACL rule. Run the display statistics acl control-plane { acl-number | all } control-plane [ | { begin | include | exclude } regular-expression ] command to check the statistics about the packets matching the ACL rule in soft forwarding.
----End
6 ACL Configuration
Example
Run the display aclcommand. If the ACL number, the number of rules, and detailed step description, and ACL rules are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display acl 4000 Ethernet frame ACL 4000, 2 rules Acl's step is 5 rule 5 deny source-mac 0000-0000-0000 0002-0002-0002 dest-mac 0002-0002-0002 00 03-0003-0003 rule 10 deny type 0200 0222 dest-mac 0000-0000-0000 0002-0002-0002
<HUAWEI> display statistics acl 4000 control-plane Ethernet frame ACL 4000, 2 rules Acl's step is 5 rule 5 deny source-mac 0000-0000-0000 0002-0002-0002 dest-mac 0002-0002-0002 0003-0003-0003(45 times matched) rule 10 deny type 0200 0222 dest-mac 0000-0000-0000 0002-0002-0002(76 times matched)
6.6 Configuring a Named ACL

This section describes how to configure the Named ACL. 6.6.1 Establishing the Configuration Task 6.6.2 (Optional) Creating a Time Range 6.6.3 Creating a Named ACL 6.6.4 (Optional) Configuring named ACL Descriptions 6.6.5 (Optional) Configuring named ACL Step 6.6.6 Checking the Configuration

An ACL can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types. Named ACLs are advanced ACLs because you need to define rules for the named ACLs by specifying the source IP address, destination IP address, IP bearer protocol type, TCP source port, TCP destination port, or ICMP protocol type and code.
None.
Data Preparation
To configure a named ACL, you need the following data.
6 ACL Configuration
No. 1 2 3 4 5
Data (Optional) Name of the time range in which the named ACL takes effect and the start time and end time of the time range Rule ID of the named ACL, permit or deny rule, and source IP address IP bearer protocol type, source and destination ports, destination IP address, or ICMP message type and code, packet priority, ToS, and timeout period of the ACL rule (Optional) Description of the named ACL (Optional) Step of the named ACL

Context
Procedure
Step 1 Run:
system-view

6.6.3 Creating a Named ACL

Context
A named ACL is an advanced ACL and its acl-number ranges from 42768 to 45767. Do as follows on the router:
Procedure
Step 1 Run:
system-view

6 ACL Configuration
Step 2 Run:
acl name acl-name [ number acl-number ] [ match-order { auto | config } ]
A named ACL is created and the named ACL view is displayed. Step 3 Perform the following steps as required to configure rules for the named ACL. One ACL can be configured with multiple rules.
l
When protocol is TCP or UDP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag time-range time-name | precedence precedence |tos tos ] * syn-flagsyn-flag needs to be specified only when TCP is used.
When protocol is ICMP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name | icmp-type icmp-code } | source { source-ip-address source-wildcard | any } | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name |icmp-type icmp-code } |source { source-ip-address source-wildcard | any } | time-range time-name | precedence precedence | tos tos ] *
When protocol is not TCP, UDP, or ICMP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | precedence precedence | tos tos ] *
Configure different advanced ACLs on the device for different protocols over IP. Different protocols have different parameters combination. For example, TCP and UDP have optional parameter [ source-port operator port ] [ destination-port operator port ] while other protocols do not. ----End
6.6.4 (Optional) Configuring named ACL Descriptions

Context
Issue 02 (2009-12-10)
6-19
6 ACL Configuration
Procedure
Step 1 Run:
system-view

acl name acl-name
The named ACL view is displayed. Step 3 Run:

description text
The named ACL description is created. The ACL description covers the function of ACL rules. Its length should be less than 127 characters. ----End
6.6.5 (Optional) Configuring named ACL Step

Context
Procedure
Step 1 Run:
system-view

acl name acl-name
The named ACL view is displayed. Step 3 Run:

step step
ACL step is configured. Note the following when modifying named ACL configurations:
l l
----End

Prerequisite
6 ACL Configuration
Procedure
l l Run the display acl name acl-name command to check the configured ACL rule. Run the display statistics acl { acl-number | all | name acl-name }control-plane [ | { begin | include | exclude } regular-expression ] command to check the statistics about the packets matching the ACL rule in soft forwarding.
----End
Example
# Check the configurations of named ACL, whose name is test.
<HUAWEI> display acl name test Advanced Name ACL test, 1 rule Acl's step is 5 rule 5 permit ip
# View the statistics about the packets matching ACL named test in soft forwarding.
<HUAWEI> display statistics acl name test control-plane Advanced ACL test, 2 rules Acl's step is 5 rule 5 deny ip destination 1.1.5.0 0.0.0.255 (10 times matched) rule 10 deny ip destination 1.1.6.0 0.0.0.255 (23 times matched)
6.7 Maintaining an ACL

This section describes how to Maintain an ACL. 6.7.1 Clearing ACL Statistics 6.7.2 Monitoring Network Operation Status of ACL
6.7.1 Clearing ACL Statistics

Context
CAUTION
Statistics cannot restore after you clear it. So, confirm the action before you use the command.
Procedure
Step 1 Run the reset acl counter { acl-number | name acl-name | all } command in the user view to reset the ACL counter. ----End
Issue 02 (2009-12-10)
6-21
6 ACL Configuration
6.7.2 Monitoring Network Operation Status of ACL

Context
In routine maintenance, you can run the following command in any view to check the operation of ACL.
Procedure
l l Run the display acl { acl-number | name acl-name | all } command in any view to check the operation of rules of the ACL. Run the display statistics acl { acl-number | all | name acl-name }control-plane command in any view to check the operation of the statistics about the packets matching the ACL rule in soft forwarding. Run the display time-range { time-name | all } command in any view to check the operation of the time range of the ACL.
----End

This section provides a configuration example of ACL. 6.8.1 Example for Configuring a Traffic Policy Based on Complex Traffic Classification 6.8.2 Example for Configuring the Security Function of Access Devices 6.8.3 Example for Configuring an ACL Rule that Is Based on the VPN Instance
6.8.1 Example for Configuring a Traffic Policy Based on Complex Traffic Classification
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 6-1, PE1, P, and PE2 are routers on an MPLS backbone network; CE1 and CE2 are access routers on the edge of the backbone network. Three users from the local network access the Internet through CE1.
l
On CE1, the CIR of the users from the network segment 1.1.1.0 is limited to 10 Mbit/s and the CBS is limited to 150000 bytes. On CE1, the CIR of the users from the network segment 2.1.1.0 is limited to 5 Mbit/s and the CBS is limited to 100000 bytes.
6-22

l
6 ACL Configuration
On CE1, the CIR of the users from the network segment 3.1.1.0 is limited to 2 Mbit/s and the CBS is limited to 100000 bytes. On CE1, the DSCP values of the service packets from the three network segments are marked to 40, 26, and 0. PE1 accesses the MPLS backbone network at the CIR of 15 Mbit/s, the CBS of 300000 bytes, the PIR of 20 Mbit/s, and the PBS of 500000 bytes. On CE1, the CIR of the UDP protocol packets (except DNS, SNMP, SNMP Trap, and Syslog packets) is limited to 5 Mbit/s, the CBS is limited to 100000 bytes, and the PIR is limited to 15 Mbit/s.
Figure 6-1 Diagram for configuring a traffic policy based on the complex traffic classification
Loopback0 11.11.11.11/32
Loopback0 33.33.33.33/32
Loopback0 22.22.22.22/32
PE1 GE1/0/0 10.1.1.2/24 CE1 GE1/0/0
POS2/0/0 100.1.1.1/24 POS1/0/0 100.1.1.2/24 GE2/0/0 10.1.1.1/24 GE4/0/0 GE3/0/0
POS2/0/0 110.1.1.1/24 P POS2/0/0 110.1.1.2/24
PE2 GE1/0/0 20.1.1.2/24 GE2/0/0 20.1.1.1/24 CE2
1.1.1.0
3.1.1.0
2.1.1.0
The configuration roadmap is as follows: 1. 2. 3. 4. 5. Configure ACL rules. Configure traffic classifiers. Configure traffic behaviors. Configure traffic policies. Apply policies to interfaces.
Data Preparation
6 ACL Configuration
l l
ACL numbers, which are 2001, 2002, 2003, 3001, and 3002. The DSCP values of the packets from the three network segments, which are re-marked to be 40, 26, and 0. The CIRs of the traffic of the three network segments, which are 10 Mbit/s, 5 Mbit/s, and 2 Mbit/s; and their CBSs, which are 150000 bytes, 100000 bytes, and 100000 bytes. The CIR of the UDP protocol packets (except DNS, SNMP, SNMP Trap, and Syslog packets) on CE1, which is 5 Mbit/s, the CBS, which is 100000 bytes, and the PIR, which is 15 Mbit/s. The CIR of PE1, which is 15 Mbit/s; the CBS, which is 300000 bytes; and the PIR, which is 20 Mbit/s, and the PBS of 500000 bytes. Names of traffic classifiers, traffic behaviors, and traffic policies; the numbers of interfaces to which traffic policies are applied.
Procedure
Step 1 Configure the IP addresses of the interfaces, the routes, and the basic MPLS functions (not mentioned here). Step 2 Configure complex traffic classification on CE1 to control the traffic that accesses CE1 from the three local networks. # Define ACL rules.
<CE1> system-view [CE1] acl number 2001 [CE1-acl-basic-2001] rule [CE1-acl-basic-2001] quit [CE1] acl number 2002 [CE1-acl-basic-2002] rule [CE1-acl-basic-2002] quit [CE1] acl number 2003 [CE1-acl-basic-2003] rule [CE1-acl-basic-2003] quit [CE1] acl number 3001 [CE1-acl-basic-3001] rule [CE1-acl-basic-3001] rule [CE1-acl-basic-3001] rule [CE1-acl-basic-3001] rule [CE1-acl-basic-3001] quit [CE1] acl number 3002 [CE1-acl-basic-3002] rule [CE1-acl-basic-3002] quit
permit source 1.1.1.0 0.0.0.255 permit source 2.1.1.0 0.0.0.255 permit source 3.1.1.0 0.0.0.255 0 1 2 3 permit permit permit permit udp udp udp udp destination-port destination-port destination-port destination-port eq eq eq eq dns snmp snmptrap syslog
4 permit udp
# Configure traffic classifiers and define ACL-based matching rules.

[CE1] traffic classifier a [CE1-classifier-a] if-match acl 2001 [CE1-classifier-a] quit [CE1] traffic classifier b [CE1-classifier-b] if-match acl 2002 [CE1-classifier-b] quit [CE1] traffic classifier c [CE1-classifier-c] if-match acl 2003 [CE1-classifier-c] quit [CE1]traffic classifier udplimit [CE1-classifier-udplimit] if-match acl 3001 [CE1-classifier-udplimit] quit [CE1] traffic classifier udplimit1 [CE1-classifier-udplimit1] if-match acl 3002 [CE1-classifier-udplimit1] quit
6-24
Issue 02 (2009-12-10)
6 ACL Configuration
After the preceding configuration, you can run the following display traffic classifier command to view the configuration of the traffic classifiers.
[CE1] display traffic classifier user-defined User Defined Classifier Information: Classifier: a Operator: OR Rule(s): if-match acl 2001 Classifier: c Operator: OR Rule(s): if-match acl 2003 Classifier: b Operator: OR Rule(s): if-match acl 2002 Classifier: udplimit Operator: OR Rule(s) : if-match acl 3001 Classifier: udplimit1 Operator: OR Rule(s) : if-match acl 3002
# Define traffic behaviors; configure traffic policing, and DSCP values to be re-marked.
[CE1] traffic behavior e [CE1-behavior-e] car cir 10000 cbs 150000 pbs 0 [CE1-behavior-e] remark dscp 40 [CE1-behavior-e] quit [CE1] traffic behavior f [CE1-behavior-f] car cir 5000 cbs 100000 pbs 0 [CE1-behavior-f] remark dscp 26 [CE1-behavior-f] quit [CE1] traffic behavior g [CE1-behavior-g] car cir 2000 cbs 100000 pbs 0 [CE1-behavior-g] remark dscp 0 [CE1-behavior-g] quit [CE1] traffic behavior udplimit [CE1-behavior-udplimit] permit [CE1-behavior-udplimit] quit [CE1] traffic behavior udplimit1 [CE1-behavior-udplimit1] car cir 5000 cbs 100000 pbs 150000 green pass yellow discard red discard [CE1-behavior-udplimit1] quit
# Define traffic policies and associate the traffic classifiers with the traffic behaviors.
[CE1] traffic policy 1 [CE1-trafficpolicy-1] classifier a behavior e [CE1-trafficpolicy-1] quit [CE1] traffic policy 2 [CE1-trafficpolicy-2] classifier b behavior f [CE1-trafficpolicy-2] quit [CE1] traffic policy 3 [CE1-trafficpolicy-3] classifier c behavior g [CE1-trafficpolicy-3] quit [CE1] traffic policy udplimit [CE1-trafficpolicy-udplimit] classifier udplimit behavior udplimit [CE1-trafficpolicy-udplimit] classifier udplimit1 behavior udplimit1 [CE1-trafficpolicy-3] quit
After the preceding configuration, run the display traffic policy command to view the configuration of the traffic policies, traffic classifiers defined in the traffic policies, and the traffic behaviors associated with traffic classifiers.
[CE1] display traffic policy user-defined User Defined Traffic Policy Information: Policy: 1 Classifier: default-class Behavior: be -none-
Issue 02 (2009-12-10)
6-25
6 ACL Configuration
Classifier: a Behavior: e Committed Access Rate: CIR 10000 (Kbps), PIR 0 (Kbps), CBS 15000 (byte), PBS 0 (byte) Conform Action: pass Yellow Action: pass Exceed Action: discard Marking: Remark DSCP cs5 Policy: 2 Classifier: default-class Behavior: be -noneClassifier: b Behavior: f Committed Access Rate: CIR 5000 (Kbps), PIR 0 (Kbps), CBS 100000 (byte), PBS 0 (byte) Conform Action: pass Yellow Action: pass Exceed Action: discard Marking: Remark DSCP af31 Policy: 3 Classifier: default-class Behavior: be -noneClassifier: c Behavior: g Committed Access Rate: CIR 2000 (Kbps), PIR 0 (Kbps), CBS 100000 (byte), PBS 0 (byte) Conform Action: pass Yellow Action: pass Exceed Action: discard Marking: Remark DSCP default Policy: udplimit Classifier: default-class Behavior: be -noneClassifier: udplimit Behavior: udplimit Firewall: permit Classifier: udplimit1 Behavior: udplimit1 Committed Access Rate: CIR 5000 (Kbps), PIR 0 (Kbps), CBS 10000 (byte), PBS 15000 (byte) Conform Action: pass Yellow Action: discard Exceed Action: discard
# Apply the traffic policies to the inbound interfaces.

[CE1] interface gigabitethernet 1/0/0 [CE1-GigabitEthernet1/0/0] undo shutdown [CE1-GigabitEthernet1/0/0] traffic-policy [CE1-GigabitEthernet1/0/0] quit [CE1] interface gigabitethernet 3/0/0 [CE1-GigabitEthernet3/0/0] undo shutdown [CE1-GigabitEthernet3/0/0] traffic-policy [CE1-GigabitEthernet3/0/0] quit [CE1] interface gigabitethernet 4/0/0 [CE1-GigabitEthernet4/0/0] undo shutdown [CE1-GigabitEthernet4/0/0] traffic-policy [CE1] interface gigabitethernet 2/0/0 [CE1-GigabitEthernet2/0/0] undo shutdown [CE1-GigabitEthernet2/0/0] traffic-policy
1 inbound
2 inbound
3 inbound udplimit outbound
Step 3 Configure complex traffic classification on PE1 to control the traffic that goes to the MPLS backbone network.
6 ACL Configuration
# Configure traffic classifiers and define matching rules.

<PE1> system-view [PE1] traffic classifier pe [PE1-classifier-pe] if-match any [PE1-classifier-pe] quit
After the preceding configuration, you can run the display traffic classifier command to view the configuration of the traffic classifiers.
[PE1] display traffic classifier user-defined User Defined Classifier Information: Classifier: pe Operator: OR Rule(s): if-match any
# Define traffic behaviors; configure traffic policing.

[PE1] traffic behavior pe [PE1-behavior-pe] car cir 15000 pir 20000 cbs 300000 pbs 500000 [PE1-behavior-pe] quit
# Define traffic policies and associate the traffic classifiers with the traffic behaviors.
[PE1] traffic policy pe [PE1-trafficpolicy-pe] classifier pe behavior pe [PE1-trafficpolicy-pe] quit
After the preceding configuration, you can run the display traffic policy command to view the configuration of the traffic policies, traffic classifiers defined in the traffic policies, and the traffic behaviors associated with traffic classifiers.
[PE1] display traffic policy user-defined User Defined Traffic Policy Information: Policy: pe Classifier: default-class Behavior: be -noneClassifier: pe Behavior: pe Committed Access Rate: CIR 15000 (Kbps), PIR 20000 (Kbps), CBS 300000 (byte), PBS 500000 (byte) Conform Action: pass Yellow Action: pass Exceed Action: discard
# Apply the traffic policies to the inbound interfaces.

[PE1] interface gigabitethernet 1/0/0 [PE1-GigabitEthernet1/0/0] undo shutdown [PE1-GigabitEthernet1/0/0] traffic-policy pe inbound [PE1-GigabitEthernet1/0/0] quit
Step 4 Verify the configuration. Run the display interface command on CE1 and PE1. You can view that the traffic on the interfaces are regulated according to the configured traffic policies. ----End
Configuration Files
l
Configuration file of CE1

# sysname CE1 # acl number 2001
Issue 02 (2009-12-10)
6-27
6 ACL Configuration

rule 5 permit source 1.1.1.0 0.0.0.255 acl number 2002 rule 5 permit source 2.1.1.0 0.0.0.255 acl number 2003 rule 5 permit source 3.1.1.0 0.0.0.255 acl number 3001 rule 0 permit udp destination-port eq dns rule 1 permit udp destination-port eq snmp rule 2 dpermit udp destination-port eq snmptrap rule 3 permit udp destination-port eq syslog acl number 3302 rule 4 permit udp # traffic classifier a operator or if-match acl 2001 traffic classifier c operator or if-match acl 2003 traffic classifier b operator or if-match acl 2002 traffic classifier udp-limit operator or if-match acl 3001 traffic classifier udp-limit1 operator or if-match acl 3002 # traffic behavior e car cir 10000 cbs 150000 pbs 0 green pass red discard remark dscp cs5 traffic behavior g car cir 2000 cbs 100000 pbs 0 green pass red discard remark dscp default traffic behavior f car cir 5000 cbs 100000 pbs 0 green pass red discard remark dscp af31 traffic behavior udp-limit traffic behavior udp-limit1 car cir 5000 cbs 100000 pbs 150000 green pass yellow discard red discard # traffic policy 3 classifier c behavior g traffic policy 2 classifier b behavior f traffic policy 1 classifier a behavior e traffic policy udp-limit classifier udp-limit behavior udp-limit classifier udp-limit1 behavior udp-limit1 # interface GigabitEthernet1/0/0 undo shutdown ip address 1.1.1.1 255.255.255.0 traffic-policy 1 inbound # interface GigabitEthernet2/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 traffic-policy udplimit outbound # interface GigabitEthernet3/0/0 undo shutdown ip address 2.1.1.1 255.255.255.0 traffic-policy 2 inbound # interface GigabitEthernet4/0/0 undo shutdown ip address 3.1.1.1 255.255.255.0 traffic-policy 3 inbound # ospf 1 area 0.0.0.0
6-28
Issue 02 (2009-12-10)

network network network network # return l 1.1.1.0 0.0.0.255 2.1.1.0 0.0.0.255 3.1.1.0 0.0.0.255 10.1.1.0 0.0.0.255
6 ACL Configuration
Configuration file of PE1

# sysname PE1 # mpls lsr-id 11.11.11.11 mpls # mpls ldp # traffic classifier pe operator or if-match any # traffic behavior pe car cir 15000 pir 20000 cbs 300000 pbs 500000 green pass yellow pass red discard # traffic policy pe classifier pe behavior pe # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.2 255.255.255.0 traffic-policy pe inbound # interface Pos2/0/0 undo shutdown ip address 100.1.1.1 255.255.255.0 mpls mpls ldp # interface LoopBack0 ip address 11.11.11.11 255.255.255.255 # ospf 1 area 0.0.0.0 network 10.1.1.0 0.0.0.255 network 100.1.1.0 0.0.0.255 network 11.11.11.11 0.0.0.0 # return
Configuration file of P
# sysname P # mpls lsr-id 33.33.33.33 mpls # mpls ldp # interface Pos1/0/0 link-protocol ppp ip address 100.1.1.2 255.255.255.0 mpls mpls ldp # interface Pos2/0/0 link-protocol ppp ip address 110.1.1.1 255.255.255.0 mpls mpls ldp # interface LoopBack0
Issue 02 (2009-12-10)
6-29
6 ACL Configuration
ip address 33.33.33.33 255.255.255.255 # ospf 1 area 0.0.0.0 network 100.1.1.0 0.0.0.255 network 110.1.1.0 0.0.0.255 network 33.33.33.33 0.0.0.0 # return l

# sysname PE2 # mpls lsr-id 22.22.22.22 mpls # mpls ldp # interface GigabitEthernet1/0/0 undo shutdown ip address 20.1.1.2 255.255.255.0 # interface Pos2/0/0 undo shutdown ip address 110.1.1.1 255.255.255.0 mpls mpls ldp # interface LoopBack0 ip address 22.22.22.22 255.255.255.255 # ospf 10 area 0.0.0.0 network 110.1.1.0 0.0.0.255 network 20.1.1.0 0.0.0.255 network 22.22.22.22 0.0.0.0 # return

# sysname CE2 # interface GigabitEthernet2/0/0 undo shutdown ip address 20.1.1.1 255.255.255.0 # ospf 1 area 0.0.0.0 network 20.1.1.0 0.0.0.255 # return
6-30
Issue 02 (2009-12-10)
6 ACL Configuration
6.8.2 Example for Configuring the Security Function of Access Devices

CAUTION
On a single NE5000E, the interface is numbered in the format of slot number/card number/port number. Whereas in the multi-chassis scenario, the interface is numbered in the format of chassis ID/slot number/card number/interface number. This requires the chassis ID to be specified along with the slot number. As shown in Figure 6-2, Router A, Router B, Router C are access devices; Router D, Router E, and Router F are core devices; Access devices are connected to core devices by 10G interfaces. The network provides voice and 3G services. Security policies need to be configured on access devices to control the access of users and to guarantee the security of both the network and devices. Figure 6-2 Networking of configuring the security function of access devices
Internet
GE1/0/0 RouterD
RouterC
GE1/0/0 Internet RouterF RouterA RouterE
GE1/0/0 Internet RouterB
Notes
None.
The configuration roadmap is as follows: 1.
Issue 02 (2009-12-10)
Set the passwords to be used for login in NMS and CLI modes.
6 ACL Configuration
2. 3.
Log information about login failures. Create an Access Control List (ACL) to deny specified services carried on TCP and UDP interfaces (to defend virus).
Data Preparation
l l
IP address of each interface Passwords to be used for login in NMS and CLI modes
Procedure
Step 1 Configure an IP address for each interface. The configuration details are not mentioned here. Step 2 Set the passwords to be used for login in NMS and CLI modes.
<RouterA> system-view [RouterA] user-interface console 0 [RouterA-ui-con0] shell [RouterA-ui-con0] authentication mode password [RouterA-ui-con0] set authentication password cipher huawei [RouterA-ui-con0] idle-timeout 30 0 [RouterA-ui-con0] quit [RouterA] user-interface maximum-vty 15 [RouterA] user-interface vty 5 14 [RouterA-ui-vty5-14] shell [RouterA-ui-vty5-14] authentication mode password [RouterA-ui-vty5-14] set authentication password cipher huawei [RouterA-ui-vty5-14] idle-timeout 30 0 [RouterA-ui-vty5-14] quit
NOTE
Configurations for each access devices are similar. Take Router A for example.
Step 3 Set logs to be exported to the control console.

[RouterA] [RouterA] [RouterA] [RouterA] <RouterA> info-center enable info-center source default channel 9 log level warnings info-center logfile channel channel9 quit terminal logging
Step 4 Configure the ACL to prevent devices from being attacked from specified TCP and UDP interfaces.
NOTE
Configuring the ACL must be performed on the access device interface that is on the access side.
[RouterA] acl number 3001 [RouterA-acl-adv-3001] description anti-virus [RouterA-acl-adv-3001] rule 5 deny tcp destination-port eq 445 [RouterA-acl-adv-3001] rule 10 deny udp destination-port eq 445 [RouterA-acl-adv-3001] rule 15 deny tcp destination-port eq 135 [RouterA-acl-adv-3001] rule 20 deny udp destination-port eq 135 [RouterA-acl-adv-3001] rule 25 deny tcp destination-port eq 137 [RouterA-acl-adv-3001] rule 30 deny udp destination-port eq netbios-ns [RouterA-acl-adv-3001] rule 35 deny tcp destination-port eq 139 [RouterA-acl-adv-3001] rule 40 deny udp destination-port eq netbios-ssn [RouterA-acl-adv-3001] rule 45 deny udp destination-port eq 1433 [RouterA-acl-adv-3001] rule 50 deny udp destination-port eq 1434 [RouterA-acl-adv-3001] rule 55 deny tcp destination-port eq 4444 [RouterA-acl-adv-3001] rule 60 deny tcp destination-port eq 5554 [RouterA-acl-adv-3001] rule 65 deny udp destination-port eq 5554 [RouterA-acl-adv-3001] rule 70 deny tcp destination-port eq 9996
6-32
Issue 02 (2009-12-10)

[RouterA-acl-adv-3001] rule 75 deny udp destination-port [RouterA-acl-adv-3001] rule 110 permit ip [RouterA-acl-adv-3001] quit [RouterA] traffic classifier anti-virus operator or [RouterA-classifier-anti-virus] if-match acl 3001 [RouterA-classifier-anti-virus] quit [RouterA] traffic behavior anti-virus [RouterA-behavior-anti-virus] quit [RouterA] traffic policy anti-virus [RouterA-trafficpolicy-anti-virus] classifier anti-virus [RouterA-trafficpolicy-anti-virus] quit [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] traffic-policy anti-virus [RouterA-GigabitEthernet1/0/0] traffic-policy anti-virus eq 9996
6 ACL Configuration
behavior anti-virus inbound outbound
----End
Configuration Files
NOTE
Only the configuration file on the Router A is provided.

l
# sysname RouterA # info-center source default channel 9 log level warning # acl number 3001 description anti-virus rule 5 deny tcp destination-port eq 445 rule 10 deny udp destination-port eq 445 rule 15 deny tcp destination-port eq 135 rule 20 deny udp destination-port eq 135 rule 25 deny tcp destination-port eq 137 rule 30 deny udp destination-port eq netbios-ns rule 35 deny tcp destination-port eq 139 rule 40 deny udp destination-port eq netbios-ssn rule 45 deny udp destination-port eq 1433 rule 50 deny udp destination-port eq 1434 rule 55 deny tcp destination-port eq 4444 rule 60 deny tcp destination-port eq 5554 rule 65 deny udp destination-port eq 5554 rule 70 deny tcp destination-port eq 9996 rule 75 deny udp destination-port eq 9996 rule 110 permit ip # traffic classifier anti-virus operator or if-match acl 3001 # traffic behavior anti-virus # traffic policy anti-virus classifier anti-virus behavior anti-virus # interface GigabitEthernet1/0/0 undo shutdown traffic-policy anti-virus inbound traffic-policy anti-virus outbound # user-interface maximum-vty 15 user-interface con 0 authentication-mode password set authentication password cipher N`C55QK<`=/Q=^Q`MAF4<1!! idle-timeout 30 0 user-interface vty 0 4 user-interface vty 5 14 set authentication password cipher N`C55QK<`=/Q=^Q`MAF4<1!!
Issue 02 (2009-12-10)
6-33
6 ACL Configuration
idle-timeout 30 0 user-interface vty 16 20 # return
6.8.3 Example for Configuring an ACL Rule that Is Based on the VPN Instance
CAUTION
On a single NE5000E, the interface is numbered in the format of slot number/card number/port number. Whereas in the multi-chassis scenario, the interface is numbered in the format of chassis ID/slot number/card number/interface number. This requires the chassis ID to be specified along with the slot number. As shown in Figure 6-3, two VPN instances are configured on the PE. CE1 belongs to VPN-A, whose VPN-target is 111:1; CE2 belongs to VPN-B, whose VPN-target is 222:2. An ACL rule is configured on the PE to permit users in VPN-A to log in to the PE through Telnet and to prevent users in VPN-B from logging in to the PE. Users in different VPNs cannot communicate with each other. Figure 6-3 Typical networking of configuring an ACL rule
AS: 65410 VPN-A CE1 GE1/0/0 10.1.1.2/24
PE1
AS: 65420
VPN-B CE2
GE1/0/0 10.1.1.1/24 AS: 100
GE2/0/0 11.1.1.1/24
GE1/0/0 11.1.1.2/24
The configuration roadmap is as follows: 1. 2. 3. Configure VPN instances. Define the ACL rule. Configure users in different VPNs with different authorities for logging into the PE.
Data Preparation
l
ACL number
6-34

l
6 ACL Configuration
VPN instance name
Procedure
Step 1 Configure VPN instances on the PE and connect CE1 and CE2 to the PE. # Configure VPN-A.
<HUAWEI> system-view [HUAWEI] sysname PE [PE] ip vpn-instance vpna [PE-vpn-instance-vpna] route-distinguisher 100:1 [PE-vpn-instance-vpna] vpn-target 111:1 both [PE-vpn-instance-vpna] quit [PE] interface gigabitethernet 1/0/0 [PE-GigabitEthernet1/0/0] ip binding vpn-instance vpna [PE-GigabitEthernet1/0/0] ip address 10.1.1.1 24 [PE-GigabitEthernet1/0/0] quit
# Configure VPN-B.
[PE] ip vpn-instance vpnb [PE-vpn-instance-vpnb] route-distinguisher 100:2 [PE-vpn-instance-vpnb] vpn-target 222:2 both [PE-vpn-instance-vpnb] quit [PE] interface gigabitethernet 2/0/0 [PE-GigabitEthernet2/0/0] ip binding vpn-instance vpnb [PE-GigabitEthernet2/0/0] ip address 11.1.1.1 24 [PE-GigabitEthernet2/0/0] quit
Step 2 Configure an ACL rule and then apply the rule on the PE. After that, users in VPN-A can log in to the PE through Telnet; whereas users in VPN-B cannot log in to the PE.
[PE] acl number 2001 [PE-acl-adv-2001] rule permit vpn-instance vpna [PE-acl-adv-2001] rule deny vpn-instance vpnb [PE-acl-adv-2001] quit
Step 3 Use the ACL rule configured on the PE to control the login of users to the PE through Telnet.
[PE] user-interface vty 0 4 [PE-ui-vty0-4] authentication-mode none [PE-ui-vty0-4] acl 2001 inbound
Step 4 Verify the configuration. # Telnet CE1 to the PE.

<CE1> telnet 10.1.1.1 Trying 10.1.1.1 ... Press CTRL+K to abort Connected to 10.1.1.1 ... *********************************************************** * Copyright (C) 2000-2009 Huawei Technologies Co., Ltd * * Without the owner's prior written consent, * * no decompiling or reverse-engineering shall be allowed. * * Notice: * * This is a private communication system. * * Unauthorized access or use may lead to prosecution. * *********************************************************** Info: The max number of VTY users is 10, and the number of current VTY users on line is 1. <PE>
CE1 can log in to the PE through Telnet. # Telnet CE2 to the PE.
<CE2> telnet 10.1.1.1
Issue 02 (2009-12-10)
6-35
6 ACL Configuration
Trying 10.1.1.1 ... Press CTRL+K to abort Error: Failed to connect to the remote host.
CE2 cannot log in to the PE through Telnet. ----End
Configuration Files
l
Configuration file of the PE

# sysname PE # ip vpn-instance vpna route-distinguisher 100:1 vpn-target 111:1 export-extcommunity vpn-target 111:1 import-extcommunity ip vpn-instance vpnb route-distinguisher 100:2 vpn-target 222:2 export-extcommunity vpn-target 222:2 import-extcommunity # acl number 2001 rule 5 permit vpn-instance vpna rule 10 deny vpn-instance vpnb # aaa authentication-scheme default # authorization-scheme default # accounting-scheme default # domain default # # interface Ethernet0/0/0 undo shutdown ip binding vpn-instance vpna ip address 10.1.1.1 255.255.255.0 # interface Ethernet0/0/1 undo shutdown ip binding vpn-instance vpnb ip address 11.1.1.1 255.255.255.0 # user-interface con 0 user-interface vty 0 4 acl 2001 inbound authentication-mode none user-interface vty 16 20 # return

# sysname CE1 # aaa authentication-scheme default # authorization-scheme default # accounting-scheme default # domain default #
6-36
Issue 02 (2009-12-10)

# interface Ethernet0/0/0 undo shutdown ip address 10.1.1.2 255.255.255.0 # user-interface con 0 user-interface vty 0 4 user-interface vty 16 20 # return l
6 ACL Configuration

# sysname CE2 # aaa authentication-scheme default # authorization-scheme default # accounting-scheme default # domain default # # interface Ethernet0/0/0 undo shutdown ip address 11.1.1.2 255.255.255.0 # user-interface con 0 user-interface vty 0 4 user-interface vty 16 20 # return
Issue 02 (2009-12-10)
6-37
7
About This Chapter
Basic IPv6 Configuration
This chapter describes the IPv6 features and IPv6 address overview. It also describes configuration steps for IPv6 ND, PMTU, TCP6, FIB cache configuration, along with typical examples. 7.1 Basic IPv6 Overview This section describes the basic concept of IPv6 7.2 Configuring an IPv6 Address for an Interface This section describes how to configure an IPv6 address for an interface. 7.3 Configuring IPv6 Neighbor Discovery This section describes how to configure IPv6 neighbor discovery. 7.4 Configuring PMTU This section describes how to configure IPv6 PMTU. 7.5 Enabling the FIB Cache This section describes how to enable the FIB cache capacity. 7.6 Configuring TCP6 This section describes how to configure TCP connections. 7.7 Maintaining IPv6 This section describes how to clear IPv6 statistics and debug IPv6. 7.8 Configuration Examples This section provides a configuration example for the IPv6 address.
Issue 02 (2009-12-10)
7-1
7.1 Basic IPv6 Overview

This section describes the basic concept of IPv6 7.1.1 Introduction to IPv6 7.1.2 IPv6 Supported by the NE5000E
7.1.1 Introduction to IPv6

Internet Protocol Version 6 (IPv6), also called IP Next Generation (IPng), is the standard network protocol of the second generation. It is a set of specifications designed by the Internet Engineering Task Force (IETF). IPv6 is the upgraded version of IPv4. The most remarkable difference between IPv6 and IPv4 is that the IP address lengthens from 32 bits to 128 bits.
7.1.2 IPv6 Supported by the NE5000E

The NE5000E supports the IPv6 protocol suite and TCP6 protocol suite.
IPv6 Address
A 128-bit IPv6 address has the following formats:
l
X:X:X:X:X:X:X:X In this format, a 128-bit IP address is divided into eight groups. The 16 bits of each group are represented by four hexadecimal characters, that is, 0 to 9, and A to F. The groups are separated by colons. Every "X" represents a group of hexadecimal values.
X:X:X:X:X:X:d.d.d.d This format is for the following types of addresses:

IPv4-compatible IPv6 address IPv4-mapped IPv6 address
IPv4-compatible IPv6 address is used to configure an IPv6 over IPv4 tunnel. In this type of address, "X" represents the first six groups of numbers. Each "X" stands for 16 bits that are represented by hexadecimal numbers. "d" represents the subsequent four group of numbers. Each "d" stands for eight bits that are represented by decimal numbers. "d.d.d.d" is a standard IPv4 address. An IPv6 address can be divided into two parts:
l l
Network prefix: equals the network ID of an IPv4 address. It is of n bits. Interface identifier: equals the host ID in an IPv4 address. It is of 128-n bits.
IPv6 Neighbor Discovery

The IPv6 neighbor discovery (ND) is a group of messages and processes that define the relationship between neighboring nodes. ND replaces the Address Resolution Protocol (ARP) messages and the Internet Control Message Protocol (ICMP) device discovery messages. It also provides additional functions.
IPv6 PMTU
Generally, the problem that different networks have different Maximum Transmission Units (MTU) can be solved in the following ways:
l
Devices fragment packets as required. The source host only needs to fragment packets; however, the intermediate router not only needs to fragment packets, but also to reassemble packets. The source host sends packets based on a proper MTU so that packets need not be fragmented on the intermediate router. In such a case, packet processing burden on the intermediate router can be reduced. During IPv6 packet transmission, only this way can be adopted because IPv6 intermediate routers do not support packet fragmentation.
The Path MTU (PMTU) Discovery mechanism aims at finding a proper MTU value on the path from the source to the destination.
IPv6 FIB
Connecting network topologies of different types needs the configuration of different routing protocols. This brings about Routing Information Base (RIB). The RIB is a base of the Forwarding Information Base (FIB). Guided by route management policies, a device extracts a minimum of necessary forwarding information from RIB and adds the information to the FIB. Through the route management module, you can also add static routes into the FIB. A FIB contains a group of minimum information needed by a device during packet forwarding. An FIB entry usually contains the destination address, prefix length, transport port, next-hop address, route flag, and time stamp. A device forwards packets according to FIB entries. The FIB mechanism consists of two parts: FIB agent (used on the control plane) and FIB container (used on the forwarding plane). A FIB agent is responsible for interacting with the RM module for delivering FIB entries to the forwarding engine, and to the I/O board in a distributed system. A FIB contains the following information:
l l
Destination address: indicates the network or host a packet is destined for. Prefix length: indicates the length of the destination address prefix. From the prefix length, you can infer that the destination address is a network address or a host address. Nexthop: indicates the address of the close next hop through which the packet reaches the destination. Flag(s): identifies route features. Interface: indicates the outgoing interface of the packet. Timestamp: Indicates the time when an FIB entry is established.
l l l
7.2 Configuring an IPv6 Address for an Interface

This section describes how to configure an IPv6 address for an interface. 7.2.1 Establishing the Configuration Task 7.2.2 Enabling IPv6 Packet Forwarding Capability 7.2.3 Configuring an IPv6 Link-Local Address for an Interface
7.2.4 Configuring an IPv6 Global Unicast Address for an Interface 7.2.5 Checking the Configuration

When a device communicates with an IPv6 device, you need to configure IPv6 address for the interface. The NE5000E supports configuring IPv6 addresses for the following interfaces:
l l
Gigabit-Ethernet interfaces and sub-interfaces POS interfaces (Only the POS interfaces configured with PPP or HDLC as the link protocol support IPv6.) Tunnel interfaces Loopback interfaces Eth-Trunk interfaces, Eth-Trunk sub-interfaces, and IP-Trunk interfaces
l l l
You can configure 10 addresses for one interface. Addresses can be the link-local address and the global unicast address. The link-local address is used in ND, and in the communication between nodes on the local link in the stateless address auto-configuration. The packets using the link-local address as the source or destination address are not forwarded to other links. The link-local address can be automatically generated or manually configured. After being enable with automatic address generation capability, the system automatically generates a linklocal address. The link-local address configured manually must be a valid link-local address (FE80::/10). It is recommended to automatically generate a link-local address because the link-local address is used only for the communication between link-local nodes. Commonly, it is used to implement communication requirements of protocol and is not directly related to the communication between users. The global unicast address is equivalent to the IPv4 public address. It is used for data forwarding across the pubic network, which is necessary for the communication between users. An EUI-64 address has the same function as an global unicast address. The difference is that only the network bits need to be specified for the EUI-64 address and the host bits are transformed from the MAC addresses of the interface while a complete 128-bit address need to be specified for the global unicast address. Note that the prefix length of the network bits in an EUI-64 address must not be longer than 64 bits. The EUI-64 address and the global unicast address can be configured simultaneously or alternatively. However, the IP addresses configured for one interface cannot be in the same network segment.
Before configuring IPv6 addresses, complete the following tasks:
l
Configuring the physical features of the interface and ensuring that the status of the physical layer of the interface is Up
7-4

l
Configuring the link layer parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up
Data Preparation
To configure IPv6 addresses for an interface, you need the following data. No. 1 2 3 Data Number of the interface Link-local address configured manually Global unicast address and prefix length
7.2.2 Enabling IPv6 Packet Forwarding Capability

Context
To enable a device to forward IPv6 packets, you must enable the IPv6 capability in both the system view and the interface view. This is because:
l
If you run the ipv6 command only in the system view, only the IPv6 packet forwarding capability is enabled on a device. The IPv6 function, however, is not enabled on the interface and hence you cannot perform any IPv6 configurations. If you run the ipv6 enable command only in the interface view, the IPv6 capability is enabled only on an interface but the IPv6 protocol status on the interface is Down. Therefore, the device cannot forward IPv6 data.
Procedure
Step 1 Run:
system-view

ipv6
The IPv6 packet forwarding capability is enabled. By default, the IPv6 packet forwarding capability is disabled. To enable a device to forward IPv6 packets, you must run this command in the system view; otherwise, the IPv6 protocol status of the interface is Down and the device cannot forward IPv6 packets although you enable IPv6 on the interface. Step 3 Run:
The view of the interface to be enabled with the IPv6 capability is displayed.
Step 4 Run:
ipv6 enable
The IPv6 capability is enabled on the interface. Before performing IPv6 configurations in the interface view, you must enable the IPv6 capability in the interface view. By default, the IPv6 capability is disabled on the interface. ----End
7.2.3 Configuring an IPv6 Link-Local Address for an Interface

Context
Procedure
Step 1 Run:
system-view

The interface view is displayed. Step 3 Perform the following as required. Run:
ipv6 address auto link-local
Auto generation of the IPv6 link-local address is enabled. Or Run:

ipv6 address ipv6-address link-local
The IPv6 link-local address is manually configured. Besides configuring a link-local address through the preceding two commands, you can also configure a global unicast IPv6 address for auto generating a link-local address. For details, see Configuring an IPv6 Global Unicast Address for an Interface. ----End
7.2.4 Configuring an IPv6 Global Unicast Address for an Interface

Context
Procedure
Step 1 Run:
system-view


ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } or ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } eui-64
The global unicast address is configured on the interface. ----End

Prerequisite
The configurations of the IPv6 addresses are complete.
Procedure
l l Run the display ipv6 interface [ interface-type interface-number | brief ] command to check the IPv6 information of an interface. Run the display ipv6 statistics [ slot slot-id | interface interface-type interface-number ] command to check the IPv6 packet statistics.
----End
Example
Run the display ipv6 interface command. If the IPv6 address of the interface is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ipv6 interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP , IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::200:1FF:FE04:5D00 Global unicast address(es): 2001::1, subnet is 2001::/64 Joined group address(es): FF02::1:FF00:1 FF02::1:FF04:5D00 FF02::2 FF02::1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
Run the display ipv6 interface command. If the configured IPv6 address and interface status are displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 interface brief
Issue 02 (2009-12-10)
7-7

*down: administratively down !down: FIB overload down (l): loopback (s): spoofing Interface GigabitEthernet2/0/2 [IPv6 Address] 2030::101:101 GigabitEthernet2/0/3 [IPv6 Address] 2001::1 LoopBack0 [IPv6 Address] Unassigned
Physical up up up
Protocol up up up(s)
Run the display ipv6 statistics command. If the statistics on IPv6 packets is displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 statistics IPv6 Protocol: Sent packets: Total Local sent out Raw packets Fragmented Fragments failed Received packets: Total Hop count exceeded Too big Address error Truncated Fragments Reassembly timeout : : : : : : : : : : : : 3630 3630 0 0 0 3630 0 0 0 0 0 0
Forwarded Discarded Fragments Multicast Local host Header error Routing failed Protocol error Option error Reassembled Multicast
: : : : : : : : : : :
0 0 0 0 3630 0 0 0 0 0 0
7.3 Configuring IPv6 Neighbor Discovery

This section describes how to configure IPv6 neighbor discovery. 7.3.1 Establishing the Configuration Task 7.3.2 Configuring Static Neighbors 7.3.3 Enabling RA Message Advertising 7.3.4 Setting the Interval for Advertising RA Messages 7.3.5 Enabling Stateful Auto Configuration 7.3.6 Configuring the Address Prefixes to Be Advertised 7.3.7 Configuring Other Information to Be Advertised 7.3.8 Checking the Configuration

Most of the ND configurations are implemented based on the interfaces. The IPv6 ND configuration is supported on the following interfaces:

l l
Gigabit-Ethernet interfaces and their sub-interfaces POS interfaces (Only the POS interfaces configured with PPP or HDLC as the link protocol support IPv6.) Tunnel interfaces Loopback interfaces Eth-Trunk interfaces, Eth-Trunk sub-interfaces, and IP-Trunk interfaces
NOTE
l l l
Though the POS interfaces can be configured with IPv6 ND-related commands, packet sending or packet forwarding on these interfaces actually do not require neighbor entries.
Before configuring IPv6 neighbor discovery, complete the following tasks:
l
Configuring the physical features for the interface and ensuring that the status of the physical layer of the interface is Up Configuring link layer parameters for the interface Configuring the IPv6 address for the interface
l l
Data Preparation
To configure IPv6 neighbor discovery, you need the following data. No. 1 2 3 4 5 6 7 8 9 Data Number of interface which needs to be configured with IPv6 ND IPv6 address and MAC address of the static neighbor Intervals, prefix, and life duration of RA messages Flag bit of automatic configuration Hop limit of ND Sending times of DAD Intervals for re-transmitting NS messages NUD reachable time Interface MTU
7.3.2 Configuring Static Neighbors

Context
Procedure
Step 1 Run:
system-view


ipv6 neighbor ipv6-address mac-address
Static neighbors are configured. Static neighbors can be configured for interfaces and their sub-interfaces. You can configure up to 300 neighbors on each interface. ----End
7.3.3 Enabling RA Message Advertising

Context
Procedure
Step 1 Run:
system-view


undo ipv6 nd ra halt
The function of advertising RA messages is enabled. ----End
7.3.4 Setting the Interval for Advertising RA Messages

Context
Procedure
Step 1 Run:

system-view


ipv6 nd ra { max-interval maximum-interval | min-interval minimum-interval }
The interval for advertising RA messages is configured. By default, the maximum interval is 600 seconds and the minimum interval is 200 seconds. The maximum interval can not be shorter than the minimum interval. ----End
7.3.5 Enabling Stateful Auto Configuration

Context
Procedure
Step 1 Run:
system-view


ipv6 nd autoconfig managed-address-flag
The flag bit for stateful auto configuration addresses is set. If this flag is set, hosts use the stateful protocol for address auto-configuration in addition to any addresses auto-configured using stateless address auto-configuration. Step 4 Run:
ipv6 nd autoconfig other-flag
The flag bit for other stateful configurations is set. When this flag is set, hosts use the stateful protocol for auto-configuration of other (non-address) information. ----End
7.3.6 Configuring the Address Prefixes to Be Advertised

Context
Procedure
Step 1 Run:
system-view


ipv6 nd ra prefix { ipv6-address prefix-length | ipv6-address/prefix-length } validlifetime preferred-lifetime [ no-autoconfig ] [ off-link ]
The prefix of RA messages is configured. ----End
7.3.7 Configuring Other Information to Be Advertised

Context
Duplicate Address Detect (DAD) is a process of IPv6 automatic address configuration. You can configure the number of DAD messages which are sent continuously. Set the interval of sending Neighbor Solicitation (NS) messages on the device. By default, NS re-transmitting time interval is 1000ms. NUD checks the reachability of neighbors. By default, NUD value is 30000ms. The MTU of the interface determines whether to fragment IP packets on the interface. Default MTUs vary with interface types. The MTU on an GigabitEthernet interface defaults to be 1500 bytes. Do as follows on the router:
Procedure
Step 1 Run:
system-view

ipv6 nd hop-limit limit
ND hop limit is configured. The value of limit ranges from 1 to 255. By default, it is 64. Step 3 Run:
7-12
Issue 02 (2009-12-10)

ipv6 nd ra router-lifetime ra-lifetime
The life duration of RA messages is configured.

NOTE
l l l
When the ipv6 nd ra command is run to set the interval for advertising RA messages, the interval must be less than or equal to the life duration. By default, the maximum interval is 600 seconds, and the minimum interval is 200 seconds. By default, the life duration of RA messages is 1800 seconds. If the prefix is configured, the duration is still 1800 seconds.
Step 5 Run:
ipv6 nd dad attempts value
Times to send DAD messages are configured. Step 6 Run:

ipv6 nd ns retrans-timer value
The interval for re-sending NS messages is set. Step 7 Run:

ipv6 nd nud reachable-time value
The NUD reachable time is set. Step 8 Run:

ipv6 mtu mtu
MTU of the interface is configured. ----End
Postrequisite
If the IPv6 MTU value is changed, run the shutdown command and the undo shudown command orderly in the interface view to validate the configuration.

Prerequisite
The configurations of the IPv6 neighbor discovery function are complete.
Procedure
l l Run the display ipv6 neighbors[ interface-type interface-number ] command to check the neighbor information in the cache. Run the display ipv6 interface [ interface-type interface-number | brief ] command to check the IPv6 information of an interface.
----End
Example
Run the display ipv6 neighbors command. If the cache of the neighbor information contains neighbors' IPv6 addresses and the specified interfaces, it means that the configuration succeeds.
<HUAWEI> display ipv6 neighbors gigabitethernet 1/0/0 -------------------------------------------------------IPv6 Address : 3003::2 Link-layer : 00e0-fc89-fe6e State : STALE Interface : GE1/0/0 Age : 7 VPN name : vpn1 VLAN : IPv6 Address : FE80::2E0:FCFF:FE89:FE6E Link-layer : 00e0-fc89-fe6e State : STALE Interface : GE1/0/0 Age : 7 VPN name : vpn1 VLAN : --------------------------------------------------------Total: 2 Dynamic: 2 Static: 0
Run the display ipv6 interface command. If information about the IPv6 address on the interface is displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::200:1FF:FE04:5D00 Global unicast address(es): 2001::1, subnet is 2001::/64 Joined group address(es): FF02::1:FF00:1 FF02::1:FF04:5D00 FF02::2 FF02::1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
Run the display ipv6 interface brief command. If information about the IPv6 address on the interface and interface status are displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 interface brief *down: administratively down !down: FIB overload down (l): loopback (s): spoofing Interface Physical GigabitEthernet2/0/2 up [IPv6 Address] 2030::101:101 GigabitEthernet2/0/3 up [IPv6 Address] 2001::1 LoopBack0 up [IPv6 Address] Unassigned
Protocol up up up(s)
7.4 Configuring PMTU

This section describes how to configure IPv6 PMTU. 7.4.1 Establishing the Configuration Task 7.4.2 Creating Static PMTU Entries 7.4.3 Configuring PMTU Aging Time

By setting PMTUs on interfaces, you can enable devices to send packets based on proper MTUs across the network. This avoids packet fragmentation, reduces the burden of the devices, implements efficient usage of network resources and achieves the best throughput.
Before configuring PMTUs, complete the following tasks:
l
Configuring the physical features for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocol for the interface
Data Preparation
To configure PMTUs, you need the following data. No. 1 2 Data IPv6 address and PMTU value to be configured PMTU aging time
7.4.2 Creating Static PMTU Entries

Context
Procedure
Step 1 Run:
system-view

ipv6 pathmtu ipv6-address [ path-mtu ]
The PMTU value of a specified IPv6 address is configured. By default, the PMTU of the IPv6 address is 1500 bytes. ----End
7.4.3 Configuring PMTU Aging Time

Context
Procedure
Step 1 Run:
system-view

ipv6 pathmtu age age-time
The aging time of PMTU is configured. By default, the dynamic PMTU aging time is 10 minutes. The PMTU aging time is used to change the lifetime of a dynamic PMTU entry in the cache. It has no effect on static PMTU entries because they cannot be aged. If the static PMTU exist, the dynamic PMTU dose not take effect. ----End

Prerequisite
The configurations of the PMTU are complete.
Procedure
l l Run the display ipv6 pathmtu { ipv6-address | all | dynamic | static } command to check all PMTU items. Run the display ipv6 interface [ interface-type interface-number | brief ] command to check the current MTU of the interface.
----End
Example
Run the display ipv6 pathmtu command. If the destination IPv6 address, the PMTU value, the aging time and type are displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 pathmtu all IPv6 Destination Address ZoneID fe80::12 0 2222::3 0 PathMTU 1300 1280 Age 40 -Type Dynamic Static
Run the display ipv6 interface command. If the current MTU of the interface is displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP ,
7-16
Issue 02 (2009-12-10)
IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::200:1FF:FE04:5D00 Global unicast address(es): 2001::1, subnet is 2001::/64 Joined group address(es): FF02::1:FF00:1 FF02::1:FF04:5D00 FF02::2 FF02::1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
7.5 Enabling the FIB Cache

This section describes how to enable the FIB cache capacity. 7.5.1 Establishing the Configuration Task 7.5.2 Enabling the FIB Cache 7.5.3 Checking the Configuration

None.
Before enabling the FIB cache capability of a device, complete the following tasks:
l
Connecting the interface and configuring the physical features for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocol parameters for the interface
Data Preparation
To enable the FIB cache capability, you need the following data. No. 1 Data Slot ID
7.5.2 Enabling the FIB Cache

Context
Procedure
Step 1 Run:
system-view

ipv6 fibcache {slot-id | all }
FIB cache is enabled on the device. By default, the FIB cache is disabled on the device. ----End

Prerequisite
The configurations of the enabling the FIB cache are complete.
Procedure
l l Run the display ipv6 fib [ spt ] [ slot-id ] [ | { begin | include | exclude } regularexpression ] command to check the FIB information. Run the display ipv6 fibcache slot-id command to check total routes in FIB cache.
----End
Example
Run the display ipv6 fib command. If the details of FIB are displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 fib FIB Table: Total number of Routes : 4 Destination: NextHop : Label : TimeStamp : Interface : IP6Token : Destination: NextHop : Label : TimeStamp : Interface : IP6Token : Destination: NextHop : Label : TimeStamp : Interface : IP6Token : Destination: NextHop : ::1 ::1 NULL Date- 14:8:2008, Time- 14:41:26 InLoopBack0 0x0 FE80:: :: NULL Date- 14:8:2008, Time- 14:44:34 NULL0 0x0 2001::2 ::1 NULL Date- 14:8:2008, Time- 14:44:36 InLoopBack0 0x0 2001:: 2001::2 PrefixLength Flag Tunnel ID reference : : : : 128 HU 0 1
PrefixLength Flag Tunnel ID reference
: : : :
10 BU 0 1
PrefixLength Flag Tunnel ID reference
: : : :
128 HU 0 1
PrefixLength : 64 Flag : U
7-18
Issue 02 (2009-12-10)

Label : NULL TimeStamp : Date- 14:8:2008, Time- 14:44:36 Interface : GigabitEthernet6/0/0 IP6Token : 0x0

Tunnel ID reference : 0 : 1
Run the display ipv6 fibcache command. If FIB cache contains the routing information, it means that the configuration succeeds.
<HUAWEI> display ipv6 fibcache 6 FIB Cache: Total number of Routes : 2 Destination: NextHop : Label : TimeStamp : Interface : IP6Token : Destination: NextHop : Label : TimeStamp : Interface : IP6Token : 2001::1 2001::2 NULL Date- 14:8:2008, Time- 14:44:45 GigabitEthernet6/0/0 0x0 2001::2 ::1 NULL Date- 14:8:2008, Time- 14:44:45 InLoopBack0 0x0 FIB PrefixLength : 64 FIB Flag : U Tunnel ID : 0 reference : 0
FIB PrefixLength : 128 FIB Flag : HU Tunnel ID : 0 reference : 0
7.6 Configuring TCP6

This section describes how to configure TCP connections. 7.6.1 Establishing the Configuration Task 7.6.2 Configuring TCP6 Timers 7.6.3 Configuring the Size of the TCP6 Sliding Window 7.6.4 Checking the Configuration

To optimize network performance, you need to adjust the TCP6 parameters.
Before configuring TCP6, complete the following tasks:
l
Connecting and configuring the physical features for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocol parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up
Data Preparation
To configure TCP6, you need the following data.
No. 1 2 3
Data Value of TCP6 FIN-WAIT timer Value of TCP6 SYN-WAIT timer Size of TCP6 Sliding Window
7.6.2 Configuring TCP6 Timers

Context
Procedure
Step 1 Run:
system-view

tcp ipv6 timer syn-timeout timer-value
The TCP6 SYN-WAIT timer is set. By default, the SYN-WAIT timer is 75s. Step 3 Run:
tcp ipv6 timer fin-timeout timer-value
The TCP6 FIN-WAIT timer is set. By default, the FIN-WAIT timer is 675s. ----End
7.6.3 Configuring the Size of the TCP6 Sliding Window

Context
Procedure
Step 1 Run:
system-view

tcp ipv6 window window-size
The size of the TCP6 sliding window is configured.

The size of the TCP6 sliding window ranges from 1 KB to 32 KB. By default, the size of the TCP6 sliding window is 8 KB. ----End

Prerequisite
The configurations of the TCP6 function are complete.
Procedure
l l l l Run the display tcp ipv6 statistics command to check related TCP6 statistics. Run the display tcp ipv6 status command to check the TCP6 connection status. Run the display udp ipv6 statistics command to check related UDP6 statistics. Run the display ipv6 socket [ socktype sock-type ] [ task-id sock-id ] command to check the information of the specified socket.
----End
Example
Run the display tcp ipv6 statistics, display tcp ipv6 status, and display udp ipv6 statistics commands. If the connection status and statistic of TCP6 and UDP6 are displayed, it means that the configuration succeeds.
<HUAWEI> display tcp ipv6 statistics Received packets: total: 0 packets in sequence: 0 (0 bytes) window probe packets: 0 window update packets: 0 checksum error: 0 offset error: 0 short error: 0 duplicate packets: 0 (0 bytes) partially duplicate packets: 0 (0 bytes) out-of-order packets: 0 (0 bytes) packets with data after window: 0 (0 bytes) packets after close: 0 ACK packets: 0 (0 bytes) duplicate ACK packets: 0 too much ACK packets: 0 packets dropped due to MD5 authentication failure: 0 packets receieved with MD5 Signature Option: 0 Sent packets: total: 0 urgent packets: 0 control packets: 0 (including 0 RST) window probe packets: 0 window update packets: 0 data packets: 0 (0 bytes) data packets retransmitted: 0 (0 bytes) ACK only packets: 0 (0 delayed) packets sent with MD5 Signature Option: 0 Other Statistics: retransmitted timeout: 0 connections dropped in retransmitted timeout: 0 keepalive timeout: 0
Issue 02 (2009-12-10)
7-21
keepalive probe: 0 keepalive timeout, so connections disconnected: 0 initiated connections: 0 accepted connections: 0 established connections: 0 closed connections: 0 (dropped: 0, initiated dropped: 0) <HUAWEI> display tcp ipv6 status TCP6CB Local Address Foreign Address State 09e39ae4 3000::2->179 3000::1->49158 Time_Wait 09e36f24 3000::2->49152 3000::1->179 Established 07da08f8 ::->179 ::->0 Listening 07d96da8 ::->23 ::->0 Listening <HUAWEI> display udp ipv6 statistics Received packets: total: 0 total(64bit high-capacity counter): 0 checksum error: 0 shorter than header: 0 invalid message length: 0 no socket on port: 0 no multicast port: 0 not delivered, input socket full: 0 input packets missing pcb cache: 0 packets sent for external pre processing: 1 Sent packets: total: 0 total(64bit high-capacity counter): 0
Run the display ipv6 socket command. If the related socket information is displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 socket SOCK_STREAM: Task = VTYD(14), socketid = 4, Proto = 6, LA = ::->22, FA = ::->0, sndbuf = 8192, rcvbuf = 8192, sb_cc = 0, rb_cc = 0, socket option = SO_ACCEPTCONN SO_REUSEPORT SO_SENDVPNID, socket state = SS_PRIV SS_ASYNC Task = VTYD(14), socketid = 3, Proto = 6, LA = ::->23, FA = ::->0, sndbuf = 8192, rcvbuf = 8192, sb_cc = 0, rb_cc = 0, socket option = SO_ACCEPTCONN SO_REUSEPORT SO_SENDVPNID, socket state = SS_PRIV SS_ASYNC SOCK_DGRAM: SOCK_RAW:
7.7 Maintaining IPv6

This section describes how to clear IPv6 statistics and debug IPv6. 7.7.1 Resetting IPv6 7.7.2 Monitoring Network Operation Status of IPv6 7.7.3 Debugging IPv6
7-22
Issue 02 (2009-12-10)
7.7.1 Resetting IPv6

Context
CAUTION
IPv6 statistics cannot restore after you clear it. So, confirm the action before you use the command.
Procedure
l l l l Run the reset ipv6 statistics [ slot slot-id ] command in the user view to clear statistics of processing IPv6 packets after you confirm it. Run the reset ipv6 pathmtu { all | dynamic | static } command in the user view to clear PMTU entries in the cache after you confirm it. Run the reset ipv6 fibcache { slot-id | all } command in the user view to clear cached entries in FIB after you confirm it. Run the reset ipv6 neighbors { all | dynamic | static [ interface-type interface-number] | interface-type interface-number } command in the user view to clear IPv6 neighbor entries in the cache after you confirm it. Run the reset tcp ipv6 statistics command in the user view to clear all TCP6 statistics after you confirm it. Run the reset udp ipv6 statistics command in the user view to clear all UDP6 statistics after you confirm it.
l l
----End
7.7.2 Monitoring Network Operation Status of IPv6

Context
In routine maintenance, you can run the following command in any view to check the operation of IPv6.
Procedure
l l l l l l
Issue 02 (2009-12-10)
Run the display ipv6 interface [ interface-type interface-number | brief ] command in any view to check the IPv6 information about the interface. Run the display ipv6 statistics [ slot slot-id | interface interface-type interface-number ] command in any view to check IPv6 packet statistics. Run the display icmpv6 statistics [ slot slot-id | interface interface-type interfacenumber ] command in any view to check the operation of ICMPv6 packet statistics. Run the display ipv6 neighbors [ interface-type interface-number ] command in any view to check contents about the neighbor cache. Run the display ipv6 pathmtu { ipv6-address | all | dynamic | static } command in any view to check all PMTU entries. Run the display tcp ipv6 statistics command in any view to check TCP6 statistics.
l l l l l
Run the display tcp ipv6 status command in any view to check TCP6 connection status. Run the display udp ipv6 statistics command in any view to check UDP6 statistics. Run the display ipv6 socket [ socktype sock-type ] [ task-id sock-id ] command in any view to check information about the specified socket. Run the display ipv6 fib [ spt ] [ slot-id ] [ | { begin | include | exclude } regularexpression ] command in any view to check information about the FIB. Run the display ipv6 fibcache slot-id command in any view to check the total number of routes in the FIB cache.
----End
7.7.3 Debugging IPv6

Context
CAUTION
Debugging affects the performance of the system. So, after debugging, execute the undo debugging all command to disable it immediately. Run the following debugging commands in the user view to debug IPv6 and locate the fault. For the procedures of displaying the debugging information, refer to the chapter "Information Center Configuration" in the NE5000E Core Router Configuration Guide - System Management. For descriptions about the debugging commands, refer to the NE5000E Core Router Debugging Reference.
Procedure
l l l l l l Run the debugging ipv6 icmpv6 command in the user view to debug ICMPv6. Run the debugging ipv6 nd command in the user view to debug IPv6 neighbors status and ND messages. Run the debugging ipv6 packet [ error ] [ acl acl-number ] command in the user view to debug IPv6 packet. Run the debugging ipv6 pathmtu command in the user view to debug PMTU. Run the debugging tcp ipv6 { event | packet } [ task-id socket-id ] command in the user view to debug TCP6. Run the debugging udp ipv6 packet [ task-id socket-id ] command in the user view to debug UDP6.
----End

This section provides a configuration example for the IPv6 address. 7.8.1 Example for Configuring an IPv6 Address for an Interface
7.8.2 Example for Configuring IPv6 Neighbor Discovery
7.8.1 Example for Configuring an IPv6 Address for an Interface

Networking Requirement
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 7-1, Router A and Router B are connected through POS interfaces. It is required to configure IPv6 global unicast addresses for the interfaces and test the connectivity between them. The IPv6 global unicast addresses to be configured for the interfaces are 3001::1/64 and 3001::2/64. Figure 7-1 Networking diagram of configuring an IPv6 address for an interface POS 1/0/0 3001::1/64 POS 1/0/0 3001::2/64
RouterA
RouterB
The configuration roadmap is as follows: 1. 2. Enable IPv6 forwarding capability on devices. Configure IPv6 global unicast addresses for the interfaces.
Data Preparation
To complement the configuration, you need the following data:
l
Global unicast addresses of the interfaces
Procedure
Step 1 Enable IPv6 packet forwarding on Router A and Router B. # Configure Router A
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] ipv6
Issue 02 (2009-12-10)
7-25
# Configure Router B
<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] ipv6
Step 2 Configure IPv6 global unicast addresses for the interfaces. # Configure Router A.
[RouterA] interface pos [RouterA-Pos1/0/0] ipv6 [RouterA-Pos1/0/0] ipv6 [RouterA-Pos1/0/0] undo [RouterA-Pos1/0/0] quit 1/0/0 enable address 3001::1/64 shutdown
[RouterB] interface pos [RouterB-Pos1/0/0] ipv6 [RouterB-Pos1/0/0] ipv6 [RouterB-Pos1/0/0] undo [RouterB-Pos1/0/0] quit 1/0/0 enable address 3001::2/64 shutdown
Step 3 Verify the configuration. If the configuration succeeds, you can view the configured IPv6 global unicast addresses and status of the interface and the IPv6 protocol are both Up. # Display interface information of Router A.
[RouterA] display ipv6 interface pos 1/0/0 Pos1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::C964:0:B8B6:1 Global unicast address(es): 3001::1, subnet is 3001::/64 Joined group address(es): FF02::1:FF00:1 FF02::1:FFB6:1 FF02::2 FF02::1 MTU is 4470 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# Display interface information of Router B.

[RouterB] display ipv6 interface pos 1/0/0 Pos1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::2D6F:0:7AF3:1 Global unicast address(es): 3001::2, subnet is 3001::/64 Joined group address(es): FF02::1:FF00:2 FF02::1:FFF3:1 FF02::2 FF02::1 MTU is 4470 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# On Router A, ping the link-local address of Router B. Note that you need to use the parameter -i to specify the interface.
[RouterA] ping ipv6 fe80::2d6f:0:7af3:1 -i pos 1/0/0 PING FE80::2D6F:0:7AF3:1 : 56 data bytes, press CTRL_C to break Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=1 hop limit=64 time = 60 ms Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=4 hop limit=64 time = 30 ms Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=5 hop limit=64 time = 1 ms --- FE80::2D6F:0:7AF3:1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/38/60 ms
# On Router A, ping the global unicast IPv6 address of Router B.

[RouterA] ping ipv6 3001::2 PING 3001::2 : 56 data bytes, press CTRL_C to break Reply from 3001::2 bytes=56 Sequence=1 hop limit=64 time = 30 ms Reply from 3001::2 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from 3001::2 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from 3001::2 bytes=56 Sequence=4 hop limit=64 time = 20 ms Reply from 3001::2 bytes=56 Sequence=5 hop limit=64 time = 40 ms --- 3001::2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 20/38/50 ms
----End
Configuration Files
l

# sysname RouterA # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3001::1/64 # return

# sysname RouterB # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3001::2/64 #
Issue 02 (2009-12-10)
7-27

return
7.8.2 Example for Configuring IPv6 Neighbor Discovery

CAUTION
On a single NE5000E, the interface is numbered in the format of slot number/card number/port number. Whereas in the multi-chassis scenario, the interface is numbered in the format of chassis ID/slot number/card number/interface number. This requires the chassis ID to be specified along with the slot number. As shown in Figure 7-2, device is directly connected to the PC by GE 1/0/10. This PC runs the Windows XP operating system. Figure 7-2 Example for configuring IPv6 neighbor discovery
Quidway
GE1/0/10 3000::/64 eui-64
PC
Notes
When configuring IPv6 neighbor discovery, pay attention to the following:
l
A PC can automatically obtain the RA prefix message from devices only after the Router Advertisement (RA) prefix message to be advertised is configured and the advertisement of the RA prefix message is enabled on devices.
The configuration roadmap is as follows: 1. 2. Configure the local unicast addresses of the link and EUI-64 site separately on GE 1/0/10. Configure the RA prefix message to be advertised on GE 1/0/10 and enable the advertisement of the RA prefix message.
Data Preparation
l l
Local unicast addresses of the link and EUI-64 site on GE 1/0/10 RA prefix message to be advertised
7-28
Procedure
Step 1 Enable the IPv6 forwarding on devices.
<HUAWEI> system-view [HUAWEI] sysname Router [Router] ipv6
Step 2 Configure the local unicast address of the link on GE 1/0/10.

[Router] interface gigabitethernet 1/0/10 [Router-GigabitEthernet1/0/10] undo shutdown [Router-GigabitEthernet1/0/10] ipv6 enable [Router-GigabitEthernet1/0/10] ipv6 address auto link-local
Step 3 Configure the local unicast address of the EUI-64 site on GE 1/0/10 and the prefix in the RA message.
[Router-GigabitEthernet1/0/10] ipv6 address 3000::/64 eui-64 [Router-GigabitEthernet1/0/10] ipv6 nd ra prefix 3000::/64 1000 1000 [Router-GigabitEthernet1/0/10] undo ipv6 nd ra halt
Step 4 Verify the configuration. If configurations are successful, you can view the configured local unicast address of the link and the EUI-64 site and find that GE 1/0/10 is Up and IPv6 is Up. # Display information about interfaces of devices.
[Router-GigabitEthernet1/0/10] display this ipv6 interface GigabitEthernet1/0/10 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::2E0:FCFF:FE7D:A497 Global unicast address(es): 3000::2E0:FCFF:FE7D:A497, subnet is 3000::/64 Joined group address(es): FF02::1:FF7D:A497 FF02::2 FF02::1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisement max interval 600 seconds, min interval 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses
# Display information about PCs.

Ethernet adapter 1: Connection-specific Description . . . . rnet NIC #2 Physical Address. . Dhcp Enabled. . . . IP Address. . . . . Subnet Mask . . . . IP Address. . . . . IP Address. . . . . IP Address. . . . . Default Gateway . . DNS Servers . . . . DNS Suffix . : . . . . . . . : Realtek RTL8139 Family PCI Fast Ethe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . : : : : : : : : : 00-E0-4C-77-A1-B6 No 110.1.1.33 255.0.0.0 3000::78b3:4397:c0c4:f078 3000::2e0:4cff:fe77:a1b6 fe80::2e0:4cff:fe77:a1b6%6 fe80::288:ff:fe10:b%6 fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1
# Ping the local unicast address of the link on the PC from the device with the use of the parameter -i which specifies the interface corresponding to the local unicast address.
[Router-GigabitEthernet1/0/10] ping ipv6 fe80::2e0:4cff:fe77:a1b6 -i gigabitethernet1/0/10 PING FE80::2E0:4CFF:FE77:A1B6: 56 data bytes, press CTRL_C to break Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=1 hop limit=64 time = 60 ms Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=4 hop limit=64 time = 30 ms Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=5 hop limit=64 time = 1 ms --- FE80::2E0:4CFF:FE77:A1B6 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/38/60 ms
# Ping the local unicast address of the EUI-64 site of the PC from the device.
[Router-GigabitEthernet1/0/10] ping ipv6 3000::78b3:4397:c0c4:f078 PING 3000::78B3:4397:C0C4:F078 : 56 data bytes, press CTRL_C to break Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=1 hop limit=64 time = 30 ms Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=4 hop limit=64 time = 20 ms Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=5 hop limit=64 time = 40 ms --- 3000::78B3:4397:C0C4:F078 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 20/38/50 ms
----End
Configuration Files
Configuration file of Router
# sysname Router # ipv6 # interface GigabitEthernet1/0/10 undo shutdown ipv6 enable ipv6 address 3000::/64 eui-64 ipv6 address auto link-local ipv6 nd ra prefix 3000::/64 1000 1000 undo ipv6 nd ra halt # return
7-30
Issue 02 (2009-12-10)
8
About This Chapter
IPv6 DNS Configuration
This chapter describes the basic principle, configuration procedures, and configuration examples for IPv6 DNS. 8.1 IPv6 DNS Overview This section describes the principle and concepts of IPv6 DNS. 8.2 Configuring IPv6 DNS This section describes how to communicate with other devices using the domain name. 8.3 Maintaining IPv6 DNS This section describes how to display IPv6 DNS configurations, clear IPv6 DNS statistics and debug IPv6 DNS. 8.4 Configuration Examples This section provides several configuration examples of IPv6 DNS.
Issue 02 (2009-12-10)
8-1
8.1 IPv6 DNS Overview

This section describes the principle and concepts of IPv6 DNS. 8.1.1 Introduction to IPv6 DNS 8.1.2 IPv6 DNS Supported by the NE5000E
8.1.1 Introduction to IPv6 DNS

IPv6 DNS has two resolution modes: dynamic IPv6 DNS resolution and static IPv6 DNS resolution. To resolve a domain name, the system first uses static IPv6 DNS resolution. If this mode fails, the system uses dynamic IPv6 DNS resolution. To improve resolution efficiency, you can put common domain names in a static domain name resolution table.
8.1.2 IPv6 DNS Supported by the NE5000E

IPv6 domain name system (DNS) is similar to IPv4 DNS. For configurations of IPv4 DNS, refer to "DNS Configuration."
8.2 Configuring IPv6 DNS

This section describes how to communicate with other devices using the domain name. 8.2.1 Establishing the Configuration Task 8.2.2 Configuring a Static IPv6 DNS Entry 8.2.3 Configuring the Dynamic IPv6 DNS Services 8.2.4 Checking the Configuration

DNS needs to be configured if the local users log on to a device using domain names to communicate with other devices. The IPv6 DNS entries show the mapping between domain names and IPv6 addresses. If users seldom use the domain name to access other devices, or if the DNS server is unavailable, a static DNS needs to be configured. To configure a static IPv6 DNS, the network administrator needs to know the relation between domain names and IPv6 addresses, and manually modify the IPv6 DNS entry when the relation changes. If the users need to use the domain name to access many devices, and the DNS server is available, a dynamic DNS can be configured. The dynamic DNS needs to be supported by a DNS server.
Before configuring IPv6 DNS, configure the route between a local device and a DNS server.
Data Preparation
To configure IPv6 DNS, you need the following data. No. 1 2 3 Data Domain name of the static IPv6 DNS entry and the corresponding IPv6 address IPv6 address of the IPv6 DNS server Domain name of the dynamic IPv6 DNS or the domain name list
8.2.2 Configuring a Static IPv6 DNS Entry

Context
Procedure
Step 1 Run:
system-view

ipv6 host host-name ipv6-address
The host name and the corresponding IPv6 address are configured. If the same host is configured with IPv6 addresses for several times, the IPv6 address configured earliest is used when needing to find the host with the IPv6 address, such as ping this host. ----End
8.2.3 Configuring the Dynamic IPv6 DNS Services

Context
Configure the IPv6 DNS server on a device. If the IPv6 DNS server is configured with a linklocal address, the interface name should also be configured with the IPv6 address. Figure 8-1 DNS server connecting IPv4 and IPv6 networks
DNS IPv4 client
DNS server
DNS IPv6 client IPv6 link
IPv4 link
Issue 02 (2009-12-10)
8-3
CAUTION
If multiple DNS servers are configured, the servers are queried in the order of configuration till proper response is received. If both IPv4 and IPv6 servers are configured, the A query is first sent to the IPv4 server, while AAAA query packets are first sent to the IPv6 server. The DNS domains are configured on a device and the domain names can be searched. If the DNS fails in searching for a host name, it appends a domain name to the host name following a "." and continues the DNS search. You can configure some commonly used domain names like "com", and "net". For example, if the search for the host name "huawei" fails, the system then searches for "huawei.com" or "huawei.net". Do as follows on the router:
Procedure
Step 1 Run:
system-view

dns resolve
The dynamic domain name resolution is enabled. Step 3 Run:

dns server ipv6 ipv6-address [ interface-type interface-number ]
The IPv6 DNS server is configured. Step 4 Run:

dns server ipv6 source-ip ipv6-address
The IPv6 address of the local device is specified. Step 5 Run:

dns domain domain-name
The suffix of domain names is added. After the source IPv6 address is specified for the local device, the local device uses the specified source IPv6 address to communicate with the IPv6 DNS server to ensure the security of check. ----End

Prerequisite
The configurations of the IPv6 DNS function are complete.
Procedure
l
8-4
Run the display ipv6 host command to check the static IPv6 DNS table.
l l l
Run the display dns server command to check the configuration of the DNS server. Run the display dns domain command to check the configuration of the suffix list of the domain name. Run the display dns ipv6 dynamic-host command to check the cache of the dynamic domain name.
----End
Example
Run the display ipv6 host command. If the static IPv6 DNS entries, including the host name and the IPv6 address, are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ipv6 host Host Age RTB 0 RTA 0 Flags static static IPv6Address (es) 20::1 20::2
Run the display dns server command. If the IPv6 addresses of all DNS servers are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns server IPv4 Dns Servers : Domain-server IpAddress 1 169.254.65.125 IPv6 Dns Servers: Domain-server Ipv6Address 1 3001::2 2 FE80::2
(Interface Name) GigabitEthernet6/0/0
Run the display dns domain command. If the suffixes of the domain names are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns domain No Domain-name 1 com 2 net
Run the display dns ipv6 dynamic-host command. If information about the cache of the dynamic domain name is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns ipv6 dynamic-host No Domain-name Ipv6address TTL 1 huawei6 3001::2 6
8.3 Maintaining IPv6 DNS

This section describes how to display IPv6 DNS configurations, clear IPv6 DNS statistics and debug IPv6 DNS. 8.3.1 Clearing IPv6 DNS Entries 8.3.2 Monitoring Network Operation Status of IPv6 DNS
Issue 02 (2009-12-10)
8-5
8.3.1 Clearing IPv6 DNS Entries

Context
CAUTION
IPv6 DNS entries cannot be restored after being cleared. So, confirm the action before you use this command.
Procedure
Step 1 Run the reset dns ipv6 dynamic-host command in the user view to clear dynamic IPv6 DNS entries statistics in the domain name cache. ----End
8.3.2 Monitoring Network Operation Status of IPv6 DNS

Context
In routine maintenance, you can run the following commands in any view to check the operation of IPv6 DNS.
Procedure
l Run:
display dns domain
Domain names are checked. l Run:

display dns server
Configurations of the DNS server are checked. l Run:

display dns ipv6 dynamic-host
Contents about the cache of the IPv6 dynamic domain names are checked. l Run:
display ipv6 host
The static DNS table is checked. ----End

This section provides several configuration examples of IPv6 DNS. 8.4.1 Example for Configuring IPv6 DNS
8.4.1 Example for Configuring IPv6 DNS

CAUTION
In the single-chassis scenario, the NE5000E numbers interfaces in three dimensions, that is, slot number, card number, and interface number. In the multi-chassis scenario, the NE5000E numbers interfaces in four dimensions, that is, chassis ID, slot number, card number, and interface number. As soon as the slot number is specified, the corresponding chassis ID must be specified. As shown in Figure 8-2, Router A, functioning as the IPv6 DNS client and working jointly whose IPv6 DNS server, can access the host with the IP address as 2002::1/64 based on the domain name huawei.com. On Router A, the static IPv6 DNS entries of Router B and Router C are configured. This ensures that Router A can manage both the routers based on the domain names RouterB and RouterC. Figure 8-2 Networking diagram of IPv6 DNS configurations
GE1/0/0 2001::1/64
RouterB
RouterC GE1/0/1
2003::1/64 GE1/0/0 DNS Server 2002::3/64 2003::2/64
DNS Client RouterA
GE1/0/1 2001::2/64
GE1/0/0 2002::2/64
huawei.com
2002::1/64
The configuration roadmap is as follows: 1. 2. 3. 4. Configure static IPv6 DNS entries. Enable the DNS resolution function. Configure IPv6 address of the IPv6 DNS server. Set the domain name suffix.
Data Preparation
l
Domain names of Router B and Router C

Issue 02 (2009-12-10)

l l
IPv6 address of the IPv6 DNS server Domain name suffix
Procedure
Step 1 Configure Router A. # Configure static IPv6 DNS entries.
<RouterA> system-view [RouterA] ipv6 host RouterB 2001::2 [RouterA] ipv6 host RouterC 2002::3
# Enable the DNS resolution function.

[RouterA] dns resolve
# Configure the IPv6 address of the IPv6 DNS server.

[RouterA] dns server ipv6 2003::2
# Set the domain name suffix to ".net".

[RouterA] dns domain net
# Set the domain name suffix to ".com".

[RouterA] dns domain com [RouterA] quit
NOTE
To resolve the domain name, you also need to configure the route from Router A to the IPv6 DNS server. For details of how to configure the route, refer to the NE5000E Core Router Configuration Guide - IP Routing.
Step 2 Verify the configuration. # Run the ping ipv6 huawei.com command on Router A. You can find that the Ping operation succeeds, and the destination IP address is 2002::1.
<RouterA> ping ipv6 huawei.com Resolved Host ( huawei.com -> 2002::1) PING huawei.com : 56 data bytes, press CTRL_C to Reply from 2002::1: bytes=56 Sequence=1 ttl=126 Reply from 2002::1: bytes=56 Sequence=2 ttl=126 Reply from 2002::1: bytes=56 Sequence=3 ttl=126 Reply from 2002::1: bytes=56 Sequence=4 ttl=126 Reply from 2002::1: bytes=56 Sequence=5 ttl=126 --- huawei.com ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 4/4/6 ms
break time=6 time=4 time=4 time=4 time=4
ms ms ms ms ms
# Run the display ipv6 host command on Router A. You can view the mapping relationships between the host names in static IPv6 DNS entries and the IPv6 addresses.
<RouterA> display ipv6 host Host Age RouterB 0 RouterC 0 Flags static static IPv6Address (es) 2001::2 2002::3
Run the display dns ipv6 dynamic-host command on Router A. You can view information about dynamic IPv6 DNS entries in the dynamic cache.
<RouterA> display dns ipv6 dynamic-host
8-8
Issue 02 (2009-12-10)

No 1 Domain-name huawei.com
NOTE

Ipv6address 2002::1 TTL 3579
TTL in the command output indicates the life time of the entry, in seconds.
----End
Configuration Files
l l

# sysname RouterA # ipv6 # ipv6 host RouterB 2001::2 ipv6 host RouterC 2002::3 # dns resolve dns server ipv6 2003::2 dns domain net dns domain com # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 address 2001::1/64 ripng 1 enable # ripng 1 # return

# sysname RouterB # ipv6 # interface GigabitEthernet1/0/1 undo shutdown ipv6 enable ipv6 address 2001::2/64 ripng 1 enable # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 address 2002::2/64 ripng 1 enable # ripng 1 # return

# sysname RouterC # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ipv6 address 2002::3/64 ripng 1 enable #
Issue 02 (2009-12-10)
8-9

interface GigabitEthernet1/0/1 undo shutdown ipv6 address 2003::1/64 ripng 1 enable # ripng 1 # return
8-10
Issue 02 (2009-12-10)
9
About This Chapter
ACL6 Configuration
This chapter describes the ACL6 fundamentals, classifications and configuration steps for ACL6, and IPv6 packet filtering, along with typical examples. 9.1 ACL6 Overview This section describes basic concept and parameters of ACL6. 9.2 Configuring an Interfaced-based ACL6 This section describes how to configure the interface-based ACL6. 9.3 Configuring a Basic ACL6 This section describes how to configure a basic ACL6. 9.4 Configuring an Advanced ACL6 This section describes how to configure an advanced ACL6. 9.5 Configuring a Named ACL6 This section describes how to configure the Named ACL6. 9.6 Maintaining ACL6 This section describes how to maintain ACL6. 9.7 Configuration Examples This section provides several configuration examples of ACL6.
Issue 02 (2009-12-10)
9-1
9.1 ACL6 Overview

This section describes basic concept and parameters of ACL6. 9.1.1 Introduction to ACL6 9.1.2 ACL6 Supported by the NE5000E
9.1.1 Introduction to ACL6

To filter data packets, you need to define a series of Access Control List (ACL) rules on the device. After ACL rules are applied to interfaces, the device classifies the received data packets and determines whether to forward or discard packets.
NOTE
In this manual, ACL applies to filter IPv4 packets and ACL6 applies to filter IPv6 packets.
9.1.2 ACL6 Supported by the NE5000E

ACL6 is classified into the following types based on application goals:
l l
Basic ACL6: classifies data packets only based on the source IP addresses. Advanced ACL6: classifies data packets more detailedly based on the source and destination IP addresses, source and destination port numbers, and protocol type. Interface-based ACL6: classifies data packets based on the interfaces that receive packets.
9.2 Configuring an Interfaced-based ACL6

This section describes how to configure the interface-based ACL6. 9.2.1 Establishing the Configuration Task 9.2.2 (Optional) Configuring the Valid Time Range of ACL6 9.2.3 Creating an Interfaced-based ACL6 9.2.4 Checking the Configuration

An ACL6 can be applied to the following tasks:
l l l
Configuring the packet filtering policy Configuring the policy-based routing Configuring the routing policy
9-2
Before configuring ACL6, complete the following task:
l
Starting the device normally
Data Preparation
To configure an ACL6, you need the following data: No. 1 2 3 Data (Optional) Name of the time range in which the Interface-based ACL6 takes effect and the start time and end time of the time range ACL6 number, permit or deny rules Type and number of the interface where the ACL6 is applied
9.2.2 (Optional) Configuring the Valid Time Range of ACL6

Context
Procedure
Step 1 Run:
system-view

A time rang is created. ----End
9.2.3 Creating an Interfaced-based ACL6

Context
The range of acl6-number of a interface-based ACL6 is 1000 to 1999. Do as follows on the router:
Procedure
Step 1 Run:
system-view
Issue 02 (2009-12-10)
9-3

acl ipv6 [ number ] acl6-number [ match-order { auto | config } ]
The interface-based ACL6 is created and the corresponding view is displayed. Step 3 Run:
rule [ rule-id ] { deny | permit } interface { interface-type interface-number | any } [ logging | time-range time-name ]*
ACL6 rules are defined. ----End

Prerequisite
The configurations of the interface-based ACL6 function are complete.
Procedure
l l Run the display acl ipv6 { acl6-number | all } command to check the ACL6 rules. Run the display statistics acl ipv6 { acl-number | all } control-plane [ | { begin | include | exclude } regular-expression ] command to check the statistics about the packets matching ACL6 in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
After the configuration, run the preceding command. You can view ACL6 number, ACL6 step, contents of the rules, and matching times of the rules.
<HUAWEI> display acl ipv6 1000 Interface Based IPv6 ACL 1000, 1 rule Acl's step is 5 rule 5 permit interface Pos4/0/0
After the preceding configurations, the statistics about the packets matching ACL6 in soft forwarding is displayed after the display statistics acl ipv6 control-plane command is used.
<HUAWEI> display statistics acl ipv6 1000 control-plane Interface Based IPv6 ACL 1000, 3 rules rule 0 deny interface any (1035 times matched) rule 1 permit interface Pos6/0/3 (586 times matched) rule 2 permit interface GigabitEthernet3/0/11 (103 times matched)
9-4
Issue 02 (2009-12-10)
9.3 Configuring a Basic ACL6

This section describes how to configure a basic ACL6. 9.3.1 Establishing the Configuration Task 9.3.2 (Optional) Configuring the Valid Time Range of ACL6 9.3.3 Creating a Basic ACL6 9.3.4 Checking the Configuration

l l l
Configuring the packet filtering policy Configuring the policy-based routing Configuring the routing policy
Before configuring an ACL6, start the device normally.
Data Preparation
To configure an ACL6, you need the following data. No. 1 2 Data (Optional) Name of the time range in which the basic ACL takes effect and the start time and end time of the time range ACL6 number, permit or deny rules, source IP address

Context
Procedure
Step 1 Run:
system-view
Issue 02 (2009-12-10)
9-5

A time rang is created. This configuration task is used to create a time range. Multiple time ranges with the same name can be created. ----End
9.3.3 Creating a Basic ACL6

Context
The range of acl6-number of a basic ACL6 is 2000 to 2999. Do as follows on the router:
Procedure
Step 1 Run:
system-view

A basic ACL6 is created and the basic ACL6 view is displayed. Step 3 Run:
rule [ rule-id ] { deny | permit } [ fragment | logging | source { source-ipv6addressprefix-length | source-ipv6-address/prefix-length | any } | time-range timename | vpn6-instance vpn6-instance-name ] *
ACL6 rules are defined. Defining ACL6 rules for the basic ACL6 is based only on the source IP address. ----End

Prerequisite
The configurations of the Basic ACL6 function are complete.
Procedure
l Run the display acl ipv6 { acl6-number | all } command to check the configured ACL6 rule.
9-6
Run the display statistics acl ipv6 { acl-number | all } control-plane [ | { begin | include | exclude } regular-expression ] command to check the statistics about the packets matching ACL6 in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
Run the display acl ipv6 command. If the ACL6 number, the number of rules, detailed step description, and ACL6 rules are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display acl ipv6 2200 Basic IPv6 ACL 2200, 1 rule Acl's step is 5 rule 5 permit
<HUAWEI> display statistics acl ipv6 2200 control-plane Basic IPv6 ACL 2200, 3 rules rule 0 permit source 2030:5060::9050/64 (235 times matched) rule 1 deny source 4050:7080::4060/96 (560 times matched) rule 80 permit source FE80::9040/32 (729 times matched)
9.4 Configuring an Advanced ACL6

This section describes how to configure an advanced ACL6. 9.4.1 Establishing the Configuration Task 9.4.2 (Optional) Configuring the Valid Time Range of ACL6 9.4.3 Creating an Advanced ACL6 9.4.4 Checking the Configuration

l
Configuring the packet filtering policy

Issue 02 (2009-12-10)
l l
Configuring the policy-based routing Configuring the routing policy
Before configuring an ACL6, complete the following task:
l
Starting the device normally
Data Preparation
To configure an ACL6, you need the following data: No. 1 2 3 Data (Optional) Name of the time range in which the advanced ACL takes effect and the start time and end time of the time range ACL6 number, permit or deny rules Protocol type, source and destination port numbers, source and destination IP address, and source IP address fragment or not, ICMP message type and coding, priority, ToS, and valid time

Context
Procedure
Step 1 Run:
system-view

9.4.3 Creating an Advanced ACL6

Context
The range of acl6-number of an advanced ACL6 is 3000 to 3999. Do as follows on the router:
Procedure
Step 1 Run:
system-view

The advance ACL6 is created and the advanced ACL6 view is displayed. Step 3 Perform the following configuration as required.
l
When protocol is specified as TCP or UDP Run:

rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6address prefix-length | destination-ipv6-address/prefix-length | any } | destination-portoperator port | fragment | logging | precedence precedence | source { source-ipv6-address prefix-length | source-ipv6-address/prefix-length | any } | source-port operator port | time-range time-name | tos tos | vpn6instance vpn6-instance-name ] *
ACL6 rules are defined.

l
When protocol is specified as ICMPv6 Run:

rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6address prefix-length | destination-ipv6-address/prefix-length | any } | fragment | icmpv6-type { icmp6-type-name | icmp6-type icmp6-code } | logging | precedence precedence | source { source-ipv6-address prefix-length | source-ipv6address/prefix-length | any } | time-range time-name | tos tos | vpn6-instance vpn6-instance-name ] *
ACL6 rules are defined.

l
When protocol is specified as other protocols except TCP, UDP, and ICMPv6 Run:
rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6address prefix-length | destination-ipv6-address/prefix-length | any } | fragment | logging | precedence precedence | source { source-ipv6-address prefixlength | source-ipv6-address/prefix-length | any } | time-range time-name | tos tos | vpn6-instance vpn6-instance-name ] *
ACL6 rules are defined. ----End

Prerequisite
The configurations of the Advanced ACL6 function are complete.
Procedure
l l Run the display acl ipv6 { acl6-number | all } command to check the configured ACL6 rule. Run the display statistics acl ipv6 { acl-number | all } control-plane [ | { begin | include | exclude } regular-expression ] command to check the statistics about the packets matching ACL6 in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
Run the display acl ipv6 command. If the ACL6 number, the number of rules, detailed step description, and ACL6 rules are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display acl ipv6 3100 Advanced IPv6 ACL 3100, 3 rules, rule 0 permit icmpv6 rule 1 permit ipv6 source 3001::/16 destination 4001::/16 rule 2 permit tcp source 5001::/16
<HUAWEI> display statistics acl ipv6 3000 control-plane Advanced IPv6 ACL 3000, 1 rule rule 1 permit ipv6 source 4001::/16 (137 times matched)
9.5 Configuring a Named ACL6

This section describes how to configure the Named ACL6. 9.5.1 Establishing the Configuration Task 9.5.2 (Optional) Configuring the Valid Time Range of ACL6 9.5.3 Creating a Named ACL6 9.5.4 Checking the Configuration

An ACL6 can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types.. Named ACL6s are advanced ACL6s because you need to define rules for the named ACL6s by specifying the source IP address, destination IP address, IP bearer protocol type, TCP source port, TCP destination port, or ICMP protocol type and code.
None.
Data Preparation
To configure a named ACL6, you need the following data. No. 1 2 3 4 5 Data (Optional) Name of the time range in which the named ACL6 takes effect and the start time and end time of the time range Rule ID of the named ACL6, permit or deny rule, and source IP address IP bearer protocol type, source and destination ports, destination IP address, or ICMP message type and code, packet priority, ToS, and timeout period of the ACL rule (Optional) Description of the named ACL6 (Optional) Step of the named ACL6

Context
Procedure
Step 1 Run:
system-view

9.5.3 Creating a Named ACL6

Context
A named ACL6 is an advanced ACL6 and its acl-number ranges from 42768 to 45767. Do as follows on the router:
Procedure
Step 1 Run:
system-view

acl ipv6 name acl-name [ number acl-number ] [ match-order { auto | config } ]
A named ACL6 is created and the named ACL view is displayed. Step 3 Perform the following steps as required to configure rules for the named ACL6:
l
When protocol is TCP or UDP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag time-range time-name | precedence precedence |tos tos ] * syn-flagsyn-flag needs to be specified only when TCP is used.
When protocol is ICMP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name | icmp-type icmp-code } | source { source-ip-address source-wildcard | any } | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name |icmp-type icmp-code } |source { source-ip-address source-wildcard | any } | time-range time-name | precedence precedence | tos tos ] *
When protocol is not TCP, UDP, or ICMP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | precedence precedence | tos tos ] *
Configure different advanced ACLs on the device for different protocols over IP. Different protocols have different parameters combination. For example, TCP and UDP have optional
parameter [ source-port operator port ] [ destination-port operator port ] while other protocols do not. ----End

Prerequisite
The configurations of the ACL6 function are complete.
Procedure
l l Run the display acl ipv6 name acl-name command to check the configured ACL6 rule. Run the display statistics acl ipv6 { acl-number | all | name acl-name } control-plane [ | { begin | include | exclude } regular-expression ] command to check the statistics about the packets matching ACL6 in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
# Check the configurations of named ACL6, whose name is test.
<HUAWEI> display acl ipv6 name test Advanced IPv6 Name ACL test, 1 rule Acl's step is 5 rule 5 permit ip
# View the statistics about the packets matching ACL6 3000 in soft forwarding.
<HUAWEI> display statistics acl ipv6 3000 control-plane Advanced IPv6 ACL 3000, 1 rule rule 0 permit ipv6 (335 times matched)
# View the statistics about the packets matching ACL6 named test in soft forwarding.
<HUAWEI> display statistics acl ipv6 name test control-plane Advanced IPv6 ACL test, 2 rules, rule 0 permit 1 (10 times matched) rule 1 permit ipv6 (23 times matched)
9.6 Maintaining ACL6

This section describes how to maintain ACL6.
Issue 02 (2009-12-10)
9-13
9.6.1 Clearing ACL6 Statistics 9.6.2 Monitoring Network Operation Status of ACL6
9.6.1 Clearing ACL6 Statistics

Context
CAUTION
Statistics cannot be restored after you clear it. So, confirm the action before you use the command.
Procedure
Step 1 Run the reset acl ipv6 counter { acl6-number | name acl-name | all } command in the user view to clear the ACL6 counter. ----End
9.6.2 Monitoring Network Operation Status of ACL6

Context
In routine maintenance, you can run the following command in any view to check the operation of ACL6.
Procedure
l l Run the display acl ipv6 { acl6-number | name acl-name | all } command in any view to check the configured ACL6 rules. Run the display statistics acl ipv6 { acl-number | all | name acl-name } control-plane command in any view to check the statistics about the packets matching ACL6 in soft forwarding.
----End

This section provides several configuration examples of ACL6. 9.7.1 Example for Configuring an ACL6 to Filter IPv6 Packets
9.7.1 Example for Configuring an ACL6 to Filter IPv6 Packets
9-14
Issue 02 (2009-12-10)
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 9-1, Router A and Router B are connected through POS interfaces. Configure ACL6 rules on Router A to prevent the IPv6 packets with the source IP address 3001::2 from entering POS1 /0/0 of Router A. Figure 9-1 Networking diagram of configuring an ACL6 to filter IPv6 packets
RouterA
POS1/0/0 3001::1/64
POS1/0/0 3001::2/64
RouterB
Loopback2 3002::2/64
The configuration roadmap is as follows: 1. 2. 3. Define an ACL6 number. Define rules in the ACL6. Set the traffic classifier, behavior, and policy.
Data Preparation
l l
ACL6 number Source IPv6 address denied by the ACL6 rule
Procedure
Step 1 Enable IPv6 forwarding capabilities on Router A and Router B, configure interface parameters, and check connectivity between them. # Configure Router A.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] ipv6 [RouterA] interface pos 1/0/0 [RouterA-Pos1/0/0] ipv6 enable [RouterA-Pos1/0/0] ipv6 address 3001::1 64 [RouterA-Pos1/0/0] undo shutdown [RouterA-Pos1/0/0] quit
# Configure a static route on Router A.

[RouterA] ipv6 route-static 3002:: 64 3001::2
<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] ipv6 [RouterB] interface loopback 2 [RouterB-LoopBack2] ipv6 enable [RouterB-LoopBack2] ipv6 address 3002::2 64 [RouterB-LoopBack2] quit [RouterB] interface pos 1/0/0 [RouterB-Pos1/0/0] ipv6 enable [RouterB-Pos1/0/0] ipv6 address 3001::2 64 [RouterB-Pos1/0/0] undo shutdown [RouterB-Pos1/0/0] quit
# Ping POS 1/0/0 of Router A from POS 1/0/0 of Router B.

[RouterB] ping ipv6 -a 3001::2 3001::1 PING 3001::1 : 56 data bytes, press CTRL_C to break Reply from 3001::1 bytes=56 Sequence=1 hop limit=64 time = 80 ms Reply from 3001::1 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from 3001::1 bytes=56 Sequence=3 hop limit=64 time = 40 ms Reply from 3001::1 bytes=56 Sequence=4 hop limit=64 time = 30 ms Reply from 3001::1 bytes=56 Sequence=5 hop limit=64 time = 1 ms --- 3001::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/40/80 ms
The ping succeeds without timeout or abnormal delay. # Ping POS 1/0/0 of Router A from loopback2 of Router B.
The ping succeeds without timeout or abnormal delay. Step 2 Create an ACL6 rule and apply the rule on the interface to prevent the IPv6 packets from 3001::2. # Configure Router A.
[RouterA] acl ipv6 number 3001 [RouterA-acl6-adv-3001] rule deny ipv6 source 3001::2/128 [RouterA-acl6-adv-3001] quit [RouterA] traffic classifier bb [RouterA-classifier-bb] if-match ipv6 acl 3001
9-16
Issue 02 (2009-12-10)

[RouterA-classifier-bb] quit [RouterA] traffic behavior aa [RouterA-behavior-aa] permit [RouterA-behavior-aa] quit [RouterA] traffic policy cc [RouterA-trafficpolicy-cc] classifier bb behavior aa [RouterA-trafficpolicy-cc] quit [RouterA] interface pos 1/0/0 [RouterA-Pos1/0/0] traffic-policy cc inbound [RouterA-Pos1/0/0] quit
Step 3 Verify the configuration. # Ping POS 1/0/0 of Router A from POS 1/0/0 of Router B.
[RouterB] ping ipv6 -a 3001::2 3001::1 PING 3001::1 : 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out --- 3001::1 ping statistics --5 packet(s) transmitted 0 packet(s) received 100.00% packet loss round-trip min/avg/max = 0/0/0 ms
The ping fails. # Ping POS 1/0/0 of Router A from loopback2 of Router B.
The ping succeeds without timeout or abnormal delay. ----End
Configuration Files
l

# sysname RouterA # ipv6 # acl ipv6 number 3001 rule 0 deny ipv6 source 3001::2/128 # traffic classifier bb operator or if-match ipv6 acl 3001 #
Issue 02 (2009-12-10)
9-17
traffic behavior aa # traffic policy cc undo share-mode classifier bb behavior aa # interface pos1/0/0 link-protocol ppp undo shutdown traffic-policy cc inbound ipv6 enable ipv6 address 3001::1/64 # ipv6 route-static 3002:: 64 3001::2 # return l

# sysname RouterB # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3001::2/64 # interface LoopBack2 ipv6 enable ipv6 address 3002::2/64 # return
9-18
Issue 02 (2009-12-10)
10 IPv6 over IPv4 Tunnel Configuration
10
IPv6 over IPv4 Tunnel Configuration
About This Chapter

This chapter describes the IPv6 over IPv4 tunnel fundamentals. It also describes configuration steps for IPv6 over IPv4 tunnel configuration, along with typical examples. 10.1 IPv6 over IPv4 Tunnel Overview This section describes the basic principles and concepts of IPv6 over IPv4 tunnel. 10.2 Configuring IPv4/IPv6 Dual Stacks This section describes how to enable the IPv4/IPv6 dual protocol stacks. 10.3 Configuring an IPv6 over IPv4 Tunnel This section describes how users in IPv6 networks communicate across an IPv4 network. 10.4 Configuring 6PE This section describes how users in IPv6 networks communicate across the existing MPLS network. 10.5 Maintaining IPv6 over IPv4 Tunnels This section describes how to debug the IPv6 tunnel. 10.6 Configuration Examples This section provides several configuration examples of IPv6 over IPv4 tunnels.
Issue 02 (2009-12-10)
10-1
10.1 IPv6 over IPv4 Tunnel Overview

This section describes the basic principles and concepts of IPv6 over IPv4 tunnel. 10.1.1 Introduction to IPv6 over IPv4 10.1.2 IPv6 over IPv4 Supported by the NE5000E
10.1.1 Introduction to IPv6 over IPv4

During the transition from the IPv4 Internet to the IPv6 Internet, IPv4 networks have been widely deployed while IPv6 domains are isolated and dispersed around the world. It is not economical to connect these isolated sites with private lines. The usual method is tunnel technology. This technology creates tunnels over IPv4 networks to connect isolated IPv6 domains. This is similar to the situation where the tunnel technology is used to deploy VPNs on the IP networks. The tunnel used to connect isolated IPv6 domains over IPv4 networks is called IPv6 over IPv4 tunnel. To implement this tunnel, enable IPv4/IPv6 dual stacks on the devices at the border of the IPv4 network and the IPv6 network.
10.1.2 IPv6 over IPv4 Supported by the NE5000E

Dual Stacks
The simplest way for an IPv6 node to remain compatible with an IPv4 node is to reserve a complete IPv4 protocol stack. In this way, the IPv6 node maintains a dual-stack structure. Figure 10-1 shows a single stack structure and a dual stack structure. Figure 10-1 Single stack and dual stack structures (Ethernet)
IPv4 Application TCP UDP
IPv4/IPv6 Application TCP UDP
IPv4 Protocol ID: 0x0800 Ethernet IPv4 Stack
IPv6 Protocol ID: Protocol ID: 0x86DD 0x0800 Ethernet Dual Stack
The characteristics of the dual-stack structure are as follows:

l
Supported by multiple link layer protocols

10-2
Multiple link layer protocols, such as Ethernet, support dual stacks. The link layer in the above diagram is the Ethernet. For an Ethernet frame with the protocol ID field value of 0x0800 indicates that the network layer has IPv4 packets. The ID field value of 0x86DD indicates that the network has IPv6 packets.
l
Supported by multiple applications Multiple applications such as DNS, FTP and Telnet support dual stacks. The upper application, such as DNS, can select TCP or UDP as its transport layer protocol. However, it prefers the IPv6 protocol stack rather than IPv4 to be the network layer protocol.
IPv6 over IPv4 Tunnel

Figure 10-2 shows principles of the IPv6 over IPv4 tunnel technology. 1. 2. Enabling IPv4/IPv6 dual stacks Enable IPv4/IPv6 dual stacks on the border device. Encapsulating IPv6 packets After receiving a packet from the IPv6 network, the border device takes the received IPv6 packet as the payload, adds an IPv4 packet header before the payload and encapsulates it into an IPv4 packet if it finds that the destination of the packet is not for itself. 3. 4. Transmitting the encapsulated packet In the IPv4 network, the encapsulated packet is transmitted to the peer border device. Decapsulating the packet The peer border device decapsulates the packet, removes the IPv4 packet header, and forwards the resulting IPv6 packet to the remote IPv6 network. Figure 10-2 Schematic diagram of IPv6 over IPv4 tunnel
Dual Stack Router IPv6 IPv6 host

IPv6 Header IPv6 Data IPv4 Header
IPv4
Tunnel
Dual Stack Router IPv6 IPv6 host

IPv6 Header IPv6 Data
IPv6 Header IPv6 Data
The virtual tunnel that transmits IPv6 packets between the border devices is called the IPv6 over IPv4 tunnel. Tunnels can be classified according to their setup modes. The common IPv6 over IPv4 tunnel modes include:
l l l
IPv6 over IPv4 manual tunnels IPv6 over IPv4 tunnel automatic tunnels 6to4 tunnels
Issue 02 (2009-12-10)
10-3
IPv6 over IPv4 Manual Tunnel

An IPv6 over IPv4 manual tunnel is set up by configuring the border devices of two tunnel ends. The source IPv4 address and destination IPv4 address of such a tunnel must be configured statically. A manual tunnel is equivalent to a permanent link between two IPv6 networks over an IPv4 backbone network. It is the fixed channel for regular and secure communication between the two border devices. The manual tunnel can be used between isolated IPv6 networks. It can also be used between a border device and a host. In this case, the host and the device on both ends of the tunnel must support the IPv4 and the IPv6 protocol stacks.
IPv6 over IPv4 Automatic Tunnel

To create an IPv6 over IPv4 automatic tunnel, you need a special kind of IPv6 address, namely an IPv4-compatible IPv6 address. The format of IPv4-compatible IPv6 address is as follows: 0:0:0:0:0:0:IPv4-address Its high-order 96 bits are all 0s, and its low-order 32 bits form an IPv4 address. This IPv4 address must be reachable in the IPv4 network, and cannot be a multicast address, a broadcast address, a loopback address or an unspecified address (0.0.0.0). To configure an automatic tunnel, specify just the source address of the tunnel on a border device or a host. The destination address of the tunnel is automatically obtained from the destination IP address field carried in the original IPv6 packet. The IPv6 over IPv4 automatic tunnel is usually used when an isolated IPv4/IPv6 dual stack host needs to access a remote IPv6 network over an IPv4 network. The automatic tunnel needs to be configured between the isolated IPv4/IPv6 host and the IPv4/IPv6 device. While setting up an automatic tunnel, configure the IPv4-compatible IPv6 address on both the ends of the tunnel. The IPv4-compatible IPv6 address depends on the IPv4 address of the physical interface of the tunnel. It is limited to the shortage of the IPv4 address. Therefore, it has certain limitations.
6to4 Tunnel
A 6to4 tunnel is a mechanism that connects several isolated IPv6 domains to each other over an IPv4 network. The 6to4 tunnel can be configured on the border device between the isolated IPv6 network and the IPv4 network. The border device on both the ends of the 6to4 tunnel must support the IPv4 and the IPv6 dual protocol stacks at the same time. The key difference between the 6to4 tunnel and the manual tunnel is that the former can be a point-to-multipoint connection, and the latter is only a point-to-point connection. Hence, the devices of the 6to4 tunnel are not configured in pairs. The 6to4 tunnel can automatically find another end of the tunnel, like the automatic tunnel. You need not specify the IPv4-compatible IPv6 address for it. The 6to4 tunnel uses a kind of special IPv6 address, namely the 6to4 address with the following format: 2002:IPv4 address: subnet ID:interface ID
The prefix of the 6to4 address is 2002:IPv4 address with the length of 48 bits. Of these, the IPv4 address is a globally unique one requested for an isolated IPv6 domain. This IPv4 address must be configured on the IPv6/IPv4 border device's physical interface that is connected with the IPv4 network. The length of the subnet ID is 16 bits, and that of the interface ID is 64 bits. Both the subnet ID and the interface ID are allocated in the isolated IPv6 domains. As shown in Figure 10-3, Site1 and Site2 are 6to4 networks, and hosts and devices in the 6to4 network are allocated with 6to4 addresses. The IPv4 address contained in the 6to4 address of the host or device in Site1 is the IPv4 address of the interface through which Router A accesses the IPv4 network. Similarly, the IPv4 address contained in the 6to4 address of the host or device in Site2 is the IPv4 address of the interface through which Router B accesses the IPv4 network. Router A and Router B are both 6to4 devices. Figure 10-3 6to4 tunnel and 6to4 relay
6to4 Router 6to4 Router IPv4 Network
6to4 Network Site2
6to4 Network Site1
RouterB RouterC
IPv6 Internet Site3
RouterA
6to4 Relay
When the host in Site1 accesses the host in Site2, the process concerned is as follows: 1. 2. 3. The IPv6 packet is transmitted to Router A. Router A checks the destination address of the IPv6 packet and finds that the address is the 6to4 address, from which Router A obtains the remote IPv4 address of the 6to4 tunnel. Router A encapsulates this IPv6 packet into the IPv4 packet. The destination address of IPv4 packet header is the remote IPv4 address of the tunnel, and its source address is the local IPv4 address of the tunnel. Router A forwards the IPv4 packet in the IPv4 network to Router B. Router B decapsulates it to obtain the previous IPv6 packet, and then sends the IPv6 packet to the destination host in Site2.
4. 5.
The above process implements the communication between the 6to4 networks. To implement the communication between the 6to4 network and native IPv6 network, a 6to4 relay device is needed. The so-called native IPv6 network means that both its internal host and device are not configured with the 6to4 address. The 6to4 relay device is the gateway between the 6to4 network and the native IPv6 network. One side of the 6to4 relay device is connected to the native IPv6 network; the other side is connected to the IPv4 network and creates the 6to4 tunnel with the 6to4 device. As shown in Figure 10-3, when the host in the 6to4 network accesses the IPv6 Internet, the process concerned is as follows:
1. 2. 3. 4.
The IPv6 packet is routed to Router A. A 6to4 tunnel is created between Router A and Router C. The IPv6 packet is encapsulated into the IPv4 packet and is sent to Router C. Router C decapsulates the IPv4 packet to obtain the previous IPv6 packet, and sends the IPv6 packet to the destination host in the IPv6 Internet.
6PE
On an IPv4 backbone network where the MPLS is deployed, the ISP can use the IPv6 Provider Edge (6PE) technology to provide the interconnection capacity for the IPv6 networks of dispersed users. 6PE is the PE with the IPv6 capacity. Figure 10-4 shows the principle of interconnecting isolated IPv6 domains through 6PE. 1. When the 6PE device receives an IPv6 packet from the CE, it directly labels the packet to translate the packet into an MPLS packet that can be transmitted over the IPv4 backbone network. The MPLS packet is forwarded to the remote 6PE through the LSP. The remote 6PE removes the label and finds the IPv6 routing table according to the destination address in the resulting IPv6 packet header. The remote 6PE then sends the packet to the destination host in the remote IPv6 network through the remote CE.
2. 3. 4.
Figure 10-4 Networking diagram of 6PE
6PE Router
IPv4/MPLS IBGP
6PE Router
CE PE
Customer site
CE IPv6
IPv6
Customer site
Note the following points when you connect isolated IPv6 sites through a 6PE tunnel:
l l
Enable IPv4, MPLS and IPv6 on 6PE. MP-BGP also needs to be enabled between 6PEs to receive or send IPv6 routes from/to the remote 6PE. The IGP over ISP's IPv4 backbone network can be OSPF or IS-IS. Static routing protocol, IGP or EBGP can work between CE and 6PE.
l l
When ISPs tend to extend their IPv4 or MPLS networks with IPv6 traffic exchange capability on MPLS, they only need to update their PE devices.
10.2 Configuring IPv4/IPv6 Dual Stacks

This section describes how to enable the IPv4/IPv6 dual protocol stacks. 10.2.1 Establishing the Configuration Task 10.2.2 Enabling IPv6 Packet Forwarding 10.2.3 Configuring IPv4 and IPv6 Addresses for the Interface

If a device has both IPv4 and IPv6 connections, the IPv4/IPv6 dual protocol stacks need to be enabled on the device. Enabling the IPv4/IPv6 dual protocol stacks on the NE5000E is a simple process. Enable the IPv6 packet forwarding capacity in the system view and configure an IPv4 address or IPv6 address on the corresponding interface. The device can then forward IPv4 and IPv6 packets on the corresponding interface.
Before configuring IPv6 tunnels, complete the following tasks:
l
Configuring the physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer parameters for the interface
Data Preparation
To configure IPv4/IPv6 dual stacks, you need the following data. No. 1 2 3 4 Data Type and number of the interface connected with the IPv4 network IPv4 address and mask of the interface connected with the IPv4 network Type and number of the interface connected with the IPv6 network IPv6 address and prefix of the interface connected with the IPv6 network
10.2.2 Enabling IPv6 Packet Forwarding

Context
To enable a device to forward IPv6 packets, you must enable the IPv6 capability in both the system view and the interface view. This is because:

l
If you run the ipv6 command only in the system view, only the IPv6 packet forwarding capability is enabled on a device. The interface on the device is not of the IPv6 capability and hence you cannot perform any IPv6 configurations. If you run the ipv6 enable command only in the interface view, the IPv6 capability is enabled only on an interface but the IPv6 protocol status on the interface is Down and the device cannot forward IPv6 data.
Procedure
Step 1 Run:
system-view

ipv6
The IPv6 packet forwarding capability is enabled. To enable a device to forward IPv6 packets, you must run this command in the system view; otherwise, the IPv6 protocol status on the interface is Down and the device cannot forward IPv6 packets although the interface is configured with an IPv6 address. By default, the IPv6 packet forwarding capability is disabled. Step 3 Run:
The view of the interface to be enabled with the IPv6 capability is displayed. Step 4 Run:
ipv6 enable
The IPv6 capability is enabled on the interface. Before performing IPv6 configurations in the interface view, you must enable the IPv6 capability in the interface view. By default, the IPv6 capability is disabled on the interface. ----End
10.2.3 Configuring IPv4 and IPv6 Addresses for the Interface

Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
The interface view of the IPv4 network is displayed. Step 3 Run:

An IPv4 address is assigned to the interface. Step 4 Run:

quit
Return to the system view. Step 5 Run:

The interface view of the IPv6 network is displayed. Step 6 Perform the following configuration as required.
l
Run:
ipv6 address auto link-local
The link-local address is set to be automatically generated.

l
Run:
ipv6 address ipv6-address link-local
The link-local address of the interface is configured.

l
Run:
ipv6 address { ipv6-address | prefix-length }
The global unicast address is configured.

l
Run:
ipv6 address ipv6-address/prefix-length [ eui-64 ]
The IPv6 EUI-64 address is configured. ----End
10.3 Configuring an IPv6 over IPv4 Tunnel

This section describes how users in IPv6 networks communicate across an IPv4 network. 10.3.1 Establishing the Configuration Task 10.3.2 Configuring an IPv6 over IPv4 Manual Tunnel 10.3.3 Configuring an IPv6 over IPv4 Automatic Tunnel 10.3.4 Configuring a 6to4 Tunnel 10.3.5 Configuring Routes in the Tunnel 10.3.6 Checking the Configuration

To enable communication between two IPv6 networks over the IPv4 network, configure an IPv6 over IPv4 tunnel on the border device of the IPv4 and IPv6 networks.
Before configuring an IPv6 over IPv4 tunnel, complete the following tasks:
l
Configuring the physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocol for the interface and ensuring that the status of the link layer protocol on the interface is Up Configuring the IPv4/IPv6 dual-protocol stacks
Data Preparation
To configure an IPv6 over IPv4 tunnel, you need the following data. No. 1 2 3 4 Data Number, IPv6 address and prefix length of the tunnel Encapsulation mode of packets over the tunnel Source IPv4 address or interface number of the tunnel Destination IPv4 address of the tunnel
10.3.2 Configuring an IPv6 over IPv4 Manual Tunnel

Context
Note the following when configuring an IPv6 over IPv4 manual tunnel:
l l
Before configuring other parameters of an IPv6 tunnel, you must create a tunnel interface. The source interface of the tunnel must be specified by the address or number of the loopback interface on the local route. The destination interface of the tunnel must be specified by the address of the loopback interface on the peer device. You need to conduct the following configurations on the devices on both the ends of the tunnel. During the configuration, note that the source address of the local tunnel end is the destination address set for the remote tunnel end; the destination address of the local tunnel end is the source address set for the remote tunnel end. To support dynamic routing protocol, you also need to configure the tunnel interface with a network address.

Procedure
Step 1 Run:
system-view

interface tunnel interface-number
The tunnel interface is created. Step 3 Run:

tunnel-protocol ipv6-ipv4
The tunnel is specified be an IPv6 over IPv4 manual tunnel. Step 4 Run:
source { ipv4-address | interface-type interface-number }
The source address or source interface of the tunnel is specified.

NOTE
For the actual implementation on the NE5000E, the source interface of the tunnel can only be a loopback interface but the source address of the tunnel can be either the address of a physical interface or the address of a loopback interface.
Step 5 Run:
destination ipv4-address
The destination address of the tunnel is specified.

NOTE
The destination address of the tunnel can be the address of a physical interface or the address of a loopback interface.
Step 6 Run:
ipv6 enable
IPv6 is enabled on the interface. Step 7 Run:

ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }
The tunnel interface is configured with an IPv6 address. ----End
10.3.3 Configuring an IPv6 over IPv4 Automatic Tunnel

Context
Note the following when configuring an IPv6 over IPv4 automatic tunnel:
l
Before configuring the other parameters of an IPv6 tunnel, you must create a tunnel interface. The source interface of the tunnel must be specified by the address or number of the loopback interface on the local route.
Issue 02 (2009-12-10)

l
When configuring an IPv6 over IPv4 automatic tunnel, you can specify only the source address of the tunnel. The destination address of the tunnel is automatically obtained from the destination IP address field carried in the original IPv6 packet. Note that the source interface of the IPv6 over IPv4 automatic tunnel must be unique. The IPv6 address configured for the automatic tunnel must be an IPv4-compatible IPv6 address. That is, the high-order 96 bits are 0 and the low-order 32 bits represent an IPv4 address of an interface in the IPv4 network.
Procedure
Step 1 Run:
system-view

A tunnel interface is configured. Step 3 Run:

tunnel-protocol ipv6-ipv4 auto-tunnel
The tunnel is specified as an IPv6 over IPv4 automatic tunnel. Step 4 Run:
The source address or source interface of the tunnel is specified. Step 5 Run:
ipv6 enable

The tunnel interface is configured with an IPv6 address. ----End
10.3.4 Configuring a 6to4 Tunnel

Context
Note the following when configuring a 6to4 tunnel:
l l
Before configuring other parameters of the tunnel, create a tunnel interface. When the specified source interface of the tunnel is a physical interface, it is recommended to set the tunnel ID to be the same as the number of the physical interface. The source tunnel interface must be specified by the address or number of the loopback interface on the local route.
10-12

l
When configuring a 6to4 tunnel, you need to specify only the source tunnel interface. The destination address of the tunnel is automatically obtained from the destination IP address field carried in the original IPv6 packet. Note that the source interface of the 6to4 tunnel must be unique. On the border device, configure a 6to4 address on the interface that is connected with the 6to4 network, and configure an IPv4 address on the interface that is connected with the IPv4 network. To make the tunnel support the routing protocol, configure an IP address for the tunnel interface.
Procedure
Step 1 Run:
system-view

A tunnel interface is created. Step 3 Run:

tunnel-protocol ipv6-ipv4 6to4
The tunnel is specified as a 6to4 tunnel. Step 4 Run:

The source address or source interface of the tunnel is specified. Step 5 Run:
ipv6 enable

The interface is configured with an IPv6 address.

NOTE
The prefix of the IPv6 address configured for the interface must be the same as the 6to4 network prefix of the border device.
----End
Postrequisite
The configuration of 6to4 relay needed to access the IPv6 network, is similar to the 6to4 tunnel. For the configuration example, see "Example for Configuring 6to4 Relay."
10.3.5 Configuring Routes in the Tunnel

Context
Routes for forwarding must exist on the source device and the destination device of the tunnel, ensuring normal packet forwarding. Configuring routes in the tunnel comprises configuring static routes and dynamic routes.
l
To configure the static route, you need to configure the route from the IP address of the local loopback interface (the source address) to the destination address (IP address of the peer loopback interface). You can enable dynamic routing protocol on the tunnel interface connected to the private networks and on the device interface.

Prerequisite
The configurations of the IPv6 over IPv4 Tunnel function are complete.
Procedure
Step 1 Run the display ipv6 interface tunnel interface-number command to check the IPv6 attributes of a tunnel interface. ----End
Example
Run the display ipv6 interface tunnel command. If the IPv6 packets forwarding is enabled, you can see the state of tunnel interface is Up, the state of IPv6 protocol is Up, source address and ND parameters.
<HUAWEI> display ipv6 interface tunnel 3/0/0 Tunnel3/0/0 current state : UP , IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::201:102 Global unicast address(es): ::2.1.1.2, subnet is ::/96 Joined group address(es): FF02::1:FF01:102 FF02::2 FF02::1 MTU is 1500 bytes ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
10.4 Configuring 6PE

This section describes how users in IPv6 networks communicate across the existing MPLS network. 10.4.1 Establishing the Configuration Task 10.4.2 Configuring IPv4/IPv6 Dual Protocol Stacks 10.4.3 Configuring MPLS
10.4.4 Enabling 6PE Peer

To interconnect IPv6 networks over the existing MPLS network, 6PE must be configured on the PE devices.
Before configuring 6PE, complete the following tasks:
l
Configuring the physical features of interfaces and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocols on interface and ensuring that the status of the link layer protocol on the interface is Up Configuring routes from 6PE to CE Configuring routes to the backbone network
l l
Data Preparation
To configure 6PE, you need the following data. No. 1 2 3 4 5 Data Interface number and IPv6 address of the 6PE's interface connected with CE devices Interface number and IPv4 address of the 6PE's interface Interface number and IPv4 address of the loopback interface to be created LSP triggering policy IPv4 address of the peer of the 6PE
10.4.2 Configuring IPv4/IPv6 Dual Protocol Stacks

Context
Procedure
Step 1 Run:
system-view

ipv6
Issue 02 (2009-12-10)
10-15
The IPv6 packet forwarding is enabled. Step 3 Run:


ip address ipv4-address { mask | mask-length }
The interface is configured with an IPv4 address. Step 5 Run: Return to the system view. Step 6 Run:

ipv6 enable

ipv6 address ipv6-address/prefix-length [ eui-64 ]
Or
ipv6 address { ipv6-address | prefix-length }
The interface is configured with an IPv6 address. Step 9 Run: Return to the system view. ----End
10.4.3 Configuring MPLS

Context
Procedure
Step 1 Run:
system-view

mpls lsr-id ip-address
The LSR ID is specified.

Step 3 Run:
mpls
MPLS is enabled and the MPLS view is displayed. Step 4 Run:

lsp-trigger { all | host | ip-prefix prefix-name | none }
The LSP trigger policy is enabled. Step 5 Run:

quit
Return to the system view. Step 6 Run:

mpls ldp
MPLS LDP is enabled. Step 7 Run:

quit
Exit the system view. Step 8 Run:


mpls
MPLS is enabled on the interface. Step 10 Run:

mpls ldp
MPLS LDP is enabled on the interface. ----End
10.4.4 Enabling 6PE Peer

Context
Procedure
Step 1 Run:
system-view

bgp as-number
The BGP view is displayed.

Step 3 Run:
peer peer-ipv4-address as-number as-number
The IP address and the AS number of a specified BGP peer are specified. Step 4 Run:
peer peer-ipv4-address connect-interface interface-type interface-number
PE peer is specified to connect with a specified interface. Step 5 Run:

ipv6-family
The BGP-IPv6 unicast address family view is displayed. Step 6 Run:

peer peer-ipv4-address enable
6PE peer is enabled. Step 7 Run:

peer peer-ipv4-address label-route-capability
Label routing capacity is enabled for 6PE. ----End
10.5 Maintaining IPv6 over IPv4 Tunnels

This section describes how to debug the IPv6 tunnel. 10.5.1 Monitoring the Running Status of IPv6 over IPv4 Tunnel 10.5.2 Debugging IPv6 over IPv4 Tunnel
10.5.1 Monitoring the Running Status of IPv6 over IPv4 Tunnel

Context
In routine maintenance, you can run the following command in any view to check the operation of IPv6 over IPv4 tunnel.
Procedure
Step 1 Run the display ipv6 interface tunnel { interface-number } command in any view to check the operation status of the tunnel interface. ----End
10-18
Issue 02 (2009-12-10)
10.5.2 Debugging IPv6 over IPv4 Tunnel

Context
CAUTION
Debugging affects the performance of the system. So, after debugging, run the undo debugging all command to disable it immediately. If an operation fault occurs on the IPv6 tunnel, run the following debugging commands in the user view to debug the IPv6 tunnel. View information about debugging, locate the fault, and analyze the cause. For the procedure of displaying the debugging information, refer to the chapter "Information Center Configuration" in the NE5000E Core Router Configuration Guide - System Management. For descriptions about the debugging commands, refer to the NE5000E Core Router Debugging Reference.
Procedure
Step 1 Run the debugging tunnel { all | control | error | keepalive | packet | timer } [ interface tunnelinterface-type interface-number ] command in the user view to debug tunnel information. ----End

This section provides several configuration examples of IPv6 over IPv4 tunnels. 10.6.1 Example for Configuring an IPv6 over IPv4 Manual Tunnel 10.6.2 Example for Configuring an IPv6 over IPv4 Automatic Tunnel 10.6.3 Example for Configuring a 6to4 Tunnel 10.6.4 Example for Configuring 6to4 Relay 10.6.5 Example for Configuring 6PE
10.6.1 Example for Configuring an IPv6 over IPv4 Manual Tunnel

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number.
As shown in Figure 10-5, two IPv6 networks are connected to Router B in the IPv4 backbone network respectively through Router A and Router C. To enable communication between two IPv6 networks, configure an IPv6 over IPv4 manual tunnel between Router A and Router C.
NOTE
It is recommended that in an actual networking environment, the source address of the tunnel is specified as the IP address of the loopback interface of the local device or the source interface of the tunnel is specified as the loopback interface on the local device. It is also recommended that in an actual networking environment, the destination address of the tunnel is specified as the IP address of the loopback interface of the peer device.
Figure 10-5 Networking diagram of the IPv6 over IPv4 manual tunnel
IPv4 network
GE1/0/0 GE2/0/0 192.168.50.1/24 192.168.51.1/24 GE1/0/0 GE1/0/0 192.168.50.2/24 Router B 192.168.51.2/24 Dual Dual Stack Stack
IPv6
RouterA
RouterC IPv6
The configuration roadmap of IPv6 over IPv4 manual tunnel is as follows: 1. 2. 3. Configure IP addresses for physical interfaces. Configure IPv6 addresses, the source interface, and the destination addresses for the tunnel interfaces. Set the tunnel protocol as IPv6-IPv4.
Data Preparation
l l
IP addresses of interfaces IPv6 addresses, the source interfaces and the destination addresses of the tunnel interfaces
Procedure
Step 1 Configure Router A. # Configure an IP address for the interface.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] ipv6 [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 192.168.50.2 255.255.255.0
10-20
Issue 02 (2009-12-10)

[RouterA-GigabitEthernet1/0/0] undo shutdown [RouterA-GigabitEthernet1/0/0] quit
# Set the tunnel protocol as IPv6-IPv4.

[RouterA] interface tunnel 1/0/0 [RouterA-Tunnel1/0/0] tunnel-protocol ipv6-ipv4
# Configure the IPv6 address, source interface, and destination address for the tunnel interface.
[RouterA-Tunnel1/0/0] [RouterA-Tunnel1/0/0] [RouterA-Tunnel1/0/0] [RouterA-Tunnel1/0/0] [RouterA-Tunnel1/0/0] ipv6 enable ipv6 address 3001::1/64 source 192.168.50.2 destination 192.168.51.2 quit
# Configure static routes.

[RouterA] ip route-static 192.168.51.2 255.255.255.0 192.168.50.1
Step 2 Configure Router B. # Configure an IP address for the interface.

<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] ip address 192.168.50.1 255.255.255.0 [RouterB-GigabitEthernet1/0/0] undo shutdown [RouterB-GigabitEthernet1/0/0] quit [RouterB] interface gigabitethernet 2/0/0 [RouterB-GigabitEthernet2/0/0] ip address 192.168.51.1 255.255.255.0 [RouterB-GigabitEthernet2/0/0] undo shutdown [RouterB-GigabitEthernet2/0/0] quit
Step 3 Configure Router C. # Configure an IP address for the interface.

<HUAWEI> system-view [HUAWEI] sysname RouterC [RouterC] ipv6 [RouterC] interface gigabitethernet 1/0/0 [RouterC-GigabitEthernet1/0/0] ip address 192.168.51.2 255.255.255.0 [RouterC-GigabitEthernet1/0/0] undo shutdown [RouterC-GigabitEthernet1/0/0] quit
# Set the tunnel protocol as IPv6-IPv4.

[RouterC] interface tunnel 1/0/0 [RouterC-Tunnel1/0/0] tunnel-protocol ipv6-ipv4
# Configure the IPv6 address, source interface, and destination address for the tunnel interface.
[RouterC-Tunnel1/0/0] [RouterC-Tunnel1/0/0] [RouterC-Tunnel1/0/0] [RouterC-Tunnel1/0/0] [RouterC-Tunnel1/0/0] ipv6 enable ipv6 address 3001::2/64 source 192.168.51.2 destination 192.168.50.2 quit

[RouterC] ip route-static 192.168.50.2 255.255.255.0 192.168.51.1
Step 4 Verify the configuration. # On Router C, ping the IPv4 address of the interface GE 1/0/0 of Router A. Router C can receive response packets from Router A.
[RouterC] ping 192.168.50.2
Issue 02 (2009-12-10)
10-21
PING 192.168.50.2: 56 data bytes, press CTRL_C to break Reply from 192.168.50.2: bytes=56 Sequence=1 ttl=255 time=84 ms Reply from 192.168.50.2: bytes=56 Sequence=2 ttl=255 time=27 ms Reply from 192.168.50.2: bytes=56 Sequence=3 ttl=255 time=25 ms Reply from 192.168.50.2: bytes=56 Sequence=4 ttl=255 time=3 ms Reply from 192.168.50.2: bytes=56 Sequence=5 ttl=255 time=24 ms --- 192.168.50.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 3/32/84 ms
# On Router C, ping the IPv6 address of Tunnel 1/0/0 of Router A. Router C can receive response packets from Router A.
[RouterC] ping ipv6 3001::1 PING 3001::1 : 56 data bytes, press Reply from 3001::1 bytes=56 Sequence=1 hop limit=255 Reply from 3001::1 bytes=56 Sequence=2 hop limit=255 Reply from 3001::1 bytes=56 Sequence=3 hop limit=255 Reply from 3001::1 bytes=56 Sequence=4 hop limit=255 Reply from 3001::1 bytes=56 Sequence=5 hop limit=255 --- 3001::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 26/26/28 ms CTRL_C to break time = 28 ms time = 27 ms time = 26 ms time = 27 ms time = 26 ms
----End
Configuration File
l

# sysname RouterA # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ip address 192.168.50.2 255.255.255.0 # interface Tunnel1/0/0 ipv6 enable ipv6 address 3001::1/64 tunnel-protocol ipv6-ipv4 source 192.168.50.2 destination 192.168.51.2 # ip route-static 192.168.51.0 255.255.255.0 192.168.50.1 # return

# sysname RouterB # interface GigabitEthernet1/0/0 undo shutdown ip address 192.168.50.1 255.255.255.0 # interface GigabitEthernet2/0/0 undo shutdown
10-22
Issue 02 (2009-12-10)

ip address 192.168.51.1 255.255.255.0 # return l

# sysname RouterC # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ip address 192.168.51.2 255.255.255.0 # interface Tunnel1/0/0 ipv6 enable ipv6 address 3001::2/64 tunnel-protocol ipv6-ipv4 source 192.168.51.2 destination 192.168.50.2 # ip route-static 192.168.50.0 255.255.255.0 192.168.51.1 # return
10.6.2 Example for Configuring an IPv6 over IPv4 Automatic Tunnel

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 10-6, two IPv6 networks are connected with the IPv4 backbone network respectively through Router A and Router B. To enable communication between the two IPv6 networks, configure an IPv6 over IPv4 automatic tunnel between Router A and Router B. Interfaces connecting Router A and the IPv4 backbone network and connecting Router B and the IPv4 backbone network should be configured public IPv4 addresses.
NOTE
Issue 02 (2009-12-10)
10-23
Figure 10-6 Networking diagram of the IPv6 over IPv4 automatic tunnel
loopback1 loopback1 3.3.3.3/32 4.4.4.4/32 IPv4 Dual Dual Stack Stack RouterA RouterB POS1/0/0 POS1/0/0 2.1.1.2/8 2.1.1.1/8 Tunnel Tunnel IPv6 IPv6 1/0/0 ::2.1.1.1 1/0/0 ::2.1.1. /96 2/96
The configuration roadmap is as follows: 1. 2. 3. Configure IP addresses for interfaces. Configure the IPv6 addresses and source interface of the tunnel interface. Set the tunnel protocol as automatic tunnel protocol.
Data Preparation
l l
IP addresses of interfaces IPv6 address and source interface of the tunnel interface
To configure an automatic tunnel, you need to specify only the source interface rather than the destination interface of the tunnel.
Procedure
Step 1 Configure Router A. # Configure the IPv4/IPv6 dual protocol stacks.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] ipv6 [RouterA] interface pos 1/0/0 [RouterA-pos1/0/0] ip address 2.1.1.1 255.0.0.0 [RouterA-pos1/0/0] quit
# Create a loopback interface and assign an IPv4 address to it.

[RouterA] interface loopback 1 [RouterA-LoopBack1] ip address 3.3.3.3 32 [RouterA-LoopBack1] quit
# Configure a static route from Router A to Router B.

[RouterA] ip route-static 2.1.1.2 255.0.0.0 2.1.1.2 [RouterA] ip route-static 4.4.4.4 255.255.255.255 2.1.1.2
10-24
Issue 02 (2009-12-10)
# Configure an automatic tunnel.

[RouterA] interface tunnel 1/0/0 [RouterA-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 auto-tunnel [RouterA-Tunnel1/0/0] ipv6 enable [RouterA-Tunnel1/0/0] ipv6 address ::3.3.3.3/96 [RouterA-Tunnel1/0/0] source loopback 1 [RouterA-Tunnel1/0/0] quit
Step 2 Configure Router B. # Configure the IPv4/IPv6 dual protocol stacks.

<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] ipv6 [RouterB] interface pos 1/0/0 [RouterB-pos1/0/0] ip address 2.1.1.2 255.0.0.0 [RouterB-Pos1/0/0] quit
# Create a loopback interface and assign an IPv4 address to it.

[RouterB] interface loopback 1 [RouterB-LoopBack1] ip address 4.4.4.4 32 [RouterB-LoopBack1] quit
# Configure a static route from Router B to Router A.

[RouterB] ip route-static 2.1.1.1 255.0.0.0 2.1.1.1 [RouterB] ip route-static 3.3.3.3 255.255.255.255 2.1.1.1
# Configure an automatic tunnel.

[RouterB] interface tunnel 1/0/0 [RouterB-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 auto-tunnel [RouterB-Tunnel1/0/0] ipv6 enable [RouterB-Tunnel1/0/0] ipv6 address ::4.4.4.4/96 [RouterB-Tunnel1/0/0] source loopback 1 [RouterB-Tunnel1/0/0] quit
Step 3 Verify the configuration. # On Router A, view the status of Tunnel 1/0/0 and find it is Up.
[RouterA] display ipv6 interface tunnel 1/0/0 Tunnel1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::201:101 Global unicast address(es): ::3.3.3.3, subnet is ::/96 Joined group address(es): FF02::1:FF01:101 FF02::2 FF02::1 MTU is 1500 bytes ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# On Router A, ping the IPv4-compatible IPv6 address of tunnel peer.

[RouterA] ping ipv6 ::4.4.4.4 PING ::4.4.4.4 : 56 data bytes, press CTRL_C Reply from ::4.4.4.4 bytes=56 Sequence=1 hop limit=64 time = 30 Reply from ::4.4.4.4 bytes=56 Sequence=2 hop limit=64 time = 40 Reply from ::4.4.4.4 bytes=56 Sequence=3 hop limit=64 time = 50 Reply from ::4.4.4.4 to break ms ms ms
Issue 02 (2009-12-10)
10-25
bytes=56 Sequence=4 hop limit=64 time = 1 ms Reply from ::4.4.4.4 bytes=56 Sequence=5 hop limit=64 time = 50 ms --- ::4.4.4.4 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/34/50 ms
----End
Configuration File
l

# sysname RouterA # ipv6 # interface pos1/0/0 link-protocol ppp ip address 2.1.1.1 255.0.0.0 # interface LoopBack1 ip address 3.3.3.3 255.255.255.255 # interface Tunnel 1/0/0 ipv6 enable ipv6 address ::3.3.3.3/96 tunnel-protocol ipv6-ipv4 auto-tunnel source loopback 1 # ip route-static 2.1.1.2 255.0.0.0 2.1.1.2 ip route-static 4.4.4.4 255.255.255.255 2.1.1.2 # return

# sysname RouterB # ipv6 # interface pos1/0/0 link-protocol ppp ip address 2.1.1.2 255.0.0.0 # interface LoopBack1 ip address 4.4.4.4 255.255.255.255 # interface Tunnel 1/0/0 ipv6 enable ipv6 address ::4.4.4.4/96 tunnel-protocol ipv6-ipv4 auto-tunnel source loopback 1 # ip route-static 2.1.1.1 255.0.0.0 2.1.1.1 ip route-static 3.3.3.3 255.255.255.255 2.1.1.1 # return
10.6.3 Example for Configuring a 6to4 Tunnel
10-26
Issue 02 (2009-12-10)
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 10-7, two IPv6 networks are both 6to4 networks. Router A and Router B are connected with the 6to4 network and the IPv4 network. To enable communication between the hosts in the two 6to4 network, it is required to set up a 6to4 tunnel between Router A and Router B. To enable communication between 6to4 networks, configure 6to4 addresses for the hosts in the 6to4 network. A 6to4 address has a 48-bit prefix composed of 2002:IPv4 address:. As shown in Figure 10-7, the IPv4 address of the interface through which A is connected to the IPv4 network is 2.1.1.1. Therefore, the 6to4 address of A in the 6to4 network should start with 2002:0201:0101::.
NOTE
Figure 10-7 Networking diagram of the 6to4 tunnel
IPv4 POS1/0/0 POS1/0/0 2.1.1.1 2.1.1.2 RouterA RouterB GE2/0/0 6to4 6to4 2002:201:101:1::1/64 GE2/0/0 Router Router 2002:201:102:1::1/64 Tunnel 1/0/0 Tunnel 1/0/0 2002:201:101::1/64 P C1 2002:201:101:1::2 2002:201:102::1/64 IPv6 2002:201:102:1::2 IPv6 P C2
The configuration roadmap is as follows: 1. 2. 3.
Issue 02 (2009-12-10)
Configure IPv4/IPv6 dual-protocol stacks. Configure the tunnel protocol as 6to4. Configure related routes.
Data Preparation
l l
IPv4 or IPv6 addresses of interfaces Source tunnel interface
Procedure
Step 1 Configure Router A. # Configure IPv4/IPv6 dual protocol stacks.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] ipv6 [RouterA] interface pos 1/0/0 [RouterA-pos1/0/0] ip address 2.1.1.1 8 [RouterA-pos1/0/0] undo shutdown [RouterA-pos1/0/0] quit [RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] ipv6 enable [RouterA-GigabitEthernet2/0/0] ipv6 address 2002:0201:0101:1::1/64 [RouterA-GigabitEthernet2/0/0] undo shutdown [RouterA-GigabitEthernet2/0/0] quit
# Configure a 6to4 tunnel.

[RouterA] interface tunnel 1/0/0 [RouterA-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 6to4 [RouterA-Tunnel1/0/0] ipv6 enable [RouterA-Tunnel1/0/0] ipv6 address 2002:0201:0101::1/64 [RouterA-Tunnel1/0/0] source 2.1.1.1 [RouterA-Tunnel1/0/0] quit
# Configure a route to other 6to4 networks.

[RouterA] ipv6 route-static 2002:: 16 tunnel 1/0/0
Step 2 Configure Router B. # Configure IPv4/IPv6 dual protocol stacks.

<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] ipv6 [RouterB] interface pos 1/0/0 [RouterB-pos1/0/0] ip address 2.1.1.2 8 [RouterB-pos1/0/0] undo shutdown [RouterB-pos1/0/0] quit [RouterB] interface gigabitethernet 2/0/0 [RouterB-GigabitEthernet2/0/0] ipv6 enable [RouterB-GigabitEthernet2/0/0] ipv6 address 2002:0201:0102:1::1/64 [RouterB-GigabitEthernet2/0/0] undo shutdown [RouterB-GigabitEthernet2/0/0] quit

[RouterB] interface tunnel 1/0/0 [RouterB-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 6to4 [RouterB-Tunnel1/0/0] ipv6 enable [RouterB-Tunnel1/0/0] ipv6 address 2002:0201:0102::1/64 [RouterB-Tunnel1/0/0] source 2.1.1.2 [RouterB-Tunnel1/0/0] quit
# Configure a route to other 6to4 networks.

[RouterB] ipv6 route-static 2002:: 16 tunnel 1/0/0

NOTE
There must be an accessible route between Router A and Router B. In this example, both the devices are directly connected; therefore, no routing protocol needs to be configured.
Step 3 Verify the configuration. # Check the IPv6 state of Tunnel 1/0/0 on Router A and find it is UP.
[RouterA] display ipv6 interface tunnel 1/0/0 Tunnel1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::201:101 Global unicast address(es): 2002:201:101::1, subnet is 2002:201:101::/64 Joined group address(es): FF02::1:FF01:101 FF02::1:FF00:1 FF02::2 FF02::1 MTU is 1500 bytes ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# Router A can ping through the 6to4 address of GE 2/0/0 of Router B.

[RouterA] ping ipv6 2002:0201:0102:1::1 PING 2002:0201:0102:1::1 : 56 data bytes, press CTRL_C to break Reply from 2002:201:102:1::1 bytes=56 Sequence=1 hop limit=255 time = 8 ms Reply from 2002:201:102:1::1 bytes=56 Sequence=2 hop limit=255 time = 25 ms Reply from 2002:201:102:1::1 bytes=56 Sequence=3 hop limit=255 time = 4 ms Reply from 2002:201:102:1::1 bytes=56 Sequence=4 hop limit=255 time = 5 ms Reply from 2002:201:102:1::1 bytes=56 Sequence=5 hop limit=255 time = 5 ms --- 2002:0201:0102:1::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 4/9/25 ms
----End
Configuration Files
l

# sysname RouterA # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ip address 2.1.1.1 255.0.0.0 # interface GigabitEthernet 2/0/0 undo shutdown ipv6 enable ipv6 address 2002:201:101:1::1/64 # interface Tunnel 1/0/0 ipv6 enable
Issue 02 (2009-12-10)
10-29

ipv6 address 2002:201:101::1/64 tunnel-protocol ipv6-ipv4 6to4 source 2.1.1.1 # ipv6 route-static 2002:: 16 Tunnel 1/0/0 # return l

# sysname RouterB # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ip address 2.1.1.2 255.0.0.0 # interface GigabitEthernet2/0/0 undo shutdown ipv6 enable ipv6 address 2002:201:102:1::1/64 # interface Tunnel 1/0/0 ipv6 enable ipv6 address 2002:201:102::1/64 tunnel-protocol ipv6-ipv4 6to4 source 2.1.1.2 # ipv6 route-static 2002:: 16 Tunnel 1/0/0 # return
10.6.4 Example for Configuring 6to4 Relay

CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The chassis ID must be specified along with the slot number. As shown in Figure 10-8, Router A is a 6to4 device and is connected with an IPv6 network. As a 6to4 relay device, Router B is connected with the IPv6 Internet (2001::/64). To enable communication between the host in the 6to4 network and the host in the IPv6 Internet, configure a 6to4 tunnel between Router A and Router B. The configuration of the tunnel between a 6to4 relay device and a common 6to4 device is similar to that between common 6to4 devices. A static route to the IPv6 Internet shall be configured on the common 6to4 device so that the 6to4 network and the IPv6 network can communicate with each other.
NOTE
10-30
Issue 02 (2009-12-10)
Figure 10-8 Networking diagram of accessing the IPv6 network through 6to4 relay
RouterA
POS1/0/0 2.1.1.1 6to4 Router
IPv4
POS1/0/0 2.1.1.2 6to4 Relay
RouterB
GE2/0/0 2002:201:101:1::1/64
Tunnel 1/0/0 2002:201:101::1/64
PC1 6to4
GE2/0/0 2001::1/64 Tunnel 1/0/0 2002:201:102::1/64 2001::2
2002:201:101:1::2
PC2
IPv6
The configuration roadmap is as follows: 1. 2. 3. Configure IPv4/IPv6 dual protocol stacks. Configure a 6to4 tunnel. Configure related static routes.
Data Preparation
l l l
IPv4 or IPv6 addresses of interfaces Source tunnel interface Static routes to the devices that are not directly connected
Procedure
Step 1 Configure Router A. # Configure IPv4/IPv6 dual protocol stacks.
<HUAWEI> system-view [HUAWEI] sysname RouterA [RouterA] ipv6 [RouterA] interface pos 1/0/0 [RouterA-Pos1/0/0] ip address 2.1.1.1 255.0.0.0 [RouterA-Pos1/0/0] undo shutdown [RouterA-Pos1/0/0] quit [RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] ipv6 enable [RouterA-GigabitEthernet2/0/0] ipv6 address 2002:0201:0101:1::1/64 [RouterA-GigabitEthernet2/0/0] undo shutdown [RouterA-GigabitEthernet2/0/0] quit

[RouterA] interface tunnel 1/0/0 [RouterA-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 6to4 [RouterA-Tunnel1/0/0] ipv6 enable [RouterA-Tunnel1/0/0] ipv6 address 2002:0201:0101::1/64 [RouterA-Tunnel1/0/0] source 2.1.1.1 [RouterA-Tunnel1/0/0] quit
# Configure a static route to 2002::/16.

[RouterA] ipv6 route-static 2002:: 16 tunnel 1/0/0
# Configure a default route to the IPv6 network.

[RouterA] ipv6 route-static :: 0 2002:0201:0102::1
Step 2 Configure Router B. # Configure IPv4/IPv6 dual protocol stacks.

<HUAWEI> system-view [HUAWEI] sysname RouterB [RouterB] ipv6 [RouterB] interface pos 1/0/0 [RouterB-Pos1/0/0] ip address 2.1.1.2 255.0.0.0 [RouterB-Pos1/0/0] undo shutdown [RouterB-Pos1/0/0] quit [RouterB] interface gigabitethernet 2/0/0 [RouterB-GigabitEthernet2/0/0] ipv6 enable [RouterB-GigabitEthernet2/0/0] ipv6 address 2001::1/64 [RouterB-GigabitEthernet2/0/0] undo shutdown [RouterB-GigabitEthernet2/0/0] quit

[RouterB] interface tunnel 1/0/0 [RouterB-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 6to4 [RouterB-Tunnel1/0/0] ipv6 enable [RouterB-Tunnel1/0/0] ipv6 address 2002:0201:0102::1/64 [RouterB-Tunnel1/0/0] source 2.1.1.2 [RouterB-Tunnel1/0/0] quit
# Configure a static route to 2002::/16.

[RouterB] ipv6 route-static 2002:: 16 tunnel1/0/0
Step 3 Verify the configuration. # Router A can ping through the IPv6 address of GE 2/0/0 on Router B.
[RouterA] ping ipv6 2001::1 PING 2001::1 : 56 data bytes, press Reply from 2001::1 bytes=56 Sequence=1 hop limit=255 Reply from 2001::1 bytes=56 Sequence=2 hop limit=255 Reply from 2001::1 bytes=56 Sequence=3 hop limit=255 Reply from 2001::1 bytes=56 Sequence=4 hop limit=255 Reply from 2001::1 bytes=56 Sequence=5 hop limit=255 --- 2001::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 5/14/29 ms CTRL_C to break time = 29 ms time = 5 ms time = 5 ms time = 5 ms time = 26 ms
----End
Configuration Files
l

# sysname RouterA # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ip address 2.1.1.1 255.0.0.0 # interface GigabitEthernet2/0/0 undo shutdown ipv6 enable ipv6 address 2002:201:101:1::1/64 # interface Tunnel 1/0/0 ipv6 enable ipv6 address 2002:201:101::1/64 tunnel-protocol ipv6-ipv4 6to4 source 2.1.1.1 # # ipv6 route-static :: 0 2002:201:102::1 # ipv6 route-static 2002:: 16 Tunnel 1/0/0 # return

# sysname RouterB # ipv6 # source 2.1.1.2 # link-protocol ppp undo shutdown ip address 2.1.1.2 255.0.0.0 # interface GigabitEthernet2/0/0 undo shutdown ipv6 enable ipv6 address 2001::1/64 # interface Tunnel 1/0/0 ipv6 enable ipv6 address 2002:201:102::1/64 tunnel-protocol ipv6-ipv4 6to4 source Pos1/0/0 # ipv6 route-static 2002:: 16 Tunnel 1/0/0 # return
10.6.5 Example for Configuring 6PE
Issue 02 (2009-12-10)
10-33
CAUTION
For the NE5000E, the interface is numbered as slot number/card number/interface number. For the NE5000E cluster, the interface is numbered as chassis ID/slot number/card number/interface number. The slot number is chassis ID/slot ID. As shown in Figure 10-9, PE1 and PE2 support the 6PE features and CE1 and CE2 support the IPv6 protocol. IPv4 IBGP connections need to be established between PEs in the IPv4/MPLS network. Run the OSPF protocol in the IPv4/MPLS network. CEs are in the IPv6 networks, Using the IPv6 address, CEs exchange the routing information with PEs along the static routes. It is required to use the 6PE feature to connect the IPv6 networks of the user over the IPv4/MPLS network of the ISP. Figure 10-9 Networking diagram of 6PE
IPv4/MPLS PE1 POS2/0/0

POS1/0/0 3000:435::1/64 4.3.5.1/24 POS2/0/0 4.3.5.2/24
PE2
POS1/0/0 3000:1065::1/64
CE1
Customer site
IPv6
POS1/0/0 3000:435::2/64
POS1/0/0 3000:1065::2/64
CE2
Customer site
IPv6
The configuration roadmap is as follows: 1. 2. 3. 4. Configure 6PE, enable IPv6 capability, and configure IPv4/IPv6 dual protocol stacks. Configure 6PE and enable MPLS capability. Configure the 6PE peer. Configure an IPv6 address for the interface and a static route on CE.
Data Preparation
l l
IP addresses of interfaces LSR ID

10-34
Procedure
Step 1 Configure 6PE, enable IPv6 capability, and configure IPv4/IPv6 dual protocol stacks. # Configure PE1 and enable its IPv6 capability.
<HUAWEI> system-view [HUAWEI] sysname PE1 [PE1] ipv6
# Configure PE2 and enable its IPv6 capability.

<HUAWEI> system-view [HUAWEI] sysname PE2 [PE2] ipv6
# Configure an IPv6 address for POS 1/0/0 on PE1 and an IP address for loopback0.
[PE1] interface pos 1/0/0 [PE1-Pos1/0/0] ipv6 enable [PE1-Pos1/0/0] ipv6 address 3000:435::1 64 [PE1-Pos1/0/0] undo shutdown [PE1-Pos1/0/0] quit [PE1] interface loopback 0 [PE1-LoopBack0] ip address 1.1.1.9 255.255.255.255 [PE1-LoopBack0] quit
# Configure an IPv6 address for POS 1/0/0 on PE2 and an IP address for loopback0.
[PE2] interface pos 1/0/0 [PE2-Pos1/0/0] ipv6 enable [PE2-Pos1/0/0] ipv6 address 3000:1065::1 64 [PE2-Pos1/0/0] undo shutdown [PE2-Pos1/0/0] quit [PE2] interface loopback 0 [PE2-LoopBack0] ip address 2.2.2.9 255.255.255.255 [PE2-LoopBack0] quit
Step 2 Configure 6PE and enable MPLS capability. # Configure an IP address for POS 2/0/0 on PE1 and enable MPLS and LDP on it.
[PE1] mpls lsr-id 1.1.1.9 [PE1] mpls Mpls starting, please wait... OK! [PE1-mpls] lsp-trigger all [PE1-mpls] quit [PE1] mpls ldp [PE1-mpls-ldp] quit [PE1] interface pos 2/0/0 [PE1-Pos2/0/0] ip address 4.3.5.1 255.255.255.0 [PE1-Pos2/0/0] mpls [PE1-Pos2/0/0] mpls ldp [PE1-Pos2/0/0] undo shutdown [PE1-Pos2/0/0] quit
# Configure an IP address for POS 2/0/0 on PE2 and enable MPLS and LDP on it.
[PE2] mpls lsr-id 2.2.2.9 [PE2] mpls Mpls starting, please wait... OK! [PE2-mpls] lsp-trigger all [PE2-mpls] quit [PE2] mpls ldp [PE2-mpls-ldp] quit [PE2] interface pos 2/0/0 [PE2-Pos2/0/0] ip address 4.3.5.2 255.255.255.0 [PE2-Pos2/0/0] mpls [PE2-Pos2/0/0] mpls ldp
Issue 02 (2009-12-10)
10-35

[PE2-Pos2/0/0] undo shutdown [PE2-Pos2/0/0] quit
# Configure OSPF on PE1 and trigger the setup of LSPs.

[PE1] ospf [PE1-ospf-1] area 0 [PE1-ospf-1-area-0.0.0.0] network 1.1.1.9 0.0.0.0 [PE1-ospf-1-area-0.0.0.0] network 4.3.5.0 0.0.0.255 [PE1-ospf-1-area-0.0.0.0] quit [PE1-ospf-1] quit
# Configure OSPF on PE2 and trigger the setup of LSPs.

[PE2] ospf [PE2-ospf-1] area 0 [PE2-ospf-1-area-0.0.0.0] network 2.2.2.9 0.0.0.0 [PE2-ospf-1-area-0.0.0.0] network 4.3.5.0 0.0.0.255 [PE2-ospf-1-area-0.0.0.0] quit [PE2-ospf-1] quit
Step 3 Configure the 6PE peer. # Configure IBGP on PE1 and enable 6PE capability on the peer and import IPv6 direct routes and static routes from each other.
[PE1] bgp 65100 [PE1-bgp] peer 2.2.2.9 as-number 65100 [PE1-bgp] peer 2.2.2.9 connect-interface loopback 0 [PE1-bgp] ipv6-family [PE1-bgp-af-ipv6] import-route direct [PE1-bgp-af-ipv6] import-route static [PE1-bgp-af-ipv6] peer 2.2.2.9 enable [PE1-bgp-af-ipv6] peer 2.2.2.9 label-route-capability [PE1-bgp-af-ipv6] quit [PE1-bgp] quit
# Configure IBGP on PE2 and enable 6PE capability on the peer and import IPv6 direct routes and static routes from each other.
[PE2] bgp 65100 [PE2-bgp] peer 1.1.1.9 as-number 65100 [PE2-bgp] peer 1.1.1.9 connect-interface loopback 0 [PE2-bgp] ipv6-family [PE2-bgp-af-ipv6] import-route direct [PE2-bgp-af-ipv6] import-route static [PE2-bgp-af-ipv6] peer 1.1.1.9 enable [PE2-bgp-af-ipv6] peer 1.1.1.9 label-route-capability [PE2-bgp-af-ipv6] quit [PE2-bgp] quit
Step 4 Configure an IPv6 address for the interface and a static route on CE. # Configure CE1 and set up an IPv6 connection between CE1 and PE1.
<HUAWEI> system-view [HUAWEI] sysname CE1 [CE1] ipv6 [CE1] interface pos 1/0/0 [CE1-Pos1/0/0] ipv6 enable [CE1-Pos1/0/0] ipv6 address 3000:435::2 64 [CE1-Pos1/0/0] undo shutdown [CE1-Pos1/0/0] quit [CE1] ipv6 route-static :: 0 pos 1/0/0
# Configure CE2 and set up an IPv6 connection between CE2 and PE2.
<HUAWEI> system-view [HUAWEI] sysname CE2
10-36
Issue 02 (2009-12-10)

[CE2] ipv6 [CE2] interface pos 1/0/0 [CE2-Pos1/0/0] ipv6 enable [CE2-Pos1/0/0] ipv6 address 3000:1065::2 64 [CE2-Pos1/0/0] undo shutdown [CE2-Pos1/0/0] quit [CE2] ipv6 route-static :: 0 pos 1/0/0
Step 5 Verify the configuration. # Display the LSP information on PE1.

[PE1] display mpls lsp ----------------------------------------------------------LSP Information: LDP LSP ----------------------------------------------------------FEC In/Out Label In/Out IF Vrf Name 2.2.2.9/32 NULL/3 -/Pos2/0/0 2.2.2.9/32 3/NULL -/----------------------------------------------------------LSP Information: BGP IPV6 LSP ----------------------------------------------------------FEC : 3000:435::/64 In Label : 109568 Out Label : ----In Interface : ----OutInterface : ----Vrf Name :
# Display the IPv6 routing information on PE1.

[PE1] display bgp ipv6 routing-table Total Number of Routes: 5 BGP Local router ID is 1.1.1.9 Status codes: * - valid, > - best, d - damped, h - history, i - internal, s - suppressed, S - Stale Origin : i - IGP, e - EGP, ? - incomplete *> Network NextHop MED Label Path/Ogn Network NextHop MED Label Path/Ogn Network NextHop MED Label Path/Ogn : : : : : : : : : : : : : : : : : : : : : : : : : ::1 :: 0 ? 3000:435:: :: 0 NULL/109568 ? 3000:435::1 :: 0 ? 3000:1065:: ::FFFF:2.2.2.9 0 109568/NULL ? FE80:: :: 0 ? PrefixLen : 64 LocPrf : 100 PrefVal : 0 PrefixLen : 64 LocPrf : PrefVal : 0 PrefixLen : 128 LocPrf : PrefVal : 0
*>
*>
PrefixLen : 128 LocPrf : PrefVal : 0
*>i Network NextHop MED Label Path/Ogn *> Network NextHop MED Label Path/Ogn
PrefixLen : 10 LocPrf : PrefVal : 0
# CE1 can ping through the IPv6 address of CE2.

[CE1] ping ipv6 3000:1065::2 PING 3000:1065::2 : 56 data bytes, press CTRL_C to break Reply from 3000:1065::2 bytes=56 Sequence=1 hop limit=63 time = 50 ms Reply from 3000:1065::2 bytes=56 Sequence=2 hop limit=63 time = 1 ms Reply from 3000:1065::2 bytes=56 Sequence=3 hop limit=63 time = 1 ms Reply from 3000:1065::2 bytes=56 Sequence=4 hop limit=63 time = 1 ms Reply from 3000:1065::2 bytes=56 Sequence=5 hop limit=63 time = 1 ms --- 3000:1065::2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/10/50 ms
----End
Configuration Files
l

# sysname PE1 # ipv6 # mpls lsr-id 1.1.1.9 mpls lsp-trigger all # mpls ldp # interface Pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3000:435::1 # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 4.3.5.1 255.255.255.0 mpls mpls ldp # interface LoopBack0 ip address 1.1.1.9 255.255.255.255 # bgp 65100 peer 2.2.2.9 as-number 65100 peer 2.2.2.9 connect-interface LoopBack0 # ipv4-family unicast undo synchronization peer 2.2.2.9 enable # ipv6-family undo synchronization import-route direct import-route static peer 2.2.2.9 enable peer 2.2.2.9 label-route-capability # ospf 1 area 0.0.0.0
10-38
Issue 02 (2009-12-10)

network 1.1.1.9 0.0.0.0 network 4.3.5.0 0.0.0.255 # return l

# sysname PE2 # ipv6 # mpls lsr-id 2.2.2.9 mpls lsp-trigger all # mpls ldp # interface Pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3000:1065::1 # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 4.3.5.2 255.255.255.0 mpls mpls ldp # interface LoopBack0 ip address 2.2.2.9 255.255.255.255 # bgp 65100 peer 1.1.1.9 as-number 65100 peer 1.1.1.9 connect-interface LoopBack0 # ipv4-family unicast undo synchronization peer 1.1.1.9 enable # ipv6-family undo synchronization import-route direct import-route static peer 1.1.1.9 enable peer 1.1.1.9 label-route-capability # ospf 1 area 0.0.0.0 network 2.2.2.9 0.0.0.0 network 4.3.5.0 0.0.0.255 # return

# sysname CE1 # ipv6 # interface Pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3000:435::2 # ipv6 route-static :: 0 Pos1/0/0 #
Issue 02 (2009-12-10)
10-39

return l

# sysname CE2 # ipv6 # interface Pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3000:1065::2 # ipv6 route-static :: 0 Pos1/0/0 # return
10-40
Issue 02 (2009-12-10)
A Glossary
A
This appendix collates frequently used glossaries in this document. A Access Control List Acknowledge Address Resolution Protocol ATM
Glossary
A list composed of multiple sequential permit/deny statements. In firewall, after ACL is applied to an interface on the device, the device decides which packet can be forwarded and which packet should be denied. In QoS, ACL is used to classify traffic. To confirm an action. The acknowledgement (ACK) message is sent from one device to another. A protocol used to map an IP Address to a MAC address, as defined in RFC 826. An asynchronous Transfer Mode. It is a data transmission technology in which data (files, voice and video) is transferred in cells with a fixed length (53 Bytes). The fixed length makes the cell be processed by the hardware. The object of ATM is to make good use of high-speed transmission medium such as E3, SONET and T3.
B Broadcast To send packets to all ports of the nodes in the network.
D Domain name Dotted decimal notation A name composed of numbers or characters. Each domain name corresponds to an IP address. A format of IP address. IP addresses in this format are separated into four parts by a dot "." with each part is in the decimal numeral.
Issue 02 (2009-12-10)
A-1
A Glossary
Ethernet
A technology complemented in LAN. It adopts Carrier Sense Multiple Access/Collision Detection. The speed of an Ethernet interface can be 10 Mbit/s, 100 Mbit/s, 1000 Mbit/s or 10000 Mbit/s. The Ethernet network features high reliability and easy maintaining..
F File Transfer Protocol An application layer protocol based on TCP/IP. It is used to transfer large amounts of data reliably between the user and the remote host. FTP is implemented based on corresponding file system.
I IPv6 A update version of IPv4. It is also called IP Next Generation (IPng). The specifications and standardizations provided by it are consistent with the Internet Engineering Task Force (IETF).Internet Protocol Version 6 (IPv6) is also called. It is a new version of the Internet Protocol, designed as the successor to IPv4. The specifications and standardizations provided by it are consistent with the Internet Engineering Task Force (IETF).The difference between IPv6 and IPv4 is that an IPv4 address has 32 bits while an IPv6 address has 128 bits.
L Local Area Network A network intended to serve a small geographic area, (few square kilometers or less), a single office or building, or a small defined group of users. It features high speed and little errors. Ethernet, FDDI and Toke Ring are three technologies implemented in LAN.
M MAC address MTU A link layer address or physical address. It is six bytes long. A maximum size of packets that an interface can process. It is in bytes
N Neighbor Discovery A process to discover neighboring modes.
P Ping To test the reachablitly of a device in the network through ICMP Echo message.
A-2
Issue 02 (2009-12-10)
A Glossary
Policy-based Routing PPP
A routing mechanism based on user-defined policies. It can implement secure communication and load balancing. A serial point to point link used for special transmission between two devices.
R Router A device running on the network layer. After receiving a packet, the device searches the routing table for a proper route and sends the packet to the next hop. The last hop device sends the packet to the host directly.
T Telnet Time Range Traffic Tunnel An application layer protocol based on TCP/IP. It implements remote login and virtual terminal. It A special time period. A group of packets sent from the source to the destination and matching certain classification. In VPN, it is a transport tunnel set up between two entities to prevent interior users from interrupting and ensure security.
U Unicast To send packets to one destination network.
V VPN Virtual Private Network (VPN). It implements an apparent single private network (as seen by the user), over a number of separate public and private networks. Virtual indicates that this kind of network is a logical network. Versatile Routing Platform. It is a versatile operation system platform developed by Huawei.
NE5000E
W Wide Area Network A network that covers a large geographic area, such as a country or a state. Devices in this network are connected through certain protocol or physical links.
Issue 02 (2009-12-10)
A-3
A Glossary
X.25
A data link layer protocol. It defines the communication in the Public Data Network (PDN) between a host and a remote terminal.
A-4
Issue 02 (2009-12-10)
B Acronyms and Abbreviations
B
A AAA ACK ASCII ATM
Acronyms and Abbreviations
This appendix collates frequently used acronyms and abbreviations in this document.
Authentication, Authorization and Accounting Acknowledgement American Standard Code for Information Interchange Asynchronous Transfer Mode
B BGP Border Gateway Protocol
C CIDR Classless Inter-Domain Routing
D DHCP DLCI DNS DOS DAD Dynamic Host Configuration Protocol Data Link Control Identifier Domain Name System Denial of Service Duplicate Address Detect
E EBGP External BGP
Issue 02 (2009-12-10)
B-1
F FEC FIB G GRE Generic Routing Encapsulation Forward Error Correction Forward Information Base
H HDLC HTTP High level Data Link Control Hyper Text Transport Protocol
I IBGP ICMP IEEE IETF IGP IP IPoEoA IPSec IS-IS ISP Internal BGP Internet Control Message Protocol Institute of Electrical and Electronics Engineers Internet Engineering Task Force Interior Gateway Protocol Internet Protocol IP over Ethernet over AAL5 Internet Protocol SECurity extensions Intermediate System-Intermediate System Internet Service Provider
L LDP LSP Label Distribution Protocol Label Switch Path
M MAC MED MPLS Medium Access Control Multi-Exit discrimination Multi-Protocol Label Switching
B-2
Issue 02 (2009-12-10)
NAT NAT-PT NIC
Network Address Translation Network Address Translation - Protocol Translation Network Information Center
O OSPF Open Shortest Path First
P PC PE POS PPP PVC Personal Computer Provider Edge Packet Over SDH/SONET Point-to-Point Protocol Permanent Virtual Circuit
Q QoS Quality of Service
R RIP RPR Routing Information Protocol Resilient Packet Ring
S SLIP SNMP SVC Serial Line Internet Protocol Simple Network Management Protocol Switched Virtual Channel
T TCP TFTP TOS TTL Transmission Control Protocol Trivial File Transfer Protocol Type of Service Time To Live
Issue 02 (2009-12-10)
B-3
U UDP URPF User Datagram Protocol Unicast Reverse Path Forwarding
V VLAN VPN NE5000E VRRP VT Virtual Local Area Network Virtual Private Network Versatile Routing Platform Virtual Router Redundancy Protocol Virtual-Template
W WINS WWW Windows Internet Name Service World Wide Web
B-4
Issue 02 (2009-12-10)

Configuration Guide - IP Services (V300R007C00 02)

Diunggah oleh

Informasi Dokumen

Deskripsi Asli:

Judul Asli

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

Configuration Guide - IP Services (V300R007C00 02)

Diunggah oleh

Hak Cipta:

Format Tersedia

HUAWEI NetEngine5000E Core Router V300R007C00

Configuration Guide - IP Services

HUAWEI TECHNOLOGIES CO., LTD.

Trademarks and Permissions

Huawei Technologies Co., Ltd.

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

About This Document

About This Document

About This Document

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

Chapter 1 IP Addresses Configuration

5 IP Performance Configuration 6 ACL Configuration

7 Basic IPv6 Configuration

8 IPv6 DNS Configuration

10 IPv6 over IPv4 Tunnel Configuration A Glossary B Acronyms and Abbreviations

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

About This Document

About This Document

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

Convention [] { x | y | ... } [ x | y | ... ] { x | y | ... }*

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

About This Document

Updates in Issue 02 (2009-12-10)

Updates in Issue 01 (2009-09-05)

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

7 Basic IPv6 Configuration..........................................................................................................7-1

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

8 IPv6 DNS Configuration..........................................................................................................8-1

10 IPv6 over IPv4 Tunnel Configuration................................................................................10-1

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

A Glossary.....................................................................................................................................A-1 B Acronyms and Abbreviations.................................................................................................B-1

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

1.1 IP Addresses Overview

1.1.1 Introduction to IP Addresses

1.1.2 Features of IP Addresses Supported by the NE5000E

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

1.2 Configuring IP Addresses for Interfaces

1.2.1 Establishing the Configuration Task

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

1.2.2 Configuring a Primary IP Address for an Interface

The system view is displayed. Step 2 Run:

The interface view is displayed. Step 3 Run:

1.2.3 (Optional) Configuring a Secondary IP Address for an Interface

The system view is displayed. Step 2 Run:

The interface view is displayed. Step 3 Run:

HUAWEI NetEngine5000E Core Router Configuration Guide - IP Services

1.2.4 Checking the Configuration

1.3 Configuring IP Address Negotiation on Interfaces