Configuration Guide - IP Services (V600R003C00 - 01)

HUAWEI CX600 Metro Services Platform V600R003C00
Configuration Guide - IP Services

Issue Date 01 2011-05-30
HUAWEI TECHNOLOGIES CO., LTD.
Copyright Huawei Technologies Co., Ltd. 2011. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd.
Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.
Huawei Technologies Co., Ltd.

Address: Huawei Industrial Base Bantian, Longgang Shenzhen 518129 People's Republic of China http://www.huawei.com support@huawei.com
Website: Email:
Issue 01 (2011-05-30)
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.
HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services
About This Document
About This Document

Purpose
This document describes multiple IP services supported by the CX600. It discusses basic configurations of IP addresses, ARP, DNS, COPS, ANCP, IP performance, ACL, IPv6, ACL6, IPv6 over IPv4 tunnels, and IPv4 over IPv6 tunnels.
NOTE
l This document takes interface numbers and link types of the CX600-X8 as an example. In working situations, the actual interface numbers and link types may be different from those used in this document. l On CX600 series excluding CX600-X1 and CX600-X2, line processing boards are called Line Processing Units (LPUs) and switching fabric boards are called Switching Fabric Units (SFUs). On the CX600-X1 and CX600-X2, there are no LPUs and SFUs, and NPUs implement the same functions of LPUs and SFUs to exchange and forward packets.
Intended Audience
This document is intended for: l l l l Commissioning Engineer Data Configuration Engineer Network Monitoring Engineer System Maintenance Engineer
Symbol Conventions
The symbols that may be found in this document are defined as follows. Symbol Description Indicates a hazard with a high level of risk that, if not avoided, will result in death or serious injury.
Issue 01 (2011-05-30)
iii
About This Document
Symbol
Description Indicates a hazard with a medium or low level of risk which, if not avoided, could result in minor or moderate injury. Indicates a potentially hazardous situation that, if not avoided, could cause device damage, data loss, and performance degradation, or unexpected results. Indicates a tip that may help you solve a problem or save your time. Provides additional information to emphasize or supplement important points of the main text.
Change History
Changes between document issues are cumulative. The latest document issue contains all the changes made in earlier issues.
Changes in Issue 01 (2011-05-16)

Initial commercial release.
iv
Issue 01 (2011-05-30)
Contents
Contents
About This Document...................................................................................................................iii 1 IP Addresses Configuration..................................................................................................... 1-1
1.1 IP Addresses Overview...................................................................................................................................1-2 1.1.1 Introduction to IP Addresses..................................................................................................................1-2 1.1.2 Features of IP Addresses Supported by the CX600...............................................................................1-2 1.2 Configuring IP Addresses for Interfaces.........................................................................................................1-3 1.2.1 Establishing the Configuration Task......................................................................................................1-3 1.2.2 Configuring a Primary IP Address for an Interface...............................................................................1-4 1.2.3 (Optional) Configuring a Secondary IP Address for an Interface..........................................................1-5 1.2.4 Checking the Configuration...................................................................................................................1-5 1.3 Configuring IP Address Negotiation on Interfaces.........................................................................................1-6 1.3.1 Establishing the Configuration Task......................................................................................................1-6 1.3.2 Configuring a Server to Assign an IP Address for a Client Through Negotiation.................................1-7 1.3.3 Configuring a Client to Obtain an IP Address Through Negotiation.....................................................1-8 1.3.4 Checking the Configuration...................................................................................................................1-9 1.4 Configuring IP Address Unnumbered for Interfaces....................................................................................1-10 1.4.1 Establishing the Configuration Task....................................................................................................1-11 1.4.2 Configuring the Primary IP Address of the Interface That Lends an IP Address................................1-12 1.4.3 Configuring an Interface That Borrows an IP Address from Another Interface..................................1-12 1.4.4 Checking the Configuration.................................................................................................................1-13 1.5 Maintaining IP Addresses.............................................................................................................................1-14 1.5.1 Monitoring Network Operation Status of IP Addresses.......................................................................1-14 1.6 Configuration Examples................................................................................................................................1-14 1.6.1 Example for Configuring Primary and Secondary IP Addresses.........................................................1-15 1.6.2 Example for Obtaining an IP Address Through Negotiation...............................................................1-16 1.6.3 Example for Configuring IP Address Unnumbered.............................................................................1-19 1.6.4 Example for Configuring IP Address Overlapping on the Same Device.............................................1-21 1.6.5 Example for Configuring an IP Address with a 31-bit Mask...............................................................1-26
2 ARP Configuration....................................................................................................................2-1
2.1 Introduction to ARP........................................................................................................................................2-3 2.1.1 Overview of ARP...................................................................................................................................2-3 2.1.2 Features of ARP Supported by the CX600............................................................................................2-3 Issue 01 (2011-05-30) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. v
Contents
2.2 Configuring Static ARP..................................................................................................................................2-6 2.2.1 Establishing the Configuration Task......................................................................................................2-6 2.2.2 Configuring Common Static ARP Entries.............................................................................................2-7 2.2.3 Configuring Static ARP Entries in a VLAN..........................................................................................2-7 2.2.4 Configuring Static ARP Entries in a VPN Instance...............................................................................2-8 2.2.5 Checking the Configuration...................................................................................................................2-9 2.3 Optimizing Dynamic ARP............................................................................................................................2-10 2.3.1 Establishing the Configuration Task....................................................................................................2-11 2.3.2 Modify the aging parameters of dynamic ARP....................................................................................2-11 2.3.3 Enabling ARP Suppression Function...................................................................................................2-12 2.3.4 Enabling Layer 2 Topology Detection Function..................................................................................2-12 2.3.5 Enabling ARP Check...........................................................................................................................2-13 2.3.6 Checking the Configuration.................................................................................................................2-14 2.4 Configuring Routed Proxy ARP...................................................................................................................2-15 2.4.1 Establishing the Configuration Task....................................................................................................2-15 2.4.2 Configure an IP Addresses for the Interface........................................................................................2-16 2.4.3 Enabling the Routed Proxy ARP Function..........................................................................................2-16 2.4.4 Checking the Configuration.................................................................................................................2-17 2.5 Configuring Proxy ARP Within a VLAN.....................................................................................................2-18 2.5.1 Establishing the Configuration Task....................................................................................................2-18 2.5.2 Configure an IP Addresses for the Interface........................................................................................2-19 2.5.3 Configuring the VLAN Associated with the Sub-interface.................................................................2-20 2.5.4 Enabling Proxy ARP Within a VLAN.................................................................................................2-20 2.5.5 Checking the Configuration.................................................................................................................2-21 2.6 Configuring Proxy ARP Between VLANs...................................................................................................2-22 2.6.1 Establishing the Configuration Task....................................................................................................2-22 2.6.2 Configuring an IP Addresses for the Interface.....................................................................................2-23 2.6.3 Configuring the VLAN Associated with the Sub-interface.................................................................2-24 2.6.4 Enabling Proxy ARP Between VLANs...............................................................................................2-24 2.6.5 Checking the Configuration.................................................................................................................2-25 2.7 Configuring ARP-Ping IP.............................................................................................................................2-26 2.7.1 Establishing the Configuration Task....................................................................................................2-26 2.7.2 Detecting the IP Address by Using the arp-ping ip Command............................................................2-27 2.8 Configuring ARP-Ping MAC........................................................................................................................2-27 2.8.1 Establishing the Configuration Task....................................................................................................2-28 2.8.2 Detecting the MAC Address by Using the arp-ping mac Command...................................................2-28 2.9 Configuring the Association Between ARP and Interface Status.................................................................2-29 2.9.1 Establishing the Configuration Task....................................................................................................2-29 2.9.2 Configuring the Association Between ARP and Interface Status........................................................2-30 2.9.3 (Optional) Adjusting Parameters about the Association Between ARP and Interface Status..............2-31 2.10 Maintaining ARP.........................................................................................................................................2-32 2.10.1 Clearing ARP Entries.........................................................................................................................2-32 vi Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 01 (2011-05-30)
Contents
2.10.2 Monitoring Network Operation Status of ARP..................................................................................2-32 2.11 Configuration Examples..............................................................................................................................2-33 2.11.1 Example for Configuring Routed Proxy ARP....................................................................................2-33 2.11.2 Example for Configuring Proxy ARP Within a VLAN.....................................................................2-36 2.11.3 Example for Configuring Proxy ARP Between VLANs...................................................................2-38 2.11.4 Example for Configuring the Association Between ARP and Interface Status.................................2-39 2.11.5 Example for Configuring Layer 2 Topology Detection.....................................................................2-44
3 DNS Configuration....................................................................................................................3-1
3.1 DNS Overview................................................................................................................................................3-2 3.1.1 Introduction to DNS...............................................................................................................................3-2 3.1.2 DNS Supported by the CX600...............................................................................................................3-2 3.2 Configuring DNS............................................................................................................................................3-2 3.2.1 Establishing the Configuration Task......................................................................................................3-3 3.2.2 Configuring Static DNS Entries.............................................................................................................3-3 3.2.3 Configuring Dynamic DNS....................................................................................................................3-4 3.2.4 Checking the Configuration...................................................................................................................3-5 3.3 Maintaining DNS............................................................................................................................................3-6 3.3.1 Clearing DNS Entries.............................................................................................................................3-6 3.3.2 Monitoring Network Operation Status of DNS......................................................................................3-6 3.4 Configuration Examples..................................................................................................................................3-7 3.4.1 Example for Configuring DNS..............................................................................................................3-7
4 COPS Configuration..................................................................................................................4-1
4.1 COPS Overview..............................................................................................................................................4-2 4.1.1 Introduction to COPS.............................................................................................................................4-2 4.1.2 COPS Features Supported by the CX600..............................................................................................4-3 4.2 Configuring the COPS Server Group..............................................................................................................4-4 4.2.1 Establishing the Configuration Task......................................................................................................4-5 4.2.2 Configuring the Global Parameters of COPS........................................................................................4-6 4.2.3 Creating a COPS Server Group..............................................................................................................4-7 4.2.4 Configuring the COPS Server................................................................................................................4-7 4.2.5 Setting the PEP ID for the COPS Server................................................................................................4-8 4.2.6 (Optional) Setting the Flow Keeping Time of the COPS Server...........................................................4-8 4.2.7 (Optional) Setting the Shared Key of the COPS Server.........................................................................4-9 4.2.8 Activating the COPS Server Group.......................................................................................................4-9 4.2.9 Checking the Configuration.................................................................................................................4-10 4.3 Configuration Examples................................................................................................................................4-11 4.3.1 Example for Configuring COPS Interfaces to Report Online and Offline Messages..........................4-11
5 ANCP Configuration.................................................................................................................5-1
5.1 ANCP Overview.............................................................................................................................................5-2 5.1.1 Introduction to the ANCP Protocol........................................................................................................5-2 5.1.2 Applicable Environment........................................................................................................................5-3 Issue 01 (2011-05-30) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. vii
Contents
5.2 Configuring the ANCP Server........................................................................................................................5-5 5.2.1 Establishing the Configuration Task......................................................................................................5-6 5.2.2 Enabling ANCP......................................................................................................................................5-7 5.2.3 Configuring the Source Interface of an ANCP Connection...................................................................5-8 5.2.4 (Optional) Configuring Parameters of ANCP Sessions.........................................................................5-8 5.2.5 Configuring ANCP Neighbor Profiles...................................................................................................5-9 5.2.6 (Optional) Configuring Bandwidth Adjustment Factors......................................................................5-10 5.2.7 (Optional) Configuring ANCP Message Damping..............................................................................5-11 5.2.8 (Optional) Configuring ANCP OAM Detection..................................................................................5-12 5.2.9 (Optional) Adjusting the Upstream and Downstream Bandwidths of a User Automatically..............5-12 5.2.10 Checking the Configuration...............................................................................................................5-13 5.3 Configuring the ANCP Proxy.......................................................................................................................5-15 5.3.1 Establishing the Configuration Task....................................................................................................5-15 5.3.2 Enabling ANCP....................................................................................................................................5-16 5.3.3 Configuring the Source Interface of an ANCP Connection.................................................................5-17 5.3.4 (Optional) Configuring Parameters of ANCP Sessions.......................................................................5-17 5.3.5 Configuring the ANCP Neighbor Profile.............................................................................................5-18 5.3.6 (Optional) Configuring Bandwidth Adjustment Factors......................................................................5-19 5.3.7 (Optional) Enabling the Function of Configuring ANCP Access Lines..............................................5-20 5.3.8 (Optional) Configuring ANCP Message Damping..............................................................................5-21 5.3.9 (Optional) Configuring ANCP OAM Detection..................................................................................5-22 5.3.10 Checking the Configuration...............................................................................................................5-23 5.4 Configuring the Association Between ANCP and HQoS in the ANCP Proxy Scenario..............................5-24 5.4.1 Establishing the Configuration Task....................................................................................................5-25 5.4.2 Configuring the Mode of the Association Between ANCP and HQoS................................................5-26 5.4.3 Configuring the QoS Profile and Scheduling Parameters....................................................................5-27 5.4.4 Configuring the BRAS to Deliver the QoS Policy Name....................................................................5-28 5.4.5 Applying the QoS Profile to the Interface............................................................................................5-28 5.4.6 Enabling ANCP on the Interface and Associating the Interface with the ANCP Neighbor Profile .......................................................................................................................................................................5-29 5.4.7 Checking the Configuration.................................................................................................................5-29 5.5 Maintaining ANCP........................................................................................................................................5-31 5.5.1 Clearing ANCP Running Information..................................................................................................5-31 5.6 Configuration Examples................................................................................................................................5-31 5.6.1 Example for Configuring the ANCP Server........................................................................................5-32 5.6.2 Configuring CX device as the ANCP Proxy and Configuring ANCP-HQoS Association..................5-35
6 IP Performance Configuration.................................................................................................6-1
6.1 IP Performance Overview...............................................................................................................................6-2 6.1.1 Introduction to IP Performance..............................................................................................................6-2 6.1.2 IP Performance Supported by the CX600..............................................................................................6-2 6.2 Improving IP Performance..............................................................................................................................6-3 6.2.1 Establishing the Configuration Task......................................................................................................6-4 viii Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 01 (2011-05-30)
Contents
6.2.2 Configuring the Maximum Transmission Unit of the Interface.............................................................6-4 6.2.3 Configuring ICMP Attributes.................................................................................................................6-5 6.2.4 Checking the Configuration...................................................................................................................6-6 6.3 Configuring TCP.............................................................................................................................................6-8 6.3.1 Establishing the Configuration Task......................................................................................................6-8 6.3.2 Configuring TCP Timer.........................................................................................................................6-8 6.3.3 Specifying the Size of a TCP Sliding Window......................................................................................6-9 6.3.4 Checking the Configuration...................................................................................................................6-9 6.4 Configuring Load Balancing for IP Packet Forwarding...............................................................................6-10 6.4.1 Establishing the Configuration Task....................................................................................................6-11 6.4.2 Configuring the Load Balancing Mode of IP Packet Forwarding........................................................6-12 6.4.3 Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding.............................6-13 6.4.4 Configuring Global Unequal-Cost Multiple Path During IP Packet Forwarding................................6-14 6.4.5 Checking the Configuration.................................................................................................................6-14 6.5 Maintaining IP Performance.........................................................................................................................6-15 6.5.1 Clearing IP Performance Statistics.......................................................................................................6-15 6.5.2 Monitoring Network Operation Status of IP Performance...................................................................6-16 6.6 Configuration Examples................................................................................................................................6-17 6.6.1 Example for Limiting Transmission of ICMP Host-Unreachable Packets..........................................6-17 6.6.2 Example for Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding........6-20 6.6.3 Example for Configuring Global Unequal-Cost Load Balancing for IP Packet Forwarding..............6-25
7 ACL Configuration....................................................................................................................7-1
7.1 ACL Overview................................................................................................................................................7-2 7.1.1 Introduction to ACL...............................................................................................................................7-2 7.1.2 ACL Supported by the CX600...............................................................................................................7-2 7.2 Configuring an Interface-based ACL..............................................................................................................7-3 7.2.1 Establishing the Configuration Task......................................................................................................7-3 7.2.2 (Optional) Creating a Time Range.........................................................................................................7-4 7.2.3 Creating an Interface-based ACL...........................................................................................................7-4 7.2.4 (Optional) Configuring ACL Descriptions............................................................................................ 7-5 7.2.5 (Optional) Configuring ACL Step..........................................................................................................7-5 7.2.6 Checking the Configuration...................................................................................................................7-6 7.3 Configuring a Basic ACL................................................................................................................................7-6 7.3.1 Establishing the Configuration Task......................................................................................................7-7 7.3.2 (Optional) Creating a Time Range.........................................................................................................7-7 7.3.3 Creating a Basic ACL............................................................................................................................ 7-8 7.3.4 (Optional) Configuring ACL Descriptions............................................................................................ 7-8 7.3.5 (Optional) Configuring ACL Step..........................................................................................................7-9 7.3.6 Checking the Configuration...................................................................................................................7-9 7.4 Configuring an Advanced ACL....................................................................................................................7-10 7.4.1 Establishing the Configuration Task....................................................................................................7-11 7.4.2 (Optional) Creating a Time Range.......................................................................................................7-11 Issue 01 (2011-05-30) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. ix
Contents
HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services 7.4.3 Creating an Advanced ACL.................................................................................................................7-12 7.4.4 (Optional) Configuring ACL Descriptions..........................................................................................7-13 7.4.5 (Optional) Configuring ACL Step........................................................................................................7-13 7.4.6 Checking the Configuration.................................................................................................................7-14
7.5 Configuring an ACL Based on the Ethernet Frame Header..........................................................................7-15 7.5.1 Establishing the Configuration Task....................................................................................................7-15 7.5.2 Creating an ACL Based on the Ethernet Frame Header......................................................................7-15 7.5.3 (Optional) Configuring ACL Descriptions..........................................................................................7-16 7.5.4 (Optional) Configuring ACL Step........................................................................................................7-16 7.5.5 Checking the Configuration.................................................................................................................7-17 7.6 Configuring an UCL......................................................................................................................................7-18 7.6.1 Establishing the Configuration Task....................................................................................................7-18 7.6.2 (Optional) Creating a Time Range.......................................................................................................7-18 7.6.3 Creating an UCL..................................................................................................................................7-19 7.6.4 (Optional) Configuring ACL Descriptions..........................................................................................7-20 7.6.5 (Optional) Configuring ACL Step........................................................................................................7-21 7.6.6 Checking the Configuration.................................................................................................................7-21 7.7 Configuring a Named ACL...........................................................................................................................7-22 7.7.1 Establishing the Configuration Task....................................................................................................7-22 7.7.2 (Optional) Creating a Time Range.......................................................................................................7-23 7.7.3 Creating a Named ACL........................................................................................................................7-23 7.7.4 (Optional) Configuring named ACL Descriptions...............................................................................7-24 7.7.5 (Optional) Configuring named ACL Step............................................................................................7-25 7.7.6 Checking the Configuration.................................................................................................................7-25 7.8 Configuring a MPLS-based ACL..................................................................................................................7-26 7.8.1 Establishing the Configuration Task....................................................................................................7-26 7.8.2 Creating a MPLS-based ACL..............................................................................................................7-27 7.8.3 Configuring Rules for a MPLS-based ACL.........................................................................................7-27 7.8.4 Checking the Configuration.................................................................................................................7-28 7.9 Configuration Examples................................................................................................................................7-28 7.9.1 Example for Configuring a Traffic Policy Based on Complex Traffic Classification.........................7-28 7.9.2 Example for Configuring the Security Function of Access Devices....................................................7-37 7.9.3 Example for Configuring an ACL Rule that Is Based on the VPN Instance.......................................7-39
8 Basic IPv6 Configuration..........................................................................................................8-1

8.1 Basic IPv6 Overview.......................................................................................................................................8-3 8.1.1 Introduction to IPv6...............................................................................................................................8-3 8.1.2 IPv6 Supported by the CX600...............................................................................................................8-3 8.2 Configuring an IPv6 Address for an Interface................................................................................................8-5 8.2.1 Establishing the Configuration Task......................................................................................................8-5 8.2.2 Enabling IPv6 Packet Forwarding Capability........................................................................................8-7 8.2.3 Configuring an IPv6 Link-Local Address for an Interface....................................................................8-8 8.2.4 Configuring an IPv6 Global Unicast Address for an Interface..............................................................8-8 x Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 01 (2011-05-30)
Contents
8.2.5 Configuring an IPv6 Anycast Address for an Interface.........................................................................8-9 8.2.6 Checking the Configuration.................................................................................................................8-10 8.3 Configuring an IPv6 Address Selection Policy Table...................................................................................8-11 8.4 Configuring IPv6 Neighbor Discovery.........................................................................................................8-13 8.4.1 Establishing the Configuration Task....................................................................................................8-13 8.4.2 Configuring Static Neighbors...............................................................................................................8-14 8.4.3 Enabling RA Message Advertising......................................................................................................8-15 8.4.4 Setting the Interval for Advertising RA Messages...............................................................................8-15 8.4.5 Enabling Stateful Auto Configuration..................................................................................................8-16 8.4.6 Configuring the Address Prefixes to Be Advertised............................................................................8-17 8.4.7 Configuring Other Information to Be Advertised................................................................................8-17 8.4.8 Configuring the Default Router Priority and Route Information.........................................................8-19 8.4.9 (Optional) Configuring Routed Proxy ND...........................................................................................8-19 8.4.10 Checking the Configuration...............................................................................................................8-20 8.5 Configuring IPv6 SEND...............................................................................................................................8-21 8.5.1 Establishing the Configuration Task....................................................................................................8-22 8.5.2 Configuring a CGA IPv6 Address.......................................................................................................8-23 8.5.3 Configuring Strict IPv6 SEND.............................................................................................................8-24 8.5.4 Checking the Configuration.................................................................................................................8-25 8.6 Configuring PMTU.......................................................................................................................................8-26 8.6.1 Establishing the Configuration Task....................................................................................................8-26 8.6.2 Creating Static PMTU Entries..............................................................................................................8-27 8.6.3 Configuring PMTU Aging Time..........................................................................................................8-27 8.6.4 Checking the Configuration.................................................................................................................8-28 8.7 Configuring TCP6.........................................................................................................................................8-29 8.7.1 Establishing the Configuration Task....................................................................................................8-29 8.7.2 Configuring TCP6 Timers....................................................................................................................8-30 8.7.3 Configuring the Size of the TCP6 Sliding Window.............................................................................8-30 8.7.4 Checking the Configuration.................................................................................................................8-30 8.8 Maintaining IPv6...........................................................................................................................................8-32 8.8.1 Resetting IPv6......................................................................................................................................8-32 8.8.2 Monitoring Network Operation Status of IPv6....................................................................................8-33 8.9 Configuration Examples................................................................................................................................8-34 8.9.1 Example for Configuring an IPv6 Address for an Interface................................................................8-34 8.9.2 Example for Configuring IPv6 Neighbor Discovery...........................................................................8-37 8.9.3 Example for Configuring IPv6 Address Selection Policy Table..........................................................8-40 8.9.4 Example for Configuring IPv6 SEND.................................................................................................8-43 8.9.5 Example for Configuring Default Router Priority and Route Information..........................................8-47
9 IPv6 DNS Configuration..........................................................................................................9-1

9.1 IPv6 DNS Overview........................................................................................................................................9-2 9.1.1 Introduction to IPv6 DNS...................................................................................................................... 9-2 9.1.2 IPv6 DNS Supported by the CX600...................................................................................................... 9-2 Issue 01 (2011-05-30) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. xi
Contents
9.2 Configuring IPv6 DNS....................................................................................................................................9-2 9.2.1 Establishing the Configuration Task......................................................................................................9-3 9.2.2 Configuring a Static IPv6 DNS Entry....................................................................................................9-3 9.2.3 Configuring the Dynamic IPv6 DNS Services.......................................................................................9-4 9.2.4 Checking the Configuration...................................................................................................................9-5 9.3 Maintaining IPv6 DNS....................................................................................................................................9-6 9.3.1 Clearing IPv6 DNS Entries....................................................................................................................9-6 9.3.2 Monitoring Network Operation Status of IPv6 DNS.............................................................................9-6 9.4 Configuration Examples..................................................................................................................................9-7 9.4.1 Example for Configuring IPv6 DNS......................................................................................................9-7
10 ACL6 Configuration.............................................................................................................. 10-1

10.1 ACL6 Overview..........................................................................................................................................10-2 10.1.1 Introduction to ACL6.........................................................................................................................10-2 10.1.2 ACL6 Supported by the CX600.........................................................................................................10-2 10.2 Configuring an Interfaced-based ACL6......................................................................................................10-2 10.2.1 Establishing the Configuration Task..................................................................................................10-3 10.2.2 (Optional) Configuring the Valid Time Range of ACL6...................................................................10-3 10.2.3 Creating an Interfaced-based ACL6...................................................................................................10-4 10.2.4 Checking the Configuration...............................................................................................................10-4 10.3 Configuring a Basic ACL6..........................................................................................................................10-5 10.3.1 Establishing the Configuration Task..................................................................................................10-5 10.3.2 (Optional) Configuring the Valid Time Range of ACL6...................................................................10-6 10.3.3 Creating a Basic ACL6......................................................................................................................10-6 10.3.4 Checking the Configuration...............................................................................................................10-7 10.4 Configuring an Advanced ACL6................................................................................................................10-7 10.4.1 Establishing the Configuration Task..................................................................................................10-8 10.4.2 (Optional) Configuring the Valid Time Range of ACL6...................................................................10-9 10.4.3 Creating an Advanced ACL6.............................................................................................................10-9 10.4.4 Checking the Configuration.............................................................................................................10-10 10.5 Configuring a Named ACL6.....................................................................................................................10-11 10.5.1 Establishing the Configuration Task................................................................................................10-11 10.5.2 (Optional) Configuring the Valid Time Range of ACL6.................................................................10-12 10.5.3 Creating a Named ACL6..................................................................................................................10-12 10.5.4 Checking the Configuration.............................................................................................................10-13 10.6 Maintaining ACL6....................................................................................................................................10-14 10.6.1 Clearing ACL6 Statistics..................................................................................................................10-15 10.6.2 Monitoring Network Operation Status of ACL6..............................................................................10-15 10.7 Configuration Examples............................................................................................................................10-15 10.7.1 Example for Configuring an ACL6 to Filter IPv6 Packets..............................................................10-16
11 IPv6 over IPv4 Tunnel Configuration................................................................................11-1

11.1 IPv6 over IPv4 Tunnel Overview................................................................................................................11-2 11.1.1 Introduction to IPv6 over IPv4...........................................................................................................11-2 xii Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 01 (2011-05-30)
Contents
11.1.2 IPv6 over IPv4 Supported by the CX600...........................................................................................11-2 11.2 Configuring IPv4/IPv6 Dual Stacks............................................................................................................11-8 11.2.1 Establishing the Configuration Task..................................................................................................11-8 11.2.2 Enabling IPv6 Packet Forwarding......................................................................................................11-9 11.2.3 Configuring IPv4 and IPv6 Addresses for the Interface..................................................................11-10 11.3 Configuring an IPv6 over IPv4 Tunnel.....................................................................................................11-11 11.3.1 Establishing the Configuration Task................................................................................................11-12 11.3.2 Configuring an IPv6 over IPv4 Manual Tunnel...............................................................................11-12 11.3.3 Configuring an IPV6 over IPv4 GRE Tunnel..................................................................................11-14 11.3.4 Configuring an IPv6 over IPv4 Automatic Tunnel..........................................................................11-15 11.3.5 Configuring a 6to4 Tunnel...............................................................................................................11-16 11.3.6 Configuring an ISATAP Tunnel......................................................................................................11-17 11.3.7 Configuring Routes in the Tunnel....................................................................................................11-18 11.3.8 Checking the Configuration.............................................................................................................11-19 11.4 Configuring 6PE........................................................................................................................................11-20 11.4.1 Establishing the Configuration Task................................................................................................11-20 11.4.2 Configuring IPv4/IPv6 Dual Protocol Stacks..................................................................................11-21 11.4.3 Configuring MPLS...........................................................................................................................11-22 11.4.4 Enabling 6PE Peer............................................................................................................................11-23 11.5 Maintaining IPv6 over IPv4 Tunnels........................................................................................................11-23 11.5.1 Monitoring the Running Status of IPv6 over IPv4 Tunnel..............................................................11-24 11.6 Configuration Examples............................................................................................................................11-24 11.6.1 Example for Configuring an IPv6 over IPv4 Manual Tunnel..........................................................11-24 11.6.2 Example for Configuring an IPv6 over IPv4 GRE Tunnel..............................................................11-28 11.6.3 Example for Configuring an IPv6 over IPv4 Automatic Tunnel.....................................................11-32 11.6.4 Example for Configuring a 6to4 Tunnel..........................................................................................11-36 11.6.5 Example for Configuring 6to4 Relay...............................................................................................11-39 11.6.6 Example for Configuring an ISATAP Tunnel.................................................................................11-42 11.6.7 Example for Configuring 6PE..........................................................................................................11-45
12 IPv4 over IPv6 Tunnel Configuration................................................................................12-1

12.1 IPv4 over IPv6 Tunnel Overview................................................................................................................12-2 12.1.1 Introduction to IPv4 over IPv6...........................................................................................................12-2 12.1.2 IPv4 over IPv6 Supported by the CX600...........................................................................................12-2 12.2 Configuring an IPv4 over IPv6 Tunnel.......................................................................................................12-3 12.2.1 Establishing the Configuration Task..................................................................................................12-3 12.2.2 Configuring a Tunnel Interface..........................................................................................................12-4 12.2.3 Configuring Routes in the Tunnel......................................................................................................12-5 12.2.4 Configuring Other Items for an IPv4 over IPv6 Tunnel....................................................................12-5 12.2.5 Checking the Configuration...............................................................................................................12-6 12.3 Maintaining IPv4 over IPv6 Tunnels..........................................................................................................12-8 12.3.1 Monitoring the Operation Status of IPv4 over IPv6 Tunnel..............................................................12-8 12.4 Configuration Examples..............................................................................................................................12-8 Issue 01 (2011-05-30) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. xiii
Contents
HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services 12.4.1 Example for Configuring an IPv4 over IPv6 Tunnel.........................................................................12-8
A Glossary.....................................................................................................................................A-1 B Acronyms and Abbreviations.................................................................................................B-1
xiv
Issue 01 (2011-05-30)
Figures
Figures
Figure 1-1 Configuring primary and secondary IP addresses for an interface...................................................1-15 Figure 1-2 Networking diagram of allocating IP address through negotiation..................................................1-17 Figure 1-3 Networking diagram of an IP address unnumbered configuration...................................................1-19 Figure 1-4 Networking diagram of configuring IP address overlapping on the same device............................1-22 Figure 1-5 Networking diagram of configuring an IP address with a 31-bit mask............................................1-26 Figure 2-1 Implementation procedure of ARP-Ping IP........................................................................................2-4 Figure 2-2 Implementation procedure of ARP-Ping MAC..................................................................................2-5 Figure 2-3 Schematic diagram of transmission device existing between devices..............................................2-30 Figure 2-4 Networking diagram of configuring proxy ARP..............................................................................2-34 Figure 2-5 Networking diagram of configuring proxy ARP in a VLAN...........................................................2-36 Figure 2-6 Networking diagram of configuring proxy ARP between VLANs..................................................2-38 Figure 2-7 Networking diagram of configuring the association between ARP and interface status.................2-40 Figure 2-8 Networking diagram of configuring Layer 2 topology detection.....................................................2-44 Figure 3-1 Networking diagram of DNS..............................................................................................................3-7 Figure 4-1 Typical networking diagram of COPS configuration.......................................................................4-11 Figure 5-1 Networking diagram of configuring an ANCP server........................................................................5-3 Figure 5-2 Networking diagram of configuring an ANCP proxy........................................................................5-5 Figure 5-3 Networking diagram of configuring the ANCP server.....................................................................5-33 Figure 5-4 Networking diagram of configuring CX device as the ANCP proxy and configuring ANCP-HQoS association...........................................................................................................................................................5-36 Figure 6-1 Networking diagram of configuring ICMP host unreachable packets.............................................6-18 Figure 6-2 Networking diagram of configuring UCMP.....................................................................................6-20 Figure 6-3 Networking diagram of configuring unequal-cost load balancing...................................................6-26 Figure 7-1 Diagram for configuring a traffic policy based on complex traffic classification............................7-29 Figure 7-2 Networking of configuring the security function of access devices.................................................7-37 Figure 7-3 Typical networking of configuring an ACL rule..............................................................................7-40 Figure 8-1 Networking diagram of configuring an IPv6 address for an interface.............................................8-35 Figure 8-2 Example for configuring IPv6 neighbor discovery..........................................................................8-38 Figure 8-3 Networking diagram for configuring an IPv6 address selection policy table..................................8-40 Figure 8-4 Networking diagram for configuring IPv6 SEND............................................................................8-43 Figure 8-5 Networking of Configuring Default Router Priorities and Route Information................................8-47 Figure 9-1 DNS server connecting IPv4 and IPv6 networks...............................................................................9-4 Figure 9-2 Networking diagram of IPv6 DNS configurations.............................................................................9-8 Figure 10-1 Networking diagram of configuring an ACL6 to filter IPv6 packets...........................................10-16 Issue 01 (2011-05-30) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. xv
Figures
HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services Figure 11-1 Single stack and dual stack structures (Ethernet)...........................................................................11-2
Figure 11-2 Schematic diagram of IPv6 over IPv4 tunnel.................................................................................11-3 Figure 11-3 6to4 tunnel and 6to4 relay..............................................................................................................11-5 Figure 11-4 ISATAP tunnel...............................................................................................................................11-7 Figure 11-5 Networking diagram of 6PE...........................................................................................................11-8 Figure 11-6 Networking diagram of the IPv6 over IPv4 manual tunnel..........................................................11-25 Figure 11-7 Networking diagram of the IPv6 over IPv4 GRE tunnel..............................................................11-28 Figure 11-8 Networking diagram of the IPv6 over IPv4 automatic tunnel......................................................11-33 Figure 11-9 Networking diagram of the 6to4 tunnel........................................................................................11-36 Figure 11-10 Networking diagram of accessing the IPv6 network through 6to4 relay...................................11-40 Figure 11-11 Networking diagram of the ISATAP tunnel...............................................................................11-43 Figure 11-12 Networking diagram of 6PE.......................................................................................................11-46 Figure 12-1 Networking diagram of an IPv4 over IPv6 tunnel..........................................................................12-2 Figure 12-2 Networking diagram of an IPv4 over IPv6 tunnel..........................................................................12-9
xvi
Issue 01 (2011-05-30)
1 IP Addresses Configuration
1
About This Chapter
IP Addresses Configuration
By assigning IP addresses to network devices, you can enable data communications between the network devices. 1.1 IP Addresses Overview An IP address is also called a logical address. The IP address of a network device on the Internet is the unique identifier of the network device. 1.2 Configuring IP Addresses for Interfaces Assigning an IP address to a device on a network enables the device to communicate with the other devices on the network. 1.3 Configuring IP Address Negotiation on Interfaces If users access the network in the Point-to-Point Protocol (PPP) mode, the server can assign IP addresses to the clients through the address negotiation function of PPP. 1.4 Configuring IP Address Unnumbered for Interfaces IP address unnumbered refers to the situation that an interface that is not assigned an IP address obtains an IP address by borrowing an IP address from another interface. 1.5 Maintaining IP Addresses Maintaining an IP address involves monitoring the operation of this IP address. 1.6 Configuration Examples This section includes the networking requirements, precautions for configuration, and configuration roadmap.
Issue 01 (2011-05-30)
1-1
1.1 IP Addresses Overview

An IP address is also called a logical address. The IP address of a network device on the Internet is the unique identifier of the network device. 1.1.1 Introduction to IP Addresses IP is the core of the TCP/IP protocol suite. The packets of the Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), and Internet Group Membership Protocol (IGMP) are all transmitted in the format of IP datagrams. Devices on different networks communicate with each other using their network layer addresses, namely IP addresses. 1.1.2 Features of IP Addresses Supported by the CX600 IP addresses can be obtained through static manual configuration, auto-negotiation, or borrowing.
1.1.1 Introduction to IP Addresses

IP is the core of the TCP/IP protocol suite. The packets of the Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), and Internet Group Membership Protocol (IGMP) are all transmitted in the format of IP datagrams. Devices on different networks communicate with each other using their network layer addresses, namely IP addresses. To communicate with each other on Internet Protocol (IP) networks, each host must be assigned an IP address. An IP address is a 32-bit number that is composed of two parts, namely, the network ID and host ID. The network ID identifies a network and the host ID identifies a host on the network. If the network IDs of hosts are the same, it indicates that the hosts are on the same network regardless of their physical locations.
1.1.2 Features of IP Addresses Supported by the CX600

IP addresses can be obtained through static manual configuration, auto-negotiation, or borrowing. The CX600 supports IP address configuration through the following methods: l l l Manually configuring an IP address for an interface Obtaining an IP address through negotiation Borrowing an IP address from other interfaces
The CX600 supports the space overlapping of network segment addresses to save the address space. l Different IP addresses in the overlapped network segments but not same can be configured on different interfaces of the same device. For example, after an interface on a device is configured with the IP address 20.1.1.1/16, if another interface is configured with the IP address 20.1.1.2/24, the system prompts a message. However, the configuration is still
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 01 (2011-05-30)
1-2
successful; if another interface is configured with the IP address 20.1.1.2/16, the system prompts an IP address conflict. The configuration fails. l The primary IP address and the secondary IP address in the overlapped network segments but not same can be configured on the same interface. For example, after the interface is configured with a primary IP address 20.1.1.1/24, if the secondary IP address is 20.1.1.2/16 sub, the system prompts a message. However, the configuration is still successful. The primary IP address and the secondary IP address in the overlapped network segments but not same can be configured on different interfaces of the same device. However, the primary IP address and the secondary IP address cannot be the same. For example, after an interface on a device is configured with the IP address 20.1.1.1/16, if another interface is configured with the IP address 20.1.1.2/24 sub, the system prompts a message. However, the configuration is still successful.
The CX600 supports 31-bit IP address masks. Therefore, there are only two IP addresses in a network segment, that is, the network address and broadcast address. The two IP addresses can be used as host addresses. You can assign the IP addresses with 31-bit masks to Point-to-Point (P2P), Point-to-Multipoint (P2MP), NBMA Address Resolution Protocol (NBMA),broadcast, and loopback interfaces. For non-P2P interfaces, if a 31-bit mask is configured, the system prompts acknowledgement information to protect P2MP orbroadcast links. For example, if an Ethernet interface on a device is assigned an IP address with a 31-bit mask, this device can access only the host in the directly connected subnet. It cannot access all hosts in the subnet. In the backbone network of a broadcast link, if a P2P link exists, you can configure the IP addresses with 31-bit masks.
1.2 Configuring IP Addresses for Interfaces

Assigning an IP address to a device on a network enables the device to communicate with the other devices on the network. 1.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for assigning an IP address to an interface. 1.2.2 Configuring a Primary IP Address for an Interface An interface can have only one primary IP address. 1.2.3 (Optional) Configuring a Secondary IP Address for an Interface To enable an interface to communicate with several networks with different network IDs, you need to assign a secondary IP address to this interface. 1.2.4 Checking the Configuration You can view the configuration of the IP address for an interface.
1.2.1 Establishing the Configuration Task

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for assigning an IP address to an interface.
Applicable Environment
To start IP services on an interface, configure the IP address for the interface. You can assign several IP addresses to each interface. Among them, one is the primary IP address and the others are secondary IP addresses.
Issue 01 (2011-05-30) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 1-3
Generally, you need to configure only a primary IP address for an interface. Secondary IP addresses, however, are required in some cases. For instance, when a device connects to a physical network through an interface, and computers on this network belong to two Class C networks, you need to configure a primary IP address and a secondary IP address for this interface to ensure that the device can communication with all computers on this network.
Pre-configuration Tasks
Before configuring an IP addresses for an interface, complete the following tasks: l l Configuring the physical parameters for the interface and ensuring that the physical layer status of the interface is Up Configuring the link layer parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up
Data Preparation
To configure IP addresses for an interface, you need the following data. No. 1 2 3 Data Interface number Primary IP address and subnet mask of the interface (Optional) Secondary IP address and subnet mask of the interface
1.2.2 Configuring a Primary IP Address for an Interface

An interface can have only one primary IP address.
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 Run:

interface interface-type interface-number
The interface view is displayed. Step 3 Run:

ip address ip-address { mask | mask-length }
A primary IP address is configured. An interface has only one primary IP address. If the interface already has a primary IP address, the newly configured primary IP address replaces the original one. ----End
1-4 Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. Issue 01 (2011-05-30)
1.2.3 (Optional) Configuring a Secondary IP Address for an Interface

To enable an interface to communicate with several networks with different network IDs, you need to assign a secondary IP address to this interface.
Procedure
Step 1 Run:
system-view


ip address ip-address { mask | mask-length } sub
A secondary IP address is configured. A secondary IP address with a 31-bit mask can be configured for an interface. You can configure a maximum of 255 secondary IP addresses on an interface. ----End
1.2.4 Checking the Configuration

You can view the configuration of the IP address for an interface.
Prerequisite
The configurations of the IP addresses for the interface are complete.
Procedure
l l Run the display ip interface [ brief ] [ interface-type [ interface-number ] ] command to check the IP configuration on the interface. Run the display interface [ interface-type [ interface-number ] ] command to check interface information.
----End
Example
Run the display ip interface command to check that the physical status and link protocol status of the interface are Up.
<HUAWEI> display ip interface brief gigabitethernet 1/1/0 *down: administratively down !down: FIB overload down (l): loopback (s): spoofing Interface IP Address/Mask Physical GigabitEthernet1/1/0 172.16.13.2/24 up up
Protocol
Issue 01 (2011-05-30)
1-5
Run the display interface command to check information about the IP address and subnet mask of the interface.
<HUAWEI> display interface gigabitethernet 1/1/0 GigabitEthernet1/1/0 current state : UP Line protocol current state : UP Last line protocol up time : 2010-06-22, 19:33:19 Description : GigabitEthernet1/1/0 Interface The Maximum Transmit Unit is 1500 bytes Internet Address is 172.16.13.2/24 Internet Address is 172.16.13.150/25 Sub Internet Address is 172.16.13.200/28 Sub IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 00e0-fc08-2b73 Media type is twisted pair, loopback not set, promiscuous mode not set 100Mbps-speed mode, full-duplex mode, link type is autonegotiation Current system time: 2010-06-29 20:26:18 Last 300 seconds input rate 338 bits/sec, 0 packets/sec Last 300 seconds output rate 514 bits/sec, 0 packets/sec Input: 1065 packets, 1571513 bytes 0 broadcasts, 1065 multicasts 0 errors, 0 runts, 0 giants, 0 CRC, 0 collisions, 0 align errors, 0 other errors Output:2866 packets, 2708571 bytes 0 broadcasts, 2866 multicasts 0 errors, 0 underruns, 0 collisions 0 packets had been deferred
1.3 Configuring IP Address Negotiation on Interfaces

If users access the network in the Point-to-Point Protocol (PPP) mode, the server can assign IP addresses to the clients through the address negotiation function of PPP.
Context
NOTE
IP Address Negotiation on Interfaces cannot be configured on the X1 and X2 models of the CX600.
1.3.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring IP address negotiation for an interface. 1.3.2 Configuring a Server to Assign an IP Address for a Client Through Negotiation After being assigned an IP address pool or an IP address, the server can assign IP addresses to the clients. 1.3.3 Configuring a Client to Obtain an IP Address Through Negotiation After interface IP address negotiation is enabled on a client, the client can obtain an IP address from the server. 1.3.4 Checking the Configuration You can view the configuration of interface IP address negotiation.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring IP address negotiation for an interface.
1-6
Issue 01 (2011-05-30)
When devices are connected through the PPP link, the client interface can obtains the IP address from the server through PPP negotiation. This is usually applicable to the situation when the client connects to the Internet Service Provider (ISP) to access the Internet through the PPP link such as dial-up. In this case, the ISP device assigns an IP address to the client through PPP negotiation.
Before configuring IP addresses for interfaces through PPP negotiation, complete the following tasks: l l l Configuring physical parameters of the interface and the link layer protocol PPP on the server Configuring IP addresses for interfaces on the server and making the link layer protocol Up Configuring physical parameters on the interface and the link layer protocol PPP on the client
Data Preparation
To configure IP addresses for interfaces through PPP negotiation, you need the following data. No. 1 2 3 4 Data Number of the interface connecting the server to the client ID of the address pool on the server or IP address assigned to the client Range of IP addresses when an address pool is used Number of the interface connecting the client to the server
1.3.2 Configuring a Server to Assign an IP Address for a Client Through Negotiation

After being assigned an IP address pool or an IP address, the server can assign IP addresses to the clients.
Procedure
Step 1 Run:
system-view
The system view is displayed.

NOTE
If there is only one client, the address pool is unnecessary. In this case, skip Steps 2, 3, and 4, and do not use the keyword pool in Step 6. Instead, directly assign the specified IP address to the client.
Step 2 (Optional) Run:

aaa
The AAA view is displayed. Step 3 (Optional) Run:

ip pool pool-number start-address [ end-address ]
The local IP address pool is configured. Step 4 (Optional) Run:

quit
Quit the AAA view. Step 5 Run:

The interface view is displayed. Obtaining an IP address through negotiation is applied to only the interface encapsulated with PPP. Step 6 Run:
remote address { ip-address | pool [ pool-number ] }
An IP address is assigned to the client. Step 7 Run:

restart
The interface is restarted. ----End
Follow-up Procedure
During preceding configurations, the address pool can also be configured in the domain view. For details, see the HUAWEI CX600 Metro Services Platform Configuration Guide Security. l l If the server authenticates the client, the address is selected from the address pool of the domain that the client belongs to by default. If the server does not authenticate the client and needs to assign an IP address to the client, the address is selected from the system address pool.
The IP address or the address pool assigned to the peer must differ from the IP address of the local device.
1.3.3 Configuring a Client to Obtain an IP Address Through Negotiation

After interface IP address negotiation is enabled on a client, the client can obtain an IP address from the server.
Procedure
Step 1 Run:
system-view
1-8
Issue 01 (2011-05-30)

The interface view is displayed. Obtaining an IP address through negotiation is applied to only the interface encapsulated with PPP. Step 3 Run:
ip address ppp-negotiate
The client is configured to obtain an IP address through negotiation. ----End
Follow-up Procedure
If an interface without an IP address supports PPP while the remote peer is configured with an IP address, enable IP address negotiation on the local interface. This enables the local interface to obtain an IP address that is generated through PPP negotiation and is assigned by the remote peer. When you configure to obtain an IP address through negotiation on the interface, note the following: l You can configure IP address negotiation on only the PPP-encapsulated interface. When the status of the PPP protocol is Down, the IP address generated through negotiation is deleted. After IP address negotiation is configured on the interface, the configuration of IP address for this interface is not needed any more. You can obtain a new IP address through negotiation, and the original IP address configured before the IP address negotiation is deleted. You cannot configure a secondary IP address for the interface configured with IP address negotiation. If you re-configure negotiation on this interface, the IP address generated through the previous negotiation is deleted and a new IP address is obtained. If the address generated through negotiation is deleted, the interface is in the non-address state.
l l l

You can view the configuration of interface IP address negotiation.
Prerequisite
The configurations of IP address negotiation on interfaces are complete.
Procedure
l Run the display ip interface [ brief ] [ interface-type interface-number ] command to check the IP configuration on the interface.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 1-9
Issue 01 (2011-05-30)
Run the display interface [ interface-type [ interface-number ] ] command to check interface information.
----End
Example
Run the display ip interface command to check that the physical status and link protocol status of the interface are Up.
<HUAWEI> display ip interface brief gigabitethernet 1/1/0 *down: administratively down !down: FIB overload down (l): loopback (s): spoofing Interface IP Address/Mask Physical Protocol GigabitEthernet1/1/0 192.168.1.10/24 up up
Run the display interface command to check information about the IP address and subnet mask of the interface.
<HUAWEI> display interface pos 1/0/0 Pos1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2010-06-22 19:33:19 Description : Pos1/0/0 Interface Route Port,The Maximum Transmit Unit is 4470 bytes, Hold timer is 10(sec) Internet Address is 192.168.1.10/24 Link layer protocol is PPP LCP opened, IPCP opened The Vendor PN is FTRJ1321P1BTL Port BW: 2.5G, Transceiver max BW: 2.5G, Transceiver Mode: SingleMode WaveLength: 1310nm, Transmission Distance: 5km Rx Power: -2.81dBm, Tx Power: -1.91dBm Physical layer is Packet Over SDH Scramble enabled, clock master, CRC-32, loopback: none Flag J0 "NetEngine " Flag J1 "NetEngine " Flag C2 22(0x16) Last physical up time : 2010-06-21 14:56:32 Last physical down time : 2010-06-21 14:56:31 Current system time: 2010-06-29 20:26:18 SDH alarm: section layer: none line layer: none path layer: none SDH error: section layer: B1 61575 line layer: B2 12002824 REI 16835916 path layer: B3 65535 Statistics last cleared:never Last 300 seconds input rate 16 bits/sec, 0 packets/sec Last 300 seconds output rate 40 bits/sec, 0 packets/sec Input: 3510 packets, 57372 bytes Input error: 0 shortpacket, 0 longpacket, 4 CRC, 0 lostpacket Output: 7270 packets, 344198 bytes Output error: 0 lostpackets Output error: 0 overrunpackets, 0 underrunpackets
1.4 Configuring IP Address Unnumbered for Interfaces

IP address unnumbered refers to the situation that an interface that is not assigned an IP address obtains an IP address by borrowing an IP address from another interface.
1-10
Issue 01 (2011-05-30)
1.4.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring IP address unnumbered. 1.4.2 Configuring the Primary IP Address of the Interface That Lends an IP Address Only the primary IP address of an interface can be borrowed. 1.4.3 Configuring an Interface That Borrows an IP Address from Another Interface An Ethernet interface cannot borrow the IP address of another interface. 1.4.4 Checking the Configuration You can view the borrowed IP address of an interface.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring IP address unnumbered.
To save IP address resources in some cases, configure the IP address unnumbered on the interface. You can also perform this configuration for an interface that is occasionally used rather than making the interface occupy an IP address constantly. Restrictions on configuring IP address unnumbered on an interface are as follows: l l l l l l The interface of IP address borrower can not be an Ethernet interface. The interface of IP address lender cannot be IP address from other. Multiple interfaces can borrow the IP address from the interface of IP address lender. If the interface of IP address lender has multiple IP addresses, the IP address lender can only be the primary IP address. If the interface of IP address borrower borrows an IP address from the interface with no IP address, the IP address borrower gets the IP adderss 0.0.0.0. The IP address of the virtual loopback interface can be borrowed by other interfaces. The loopback interface, however, cannot borrow the IP address from other interfaces.
Before configuring IP address unnumbered on an interface, complete the following tasks: l l Configuring physical attributes for the IP address borrower and lender Configuring link layer protocols for the IP address borrower and lender
Data Preparation
To configure IP address unnumbered on an interface, you need the following data. No. 1 2 Data Number, IP address, and mask of the interface that lends the IP address to other interfaces Number of the interface that borrows an IP address from another interface
Issue 01 (2011-05-30)
1-11
NOTE
The configuration here only describes how to configure an unnumbered interface to borrow an IP address. Dynamic routing protocols cannot be enabled on an interface without an IP address. Therefore, you need to manually configure a static route to the remote network segment to realize communication between devices.
1.4.2 Configuring the Primary IP Address of the Interface That Lends an IP Address
Only the primary IP address of an interface can be borrowed.
Procedure
Step 1 Run:
system-view


The primary IP address of the interface is configured. An interface can also obtain the primary IP address through PPP negotiation. ----End
1.4.3 Configuring an Interface That Borrows an IP Address from Another Interface

An Ethernet interface cannot borrow the IP address of another interface.
Procedure
Step 1 Run:
system-view


ip address unnumbered interface interface-type interface-number
The interface is configured to borrow an IP address from the specified interface. The ATM interface, tunnel interface, and the interface encapsulated with frame relay, PPP or HDLC can borrow the IP address from an Ethernet interface or other interfaces. ----End

You can view the borrowed IP address of an interface.
Prerequisite
The configurations of IP address unnumbered are complete.
Procedure
l l Run the display ip interface [ brief ] [ interface-type [ interface-number ] ] command to check the IP configuration on the interface. Run the display interface [ interface-type [ interface-number ] ] command to check interface information.
----End
Example
Run the display ip interface command. If the physical status and link protocol status of the interface are Up, it means that the configuration succeeds. Run the display interface command. If information about the IP address and mask of the interface is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display interface pos 6/0/0 Pos6/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2010-06-22 19:33:19 Description: Pos6/0/0 Interface Route Port,The Maximum Transmit Unit is 4470, Hold timer is 10(sec) Internet Address is unnumbered, using address of GigabitEthernet3/0/9(120.1.1.1/ 24) Link layer protocol is PPP LCP opened, IPCP opened The Vendor PN is FTRJ1321P1BTL Port BW: 2.5G, Transceiver max BW: 2.5G, Transceiver Mode: SingleMode WaveLength: 1310nm, Transmission Distance: 5km Rx Power: -7.19dBm, Tx Power: -5.76dBm Physical layer is Packet Over SDH Scramble enabled, clock master, CRC-32, loopback: none Flag J0 "NetEngine " Flag J1 "NetEngine " Flag C2 22(0x16) Last physical up time : 2010-06-21 14:56:32 Last physical down time : 2010-06-21 14:56:31 Current system time: 2010-06-29 20:26:18 SDH alarm: section layer: none line layer: none path layer: none SDH error: section layer: B1 0 line layer: B2 0 REI 1370245 path layer: B3 0 REI 56395 Statistics last cleared:never Last 300 seconds input rate 24 bits/sec, 0 packets/sec Last 300 seconds output rate 24 bits/sec, 0 packets/sec Input: 1420 packets, 23131 bytes Input error: 2 shortpacket, 0 longpacket, 1 CRC, 0 lostpacket Output: 1421 packets, 23150 bytes Output error: 0 lostpackets Output error: 0 overrunpackets, 0 underrunpackets
Issue 01 (2011-05-30)
1-13
1.5 Maintaining IP Addresses

Maintaining an IP address involves monitoring the operation of this IP address. 1.5.1 Monitoring Network Operation Status of IP Addresses This section describes IP address monitoring through the display command.
1.5.1 Monitoring Network Operation Status of IP Addresses

This section describes IP address monitoring through the display command.
Context
In routine maintenance, you can run the following commands in any view to check the operation of IP addresses.
Procedure
l l Run the display ip interface [ brief ] [ interface-type [ interface-number ] ] command in any view to check the IP address configuration on the interface. Run the display interface [ interface-type [ interface-number ] ] command in any view to check information about the interface.
----End
1.6 Configuration Examples

This section includes the networking requirements, precautions for configuration, and configuration roadmap.
Context
NOTE
This document takes interface numbers and link types of the CX600-X8 as an example. In working situations, the actual interface numbers and link types may be different from those used in this document.
1.6.1 Example for Configuring Primary and Secondary IP Addresses This part describes how to configure a primary IP address and a secondary IP address for an interface. 1.6.2 Example for Obtaining an IP Address Through Negotiation This part describes how an interface obtains an IP address through negotiation. 1.6.3 Example for Configuring IP Address Unnumbered This part describes how to configure IP address borrowing for an interface. 1.6.4 Example for Configuring IP Address Overlapping on the Same Device This part describes how to configure IP address overlapping on a device. 1.6.5 Example for Configuring an IP Address with a 31-bit Mask This part describes how to configure an IP address with a 31-bit mask.
1.6.1 Example for Configuring Primary and Secondary IP Addresses

This part describes how to configure a primary IP address and a secondary IP address for an interface.
Networking Requirements
As shown in Figure 1-1, GE 1/0/1 of the device connects to a LAN in which computers belong to one of the two network segments: 172.16.1.0/24 and 172.16.2.0/24. It is required that the device can communicate with the two network segments. At the same time, the hosts of the two network segments cannot communicate with each other. Figure 1-1 Configuring primary and secondary IP addresses for an interface
172.16.1.0/24
CX600
GE1/0/1 172.16.1.1/24 172.16.2.1/24 sub
172.16.2.0/24
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. Analyze the address of the network segment to which the interface connects. Configure the primary IP address for the interface and then configure one or more secondary IP addresses for the interface.
NOTE
The primary IP address and the secondary IP address in the overlapped network segments but not same can be configured on the same interface. The secondary IP addresses of an interface cannot be in the same network segment.
Data Preparation
To complete the configuration, you need the following data: l l Primary IP address and subnet mask of the interface Secondary IP address and subnet mask of the interface
Procedure
Step 1 Configure the device.
# Configure the primary and secondary IP addresses for GE 1/0/1 of the device.
<HUAWEI> system-view [HUAWEI] sysname CX[CX-] interface gigabitethernet 1/0/1 [CX--GigabitEthernet1/0/1] ip address 172.16.1.1 255.255.255.0 [CX--GigabitEthernet1/0/1] ip address 172.16.2.1 255.255.255.0 sub [CX--GigabitEthernet1/0/1] undo shutdown [CX--GigabitEthernet1/0/1] quit
Step 2 Verify the configuration. # Ping the host on the network segment 172.16.1.0 from the device. The ping succeeds.
[CX-] ping 172.16.1.2 PING 172.16.1.2: 56 data bytes, press CTRL_C to break Reply from 172.16.1.2: bytes=56 Sequence=1 ttl=128 time=25 Reply from 172.16.1.2: bytes=56 Sequence=2 ttl=128 time=27 Reply from 172.16.1.2: bytes=56 Sequence=3 ttl=128 time=26 Reply from 172.16.1.2: bytes=56 Sequence=4 ttl=128 time=26 Reply from 172.16.1.2: bytes=56 Sequence=5 ttl=128 time=26 --- 172.16.1.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/26/27 ms
ms ms ms ms ms
# Ping the host on the segment 172.16.2.0 from the device. The ping succeeds.
[CX-] ping 172.16.2.2 PING 172.16.2.2: 56 data bytes, press CTRL_C to break Reply from 172.16.2.2: bytes=56 Sequence=1 ttl=128 time=25 Reply from 172.16.2.2: bytes=56 Sequence=2 ttl=128 time=26 Reply from 172.16.2.2: bytes=56 Sequence=3 ttl=128 time=26 Reply from 172.16.2.2: bytes=56 Sequence=4 ttl=128 time=26 Reply from 172.16.2.2: bytes=56 Sequence=5 ttl=128 time=26 --- 172.16.2.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/25/26 ms
ms ms ms ms ms
# The hosts of the two network segments cannot ping through each other. ----End
Configuration Files
The following lists the configuration file of the CX-:
# sysname CX# interface GigabitEthernet1/0/1 undo shutdown ip address 172.16.1.1 255.255.255.0 ip address 172.16.2.1 255.255.255.0 sub # return
1.6.2 Example for Obtaining an IP Address Through Negotiation

This part describes how an interface obtains an IP address through negotiation.
1-16
Issue 01 (2011-05-30)
NOTE
Obtaining an IP Address Through Negotiation on Interfaces cannot be configured on the X1 and X2 models of the CX600.
As shown in Figure 1-2, CX-A allocates an IP address for POS 1/0/0 on CX-B through PPP negotiation. Figure 1-2 Networking diagram of allocating IP address through negotiation
Ethernet CX-A
POS 1/0/0 192.168.1.1/24 POS 1/0/0 CX-B
Ethernet
The configuration roadmap is as follows: 1. 2. 3. 4. Configure a local IP address pool. Configure an IP address for the local interface. Specify an IP address or address pool for the remote end. Enable obtaining an IP address through negotiation on the remote end.
Data Preparation
To complete the configuration, you need the following data: l l IP address and subnet mask of the local interface The range of the IP address to be allocated to the remote end
Procedure
Step 1 Configure CX-A. # Configure a local IP address pool.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] aaa [CX-A-aaa] ip pool 1 192.168.1.10 192.168.1.20 [CX-A-aaa] quit
# Configure an IP address for POS 1/0/0.

[CX-A] interface pos 1/0/0 [CX-A-Pos1/0/0] ip address 192.168.1.1 255.255.255.0
# Configure POS 1/0/0 to allocate an IP address to the remote end.

[CX-A-Pos1/0/0] remote address pool 1 [CX-A-Pos1/0/0] shutdown [CX-A-Pos1/0/0] undo shutdown
Issue 01 (2011-05-30)
1-17
[CX-A-Pos1/0/0] quit
Step 2 Configure CX-B. # Enable obtaning an IP address of the interface through PPP negotiation.
<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] interface pos 1/0/0 [CX-B-Pos1/0/0] ip address ppp-negotiate [CX-B-Pos1/0/0] undo shutdown [CX-B-Pos1/0/0] quit
Step 3 Verify the configuration. CX-B can ping through POS 1/0/0 on CX-A.
[CX-B] ping 192.168.1.1 PING 192.168.1.1: 56 data bytes, press CTRL_C to break Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=255 time=156 ms Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=255 time=63 ms Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=255 time=62 ms Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=255 time=63 ms Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=255 time=63 ms --- 192.168.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 62/81/156 ms
# View the status of POS 1/0/0 on CX-B.

[CX-B] display interface pos 1/0/0 Pos1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2010-06-22 19:33:19 Description : Pos1/0/0 Interface Route Port,The Maximum Transmit Unit is 4470, Hold timer is 10(sec) Internet Address is negotiated, 192.168.1.10/32 Link layer protocol is PPP LCP opened, IPCP opened The Vendor PN is FTRJ1321P1BTL Port BW: 2.5G, Transceiver max BW: 2.5G, Transceiver Mode: SingleMode WaveLength: 1310nm, Transmission Distance: 5km Rx Power: -2.81dBm, Tx Power: -1.91dBm Physical layer is Packet Over SDH Scramble enabled, clock master, CRC-32, loopback: none Flag J0 "NetEngine " Flag J1 "NetEngine " Flag C2 22(0x16) Last physical up time : 2010-06-21 14:56:32 Last physical down time : 2010-06-21 14:56:31 Current system time: 2010-06-29 20:26:18 SDH alarm: section layer: none line layer: none path layer: none SDH error: section layer: B1 61575 line layer: B2 12002824 REI 16835916 path layer: B3 65535 Statistics last cleared:never Last 300 seconds input rate 16 bits/sec, 0 packets/sec Last 300 seconds output rate 40 bits/sec, 0 packets/sec Input: 3510 packets, 57372 bytes Input error: 0 shortpacket, 0 longpacket, 4 CRC, 0 lostpacket Output: 7270 packets, 344198 bytes Output error: 0 lostpackets Output error: 0 overrunpackets, 0 underrunpackets
1-18
Issue 01 (2011-05-30)
If the information "Internet Address is negotiated, 192.168.1.10/32" is displayed, it means that the address negotiation succeeds. ----End
Configuration Files
l Configuration file of CX-A
# sysname CX-A # aaa ip pool 1 192.168.1.10 192.168.1.20 # interface Pos1/0/0 link-protocol ppp undo shutdown remote address pool 1 ip address 192.168.1.1 255.255.255.0 # return
Configuration file of CX-B

# sysname CX-B # interface Pos1/0/0 link-protocol ppp undo shutdown ip address ppp-negotiate # return
1.6.3 Example for Configuring IP Address Unnumbered

This part describes how to configure IP address borrowing for an interface.
As shown in Figure 1-3, an enterprise builds its intranet through the ISDN. CX-A and CX-B connect to a local LAN through the GE interfaces. The devices connect to each other through the dialing ports. Each device connects to the LAN through GE 1/0/0 and connects to the ISDN through POS 2/0/0. To save IP address resources, the dialing ports are planned to borrow the IP addresses from the GE interfaces. Figure 1-3 Networking diagram of an IP address unnumbered configuration
CX-A Ethernet GE1/0/0 POS 2/0/0 172.16.10.1/24 ISDN
CX-B Ethernet POS 2/0/0 GE1/0/0 172.16.20.1/24
Issue 01 (2011-05-30)
1-19
The configuration roadmap is as follows: 1. 2. Configure IP addresses to be borrowed. Configure the interfaces to borrow IP addresses from other interfaces.
Data Preparation
To complete the configuration, you need the following data: l l IP address of the interface that lends an IP address Number of the interface that lends an IP address
Procedure
Step 1 Configure CX-A. # Configure an IP address for GE 1/0/0.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] interface gigabitethernet 1/0/0 [CX-A-GigabitEthernet1/0/0] ip address 172.16.10.1 255.255.255.0 [CX-A-GigabitEthernet1/0/0] undo shutdown [CX-A-GigabitEthernet1/0/0] quit
# Configure the POS interface to borrow an IP address from the GE interface.

[CX-A] interface pos 2/0/0 [CX-A-Pos2/0/0] ip address unnumbered interface gigabitethernet 1/0/0 [CX-A-Pos2/0/0] link-protocol ppp [CX-A-Pos2/0/0] undo shutdown [CX-A-Pos2/0/0] quit
# Configure an Ethernet route to CX-B.

[CX-A] ip route-static 172.16.20.0 255.255.255.0 pos 2/0/0
Step 2 Configure CX-B. # Configure an IP address for GE 1/0/0.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] interface gigabitethernet 1/0/0 [CX-B-GigabitEthernet1/0/0] ip address 172.16.20.1 255.255.255.0 [CX-B-GigabitEthernet1/0/0] undo shutdown [CX-B-GigabitEthernet1/0/0] quit
# Configure the POS interface to borrow an IP address from the GE interface.

[CX-B] interface pos 2/0/0 [CX-B-Pos2/0/0] ip address unnumbered interface gigabitethernet 1/0/0 [CX-B-Pos2/0/0] link-protocol ppp [CX-B-Pos2/0/0] undo shutdown [CX-B-Pos2/0/0] quit
# Configure an Ethernet route to CX-A.

[CX-B] ip route-static 172.16.10.0 255.255.255.0 pos 2/0/0
Step 3 Verify the configuration. # CX-A can ping through the address of the host connected to CX-B.
[CX-A] ping 172.16.20.2 PING 172.16.20.2: 56 data bytes, press CTRL_C to break Reply from 172.16.20.2: bytes=56 Sequence=1 ttl=254 time=25 Reply from 172.16.20.2: bytes=56 Sequence=2 ttl=254 time=25 Reply from 172.16.20.2: bytes=56 Sequence=3 ttl=254 time=26 Reply from 172.16.20.2: bytes=56 Sequence=4 ttl=254 time=26 Reply from 172.16.20.2: bytes=56 Sequence=5 ttl=254 time=26 --- 172.16.20.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/25/26 ms
ms ms ms ms ms
----End
Configuration Files
# sysname CX-A # interface Pos2/0/0 link-protocol ppp undo shutdown ip address unnumbered interface GigabitEthernet1/0/0 # interface GigabitEthernet1/0/0 undo shutdown ip address 172.16.10.1 255.255.255.0 # ip route-static 172.16.20.0 255.255.255.0 Pos2/0/0 # return

# sysname CX-B # interface Pos2/0/0 link-protocol ppp undo shutdown ip address unnumbered interface GigabitEthernet1/0/0 # interface GigabitEthernet1/0/0 undo shutdown ip address 172.16.20.1 255.255.255.0 # ip route-static 172.16.10.0 255.255.255.0 Pos2/0/0 # return
1.6.4 Example for Configuring IP Address Overlapping on the Same Device

This part describes how to configure IP address overlapping on a device.
As shown in Figure 1-4, Network A and Network B are independent from each other. They access the Internet through different paths. Using the same Layer 2 network provided by ISP 1, Network A and Network B can access each other. It is required to use CX-B to connect Network A and Network B to the Layer 2 network provided by ISP 1 by using the IP addresses 192.168.1.11/24 and 192.168.1.12/24.
Figure 1-4 Networking diagram of configuring IP address overlapping on the same device
GE1/0/0 192.168.1.1/24 CX-A AS:100
Layer2 network r2 GE3/0/0 192.168.1.12/24 POS4/0/0 20.1.1.1/24 POS4/0/0 20.1.1.2/24
r1 GE1/0/0 192.168.1.11/24 POS2/0/0 10.1.1.1/24 POS2/0/0 10.1.1.2/24 CX-B
ISP1 AS:200 CX-C Cx-D
Network A
Network B
Procedure
Step 1 Configure a VPN instance. # On CX-B, create a VPN instance for Network A, and bind the VPN instance to the upstream interface GE 1/0/0 and the downstream interface POS 2/0/0.
<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] ip vpn-instance r1 [CX-B-vpn-instance-r1] ipv4-family [CX-B-vpn-instance-r1-af-ipv4] route-distinguisher 100:1 [CX-B-vpn-instance-r1-af-ipv4] quit [CX-B-vpn-instance-r1] quit [CX-B] interface gigabitethernet 1/0/0 [CX-B-GigabitEthernet1/0/0] ip binding vpn-instance r1 [CX-B-GigabitEthernet1/0/0] ip address 192.168.1.11 24 [CX-B-GigabitEthernet1/0/0] undo shutdown [CX-B-GigabitEthernet1/0/0] quit [CX-B] interface pos 2/0/0 [CX-B-Pos2/0/0] ip binding vpn-instance r1 [CX-B-Pos2/0/0] ip address 10.1.1.1 24 [CX-B-Pos2/0/0] undo shutdown [CX-B-Pos2/0/0] quit
# On CX-B, create a VPN instance for Network B, and bind the VPN instance to the upstream interface GE 3/0/0 and the downstream interface POS 4/0/0.
[CX-B] ip vpn-instance r2 [CX-B-vpn-instance-r2] ipv4-family [CX-B-vpn-instance-r2-af-ipv4] route-distinguisher 100:2 [CX-B-vpn-instance-r2-af-ipv4] quit [CX-B-vpn-instance-r2] quit [CX-B] interface gigabitethernet 3/0/0 [CX-B-GigabitEthernet3/0/0] ip binding vpn-instance r2 [CX-B-GigabitEthernet3/0/0] ip address 192.168.1.12 24 [CX-B-GigabitEthernet3/0/0] undo shutdown
1-22
Issue 01 (2011-05-30)

[CX-B-GigabitEthernet3/0/0] quit [CX-B] interface pos 4/0/0 [CX-B-Pos4/0/0] ip binding vpn-instance r2 [CX-B-Pos4/0/0] ip address 20.1.1.1 24 [CX-B-Pos4/0/0] undo shutdown [CX-B-Pos4/0/0] quit
# On CX-B, configure static routes for the two VPN instances.

[CX-B] ip route-static vpn-instance r1 0.0.0.0 0 192.168.1.1 [CX-B] ip route-static vpn-instance r2 0.0.0.0 0 192.168.1.1
Step 2 Set up the EBGP neighbor relationship between CX-A and the two upstream interfaces on CXB respectively. # Configure CX-B.
[CX-B] bgp 200 [CX-B-bgp] router-id 100.1.1.1 [CX-B-bgp] ipv4-family vpn-instance r1 [CX-B-bgp-r1] peer 192.168.1.1 as-number 100 [CX-B-bgp-r1] import-route direct [CX-B-bgp-r1] quit [CX-B-bgp] ipv4-family vpn-instance r2 [CX-B-bgp-r2] peer 192.168.1.1 as-number 100 [CX-B-bgp-r2] import-route direct [CX-B-bgp-r2] quit [CX-B-bgp] quit
# Configure CX-A.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] interface gigabitethernet 1/0/0 [CX-A-GigabitEthernet1/0/0] ip address 192.168.1.1 24 [CX-A-GigabitEthernet1/0/0] undo shutdown [CX-A-GigabitEthernet1/0/0] quit [CX-A] bgp 100 [CX-A-bgp] peer 192.168.1.11 as-number 200 [CX-A-bgp] peer 192.168.1.12 as-number 200 [CX-A-bgp] quit
Step 3 Configure IP addresses and static routes for CX-C and CX-D on the local network. # Configure the IP address and static route for CX-C.
<HUAWEI> system-view [HUAWEI] sysname CX-C [CX-C] interface pos 2/0/0 [CX-C-Pos2/0/0] ip address 10.1.1.2 24 [CX-C-Pos2/0/0] undo shutdown [CX-C-Pos2/0/0] quit [CX-C] ip route-static 0.0.0.0 0 10.1.1.1
# Configure the IP address and static route for CX-D.

<HUAWEI> system-view [HUAWEI] sysname CX-D [CX-D] interface pos 4/0/0 [CX-D-Pos4/0/0] ip address 20.1.1.2 24 [CX-D-Pos4/0/0] undo shutdown [CX-D-Pos4/0/0] quit [CX-D] ip route-static 0.0.0.0 0 20.1.1.1
Step 4 Verify the configuration. # After the configurations, view the private routing table on CX-B. The routes of the two local networks connected to CX-B belong to two VPN instances (r1 and r2) respectively. This indicates that the routes are isolated.
[CX-B] display ip routing-table vpn-instance r1 Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: r1 Destinations : 6 Routes : 6 Destination/Mask 0.0.0.0/0 10.1.1.0/24 10.1.1.1/32 10.1.1.2/32 192.168.1.0/24 192.168.1.11/32 Proto Static Direct Direct Direct Direct Direct Pre 60 0 0 0 0 0 Cost 0 0 0 0 0 0 Flags RD D D D D D NextHop 192.168.1.1 10.1.1.1 127.0.0.1 10.1.1.2 192.168.1.11 127.0.0.1 Interface GigabitEthernet1/0/0 Pos2/0/0 InLoopBack0 Pos2/0/0 GigabitEthernet1/0/0 InLoopBack0
[CX-B] display ip routing-table vpn-instance r2 Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: r2 Destinations : 6 Routes : 6 Destination/Mask 0.0.0.0/0 20.1.1.0/24 20.1.1.1/32 20.1.1.2/32 192.168.1.0/24 192.168.1.12/32 Proto Static Direct Direct Direct Direct Direct Pre 60 0 0 0 0 0 Cost 0 0 0 0 0 0 Flags RD D D D D D NextHop 192.168.1.1 20.1.1.1 127.0.0.1 20.1.1.2 192.168.1.12 127.0.0.1 Interface GigabitEthernet3/0/0 Pos4/0/0 InLoopBack0 Pos4/0/0 GigabitEthernet3/0/0 InLoopBack0
# Run the display ip routing-table command on CX-A. The command output shows that the public routing table on CX-A contains routes to the two local networks.
[CX-A] display ip routing-table Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: Public Destinations : 8 Routes : 8 Destination/Mask Proto Pre 255 255 255 255 0 0 0 0 0 0 0 0 Cost 0 0 0 0 D D D D Flags D D D D NextHop 192.168.1.11 192.168.1.11 192.168.1.12 192.168.1.12 127.0.0.1 127.0.0.1 192.168.1.1 127.0.0.1 InLoopBack0 InLoopBack0 GigabitEthernet1/0/0 InLoopBack0 Interface
10.1.1.0/24 EBGP GigabitEthernet1/0/0 10.1.1.2/32 EBGP GigabitEthernet1/0/0 20.1.1.0/24 EBGP GigabitEthernet1/0/0 20.1.1.2/32 EBGP GigabitEthernet1/0/0 127.0.0.0/8 Direct 127.0.0.1/32 Direct 192.168.1.0/24 Direct 192.168.1.1/32 Direct
Network A and Network B can ping through each other. ----End
Configuration Files
# sysname CX-A # interface GigabitEthernet1/0/0 undo shutdown ip address 192.168.1.1 255.255.255.0
1-24
Issue 01 (2011-05-30)

# bgp 100 peer 192.168.1.11 as-number 200 peer 192.168.1.12 as-number 200 # ipv4-family unicast undo synchronization peer 192.168.1.11 enable peer 192.168.1.12 enable # return
Configuration file of CX-B.

# sysname CX-B # ip vpn-instance r1 ipv4-family route-distinguisher 100:1 # ip vpn-instance r2 ipv4-family route-distinguisher 100:2 # interface GigabitEthernet1/0/0 undo shutdown ip binding vpn-instance r1 ip address 192.168.1.11 255.255.255.0 # interface GigabitEthernet3/0/0 undo shutdown ip binding vpn-instance r2 ip address 192.168.1.12 255.255.255.0 # interface Pos2/0/0 link-protocol ppp undo shutdown ip binding vpn-instance r1 ip address 10.1.1.1 255.255.255.0 # interface Pos4/0/0 link-protocol ppp undo shutdown ip binding vpn-instance r2 ip address 20.1.1.1 255.255.255.0 # bgp 200 router-id 100.1.1.1 # ipv4-family unicast undo synchronization # ipv4-family vpn-instance r1 peer 192.168.1.1 as-number 100 import-route direct # ipv4-family vpn-instance r2 peer 192.168.1.1 as-number 100 import-route direct # ip route-static vpn-instance r1 0.0.0.0 0.0.0.0 192.168.1.1 ip route-static vpn-instance r2 0.0.0.0 0.0.0.0 192.168.1.1 # return
Configuration file of CX-C

# sysname CX-C # interface pos 2/0/0
Issue 01 (2011-05-30)
1-25
link-protocol ppp undo shutdown ip address 10.1.1.2 255.255.255.0 # ip route-static 0.0.0.0 0.0.0.0 10.1.1.1 # return
Configuration file of CX-D

# sysname CX-D # interface pos 4/0/0 link-protocol ppp undo shutdown ip address 20.1.1.2 255.255.255.0 # ip route-static 0.0.0.0 0.0.0.0 20.1.1.1 # Return
1.6.5 Example for Configuring an IP Address with a 31-bit Mask

This part describes how to configure an IP address with a 31-bit mask.
As shown in Figure 1-5, CX-A and CX-B are connected through a PPP link. Figure 1-5 Networking diagram of configuring an IP address with a 31-bit mask
POS1/0/0 10.1.1.1/31
POS1/0/0 10.1.1.0/31
CX-A
CX-B
The configuration roadmap is as follows: 1. 2. Configure an IP address with a 31-bit mask for POS 1/0/0 on CX-A. Configure an IP address with a 31-bit mask for POS 1/0/0 on CX-B.
Data Preparation
To complete the configuration, you need the following data: l l IP address and mask of POS 1/0/0 on CX-A IP address and mask of POS 1/0/0 on CX-B
Procedure
Step 1 Configure an IP address for each interface. # Configure an IP address for POS 1/0/0 on CX-A.

<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] interface pos 1/0/0 [CX-A-Pos1/0/0] ip address 10.1.1.1 255.255.255.254 [CX-A-Pos1/0/0] undo shutdown [CX-A-Pos1/0/0] quit
# Configure an IP address for POS 1/0/0 on CX-B.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] interface pos 1/0/0 [CX-B-Pos1/0/0] ip address 10.1.1.0 255.255.255.254 [CX-B-Pos1/0/0] undo shutdown [CX-B-Pos1/0/0] quit
Step 2 Verify the configuration. # After the preceding configurations, you can check the routing table on CX-A. You can find that in the routing table, the network address and the broadcast address of the network segment are both used as host addresses.
[CX-A] display ip routing-table Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: Public Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.1.0/31 Direct 0 0 D 10.1.1.1 Pos1/0/0 10.1.1.0/32 Direct 0 0 D 10.1.1.0 Pos1/0/0 10.1.1.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
# After the preceding configurations, you can check the routing table on CX-B. You can find that in the routing table, the network address and the broadcast address of the network segment are both used as host addresses.
[CX-B] display ip routing-table Route Flags: R - relay, D - download to fib -----------------------------------------------------------------------------Routing Tables: Public Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.1.0/31 Direct 0 0 D 10.1.1.0 Pos1/0/0 10.1.1.0/32 Direct 0 0 D 127.0.0.1 InLoopBack0 10.1.1.1/32 Direct 0 0 D 10.1.1.1 Pos1/0/0 127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
----End
Configuration Files
# sysname CX-A # interface Pos1/0/0 link-protocol ppp undo shutdown ip address 10.1.1.1 255.255.255.254 # return

#
Issue 01 (2011-05-30)
1-27
sysname CX-B # interface Pos1/0/0 link-protocol ppp undo shutdown ip address 10.1.1.0 255.255.255.254 # return
1-28
Issue 01 (2011-05-30)
2 ARP Configuration
2
About This Chapter
ARP Configuration
ARP can map an IP address to a MAC address and implements transmission of Ethernet frames. 2.1 Introduction to ARP ARP, acronym for Address Resolution Protocol, is at the link layer of the TCP/IP protocol suite. 2.2 Configuring Static ARP Static ARP indicates that there is a fixed mapping between an IP address and a MAC address. Static ARP needs to be configured by an administrator. 2.3 Optimizing Dynamic ARP If dynamic ARP is configured, the system automatically resolutes an IP address into an Ethernet MAC address. 2.4 Configuring Routed Proxy ARP Proxy ARP enables devices whose IP addresses belong to the same network segment but different physical networks to communicate with each other. 2.5 Configuring Proxy ARP Within a VLAN By configuring proxy ARP on a VLAN, you can interconnect isolated hosts on a VLAN. 2.6 Configuring Proxy ARP Between VLANs By configuring inter-VLAN proxy ARP, you can interconnect hosts on different VLANs. 2.7 Configuring ARP-Ping IP ARP-Ping IP is a method of detecting whether an IP address is used by another device on a local area network (LAN) by sending ARP packets. 2.8 Configuring ARP-Ping MAC ARP-Ping MAC is a method of detecting whether a MAC address is used by another device on a LAN by sending ICMP packets. 2.9 Configuring the Association Between ARP and Interface Status By configuring ARP and interface status association, you can determine whether the peer device can forward packets normally by checking whether the device receives a response to the ARP detection packet sent to the peer device. In this manner, you can determine the protocol status (up or down) of the device and triggers fast route convergence.
2 ARP Configuration
2.10 Maintaining ARP The operations of ARP maintenance include clearing ARP statistics and monitoring ARP operating status. 2.11 Configuration Examples This section includes the networking requirements, precautions for configuration, and configuration roadmap.
2-2
Issue 01 (2011-05-30)
2 ARP Configuration
2.1 Introduction to ARP

ARP, acronym for Address Resolution Protocol, is at the link layer of the TCP/IP protocol suite. 2.1.1 Overview of ARP An Ethernet device must support ARP. ARP implements dynamic mapping between Layer 3 IP addresses and Layer 2 MAC addresses. 2.1.2 Features of ARP Supported by the CX600 ARP can operate in either of two modes: static and dynamic. The extensions of ARP include proxy ARP, gratuitous ARP, association between ARP and interface status, and ARP-Ping.
2.1.1 Overview of ARP

An Ethernet device must support ARP. ARP implements dynamic mapping between Layer 3 IP addresses and Layer 2 MAC addresses. Each host or device on the Local Area Network (LAN) can be configured a 32-bit IP address to communicate with others. The assigned IP address is independent of the hardware address. On the Ethernet, a host or a device transmits and receives Ethernet frames according to a 48-bit Medium Access Control (MAC) address. The MAC address is also called the physical address or the hardware address, which is assigned to an Ethernet interface when equipment is produced. Therefore, on an interconnected network, an address resolution mechanism is required to provide the mapping between MAC addresses and IP addresses. The Address Resolution Protocol (ARP) maps an IP address to the corresponding MAC address.
2.1.2 Features of ARP Supported by the CX600

ARP can operate in either of two modes: static and dynamic. The extensions of ARP include proxy ARP, gratuitous ARP, association between ARP and interface status, and ARP-Ping. ARP is only used in the IPv4 environment and can only run on Ethernet links.
Introduction to ARP-Ping
ARP-Ping consists of ARP-Ping IP and ARP-Ping MAC. ARP-Ping is developed to maintain the deployed Layer 2 features.
Introduction to ARP-Ping IP
ARP-Ping IP uses ARP packets to check whether an IP address is used by another device on the LAN. Before configuring an IP address for a device, you need to check that this IP address is not used by another device on the network by sending the ARP packets. Then, you can take appropriate actions. You can also run the ping command to check whether the IP address is used by another device on the network. If enabled with the firewall function that does not reply to Ping packets, the destination host and device do not reply to Ping packets and think that the IP address is not in use. ARP is a Layer 2 protocol. In most cases, ARP packets can pass through the firewall. In this way, the preceding situation does not occur.
2 ARP Configuration
Principles of ARP-Ping IP
ARP-Ping IP sends ARP Request packets. The following describes how to implement ARP-Ping IP: 1. 2. 3. After setting the specified IP address through command lines, you can send ARP Request packets and start the timeout timer. After receiving an ARP Request packet, each device or host on the LAN replies with an ARP Reply packet. After receiving the ARP Reply packet, the source device compares the source IP address contained in the Reply packet with the IP address input in the command line. If they are consistent, the MAC address corresponding to the input IP address is displayed and the timeout timer of ARP Reply packets is disabled. The operation finishes. If the timeout timer of ARP Reply packets times out, it means that the IP address is not in use. As shown in Figure 2-1, CX-A and Gigabitethernet A are directly connected. You can run the arp-ping ip command on CX-A to check whether the IP address 10.1.1.2 is in use. Figure 2-1 Implementation procedure of ARP-Ping IP
Host B Host A 10.1.1.3/32 10.1.1.2/32 GE1/0/0 10.1.1.1/24 CX-A
Ethernet A
Run the arp-ping ip 10.1.1.2 command on CX-A. After receiving the ARP Reply packet from Host A 10.1.1.2 on the network, CX-A displays the MAC address of Host A.CX-A displays the MAC address of Node B. Through the command output, you can know whether the IP address is used by another host on the network.
NOTE
The arp-ping ip command is applicable to the outgoing interface in one of the following types: the Gigabit Ethernet interface, and Eth-Trunk interface, VLANIF interface, member interface of the VLANIF interface, Ethernet interface, (including the Layer 2 interfaces into which these interfaces are switched).
Introduction to ARP-Ping MAC

ARP-Ping MAC uses ICMP packets to check whether a MAC address is used by another device on the LAN. When you know a specific MAC address on a network segment but do not know the corresponding IP address, you can obtain the IP address corresponding to the MAC address by
2 ARP Configuration
sending the broadcast Internet Control Messages Protocol (ICMP) packets through ARP-Ping MAC. In this way, you can query the IP address corresponding to the specific MAC address on the network segment.
Principles of ARP-Ping MAC

ARP-Ping MAC sends broadcast ICMP Echo Request packets. The following describes how to implement ARP-Ping MAC: 1. 2. 3. After setting the specified MAC address through the command line, you can send broadcast ICMP Echo Request packets and start the timeout timer. After receiving an ICMP Echo Request packet, each device or host on the LAN replies with an ICMP Echo Reply packet. After receiving the ICMP Echo Reply packet, the source device compares the source MAC address contained in the Echo Reply packet with the MAC address input in the command line. If they are consistent, the IP address of the Echo Reply packet is displayed. Then the source device prompts you that the MAC address is in use and disables the timeout timer. The operation finishes. If the timeout timer of the ICMP Echo Reply packets times out, it means that the MAC address is not in use.
NOTE
If the system denies the request for replying with the network segment address, the sender cannot receive the ICMP Echo Reply packet.
As shown in Figure 2-2, CX-A and Gigabitethernet A are directly connected. You can run the arp-ping mac command on CX-A to check whether the MAC address 0013-46E7-2EF5 is in use. Figure 2-2 Implementation procedure of ARP-Ping MAC
Host A 0013-46E7-2EF5 GE1/0/0 10.1.1.0/24 CX-A
Ethernet A
The following describes how to implement ARP-Ping MAC on CX-A: Run the arp-ping mac 0013-46E7-2EF5 10.1.1.0 or arp-ping mac 0013-46E7-2EF5 gigabitethernet 1/0/0 command on CX-A. After receiving the ICMP Reply packets replied by all the hosts on the network, CX-A displays the IP address of the host with the MAC address 0013-46E7-2EF5. Through the command output, you can obtain the IP address corresponding to the MAC address.
2 ARP Configuration
NOTE
The arp-ping mac command is applicable to the outgoing interface in one of the following types: Gigabit Ethernet interface, VLANIF interface, the Ethernet interface, and Eth-Trunk interface.
2.2 Configuring Static ARP

Static ARP indicates that there is a fixed mapping between an IP address and a MAC address. Static ARP needs to be configured by an administrator. 2.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring static ARP. 2.2.2 Configuring Common Static ARP Entries Static ARP entries are required for the communication between common interfaces. 2.2.3 Configuring Static ARP Entries in a VLAN In the scenario where two users belong to the same VLAN but user isolation is configured in the VLAN, to implement communications between the two users, you need to enable static ARP within the VLAN on the member interface of the VLAN. 2.2.4 Configuring Static ARP Entries in a VPN Instance To implement Layer 2 interworking of the devices in a VPN instance, you can configure static ARP in the VPN instance. 2.2.5 Checking the Configuration You can view the configuration of static ARP.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring static ARP.
Static ARP is used in the following situations: l For the packets whose destination IP address is on another network segment, static ARP can help these packets traverse a gateway of the local network segment so that the gateway can forward the packets to their destination. When you need to filter out some packets with illegitimate destination IP addresses, static ARP can bind these illegitimate addresses to a nonexistent MAC address.
Before configuring ARP, complete the following tasks: l l l
2-6
Configuring physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring link layer protocol parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up Configuring the network layer protocol for the interface
2 ARP Configuration
Data Preparation
To configure ARP, you need the following data. No. 1 2 Data IP address and MAC address of the static ARP entry VPN instance name and VLAN ID to which the static ARP entry belongs
2.2.2 Configuring Common Static ARP Entries

Static ARP entries are required for the communication between common interfaces.
Context
If static ARP and the Virtual Router Redundancy Protocol (VRRP) are enabled on a device simultaneously, the virtual IP address of the VRRP backup group configured on the Dot1q termination sub-interface, QinQ termination sub-interface, or VLANIF interface cannot be the IP address contained in the static ARP entries; otherwise, incorrect host routes are generated and thus packets cannot be normally forwarded.
NOTE
To configure static ARP for the packets with double tags, run the arp static cevid command. For details, see the HUAWEI CX600 Metro Services Platform Command Reference - LAN Access and MAN Access.
Procedure
Step 1 Run:
system-view

arp static ip-address mac-address
Configure common static ARP entries.

NOTE
Static ARP entries keep valid when a device works normally.
----End
2.2.3 Configuring Static ARP Entries in a VLAN

In the scenario where two users belong to the same VLAN but user isolation is configured in the VLAN, to implement communications between the two users, you need to enable static ARP within the VLAN on the member interface of the VLAN.
Context
If static ARP and the Virtual Router Redundancy Protocol (VRRP) are enabled on a device simultaneously, the virtual IP address of the VRRP backup group configured on the Dot1q
2 ARP Configuration
termination sub-interface, QinQ termination sub-interface, or VLANIF interface cannot be the IP address contained in the static ARP entries; otherwise, incorrect host routes are generated and thus packets cannot be normally forwarded.
NOTE
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 Configure static ARP entries in a Virtual Local Area Network (VLAN). To configure static ARP entries in a VLAN, do as follows: l Run the arp static ip-address mac-address vid vlan-id interface interface-type interfacenumber command. It is required to set parameters vid vlan-id and interface interface-type interface-number when you configure static ARP entries in the VLAN. If the interface corresponding to the VLAN is bound to a Virtual Private Network (VPN), the device can automatically associate the configured static ARP entry with the VPN. This command is applicable to port-based VLANs. l Run the arp static ip-address mac-address [ vpn-instance vpn-instance-name ] vid vlanid command. This command is applicable to the sub-interface that supports VLAN and can be bound to the VPN.
NOTE
----End
2.2.4 Configuring Static ARP Entries in a VPN Instance

To implement Layer 2 interworking of the devices in a VPN instance, you can configure static ARP in the VPN instance.
Context
If static ARP and the Virtual Router Redundancy Protocol (VRRP) are enabled on a device simultaneously, the virtual IP address of the VRRP backup group configured on the Dot1q termination sub-interface, QinQ termination sub-interface, or VLANIF interface cannot be the IP address contained in the static ARP entries; otherwise, incorrect host routes are generated and thus packets cannot be normally forwarded.
NOTE
2-8
Issue 01 (2011-05-30)
2 ARP Configuration
Procedure
Step 1 Run:
system-view

arp static ip-address mac-address vpn-instance vpn-instance-name
Configure static ARP entries in a VPN instance.

NOTE
----End

You can view the configuration of static ARP.
Prerequisite
The configurations of the ARP function are complete.
Procedure
l Run the display arp slot slot-id [ network net-number [ net-mask | mask-length ] ] [ dynamic | static ] command to check information about ARP mapping tables based on slots. Run the display arp vlan vlan-id interface interface-type interface-number command to check information about ARP mapping tables based on VLANs. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] command to check information about ARP mapping tables based on VPN instances. Run the display arp statistics { all | slot slot-id } command to check the statistics for ARP entries.
l l l
----End
Example
Run the display arp slot command. If all the ARP entries of the interface board are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.12 0000-0a41-0202 S-GE1/0/1 r2 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/1 r2 192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:4 Dynamic:2 Static:1 Interface:1
Run the display arp vlancommand. If all the ARP mapping table of a specified VLAN are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp vlan 10 interface gigabitethernet 1/0/1
Issue 01 (2011-05-30)
2-9
2 ARP Configuration
IP ADDRESS MAC ADDRESS
EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------1.1.1.3 0002-0002-0002 S-GE1/0/1 10/-----------------------------------------------------------------------------Total:1 Dynamic:0 Static:1 Interface:0
Run the display arp vpn-instance command. If all the ARP entries of the VPN instance are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp vpn-instance r1 slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 12 S-GE1/0/0 r1 -----------------------------------------------------------------------------Total:2 Dynamic:0 Static:1 Interface:1
Run the display arp statistics { all | slot slot-id } command. If the statistics for ARP entries are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp statistics all Dynamic:20 Static:10
2.3 Optimizing Dynamic ARP

If dynamic ARP is configured, the system automatically resolutes an IP address into an Ethernet MAC address. 2.3.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for optimizing dynamic ARP. 2.3.2 Modify the aging parameters of dynamic ARP If the device needs to update ARP entries frequently, you can reduce the aging timeout period of ARP entries, increase the number of aging detections for ARP entries, and reduce the aging detection intervals of ARP entries. 2.3.3 Enabling ARP Suppression Function If the system receives a great number of ARP packets from the same source at a time, the system needs to update ARP entries repeatedly. To ensure the performance of the system, you can enable ARP suppression. In this manner, the system only responds to the ARP packets but does not update ARP entries. 2.3.4 Enabling Layer 2 Topology Detection Function After Layer 2 topology detection is enabled, the system updates all the ARP entries corresponding to the VLANs to which a Layer 2 interface belongs, if this Layer 2 interface goes Up. 2.3.5 Enabling ARP Check ARP check can be enabled to ensure network security. In this case, when an interface receives an ARP packet, it checks whether the source MAC address and destination MAC address in the Ethernet packet header are the same as those in the Data field of the ARP packet. 2.3.6 Checking the Configuration You can view the configuration of dynamic ARP.
2 ARP Configuration

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for optimizing dynamic ARP.
Dynamic ARP is one of functions owned by a device or host. You do not need to run a command to enable dynamic ARP but you can modify some parameters of dynamic ARP.
None
Data Preparation
Optimizing dynamic ARP, you need the following data. No. 1 2 3 Data ID of the Ethernet interface or the virtual Ethernet interface to which the dynamic ARP entry belongs Aging detection times of the dynamic ARP entry Aging time of the dynamic ARP entry
2.3.2 Modify the aging parameters of dynamic ARP

If the device needs to update ARP entries frequently, you can reduce the aging timeout period of ARP entries, increase the number of aging detections for ARP entries, and reduce the aging detection intervals of ARP entries.
Procedure
Step 1 Run:
system-view

interface interface-type interface-number [ .subinterface-number ]
The Ethernet interface view or the virtual Ethernet sub-interface view is displayed. Step 3 Run:
arp detect-times detect-times
The number of aging detection times of the dynamic ARP entries is configured. Step 4 Run:
arp expire-time expire-times
The timeout period for aging dynamic ARP entries is configured.

2 ARP Configuration
By default, the aging detection times of the dynamic ARP entries is three, and the aging timeout period is 1200 seconds. ----End
2.3.3 Enabling ARP Suppression Function

If the system receives a great number of ARP packets from the same source at a time, the system needs to update ARP entries repeatedly. To ensure the performance of the system, you can enable ARP suppression. In this manner, the system only responds to the ARP packets but does not update ARP entries.
Procedure
Step 1 Run:
system-view

arp-suppress enable
ARP suppression is enabled on the current device. The ARP suppression function can be enabled only on the Eth-Trunk interface, and VLANIF interface. The ARP suppression function can be enabled only on the Eth-Trunk interface, and VLANIF interface. By default, ARP suppression is disabled and only VLANIF interfaces are suppressed. ----End
2.3.4 Enabling Layer 2 Topology Detection Function

After Layer 2 topology detection is enabled, the system updates all the ARP entries corresponding to the VLANs to which a Layer 2 interface belongs, if this Layer 2 interface goes Up.
Procedure
Step 1 Run:
system-view

l2-topology detect enable
The Layer 2 topology detection function is enabled. By default, this function is not enabled. ----End
2 ARP Configuration
2.3.5 Enabling ARP Check

ARP check can be enabled to ensure network security. In this case, when an interface receives an ARP packet, it checks whether the source MAC address and destination MAC address in the Ethernet packet header are the same as those in the Data field of the ARP packet.
Context
On the metro Ethernet, there are various ARP attacks. To protect the network, you need to configure ARP security features at the access layer or convergence layer of the network to protect against ARP attacks. If there are ARP spoofing attacks on the network, you can run the arp validate command to enable an interface to check the received ARP packet to determine whether the source MAC address and destination MAC address in the Ethernet packet header are respectively the same as those in the Data field of the ARP packet. If they are not the same, the ARP packet is discarded. If they are the same, the ARP packet is forwarded.
NOTE
l ARP check cannot be configured on sub-interfaces. When a sub-interface receives an ARP packet, the main interface where the sub-interface is configured checks the ARP packet to determine whether the destination MAC address in the Ethernet packet header is the same as that in the Data field of the ARP packet. If they are the same, the sub-interface forwards the ARP packet. If they are not the same, the sub-interface discards the ARP packet. l ARP check cannot be configured on VLANIF interfaces. When a VLANIF interface receives an ARP packet, the physical interface that belongs to the VLAN for which the VLANIF interface is configured checks the ARP packet to determine whether the destination MAC address in the Ethernet packet header is the same as that in the Data field of the ARP packet. If they are the same, the VLANIF interface forwards the ARP packet. If they are not the same, the VLANIF interface discards the ARP packet.
Do as follows on the devices on which ARP check needs to be enabled.
Procedure
Step 1 Run:
system-view

interface { ethernet | gigabitethernet | eth-trunk } interface-number
The view of the Ethernet interface where ARP check needs to be enabled is displayed. Step 3 Run:
arp validate { source-mac | destination-mac }
*
ARP check is enabled. l If source-mac is specified: After receiving an ARP Request packet, an interface only checks whether the source MAC address in the Ethernet packet header is consistent with that in the Data field of the ARP packet. After receiving an ARP Response packet, an interface only checks whether the source MAC address in the Ethernet packet header is consistent with that in the Data field of the ARP packet.
2 ARP Configuration
l If destination-mac is specified: After receiving an ARP Request packet, an interface does not check whether the destination MAC address in the Ethernet packet header is consistent with that in the Data field of the ARP packet because ARP packets are broadcast packets. After receiving an ARP Response packet, an interface only checks whether the destination MAC address in the Ethernet packet header is consistent with that in the Data field of the ARP packet. l If both source-mac and destination-mac are specified: After receiving an ARP Request packet, an interface only checks whether the source MAC address in the Ethernet packet header is consistent with that in the Data field of the ARP packet. After receiving an ARP Response packet, an interface checks whether both the source MAC address and destination MAC address in the Ethernet packet header are respectively the same as those in the Data field of the ARP packet. ----End

You can view the configuration of dynamic ARP.
Prerequisite
The configurations of the ARP function are complete.
Procedure
l l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check information about ARP mapping tables based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask | mask-length ] ] [ dynamic | static ] command to check information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] command to check information about ARP mapping tables based on VPN instances. Run the display arp statistics { all | slot slot-id } command to check the statistics for ARP entries.
l l
----End
Example
Run the display arp interface command. If all the ARP entries of the interface are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display arp interface gigabitethernet 1/0/0 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 15 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:2 Dynamic:1 Static:0 Interface:1

<HUAWEI> display arp slot 1 IP ADDRESS MAC ADDRESS
2 ARP Configuration
EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.12 0000-0a41-0202 I GE1/0/1 r2 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/1 r2 192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:4 Dynamic:2 Static:0 Interface:2
<HUAWEI> display arp vpn-instance r1 slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 12 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:2 Dynamic:1 Static:0 Interface:1
Run the display arp statistics { all | slot slot-id } command. If the statistics for ARP entries are displayed, it means that the configuration succeeds. For example:
2.4 Configuring Routed Proxy ARP

Proxy ARP enables devices whose IP addresses belong to the same network segment but different physical networks to communicate with each other. 2.4.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring routed proxy ARP. 2.4.2 Configure an IP Addresses for the Interface The IP address assigned to a routed proxy ARP-enabled interface must be on the same network segment with the IP address of the host on the LAN to which this interface connects. 2.4.3 Enabling the Routed Proxy ARP Function To interconnect the subnets in the same IP network, you need to enable routed proxy ARP. 2.4.4 Checking the Configuration You can view the configuration of routed proxy ARP.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring routed proxy ARP.
The two physical networks of an enterprise are in different subnets of the same IP network, and are separated by a device. You need to enable the proxy ARP on the device interface connected to the physical networks. This enables communication between the two networks.
2 ARP Configuration
Network IDs of subnet hosts must be the same. You need not configure default gateways for hosts.
Before configuring routed proxy ARP, complete the following tasks: l l Configuring the physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up
Data Preparation
To configure routed proxy ARP, you need the following data. No. 1 2 Data Number of the interface to be enabled with routed proxy ARP IP address of the interface to be enabled with routed proxy ARP
2.4.2 Configure an IP Addresses for the Interface

The IP address assigned to a routed proxy ARP-enabled interface must be on the same network segment with the IP address of the host on the LAN to which this interface connects.
Procedure
Step 1 Run:
system-view

interface interface-type interface-number [ .subinterface-number ]
The interface view is displayed. The interfaces supporting routed proxy ARP include GE interfaces, GE sub-interfaces, VirtualEthernet sub-interfaces,Eth-Trunk interfaces, and Eth-Trunk sub-interfaces. Step 3 Run:
The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the LAN connected with this interface. ----End
2.4.3 Enabling the Routed Proxy ARP Function

To interconnect the subnets in the same IP network, you need to enable routed proxy ARP.
2 ARP Configuration
Procedure
Step 1 Run:
system-view


arp-proxy enable
By default, the routed proxy ARP function is disabled on the interface. After routed proxy ARP is enabled, you must reduce the aging time of ARP entries in the deviece so that the number of packets received but cannot be forwarded by the device is decreased. To configure the aging time of ARP entries. ----End

You can view the configuration of routed proxy ARP.
Prerequisite
The configurations of the routed proxy ARP function are complete.
Procedure
l l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check information about ARP mapping tables based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask | mask-length ] ] [ dynamic | static ] command to check information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] command to check information about ARP mapping tables based on VPN instances. Run the display arp statistics { all | slot slot-id } command to check statistics about ARP entries.
l l
----End
Example
Issue 01 (2011-05-30)
2-17
2 ARP Configuration
<HUAWEI> display arp slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.12 0000-0a41-0202 I GE1/0/1 r2 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/1 r2 192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:4 Dynamic:2 Static:0 Interface:2
<HUAWEI> display arp vpn-instance r1 slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------\192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 12 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:2 Dynamic:1 Static:0 Interface:1
Run the display arp statistics { all | slot slot-id } command. If statistics about ARP entries are displayed, it means that the configuration succeeds. For example:
2.5 Configuring Proxy ARP Within a VLAN

By configuring proxy ARP on a VLAN, you can interconnect isolated hosts on a VLAN. 2.5.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring proxy ARP on a VLAN. 2.5.2 Configure an IP Addresses for the Interface The IP address assigned to an interface needs to be in the same network segment with the IP addresses of the users of the VLANs associated to this interface. 2.5.3 Configuring the VLAN Associated with the Sub-interface Do as follows on the CX device that uses sub-interfaces to implement interworking in a VLAN. 2.5.4 Enabling Proxy ARP Within a VLAN To interconnect isolated users on a VLAN, you need to enable intra-VLAN proxy ARP on the interface associated to the VLAN. 2.5.5 Checking the Configuration You can view the configuration of intra-VLAN proxy ARP.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring proxy ARP on a VLAN.
2-18
Issue 01 (2011-05-30)
2 ARP Configuration
If two users are in the same VLAN but they are isolated from each other, to ensure the two users can communicate, you need to enable proxy ARP within the VLAN on the interface associated with the VLAN.
Before configuring proxy ARP within a VLAN, complete the following tasks: l l l Configuring physical attributes for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the VLAN Configuring user isolation in the VLAN
Data Preparation
To configure proxy ARP within a VLAN, you need the following data. No. 1 2 3 Data Number of the interface to be enabled with proxy ARP in a VLAN IP address of the interface to be enabled with proxy ARP in a VLAN VLAN ID associated with the interface to be enabled with proxy ARP in a VLAN
2.5.2 Configure an IP Addresses for the Interface

The IP address assigned to an interface needs to be in the same network segment with the IP addresses of the users of the VLANs associated to this interface.
Procedure
Step 1 Run:
system-view

interface { ethernet | gigabitethernet | eth-trunk } interface-number.subinterface-number
Or
interface vlanif vlan-id
The interface view is displayed. The interfaces supporting routed proxy ARP in a VLAN include VLANIF interfaces, Ethernet sub-interfaces, GE sub-interfaces, and Eth-Trunk sub-interfaces. Step 3 Run:
Issue 01 (2011-05-30)
2-19
2 ARP Configuration
The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the VLAN associated with this interface. ----End
2.5.3 Configuring the VLAN Associated with the Sub-interface

Do as follows on the CX device that uses sub-interfaces to implement interworking in a VLAN.
Context
NOTE
This step is required when you enable proxy ARP in a VLAN on the Ethernet sub-interfaces, GE subinterfaces, or Eth-Trunk sub-interfaces.To enable proxy ARP in a VLAN on the VLANIF interface, skip this step.
Procedure
Step 1 Run:
system-view

The sub-interface view is displayed. Step 3 Run:

vlan-type dot1q low-vid
The Ethernet sub-interface is encapsulated with 802.1Q and the VLAN ID associated with the sub-interface is configured. In the CX600, one sub-interface can be associated with one VLAN. By default, the sub-interface is not encapsulated and the associated VLAN ID is not configured. ----End
2.5.4 Enabling Proxy ARP Within a VLAN

To interconnect isolated users on a VLAN, you need to enable intra-VLAN proxy ARP on the interface associated to the VLAN.
Procedure
Step 1 Run:
system-view

2-20
Issue 01 (2011-05-30)
2 ARP Configuration
Or

arp-proxy inner-sub-vlan-proxy enable
Proxy ARP within a VLAN is enabled. ----End

You can view the configuration of intra-VLAN proxy ARP.
Prerequisite
The configurations of the proxy ARP within a VLAN function are complete.
Procedure
l l
----End
Example
<HUAWEI> display arp slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.12 0000-0a41-0202 I GE1/0/1 r2 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/1 r2 192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/0 r1
Issue 01 (2011-05-30)
2-21
2 ARP Configuration
-----------------------------------------------------------------------------Total:4 Dynamic:2 Static:0 Interface:2
2.6 Configuring Proxy ARP Between VLANs

By configuring inter-VLAN proxy ARP, you can interconnect hosts on different VLANs. 2.6.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring inter-VLAN proxy ARP. 2.6.2 Configuring an IP Addresses for the Interface The IP address assigned to an interface needs to be in the same network segment with the IP addresses of the users of all the VLANs associated to this interface. 2.6.3 Configuring the VLAN Associated with the Sub-interface Do as follows on the device that uses sub-interfaces to implement interworking between VLANs. 2.6.4 Enabling Proxy ARP Between VLANs To interconnect users on different VLANs, you need to enable inter-VLAN proxy ARP on the sub-interfaces associated to the VLANs. 2.6.5 Checking the Configuration You can view the configuration of inter-VLAN proxy ARP.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring inter-VLAN proxy ARP.
If two users belong to different VLANs and they need to communicate, you need to enable proxy ARP between VLANs on the sub-interface associated with the VLAN. Sub-VLANs in a super-VLAN cannot communicate with each other. To solve this problem, enable proxy ARP between VLANs on the VLANIF interface corresponding to the superVLAN. Implementing communication between VLANs through proxy ARP occupies fewer resources than through than through configuring a VLANIF interface for each sub-VLAN.
2 ARP Configuration
IP addresses of hosts in a VLAN must be in the same network segment.
Before configuring proxy ARP between VLANs, complete the following tasks: l l Configuring physical attributes for the interface and ensuring that the status of the physical layer of the interface is Up Configuring VLAN aggregation
Data Preparation
To configure proxy ARP between VLANs, you need the following data. No. 1 2 3 Data Number of the interface to be enabled with proxy ARP between VLANs IP address of the interface to be enabled with proxy ARP between VLANs VLAN ID associated with the interface to be enabled with proxy ARP between VLANs
2.6.2 Configuring an IP Addresses for the Interface

The IP address assigned to an interface needs to be in the same network segment with the IP addresses of the users of all the VLANs associated to this interface.
Procedure
Step 1 Run:
system-view

interface { ethernet | gigabitethernet } interface-number.sub-interface-number
Or
The interface view is displayed. The interfaces supporting routed proxy ARP between VLANs include VLANIF interfaces, Ethernet sub-interfaces, GE sub-interfaces, and Eth-Trunk sub-interfaces. Step 3 Run:
The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the VLAN associated with this interface. ----End
2 ARP Configuration
2.6.3 Configuring the VLAN Associated with the Sub-interface

Do as follows on the device that uses sub-interfaces to implement interworking between VLANs.
Context
NOTE
This step is required when you enable proxy ARP between VLANs on the Ethernet sub-interfaces, GE subinterfaces, or Eth-Trunk sub-interfaces. To enable proxy ARP between VLANs on the VLANIF interface, skip this step.
Procedure
Step 1 Run:
system-view

The sub-interface view is displayed. Step 3 Run:

vlan-type dot1q low-vid
The Ethernet sub-interface is encapsulated with 802.1Q and the VLAN ID associated with the sub-interface is configured. In the CX600, one sub-interface can be associated with one VLAN. By default, the sub-interface is not encapsulated and the associated VLAN ID is not configured. ----End
2.6.4 Enabling Proxy ARP Between VLANs

To interconnect users on different VLANs, you need to enable inter-VLAN proxy ARP on the sub-interfaces associated to the VLANs.
Procedure
Step 1 Run:
system-view

interface { ethernet | gigabitethernet } interface-number.sub-interface-number
Or
The interface view is displayed.

2 ARP Configuration
The interfaces supporting routed proxy ARP between VLANs include Eth-Trunk sub-interfaces, VLANIF interfaces, Ethernet sub-interfaces,and GE sub-interfaces. Step 3 Run:
arp-proxy inter-sub-vlan-proxy enable
Proxy ARP between VLANs is enabled. ----End

You can view the configuration of inter-VLAN proxy ARP.
Prerequisite
The configurations of Proxy ARP Between VLANs are complete.
Procedure
l l
----End
Example
<HUAWEI> display arp slot 1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC -----------------------------------------------------------------------------192.168.1.12 0000-0a41-0202 I GE1/0/1 r2 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/1 r2 192.168.1.11 0000-0a41-0201 I GE1/0/0 r1 192.168.1.1 0000-0a41-0200 17 D-6 GE1/0/0 r1 -----------------------------------------------------------------------------Total:4 Dynamic:2 Static:0 Interface:2
Issue 01 (2011-05-30)
2-25
2 ARP Configuration
2.7 Configuring ARP-Ping IP

ARP-Ping IP is a method of detecting whether an IP address is used by another device on a local area network (LAN) by sending ARP packets. 2.7.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring ARP-Ping IP. 2.7.2 Detecting the IP Address by Using the arp-ping ip Command ARP-Ping IP detects whether an IP address is used by a device on a LAN by sending ARP requests.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring ARP-Ping IP.
In the LAN, to configure an IP address for a device, you need to use the arp-ping ip command to check whether this IP address is used by another device in the network. The arp-ping ip command is mainly used in the maintenance of the deployed Lay 2 features. For example, in the L2VPN networking, such as the virtual private LAN segment (VPLS) and virtual private wire service (VPWS) that the Ethernet or VLAN is used to access, you can run the arp-ping ip command on the PE or CE to check whether the IP address is used by the local or remote host. You can also run the ping command to check whether the IP address is used by another device on the network. If enabled with the firewall function that does not reply to Ping packets, the destination host and device do not reply to Ping packets and think that the IP address is not in use. ARP is a Layer 2 protocol. In most cases, ARP packets can pass through the firewall. In this way, the preceding situation does not occur.
Before configuring ARP-Ping IP, complete the following tasks:
2 ARP Configuration
Configuring parameters of the link layer protocol and IP addresses for the interfaces and ensuring that the status of the link layer protocol on the interfaces is Up.
Data Preparation
To configure ARP-Ping IP, you need the following data. No. 1 Data IP address to be checked
2.7.2 Detecting the IP Address by Using the arp-ping ip Command

ARP-Ping IP detects whether an IP address is used by a device on a LAN by sending ARP requests.
Procedure
Step 1 Run:
arp-ping ip ip-address [ interface interface-type interface-number [ vlan-id vlanid ] ]
Check whether the IP address is in use.

NOTE
When the specified outgoing interface is a Layer 2 interface, you need to configure vlan-id vlan-id; when the specified outgoing interface is a Layer 3 interface, you cannot configure vlan-id vlan-id.
The following information is displayed: l If the following information is displayed, it means that the IP address is not in use.
[HUAWEI] arp-ping ip 110.1.1.2 ARP-Pinging 110.1.1.2: Request timed out Request timed out Request timed out The IP address is not used by anyone!
l If the following information is displayed, it means that the IP address is in use.

[HUAWEI] arp-ping ip 128.1.1.1 ARP-Pinging 128.1.1.1: 128.1.1.1 is used by 00e0-517d-f202
----End
2.8 Configuring ARP-Ping MAC

ARP-Ping MAC is a method of detecting whether a MAC address is used by another device on a LAN by sending ICMP packets. 2.8.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring ARP-Ping MAC. 2.8.2 Detecting the MAC Address by Using the arp-ping mac Command
2 ARP Configuration
ARP-Ping MAC detects whether an IP address is used by a device on a LAN by sending ICMP packets.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring ARP-Ping MAC.
To check whether a MAC address is in use or query the IP address through the MAC address, you can use the arp-ping mac command.
Before configuring ARP-Ping MAC, complete the following tasks: l Configuring parameters of the link layer protocol and IP addresses for the interfaces and ensuring that the status of the link layer protocol on the interfaces is Up.
Data Preparation
To configure ARP-Ping MAC, you need the following data. No. 1 Data MAC address to be checked
2.8.2 Detecting the MAC Address by Using the arp-ping mac Command
ARP-Ping MAC detects whether an IP address is used by a device on a LAN by sending ICMP packets.
Procedure
Step 1 Run:
arp-ping mac mac-address { ip-address [ vpn-instance vpn-instance-name ] | interface interface-type interface-number }
Check whether the MAC address is in use. Alternatively, you can query the IP address through the MAC address. The following information is displayed: l If the following information is displayed, it means that the MAC address is not in use.
[HUAWEI] arp-ping mac 00e0-517d-f201 interface gigabitethernet 1/0/0 OutInterface: GigabitEthernet1/0/0 MAC[00-E0-51-7D-F2-01], press CTRL_C to break Request timed out Request timed out Request timed out ----- ARP-Ping MAC statistics ----3 packet(s) transmitted
2-28
Issue 01 (2011-05-30)

0 packet(s) received MAC[00-E0-51-7D-F2-01]
2 ARP Configuration
not be used
l If the following information is displayed, it means that the MAC address is in use.
[HUAWEI] arp-ping mac 00e0-517d-f202 interface gigabitethernet 1/0/0 OutInterface: GigabitEthernet1/0/0 MAC[00-E0-51-7D-F2-02], press CTRL_C to break ----- ARP-Ping MAC statistics ----1 packet(s) transmitted 1 packet(s) received IP ADDRESS MAC ADDRESS 128.1.1.1 00-E0-51-7D-F2-02
----End
2.9 Configuring the Association Between ARP and Interface Status

By configuring ARP and interface status association, you can determine whether the peer device can forward packets normally by checking whether the device receives a response to the ARP detection packet sent to the peer device. In this manner, you can determine the protocol status (up or down) of the device and triggers fast route convergence. 2.9.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring ARP and interface status association. 2.9.2 Configuring the Association Between ARP and Interface Status Through ARP and interface status association, you can detect link status. Do as follows on the CX device to perform probes. 2.9.3 (Optional) Adjusting Parameters about the Association Between ARP and Interface Status The parameters include the intervals at which ARP detection packets are transmitted, maximum number of times that the device sends ARP detection packets but receives no response before the ARP protocol status is set to Down, and detection mode. Do as follows on the CX device to perform probes.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring ARP and interface status association.
If transmission devices exist over a link (between devices in the diagram), the actual physical path is segmented by the transmission devices although communication ends and transmission devices are directly connected at the network layer. In such a case, if the link or remote end fails, the local end must take a long time to detect the fault. To solve the preceding problem, configure the association between the Bidirectional Forwarding Detection (BFD) status and the interface status. For details, refer to the chapter "BFD Configuration" in the HUAWEI CX600 Metro Services Platform Configuration Guide Reliability. For the device that does not support the BFD function, the CX600 provides the ARP and interface status association function so that local interfaces can correctly judge the forwarding status of
2 ARP Configuration
the remote end and change its protocol status accordingly (Up or Down). Fast convergence of routes is thus triggered. Figure 2-3 Schematic diagram of transmission device existing between devices
CX-A
CX-B
Pre-configuration Task
Before configuring the association between ARP and interface status, complete the following tasks: l l Configuring physical parameters for interfaces to make the physical statuses of interfaces Up. Configuring link layer parameters and IP addresses for interfaces to make the link protocol status of interfaces Up.
Data Preparation
To configure the association between ARP and interface status, you need the following data. No. 1 2 3 4 Data Destination IP address of an ARP probe packet Interval for sending ARP probe packets Maximum times that no response is received for the continually sent ARP probe packets before the protocol status of an interface turns Down Probe mode
2.9.2 Configuring the Association Between ARP and Interface Status

Through ARP and interface status association, you can detect link status. Do as follows on the CX device to perform probes.
Procedure
Step 1 Run:
system-view

2-30
Issue 01 (2011-05-30)
2 ARP Configuration
The view of the interface to be enabled with the association between ARP and interface status is displayed.
NOTE
The association between ARP and interface status can be configured only on Ethernet interfaces, Ethernet sub-interfaces, Gigabit Ethernet interfaces, and Gigabit Ethernet sub-interfaces.
Step 3 Run:
arp status-detect ip-address
The association between ARP and interface status and the destination IP address of the probe are configured. The probed IP address must be the IP address of the directly-connected device. The device to be probed need not be configured. ----End
2.9.3 (Optional) Adjusting Parameters about the Association Between ARP and Interface Status
The parameters include the intervals at which ARP detection packets are transmitted, maximum number of times that the device sends ARP detection packets but receives no response before the ARP protocol status is set to Down, and detection mode. Do as follows on the CX device to perform probes.
Procedure
Step 1 Run:
system-view

The view of the interface to be enabled with the association between ARP and interface status is displayed. Step 3 Run:
arp status-detect interval detect-interval
The interval for sending ARP probe packets is set. By default, the interval is 1000 ms. Step 4 Run:
arp status-detect times detect-times
The maximum times that no response is received for the continually sent ARP probe packets before the protocol status of an interface turns Down are set. By default, the maximum times are 3. Step 5 Run:
arp status-detect mode loose
The probe mode is set to loose. By default, the probe mode is strict.
2 ARP Configuration
l In loose mode, probe packets are sent only when the protocol status turns Up. The remote end declares the protocol to be Up when receiving any types of legal ARP packets. l In strict mode, probe packets are sent no matter the protocol status is Up or Down. The device declares the protocol to be Up only when receiving legal ARP response packets.
NOTE
When you configure ARP probe on both ends, configure the strict mode at least on one end. That is, two ends cannot be configured with the loose mode concurrently. .This is because when the interface on one end is Down, the protocol status of the remote end turns Down because of a timeout probe. If the probe mode is set to loose, both ends never send probe packets actively, which results in the deadlock state.
----End
Follow-up Procedure
The device to be probed need not be configured.
2.10 Maintaining ARP

The operations of ARP maintenance include clearing ARP statistics and monitoring ARP operating status. 2.10.1 Clearing ARP Entries This section describes ARP entries clearance through the reset command. 2.10.2 Monitoring Network Operation Status of ARP This section describes ARP operation monitoring through the display command.
2.10.1 Clearing ARP Entries

This section describes ARP entries clearance through the reset command.
Context
CAUTION
l The mapping between the IP and MAC addresses is deleted after you clear ARP entries. So, confirm the action before you use the command. l The static ARP entries cannot restore after you clear it. So, confirm the action before you use the command.
Procedure
Step 1 Run the reset arp { all | dynamic | interface interface-type interface-number | slot slot-id | static } command in the user view to clear the ARP entries in the ARP mapping table. ----End
2.10.2 Monitoring Network Operation Status of ARP

This section describes ARP operation monitoring through the display command.
2 ARP Configuration
Context
In routine maintenance, you can run the following command in any view to check the operation of ARP.
Procedure
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command in any view to check the information about the ARP mapping table based on interfaces. Run the display arp slot slot-id [ network net-number [ net-mask ] ] [ dynamic | static ] command in any view to check the information about ARP mapping tables based on slots. Run the display arp vpn-instance vpn-instance-name slot slot-id [ dynamic | static ] command in any view to check the information about ARP mapping tables based on VPN instances.
l l
----End

Context
NOTE
2.11.1 Example for Configuring Routed Proxy ARP This section provides an example of configuring routed proxy ARP. 2.11.2 Example for Configuring Proxy ARP Within a VLAN This section provides an example of configuring intra-VLAN proxy ARP. 2.11.3 Example for Configuring Proxy ARP Between VLANs This section provides an example of configuring inter-VLAN proxy ARP. 2.11.4 Example for Configuring the Association Between ARP and Interface Status This section provides an example of configuring ARP and interface status association. 2.11.5 Example for Configuring Layer 2 Topology Detection This section provides an example of configuring Layer 2 topology detection.
2.11.1 Example for Configuring Routed Proxy ARP

This section provides an example of configuring routed proxy ARP.
As shown in Figure 2-4, two devices are connected through serial lines. Each device has a GE 1/0/0 interface connecting with a local network. The network segment of the two local networks is 172.16.0.0/16. No default gateways are specified for Host A and Host B. The device should be configured with proxy ARP, enabling hosts in two local networks to communicate with each other.
2 ARP Configuration
Figure 2-4 Networking diagram of configuring proxy ARP
Host A 172.16.1.2/16 0000-5e33-ee20 GE1/0/0 172.16.1.1/24 CX-A 00e0-fc39-80aa POS2/0/0 172.17.3.1/24 Ethernet A
Host B 172.16.2.2/16 0000-5e33-ee10 GE1/0/0 CX-B 172.16.2.1/24 00e0-fc39-80bb POS2/0/0 172.17.3.2/24 Ethernet B
The configuration roadmap is as follows: 1. 2. 3. Configure IP addresses for interfaces. Enable proxy ARP on interfaces. Configure the default routes.
Data Preparation
To complete the configuration, you need the following data: l l l IP address for related interfaces Default routes IP address of the host
Procedure
Step 1 Configure CX-A. # Configure an IP address for GE 1/0/0.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] interface gigabitethernet 1/0/0 [CX-A-GigabitEthernet1/0/0] ip address 172.16.1.1 255.255.255.0
# Enable proxy ARP.

[CX-A-GigabitEthernet1/0/0] arp-proxy enable [CX-A-GigabitEthernet1/0/0] undo shutdown [CX-A-GigabitEthernet1/0/0] quit
# Configure a static route.

[CX-A] ip route-static 0.0.0.0 0 pos 2/0/0 172.17.3.2

[CX-A] interface pos 2/0/0 [CX-A-Pos2/0/0] ip address 172.17.3.1 255.255.0.0 [CX-A-Pos2/0/0] undo shutdown
2-34
Issue 01 (2011-05-30)

[CX-A-Pos2/0/0] quit
2 ARP Configuration
Step 2 Configure CX-B. # Configure an IP address for GE 1/0/0.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] interface gigabitethernet 1/0/0 [CX-B-GigabitEthernet1/0/0] ip address 172.16.2.1 255.255.255.0
# Enable proxy ARP.

[CX-B-GigabitEthernet1/0/0] arp-proxy enable [CX-B-GigabitEthernet1/0/0] undo shutdown [CX-B-GigabitEthernet1/0/0] quit

[CX-B] ip route-static 0.0.0.0 0 pos 2/0/0 172.17.3.1

[CX-B] interface pos 2/0/0 [CX-B-Pos2/0/0] ip address 172.17.3.2 255.255.0.0 [CX-B-Pos2/0/0] undo shutdown [CX-B-Pos2/0/0] quit
Step 3 Configure the host. # Configure the IP address of Host A to 172.16.1.2/16. # Configure the IP address of Host B to 172.16.2.2/16. Step 4 Verify the configuration. # Host A can ping through Host B. # The ARP table of Host A shows that the MAC address of Host B is the MAC address of GE1/0/0 on CX-A.
C:\Documents and Settings\Administrator> arp -a Interface: 172.16.1.2 --- 0x2 Internet Address Physical Address Type 172.16.2.2 00e0-fc39-80aa dynamic
----End
Configuration Files
# sysname CX-A # interface GigabitEthernet1/0/0 undo shutdown ip address 172.16.1.1 255.255.255.0 arp-proxy enable # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 172.17.3.1 255.255.255.0 # ip route-static 0.0.0.0 0 Pos2/0/0 172.17.3.2 # return
Issue 01 (2011-05-30)
2-35
2 ARP Configuration

# sysname CX-B # interface GigabitEthernet1/0/0 undo shutdown ip address 172.16.2.1 255.255.255.0 arp-proxy enable # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 172.17.3.2 255.255.255.0 # ip route-static 0.0.0.0 0 Pos2/0/0 172.17.3.1 # return
2.11.2 Example for Configuring Proxy ARP Within a VLAN

This section provides an example of configuring intra-VLAN proxy ARP.
As shown in Figure 2-5, DSLAM is connected to the sub-interface Eth-Trunk1.1 of the device. Eth-Trunk1.1 is associated with VLAN 10. PC A and PC B are two users connected with DSLAM. On DSLAM, the interfaces connected with PC A and PC B belong to the same VLAN. User isolation in a VLAN is configured on DSLAM. To implement communication between PC A and PC B, enable proxy ARP within a VLAN on Eth-Trunk1.1 of the device. Figure 2-5 Networking diagram of configuring proxy ARP in a VLAN
CX device Eth-trunk 1.1(Proxy ARP) 10.10.10.1/24
DSLAM
PC A
PC B VLAN 10
2-36
Issue 01 (2011-05-30)
2 ARP Configuration
The configuration roadmap is as follows: 1. 2. 3. Configure an IP addresses for Eth-Trunk1.1. Configure the VLAN associated with the sub-interface. Enable proxy ARP in a VLAN on Eth-Trunk1.1.
Data Preparation
To complete the configuration, you need the following data: l l IP address of Eth-Trunk1.1 VLAN ID associated with Eth-Trunk1.1
Procedure
Step 1 Configure an IP address for Eth-Trunk1.1.
<HUAWEI> system-view [HUAWEI] sysname CX[CX device] interface eth-trunk 1 [CX device-Eth-Trunk] undo shutdown [CX device-Eth-Trunk] quit [CX device] interface eth-trunk 1.1 [CX device-Eth-Trunk1.1] ip address 10.10.10.1 255.255.255.0 [CX device-Eth-Trunk1.1] undo shutdown [CX device-Eth-Trunk1.1] quit
Step 2 Configure IP addresses for PCs. # Configure IP addresses for PCs. The IP addresses must be in the same network segment with the IP address of Eth-Trunk1.1. # After the configurations, PCs and the device can ping through each other but PCs cannot ping through each other. Step 3 Associate Eth-Trunk1.1 with VLAN 10.
[CX device] interface eth-trunk 1.1 [CX device-Eth-Trunk1.1] vlan-type dot1q 10
Step 4 Enable proxy ARP in VLAN 10 on Eth-Trunk1.1.

[CX device-Eth-Trunk1.1] arp-proxy inner-sub-vlan-proxy enable [CX device-Eth-Trunk1.1] quit
Step 5 Verify the configuration. # PC A and PC B can ping through each other. ----End
Configuration Files
The configuration file of the CX- is as follows:
# sysname CX# interface Eth-Trunk1 undo shutdown mac-address 00e0-271e-f652
Issue 01 (2011-05-30)
2-37
2 ARP Configuration
# interface Eth-Trunk1.1 undo shutdown vlan-type dot1q 10 ip address 10.10.10.1 255.255.255.0 arp-proxy inner-sub-vlan-proxy enable # return
2.11.3 Example for Configuring Proxy ARP Between VLANs

This section provides an example of configuring inter-VLAN proxy ARP.
As shown in Figure 2-6, VLAN 2 and VLAN 3 compose a super-VLAN, VLAN 4. The sub-VLANs (VLAN 2 and VLAN 3) cannot ping through each other. To implement communication between VLAN 2 and VLAN 3, configure proxy ARP between VLANs. Figure 2-6 Networking diagram of configuring proxy ARP between VLANs
CX-A
VLAN2
VLAN3
VLAN4
VLAN2
VLAN3
The configuration roadmap is as follows: 1. 2. Configure an IP addresses for VLANIF4. Enable proxy ARP between VLANs on VLANIF4.
Data Preparation
To complete the configuration, you need IP addresses of interfaces.
2 ARP Configuration
Procedure
Step 1 Configure an IP address for the VLANIF interface.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] interface vlanif 4 [CX-A-Vlanif4] ip address 10.10.10.1 255.255.255.0 [CX-A-Vlanif4] undo shutdown [CX-A-Vlanif4] quit
Step 2 Configure IP addresses for PCs. # Configure IP addresses for PCs. The IP addresses must be in the same network segment with the IP address of VLANIF4. # After configurations, PCs and the device can ping through each other but PCs in VLAN 2 and PCs in VLAN 3 cannot ping through each other. Step 3 Configure proxy ARP between VLANs.
[CX-A] interface vlanif 4 [CX-A-Vlanif4] arp-proxy inter-sub-vlan-proxy enable [CX-A-Vlanif4] quit
Step 4 Verify the configuration. l PCs in VLAN 2 and PCs in VLAN 3 can ping through each other. l Check the ARP table on the PC. # You can find that in the ARP tables of PCs in VLAN 2, the MAC addresses of all PCs in VLAN 3 are the MAC address of VLANIF4 on the device. ----End
Configuration Files
The configuration file of CX-A is as follows:
# sysname CX-A # vlan batch 2 to 4 # vlan 4 aggregate-vlan access-vlan 2 to 3 # interface Vlanif4 undo shutdown ip address 10.10.10.1 255.255.255.0 arp-proxy inter-sub-vlan-proxy enable # Return
2.11.4 Example for Configuring the Association Between ARP and Interface Status
This section provides an example of configuring ARP and interface status association.
As shown in Figure 2-7, two devices are connected through a Layer 2 switch. If a fault occurs on the GE interface of CX-A but the GE interface of CX-B is Up because the link between the
2 ARP Configuration
switch and CX-B works normally. The protocol status of the GE interface of CX-B is also Up. It is required to configure the association between ARP and interface status on CX-B to probe the status of the GE interface of CX-A. CX-B can then rapidly change its protocol status according to the interface status change of CX-A. Figure 2-7 Networking diagram of configuring the association between ARP and interface status
GE 1/0/0 10.1.1.1/24 CX-A Switch
GE 1/0/0 10.1.1.2/24 CX-B
The configuration roadmap is as follows: 1. 2. 3. Configure an IP address for each interface. Enable the association between ARP and interface status on the interface. Adjust parameters about the association between ARP and interface status to optimize performance.
Data Preparation
To complete the configuration, you need the following data: l l l l IP addresses of the interfaces Destination IP address of an ARP probe packet Interval for sending ARP probe packets Maximum times that no response is received for the continually sent ARP probe packets before the protocol of an interface turns Down
Procedure
Step 1 Configuring an IP address for each interface # Configure CX-A.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] interface gigabitethernet 1/0/0 [CX-A-GigabitEthernet1/0/0] ip address 10.1.1.1 255.255.255.0 [CX-A-GigabitEthernet1/0/0] undo shutdown [CX-A-GigabitEthernet1/0/0] quit
# Configure CX-B.
<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] interface gigabitethernet 1/0/0 [CX-B-GigabitEthernet1/0/0] ip address 10.1.1.2 255.255.255.0 [CX-B-GigabitEthernet1/0/0] undo shutdown [CX-B-GigabitEthernet1/0/0] quit
2-40
Issue 01 (2011-05-30)
2 ARP Configuration
# Ping CX-A on CX-B. The ping succeeds. Run the display interface command on CX-A and CX-B to view statuses of the GE interfaces. You can find that the physical status and protocol status of the GE interfaces are Up.
[CX-B] ping 10.1.1.1 PING 10.1.1.1: 56 data bytes, press CTRL_C to break Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=255 time=110 ms Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=255 time=60 ms Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=255 time=100 ms Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=255 time=70 ms Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=255 time=70 ms --- 10.1.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 60/82/110 ms [CX-A] display interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2010-06-22, 16:52:54 Description : GigabitEthernet1/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1500 bytes Internet Address is 10.1.1.1/24 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0000-5e13-0101 The Vendor PN is SCP6F86-GL-CWH Port BW: 1G, Transceiver max BW: 1G, Transceiver Mode: MultiMode WaveLength: 850nm, Transmission Distance: 300m Rx Power: -8.00dBm, Tx Power: -5.13dBm Loopback:none, full-duplex mode, negotiation: disable, Pause Flowcontrol:Receive Enable and Send Enable Last physical up time : 2010-06-22, 16:52:54 Last physical down time : 2010-06-22, 16:52:53 Current system time: 2010-06-22 16:53:18 Statistics last cleared:never Last 300 seconds input rate: 208 bits/sec, 0 packets/sec Last 300 seconds output rate: 544 bits/sec, 1 packets/sec Input: 882114 bytes, 10877 packets Output: 2147780 bytes, 31585 packets Input: Unicast: 0 packets, Multicast: 7368 packets Broadcast: 3509 packets, JumboOctets: 0 packets CRC: 0 packets, Symbol: 0 packets Overrun: 0 packets InRangeLength: 0 packets LongPacket: 0 packets, Jabber: 0 packets, Alignment: 0 packets Fragment: 0 packets, Undersized Frame: 0 packets RxPause: 0 packets Output: Unicast: 0 packets, Multicast: 0 packets Broadcast: 31585 packets, JumboOctets: 0 packets Lost: 0 packets, Overflow: 0 packets, Underrun: 0 packets TxPause: 0 packets [CX-B] display interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2010-06-22 14:56:32 Description : GigabitEthernet1/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1500 bytes Internet Address is 10.1.1.2/24 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0000-5e13-0100 The Vendor PN is SCP6F86-GL-CWH Port BW: 1G, Transceiver max BW: 1G, Transceiver Mode: MultiMode WaveLength: 850nm, Transmission Distance: 300m Rx Power: -8.00dBm, Tx Power: -5.13dBm Loopback:none, full-duplex mode, negotiation: disable, Pause Flowcontrol:Receive Enable and Send Enable Last physical up time : 2010-06-22 14:56:32 Last physical down time : 2010-06-22 14:56:31 Current system time: 2010-06-22 16:53:19
Issue 01 (2011-05-30)
2-41
2 ARP Configuration
Statistics last cleared:never Last 300 seconds input rate: 208 bits/sec, 0 packets/sec Last 300 seconds output rate: 544 bits/sec, 1 packets/sec Input: 882114 bytes, 10877 packets Output: 2147780 bytes, 31585 packets Input: Unicast: 0 packets, Multicast: 7368 packets Broadcast: 3509 packets, JumboOctets: 0 packets CRC: 0 packets, Symbol: 0 packets Overrun: 0 packets InRangeLength: 0 packets LongPacket: 0 packets, Jabber: 0 packets, Alignment: 0 packets Fragment: 0 packets, Undersized Frame: 0 packets RxPause: 0 packets Output: Unicast: 0 packets, Multicast: 0 packets Broadcast: 31585 packets, JumboOctets: 0 packets Lost: 0 packets, Overflow: 0 packets, Underrun: 0 packets
Step 2 Run the shutdown command on the GE interface of CX-A to simulate a fault.
[CX-A] interface gigabitethernet 1/0/0 [CX-A-GigabitEthernet1/0/0] shutdown [CX-A-GigabitEthernet1/0/0] quit
# Run the display interface command on CX-B to view the status of the GE interfaces. You can find that the physical status and protocol status of the GE interfaces are Up. CX-B, however, cannot ping through CX-A.
[CX-B] display interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2010-06-22 14:56:32 Description : GigabitEthernet1/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1500 bytes Internet Address is 10.1.1.2/24 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0000-5e13-0100 The Vendor PN is SCP6F86-GL-CWH Port BW: 1G, Transceiver max BW: 1G, Transceiver Mode: MultiMode WaveLength: 850nm, Transmission Distance: 300m Rx Power: -8.00dBm, Tx Power: -5.13dBm Loopback:none, full-duplex mode, negotiation: disable, Pause Flowcontrol:Receive Enable and Send Enable Last physical up time : 2010-06-22 14:56:32 Last physical down time : 2010-06-22 14:56:31 Current system time: 2010-06-22 16:53:19 Statistics last cleared:never Last 300 seconds input rate: 208 bits/sec, 0 packets/sec Last 300 seconds output rate: 544 bits/sec, 1 packets/sec Input: 882114 bytes, 10877 packets Output: 2147780 bytes, 31585 packets Input: Unicast: 0 packets, Multicast: 7368 packets Broadcast: 3509 packets, JumboOctets: 0 packets CRC: 0 packets, Symbol: 0 packets Overrun: 0 packets InRangeLength: 0 packets LongPacket: 0 packets, Jabber: 0 packets, Alignment: 0 packets Fragment: 0 packets, Undersized Frame: 0 packets RxPause: 0 packets Output: Unicast: 0 packets, Multicast: 0 packets Broadcast: 31585 packets, JumboOctets: 0 packets Lost: 0 packets, Overflow: 0 packets, Underrun: 0 packets [CX-B] ping 10.1.1.1 PING 10.1.1.1: 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out
2-42
Issue 01 (2011-05-30)

Request time out --- 10.1.1.1 ping statistics --5 packet(s) transmitted 0 packet(s) received 100.00% packet loss
2 ARP Configuration
Step 3 Enable the association between ARP and interface status on CX-B. # Specify the IP address of the GE interface of CX-A as the destination IP address of the probe.
[CX-B] interface gigabitethernet 1/0/0 [CX-B-GigabitEthernet1/0/0] arp status-detect 10.1.1.1
Step 4 Adjust parameters about the association between ARP and interface status on CX-B. # Set the interval for sending ARP probe packets to 3 seconds.
[CX-B-GigabitEthernet1/0/0] arp status-detect interval 3000
# Set the probe times to five.

[CX-B-GigabitEthernet1/0/0] arp status-detect times 5 [CX-B-GigabitEthernet1/0/0] quit
# After about 15 seconds (three seconds x five times), the GE interface status of CX-B is Up and the protocol status turns Down.
[CX-B] Sep 16 2007 15:37:45 CX-B %%01IFNET/4/LINK_STATE(l): Line protocol on interfa ce GigabitEthernet1/0/0 has turned into DOWN state. [CX-B] display interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP Line protocol current state : DOWN Description : GigabitEthernet1/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1500 bytes Internet Address is 10.1.1.2/24 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0000-5e13-0100 The Vendor PN is SCP6F86-GL-CWH Port BW: 1G, Transceiver max BW: 1G, Transceiver Mode: MultiMode WaveLength: 850nm, Transmission Distance: 300m Rx Power: -8.00dBm, Tx Power: -5.13dBm Loopback:none, full-duplex mode, negotiation: disable, Pause Flowcontrol:Receive Enable and Send Enable Last physical up time : 2010-06-22 14:56:32 Last physical down time : 2010-06-22 14:56:31 Current system time: 2010-06-22 16:55:19 Statistics last cleared:never Last 300 seconds input rate: 208 bits/sec, 0 packets/sec Last 300 seconds output rate: 544 bits/sec, 1 packets/sec Input: 882114 bytes, 10877 packets Output: 2147780 bytes, 31585 packets Input: Unicast: 0 packets, Multicast: 7368 packets Broadcast: 3509 packets, JumboOctets: 0 packets CRC: 0 packets, Symbol: 0 packets Overrun: 0 packets InRangeLength: 0 packets LongPacket: 0 packets, Jabber: 0 packets, Alignment: 0 packets Fragment: 0 packets, Undersized Frame: 0 packets RxPause: 0 packets Output: Unicast: 0 packets, Multicast: 0 packets Broadcast: 31585 packets, JumboOctets: 0 packets Lost: 0 packets, Overflow: 0 packets, Underrun: 0 packets
----End
Issue 01 (2011-05-30)
2-43
2 ARP Configuration
Configuration Files
# sysname CX-A # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 # return

# sysname CX-B # interface GigabitEthernet1/0/0 undo shutdown arp status-detect 10.1.1.1 arp status-detect times 5 arp status-detect interval 3000 ip address 10.1.1.2 255.255.255.0 # return
2.11.5 Example for Configuring Layer 2 Topology Detection

This section provides an example of configuring Layer 2 topology detection.
As shown in Figure 2-8, configure VLAN 100 as the default VLAN of the two GE interfaces on the device enabled with the portswitch function. Configure the IP addresses of the two GE interfaces based on the figure. Figure 2-8 Networking diagram of configuring Layer 2 topology detection
CX600 GE 1/0/1 VLANIF100 10.1.1.2/24 GE 1/0/2
VLAN100 PC A 10.1.1.1/24 PC B 10.1.1.3/24
The configuration roadmap is as follows:
2 ARP Configuration
1. 2.
Enable portswitch on two GE interfaces and configure them to join VLAN 100 by default. Enable Layer 2 topology detection and view changes of ARP entries.
Data Preparation
To complete the configuration, you need the following data: l l Types and numbers of the interfaces to be added to a VLAN IP addresses of the VLANIF interface and the PCs
Procedure
Step 1 Create VLAN 100 and configure VLAN 100 to be the default VLAN of the two GE interfaces on the device. # Create VLAN 100 and configure an IP address for the VLANIF interface.
<HUAWEI> system-view [HUAWEI] sysname CX device [CX device] vlan 100 [CX device-vlan100] quit [CX device] interface vlanif 100 [CX device-vlanif100] undo shutdown [CX device-vlanif100] ip address 10.1.1.2 24 [CX device-vlanif100] quit
# Configure the two GE interfaces to join VLAN 100 by default.

[CX [CX [CX [CX [CX [CX [CX [CX [CX [CX device] interface gigabitethernet 1/0/1 device-GigabitEthernet1/0/1] undo shutdown device-GigabitEthernet1/0/1] portswitch device-GigabitEthernet1/0/1] port default vlan 100 device-GigabitEthernet1/0/1] quit device] interface gigabitethernet 1/0/2 device-GigabitEthernet1/0/2] undo shutdown device-GigabitEthernet1/0/2] portswitch device-GigabitEthernet1/0/2] port default vlan 100 device-GigabitEthernet1/0/2] quit
Step 2 Enable the Layer 2 topology detection function.

[CX device] l2-topology detect enable
Step 3 Restart GE 1/0/1 and view changes of ARP entries and aging time. # View ARP entries on the device. You can find that the device has learnt the MAC address of the PC.
[CX device] display arp all IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPNINSTANCE VLAN/CEVLAN PVC ----------------------------------------------------------------------------10.1.1.2 00e0-c01a-4900 I Vlanif100 10.1.1.1 00e0-c01a-4901 20 DF6 GE1/0/1 100/10.1.1.3 00e0-de24-bf04 20 DF6 GE1/0/2 100/----------------------------------------------------------------------------Total:3 Dynamic:2 Static:0 Interface:1
# Run the shutdown command and then the undoshutdown command on GE 1/0/1 to view the aging time of ARP entries.
[CX device] interface gigabitethernet 1/0/1 [CX device-GigabitEthernet1/0/1] shutdown
Issue 01 (2011-05-30)
2-45
2 ARP Configuration
[CX device-GigabitEthernet1/0/1] undo shutdown [CX device-GigabitEthernet1/0/1] display arp all IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC ---------------------------------------------------------------------------10.1.1.2 00e0-c01a-4900 I Vlanif100 10.1.1.3 00e0-de24-bf04 0 DF6 GE1/0/2 100/-----------------------------------------------------------------------------Total:2 Dynamic:1 Static:0 Interface:1
NOTE
From the preceding display, you can find that the ARP entries learnt from GE 1/0/1 are deleted after GE 1/0/1 is shut down and the aging time of the ARP entries learnt from GE 1/0/2 changes to 0. When the aging time is 0, the device sends an ARP probe packet for updating ARP entries.
[CX device-GigabitEthernet1/0/1] display arp all IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC ---------------------------------------------------------------------------10.1.1.2 00e0-c01a-4900 I Vlanif100 10.1.1.3 00e0-de24-bf04 20 DF6 GE1/0/2 100/---------------------------------------------------------------------------Total:2 Dynamic:1 Static:0 Interface:1
NOTE
After the entry is updated, the aging time restores the default value, 20 minutes.
----End
Configuration Files
The configuration file of CX device is as follows:
# sysname CX device # L2-topolgy detect enable # vlan 100 # interface Vlanif100 undo shutdown ip address 10.1.1.2 255.255.255.0 # interface GigabitEthernet1/0/1 undo shutdown portswitch port default vlan 100 # interface GigabitEthernet1/0/2 undo shutdown portswitch port default vlan 100 # return
2-46
Issue 01 (2011-05-30)
3 DNS Configuration
3
About This Chapter
DNS Configuration
By configuring the Domain Name System (DNS), you can enable network devices to communicate with other through their domain names. 3.1 DNS Overview The DNS is a host naming mechanism. It assigns a domain name, that is easy to memorize and is of significance, to each host on the Internet in a hierarchical manner. 3.2 Configuring DNS By configuring the DNS, you can set up a mapping between a domain name and an IP address. In this manner, you can enable the device to communicate with other devices. 3.3 Maintaining DNS The operations of DNS maintenance include clearing DNS statistics and monitoring the DNS operating status. 3.4 Configuration Examples This section includes the networking requirements, precautions for configuration, and configuration roadmap.
Issue 01 (2011-05-30)
3-1
3 DNS Configuration
3.1 DNS Overview

The DNS is a host naming mechanism. It assigns a domain name, that is easy to memorize and is of significance, to each host on the Internet in a hierarchical manner. 3.1.1 Introduction to DNS After each host on the Internet is assigned a domain name, you can set up a mapping between the domain name and IP address of a host through. In this manner, you can use domain names, which are easy to memorize and are of significance, instead of complicated IP addresses. 3.1.2 DNS Supported by the CX600 Domain name resolution can be performed in either dynamic mode or static mode.
3.1.1 Introduction to DNS

After each host on the Internet is assigned a domain name, you can set up a mapping between the domain name and IP address of a host through. In this manner, you can use domain names, which are easy to memorize and are of significance, instead of complicated IP addresses. The Domain Name System (DNS) is a host naming mechanism provided by TCP/IP, with which hosts can be named in the form of character string. This system assumes a hierarchical naming structure. It designates a meaningful name for the device in the Internet and associates the name with the IP address through a domain name resolution server. In this manner, you can use domain names that are easy to remember instead of memorizing complex IP addresses.
3.1.2 DNS Supported by the CX600

Domain name resolution can be performed in either dynamic mode or static mode. DNS has two resolution modes: dynamic DNS resolution and static DNS resolution. To resolve a domain name, the system first uses static DNS resolution. If this mode fails, the system uses dynamic DNS resolution. To improve resolution efficiency, you can put common domain names in a static domain name resolution table. The CX600 supports static resolution and dynamic resolution.
3.2 Configuring DNS

By configuring the DNS, you can set up a mapping between a domain name and an IP address. In this manner, you can enable the device to communicate with other devices. 3.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring the DNS. 3.2.2 Configuring Static DNS Entries You can create a table of mappings between domain names and IP addresses and add commonlyused domain names to this table. When a client needs to use the IP address corresponding to a domain name, the client can search the table for the required IP address. This improves the efficiency of domain name resolution. 3.2.3 Configuring Dynamic DNS
3 DNS Configuration
To perform dynamic domain name resolution, you need a special domain name resolution server, which runs a server program. This server provides mappings between domain names and IP addresses and receives resolution requests from the client. 3.2.4 Checking the Configuration You can view the configuration of the DNS.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring the DNS.
If local users accessing devices need to communicate with other devices by using domain names, you can configure DNS on the device. An DNS entry is an mapping between a domain name and an IP address. If local users communicate with other devices hardly through the domain name or if the DNS server is unavailable, configure static DNS. Prior to configuring static DNS, you must know the mapping between the domain name and the IP address. In case of a change in the mapping, you must modify the DNS entry manually. You can configure dynamic DNS on the device if local users frequently use domain names for communicating with other devices and the DNS server is available.
Before configuring DNS, complete the following tasks: l l l l Configuring physical attributes of the interface and ensuring that the physical layer status of the interface is Up Configuring parameters of the link layer protocol of the interface and ensuring that the link layer protocol status of the interface is Up Configuring routes between the local device and the DNS server Configuring the DNS server
Data Preparation
To configure DNS, you need the following data. No. 1 2 3 Data Domain name and the corresponding IP address in a static DNS entry IP address of a DNS server Domain name or the domain name list of a dynamic DNS entry
3.2.2 Configuring Static DNS Entries

You can create a table of mappings between domain names and IP addresses and add commonlyused domain names to this table. When a client needs to use the IP address corresponding to a
3 DNS Configuration
domain name, the client can search the table for the required IP address. This improves the efficiency of domain name resolution.
Procedure
Step 1 Run:
system-view

ip host host-name ip-address
The IP address corresponding to the host name is configured. A host name corresponds to only one IP address. When you configure an IP address for a host for several times, only the IP address configured at the latest is valid. To resolve several host names, repeat Step 2. You can configure a maximum of 50 static DNS entries. ----End
3.2.3 Configuring Dynamic DNS

To perform dynamic domain name resolution, you need a special domain name resolution server, which runs a server program. This server provides mappings between domain names and IP addresses and receives resolution requests from the client.
Procedure
Step 1 Run:
system-view

dns resolve
Dynamic domain name resolution is enabled. Step 3 Run:

dns server ip-address
A DNS server is specified. Step 4 (Optional) Run:

dns server source-ip source-ip-address
The IP address of the local device is specified. The local device uses the specified IP address to communicate with the DNS server, which ensures communication security. Step 5 Run:
dns domain domain-name
The suffix of the domain name is added. ----End

3 DNS Configuration
Follow-up Procedure
The system supports the configuration of a maximum of 6 domain name servers, 1 source address, and 10 domain name suffixes. To configure more than one domain name server, repeat Step 3. To configure more than one domain name suffix, repeat Step 5.

You can view the configuration of the DNS.
Prerequisite
The configurations of the DNS function are complete.
Procedure
l l l l Run the display ip host command to check the information about the static DNS entry table. Run the display dns server command to check the configurations about DNS servers. Run the display dns domain command to check the configurations about domain name suffixes. Run the display dns dynamic-host command to check the information about dynamic DNS entries in the domain name cache.
----End
Example
Run the display ip host command. If static DNS entries including the mappings between host names and IP addresses, are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ip host Host Age Flags hw 0 static gww 0 static Address 10.1.1.1 192.168.1.1
Run the display dns server command. If IP addresses of all domain servers are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns server IPv4 Dns Servers : Domain-server IpAddress 1 172.16.1.1 2 172.16.1.2 IPv6 Dns Servers : No configured servers.
Run the display dns domain command. If the list of suffixes of domain names is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns domain No Domain-name 1 com 2 net
Run the display dns dynamic-host command. If information about the dynamic domain name cache is displayed, it means that the configuration succeeds. For example:
3 DNS Configuration
<HUAWEI> display dns dynamic-host No Domain-name IpAddress 1 www.huawei.com 91.1.1.1 2 www.huawei.com.cn 87.1.1.1
TTL 3521 3000
Alias
3.3 Maintaining DNS

The operations of DNS maintenance include clearing DNS statistics and monitoring the DNS operating status. 3.3.1 Clearing DNS Entries This section describes DNS entry clearance through the reset command. 3.3.2 Monitoring Network Operation Status of DNS This section describes DNS operation monitoring through the display command.
3.3.1 Clearing DNS Entries

This section describes DNS entry clearance through the reset command.
Context
CAUTION
DNS entries cannot be restored after being cleared. So, confirm the action before you use this command.
Procedure
Step 1 Run the reset dns dynamic-host command in the user view to clear dynamic DNS entries statistics in the domain name cache. ----End
3.3.2 Monitoring Network Operation Status of DNS

This section describes DNS operation monitoring through the display command.
Context
In routine maintenance, you can run the following command in any view to check the operation of DNS.
Procedure
l l l Run the display ip host command to check the information about the static DNS entry table. Run the display dns server command to check configurations about DNS servers. Run the display dns domain command to check configurations about domain name suffixes.
3-6
3 DNS Configuration
Run the display dns dynamic-host command to check the information about dynamic DNS entries in the domain name cache.
----End

Context
NOTE
This document takes interface numbers and link types of the CX600 as an example. In working situations, the actual interface numbers and link types may be different from those used in this document.
3.4.1 Example for Configuring DNS This section provides an example of configuring the DNS.
3.4.1 Example for Configuring DNS

This section provides an example of configuring the DNS.
As shown in Figure 3-1, CX-A acts as a DNS client, being required to access the host 2.1.1.3/16 by using the domain name huawei.com. You need to configure domain name suffixes "com" and "net". On CX-A, configure static DNS entries of CX-B and CX-C so that CX-A can communicate with them by using domain names. Figure 3-1 Networking diagram of DNS
Loopback0 4.1.1.1/32 CX-B GE1/0/0 1.1.1.2/16 DNS Client CX-A GE1/0/1 1.1.1.1/16
Loopback0 4.1.1.2/32 CX-C GE1/0/1 3.1.1.1/16 GE1/0/0 DNS Server 2.1.1.2/16 3.1.1.2/16
GE1/0/0 2.1.1.1/16
huawei.com 2.1.1.3/16
3 DNS Configuration
1. 2. 3. 4.
Configure static DNS entries. Enable DNS resolution. Configure an IP address for the DNS server. Configure suffixes of domain names.
Data Preparation
To complete the configuration, you need the following data: l l l Domain names of CX-B and CX-C IP address of the DNS server Suffixes of domain names
Procedure
Step 1 Configure CX-A. # Configure static DNS entries.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ip host CX-B 4.1.1.1 [CX-A] ip host CX-C 4.1.1.2
# Enable DNS resolution.

[CX-A] dns resolve
# Configure an IP address for the DNS server.

[CX-A] dns server 3.1.1.2
# Configure a domain name suffix "net".

[CX-A] dns domain net
# Configure a domain name suffix "com".

[CX-A] dns domain com [CX-A] quit
NOTE
To complete DNS resolution, configuring routes from CX-A to the DNS server is mandatory. For procedures for configuring routes, refer to the CX600 Metro Services Platform Configuration Guide - IP Routing.
Step 2 Verify the configuration. # Run the ping huawei command on CX-A to ping the IP address 2.1.1.3. The ping succeeds.
<CX-A> ping huawei.com Trying DNS server (3.1.1.2) PING huawei.com (2.1.1.3): 56 Reply from 2.1.1.3: bytes=56 Reply from 2.1.1.3: bytes=56 Reply from 2.1.1.3: bytes=56 Reply from 2.1.1.3: bytes=56 Reply from 2.1.1.3: bytes=56 --- huawei.com ping statistics 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss
data bytes, press CTRL_C to break Sequence=1 ttl=126 time=6 ms Sequence=2 ttl=126 time=4 ms Sequence=3 ttl=126 time=4 ms Sequence=4 ttl=126 time=4 ms Sequence=5 ttl=126 time=4 ms ---
3-8
Issue 01 (2011-05-30)

round-trip min/avg/max = 4/4/6 ms
3 DNS Configuration
# Run the display ip host command on CX-A to view static DNS entries, including mappings between host names and IP addresses.
<CX-A> display ip host Host Age CX-B 0 CX-C 0 Flags Address static 4.1.1.1 static 4.1.1.2
# Run the display dns dynamic-host command on CX-A to view dynamic DNS entries in the domain name cache.
<CX-A> display dns dynamic-host No Domain-name IpAddress 1 huawei.com 2.1.1.3
NOTE
TTL 3579
Alias
TTL value in the above display indicates the lifetime of an entry. It is in seconds.
----End
Configuration Files
# sysname CX-A # ip host CX-B 4.1.1.1 ip host CX-C 4.1.1.2 # dns resolve dns server 3.1.1.2 dns domain net dns domain com # interface GigabitEthernet1/0/0 undo shutdown ip address 1.1.1.2 255.255.0.0 # rip 1 network 1.0.0.0 # return

# sysname CX-B # interface GigabitEthernet1/0/0 undo shutdown ip address 2.1.1.1 255.255.0.0 # interface GigabitEthernet1/0/1 undo shutdown ip address 1.1.1.1 255.255.0.0 # interface LoopBack0 ip address 4.1.1.1 255.255.255.255 # rip 1 network 2.0.0.0 network 1.0.0.0 network 4.0.0.0 # return
Issue 01 (2011-05-30)
3-9
3 DNS Configuration

# sysname CX-C # interface GigabitEthernet1/0/0 undo shutdown ip address 2.1.1.2 255.255.0.0 # interface GigabitEthernet1/0/1 undo shutdown ip address 3.1.1.1 255.255.0.0 # interface LoopBack0 ip address 4.1.1.2 255.255.255.255 # rip 1 network 2.0.0.0 network 3.0.0.0 network 4.0.0.0 # return
3-10
Issue 01 (2011-05-30)
4 COPS Configuration
4
About This Chapter
Context
NOTE
COPS Configuration
The IPTN solution works to ensure end-to-end quality of service. COPS is used for exchanging information between servers and devices.
COPS cannot be configured on the X1 and X2 models of the CX600.
4.1 COPS Overview The IPTN solution not only improves the transmission efficiency of bearer networks, but also ensures end-to-end quality of service. COPS is used for exchanging policies between RM servers and devices. 4.2 Configuring the COPS Server Group A COPS server group brings together several COPS servers that have the same attributes and work in load balancing mode. The device manages COPS servers as a group. 4.3 Configuration Examples This section includes networking requirements, configuration precautions, and the configuration roadmap.
Issue 01 (2011-05-30)
4-1
4.1 COPS Overview

The IPTN solution not only improves the transmission efficiency of bearer networks, but also ensures end-to-end quality of service. COPS is used for exchanging policies between RM servers and devices. 4.1.1 Introduction to COPS Common Open Policy Service (COPS) employs a simple query and response model. It is used to exchange policy information between a policy server and its clients. 4.1.2 COPS Features Supported by the CX600 The CX600 supports three types of controls on the number of users online at any given time. It allows an ISP to configure a value for the number of users online that exceeds the network bearing capacity. The CX600 also allows restrictions on the number of users who go online at the same time, as well as security inspections and control of IPTN users.
4.1.1 Introduction to COPS

Common Open Policy Service (COPS) employs a simple query and response model. It is used to exchange policy information between a policy server and its clients. More people are using broadband Internet every day. The range of data services is growing as are the revenues of telecommunications service providers. IP services are replacing voice telecommunications as packet networks develop. Broadband access is the core driver behind the development of IP services. As time goes on service providers are becoming more experienced and adept at delivering an ever richer and more exciting selection of IP services. When it comes to bearing services and operations, however, IP networks are far from perfect. Carriers are concerned that existing IP networks cannot bear all of the wide variety of telecommunications services now available. Many data services like voice, video and other multimedia services are very demanding when it comes to bandwidth needs, tolerance of delays, and packet loss ratio. Quality of service (QoS) takes a big hit when networks fail to meet these demands. Today the provision of Internet services is for the most part a "best effort" endeavor. Networks simply do not have resources in reserve. The only way for networks to reduce congestion in an effort to guarantee QoS is to discard packets. Existing IP networks have many deficiencies as they work to bear carrier-class services. QoS for IP networks has improved greatly, but this has been achieved mainly by focusing on single nodes that prioritize and process packets in order of precedence. If, however, end to end quality is to be ensured, service awareness and access control must be realized on the entire network, and especially on the access network. IP bearer networks that can deliver services with an end-to-end QoS guarantee are urgently needed. Today's Internet must be upgraded to provide those better quality data services. To this end, Huawei has developed its IP telecommunication network (IPTN) solution. The IPTN solution aims to provide end-to-end QoS on existing IP networks. IPTN introduces the concept of a bearer control layer residing between the service control layer and the bearer layer. IPTN is designed to improve the transmission efficiency of a bearer network. Resources are applied for when needed, held only while they are in use, and released when they are no longer required. IPTN guarantees end-to-end QoS on IP networks, adding value to networks and helping carriers to maximize return on investment. IPTN:
l l l l l
Works with existing IP networks and does not affect traditional services that have no QoS guarantee. Bears traditional telecommunication services as well as offering support for a wide range of other services. Applies for resources before a connection is set up, guarantees quality of service while the connection is in use, and releases the resources after the connection is closed. Has a network structure with three layers: logical bearer layer, bearer control layer, and service control layer. Has a bearer layer based on MPLS, which allows resources for IPTN services to be separated from those for IP services.
COPS is an application protocol. It employs a simple query and response model and is used to exchange policies between a policy server and its clients. COPS refers to a policy server as a Policy Decision Point (PDP). PDP clients are called Policy Enforcement Points (PEPs). IPTN uses COPS to exchange policies between an RM server and a CX device. The RM server receives messages from the Soft Switch and then uses the COPS protocol to send these messages to the CX device.
4.1.2 COPS Features Supported by the CX600

The CX600 supports three types of controls on the number of users online at any given time. It allows an ISP to configure a value for the number of users online that exceeds the network bearing capacity. The CX600 also allows restrictions on the number of users who go online at the same time, as well as security inspections and control of IPTN users.
Three Levels of Limits of Number of Users

The CX600 allows Internet Service Providers (ISPs) to configure a number of users exceeding the network bearing capability and to limit the number of users who access the Internet at the same time. To identify Digital Subscriber Line Access Multiplexers (DSLAMs) and users, a PE device provides IPTN services by using QinQ termination sub-interfaces. The CX600 provides three levels of limits of number of users: l l l VLAN-group: is a set of users that use the same statistics policies and queue policies. QinQ termination sub-interface: is used for the access of users in the same IP network segment. Multiple VLAN-groups can be configured on a sub-interface. Primary interface: Multiple QinQ termination sub-interfaces can be configured on a primary interface.
After the three levels of limits are configured, the CX600 can guarantee that the number of online users satisfies requirements of any level.
Detection of Online and Offline of Users

When a user goes offline, a DHCP Release message was send to the DHCP server. If DHCP Relay is enabled on the PE, the PE can sense the message and notifies the COPS server about the offline of the user. The COPS server then releases the network resources held by that user. The CX600 detects users by using the Address Resolution Protocol (ARP). ARP sends ARP Request messages at intervals according to IP addresses of users recorded on the local device.
When users are online, they send ARP Response messages. The PE knows that the users are online based on the ARP Response messages. If the PE does not receive any ARP Response message in several continuous periods from a user, it considers that the user goes offline abnormally. Then, the PE sends DHCP Release messages to the DHCP server so that the DHCP server releases the IP address of the user, which avoids waste of IP addresses. At the same time, the PE notifies the COPS server of the offline of the user.
Security Checking over Users

The CX600 provides the DHCP security binding function. The CX600 saves the information on users according to the combination of IP addresses, MAC addresses, access interfaces, and VLANs. Users can access the network only when they match all the information. The saved information is released with the release of IP addresses. After the DHCP security binding function is enabled and the link for a user fails, the user can achieve Internet services only when the user resends DHCP packets to apply for a valid IP address.
Control over Users

The CX600 can display information about online users and force users to go offline. Such functions are used when user operations are found abnormal or when network resources need to be adjusted. The CX600 can force users to go offline in either of the following modes: l l Force users to go offline by interfaces. Force users to go offline by interface plus VLAN-group labels.
In the case that network configurations are not changed, the users that are forced to go offline can resend DHCP Request messages to use network resources again.
4.2 Configuring the COPS Server Group

A COPS server group brings together several COPS servers that have the same attributes and work in load balancing mode. The device manages COPS servers as a group. 4.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a COPS server group. 4.2.2 Configuring the Global Parameters of COPS This section describes how to set global COPS parameters. These include setting the timeout period for COPS Open messages, setting the source interface through which COPS messages are sent, and binding the COPS server group to the IPTN service. 4.2.3 Creating a COPS Server Group To create a COPS server group, you must specify the name and client type for the COPS server group. 4.2.4 Configuring the COPS Server To configure a COPS server, you must specify the IP address, interface number, VPN instance for the server, as well as the weight of the server and client interface number. 4.2.5 Setting the PEP ID for the COPS Server
The COPS server uses a client identifier to identify a client. The default client identifier is huawei. 4.2.6 (Optional) Setting the Flow Keeping Time of the COPS Server Setting the flow keeping time for a COPS server helps to prevent intermittent connection interruptions when the network becomes unstable. The flow keeping time refers to the duration in which connection information is kept after the COPS client is disconnected from the COPS server. Flow keeping prevents the connection from being intermittently broken due to the network instability. 4.2.7 (Optional) Setting the Shared Key of the COPS Server Encrypting COPS packets improves the security of packet exchanges between a client and COPS server group. 4.2.8 Activating the COPS Server Group When a COPS server group is activated, the device attempts to set up a TCP connection with each server in the COPS server group. 4.2.9 Checking the Configuration You can view the configuration of the COPS server.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a COPS server group.
To send policies for value-added services using a COPS server, you must configure a COPS server group on a device. A COPS server group is used to manage COPS servers. The servers in a COPS server group work in load balancing mode and share many of the same attributes. Each server in the group, however, has a unique IP address, VPN instance, port number, and weight value.
None.
Data Preparation
To configure a COPS server group, you need the following data. No. 1 2 3 4 5
Issue 01 (2011-05-30)
Data Name of the COPS server group IP address, VPN instance, server port number, client port number, and weight of each COPS server to be included in the group PEP ID of the COPS clients (Optional) Flow keeping time after the COPS client and the COPS server are disconnected (Optional) Shared key of the COPS server
No. 6
Data (Optional) Timeout period for COPS Open messages and source interface of the device sending COPS messages
4.2.2 Configuring the Global Parameters of COPS

This section describes how to set global COPS parameters. These include setting the timeout period for COPS Open messages, setting the source interface through which COPS messages are sent, and binding the COPS server group to the IPTN service.
Procedure
Step 1 Run:
system-view

cops-server open-timeout time
The timeout period for the COPS Open message is set. This parameter defines the period of time the device waits for a response after it sends a COPS Open message to the COPS server. If the device receives no response from the COPS server within this period, it resends the Open message to the server. Be default, the timeout period for the COPS Open message is 15 seconds.
NOTE
If the network is not stable, extending the timeout period for COPS Open messages is recommended.
Step 3 Run:
cops-server source-interface interface-type interface-number
The source interface that sends the COPS message is configured. This parameter defines the interface from which COPS messages are sent. A COPS session can be established only after the source interface of the COPS messages is configured.
NOTE
Configuring a logical interface, such as a loopback interface, to be the source interface for COPS messages is recommended. Physical interfaces may go Down, rendering the system incapable of receiving responses from the COPS server.
Step 4 Run:
cops-group iptn-binding group-name
The COPS server group is bound to IPTN services.

NOTE
A newly created COPS server group can implement IPTN services only after it is bound to the IPTN services.
----End
4.2.3 Creating a COPS Server Group

To create a COPS server group, you must specify the name and client type for the COPS server group.
Procedure
Step 1 Run:
system-view

cops-server group group-name [ client-type ssg ]
A COPS server group is created.

NOTE
When creating a COPS server group for the first time, you must specify the parameter client-type, indicating the type of service required from the COPS server.
----End
Follow-up Procedure
After a COPS server group is created, the view of the COPS server group is displayed. If there is an existing COPS server group, run the preceding command to enter its view.
4.2.4 Configuring the COPS Server

To configure a COPS server, you must specify the IP address, interface number, VPN instance for the server, as well as the weight of the server and client interface number.
Procedure
Step 1 Run:
system-view

cops-server group group-name
The view of the COPS server group is displayed. Step 3 Run:

cops-server ip-address [ server-port | client-port client-port | vpn-instance instance-name | weight value ] *
The COPS server is configured.

NOTE
l Modifying the port number of the COPS server is not recommended. The device cannot set up a TCP connection with the COPS server if the modified port number is in use. l Ensure that at least one reachable route exists between the device and the COPS server.
----End
4.2.5 Setting the PEP ID for the COPS Server

The COPS server uses a client identifier to identify a client. The default client identifier is huawei.
Context
The PEP ID is used by a COPS server to identify clients. Normally, the IP address of a loopback interface on the device can be specified as the PEP ID.
Procedure
Step 1 Run:
system-view


cops-server pep-id client-id
The PEP ID is set for the COPS client. ----End
Follow-up Procedure
You can set the PEP ID based on the COPS server group. If a device is a client of several different COPS server groups, it can have a different PEP ID for each of those server groups. The default PEP ID is huawei.
4.2.6 (Optional) Setting the Flow Keeping Time of the COPS Server
Setting the flow keeping time for a COPS server helps to prevent intermittent connection interruptions when the network becomes unstable. The flow keeping time refers to the duration in which connection information is kept after the COPS client is disconnected from the COPS server. Flow keeping prevents the connection from being intermittently broken due to the network instability.
Procedure
Step 1 Run:
system-view


cops-server flow-keeping-time time
4-8
Issue 01 (2011-05-30)
The flow keeping time of the COPS server is set. ----End
Follow-up Procedure
After the cops-server flow-keeping-time command is run, the system can promptly restore connection information if a COPS client re-establishes a connection with the COPS server within the configured flow keeping time limit.
NOTE
l Setting a value for flow keeping time is recommended if the network is unstable and, especially, if routes to the COPS server frequently flap. l By default, flow keeping time for the COPS server is 300 seconds.
4.2.7 (Optional) Setting the Shared Key of the COPS Server

Encrypting COPS packets improves the security of packet exchanges between a client and COPS server group.
Procedure
Step 1 Run:
system-view


cops-server shared-key key-string
The shared key of the COPS server is set. ----End
Follow-up Procedure
The shared key encrypts COPS messages. The device and the COPS server must be set with the same shared key. Setting a shared key improves the security of message exchanges between clients and the COPS server group.
NOTE
If secure message exchange between the client and COPS server group is a high priority, setting a shared key for the COPS server is recommended.
4.2.8 Activating the COPS Server Group

When a COPS server group is activated, the device attempts to set up a TCP connection with each server in the COPS server group.
Procedure
Step 1 Run:
system-view


active
All the COPS servers in the COPS server group are activated.
NOTE
The device attempts to set up connections with the COPS servers only after the COPS server group is activated.
----End
Follow-up Procedure
After the preceding configuration, the device attempts to set up TCP connections with all the COPS servers in the COPS server group.

You can view the configuration of the COPS server.
Prerequisite
The configurations of the COPS Server Group are complete.
Procedure
Step 1 Run the display cops-server configuration [ groupgroup-name ] command to check the configuration of a specified COPS server group. ----End
Example
Check information about the COPS server group huawei.
<HUAWEI> display cops-server configuration group huawei -- Cops group table display ------------------------------------------------Group index : 0 Group name : huawei Client type : ssg Group up or down flag : Down Group active state : Active Secret key : huawei Flow keeping time (second) : 500 PEP ID : client1 Group Source interface name : -Group Reference number : 0
4-10
Issue 01 (2011-05-30)
[state][server IPv4 addr][server port][client port][weight][vpn name][server key ] Down 202.40.2.2 3288 0 0 ---- End cops group table -----------------------------------------------------

This section includes networking requirements, configuration precautions, and the configuration roadmap. 4.3.1 Example for Configuring COPS Interfaces to Report Online and Offline Messages This section provides an example for configuring COPS interface to report messages indicating that a user going online or offline.
4.3.1 Example for Configuring COPS Interfaces to Report Online and Offline Messages
This section provides an example for configuring COPS interface to report messages indicating that a user going online or offline.
As shown in Figure 4-1, a DHCP client accesses the PE through the DSLAM. The DHCP client uses a DCHP relay to apply to a DHCP server for relevant configuration information, such as an IP address. After the DHCP server allocates an IP address to the DHCP client, the PE reports that the user has gone online to a COPS server. When the user goes offline and releases the IP address, the PE also reports this information to the COPS server so the user record can be updated. Figure 4-1 Typical networking diagram of COPS configuration
COPS server 202.40.2.2/16 GE2/0/1 202.40.2.1/16 PE GE2/0/0 202.40.1.1/16
DHCP client
DSLAM
DHCP Relay
202.40.1.2/16 DHCP server
Issue 01 (2011-05-30)
4-11
The configuration roadmap is as follows: 1. 2. 3. 4. 5. 6. 7. Configure the parameters for the DHCP relay. Configure the global COPS parameters. Create a COPS server group and add COPS servers to it. Configure the PEP ID and other optional items for the COPS server. Activate the COPS server group. Bind the COPS server group to IPTN services. Verify the configuration.
Data Preparation
To complete the configuration, you need the following data: l l l l l Name, IP address, VPN instance, and port number of the COPS servers, port number of the COPS clients, and weights PEP ID (Optional) Flow keeping time after a COPS client is disconnected from the COPS server (Optional) Shared key of the COPS server Timeout period for COPS Open messages and the source interface of the device sending COPS messages
Procedure
Step 1 Configure the DHCP relay functions on the device. For detailed configuration information, refer to the chapter "DHCPv4 Configuration" in the CX600 Metro Services Platform Configuration Guide - User Access. Step 2 Configure the global parameters for COPS, including the timeout period for COPS Open messages and the source interface for sending COPS messages.
<PE> system-view [PE] cops-server open-timeout 30 [PE] cops-server source-interface loopBack 0
Step 3 Create a COPS server group and add COPS servers to it.
[PE] cops-server group huawei client-type ssg [PE-cops-huawei] cops-server 202.40.2.2
Step 4 Configure the COPS PEP ID and other optional items.

[PE-cops-huawei] cops-server pep-id client1 [PE-cops-huawei] cops-server flow-keeping-time 500 [PE-cops-huawei] cops-server shared-key huawei
Step 5 Activate the COPS server group.

[PE-cops-huawei] undo active [PE-cops-huawei] active [PE-cops-huawei] quit
Step 6 Bind the COPS server group to IPTN services.

[PE] cops-group iptn-binding huawei
4-12
Issue 01 (2011-05-30)
Step 7 Verify the configuration.

<PE> display cops-server configuration group huawei -- Cops group table display ------------------------------------------------Group index : 0 Group name : huawei Client type : ssg Group up or down flag : Up Group active state : Active Secret key : huawei Flow keeping time (second) : 500 PEP ID : client1 Group Source interface name : -Group Reference number : 0 [state][server IPv4 addr][server port][client port][weight][vpn name][server key ] Down 202.40.2.2 3288 0 0 ---- End cops group table -----------------------------------------------------
----End
Configuration Files
The configuration file of CX device is as follows:
# sysname PE1 # cops-server open-timeout 30 cops-server source-interface LoopBack0 cops-group iptn-binding huawei # interface Gigabitethernet2/0/0 ip address 202.40.1.1 255.255.255.252 ip relay address 202.40.3.2 dhcp select relay # interface Gigabitethernet2/0/1 ip address 202.40.2.1 255.255.255.252 # interface Gigabitethernet2/0/2 ip address 202.40.3.1 255.255.255.252 # interface LoopBack0 ip address 9.9.9.9 255.255.255.255 # cops-server group huawei client-type ssg cops-server flow-keeping-time 500 cops-server shared-key huawei cops-server pep-id client1 cops-server 202.40.2.2 active # return
Issue 01 (2011-05-30)
4-13
5 ANCP Configuration
5
About This Chapter
Context
NOTE
ANCP Configuration
With ANCP, the CX device is able to transmit control messages between a BRAS and an access node.
ANCP cannot be configured on the X1 and X2 models of the CX600.
5.1 ANCP Overview ANCP provides a channel for transmitting control messages between a BRAS and an AN such as a DSLAM. 5.2 Configuring the ANCP Server When it is configured as an ANCP server, the CX device functions as a BRAS. 5.3 Configuring the ANCP Proxy As an ANCP proxy, the CX device establish ANCP neighbor relationships with the DSLAM and the BRAS to aggregate ANCP lines. 5.4 Configuring the Association Between ANCP and HQoS in the ANCP Proxy Scenario After ANCP is associated with HQoS, ANCP can be used to control the traffic rate for downstream user lines and QoS parameters. 5.5 Maintaining ANCP You may clear ANCP running information as part of ANCP maintenance. 5.6 Configuration Examples ANCP configuration examples explain networking requirements and configuration procedures and provide networking diagrams, configuration notes, and configuration roadmaps.
Issue 01 (2011-05-30)
5-1
5.1 ANCP Overview

ANCP provides a channel for transmitting control messages between a BRAS and an AN such as a DSLAM. 5.1.1 Introduction to the ANCP Protocol Before configuring ANCP, familiarize yourself with how ANCP works. This will help you complete the configuration task rapidly and accurately. 5.1.2 Applicable Environment ANCP plays two roles, namely, ANCP server and ANCP proxy.
5.1.1 Introduction to the ANCP Protocol

Before configuring ANCP, familiarize yourself with how ANCP works. This will help you complete the configuration task rapidly and accurately. The Access Node Control Protocol (ANCP) provides a channel through which control messages can be transmitted between a Broadband Remote Access Server (BRAS) and an access node (AN) such as a Digital Subscriber Line Access Multiplexer (DSLAM). ANCP is both based on and an extension of General Switch Management Protocol Version 3 (GSMPv3). It introduces a mechanism for establishing and maintaining neighbor relationships. The ANCP protocol works as follows: 1. An AN initiates a TCP connection with the BRAS. The BRAS uses port 6068 to listen, and the configured AN is powered on and then initiates a TCP connection with the listening port on the BRAS. The BRAS functions as a TCP server while the AN functions as a TCP client. The AN sets up a GSMP neighbor relationship with the BRAS, and performs ANCP capability negotiations. The capabilities defined in the ANCP protocol include: l Dynamic discovery of topologies l Configuration of line parameters l Multicast control l Management of line detection l Batch transactions Currently, the CX600 supports three capabilities, namely, dynamic discovery of topologies, configuration of line parameters, and management of line detection. 3. The ANCP protocol starts to work. After a neighbor relationship is established, the ANCP protocol works as follows: l Dynamically discovers topologies and updates line information. The AN monitors the status of the access lines and uses ANCP to report information about the access lines to the BRAS. This information includes the IDs of active access lines, the types of access lines, and upstream and downstream bandwidths. This AccessLoop-Circuit-ID as defined by ANCP is the same as the Option 82 field value in DHCP control messages or the value of the PPPoE+ field in PPP control messages. If the line information changes, the AN uses ANCP to notify the BRAS to update related line information.
2.
l Applies appropriate line parameters when users go online. When a user connected to the AN goes online, the connection request message from the user carries Option 82 information or PPPoE+ information that is the same as that of the access line ID. The BRAS is able to map the relationship between users and access lines, and then use this information to control bandwidth for services and perform traffic policing as needed. l (Optional) The Remote Authentication Dial-In User Service (RADIUS) server delivers a line policy to the DSLAM. When a user goes online or customizes services, the RADIUS server delivers a line policy based on relevant line information to the BRAS. The BRAS delivers the policy to the DSLAM, which then applies the policy. l Performs OAM detection on access lines. The BRAS uses ANCP to send OAM detection packets to the DSLAM. After receiving the packets, the DSLAM performs loopback detection on Digital Subscriber Lines (DSLs) and then uses ANCP to report the test results to the BRAS through ANCP.
5.1.2 Applicable Environment

ANCP plays two roles, namely, ANCP server and ANCP proxy.
ANCP Sever
Figure 5-1 Networking diagram of configuring an ANCP server
Access Line
ANCP Session
Policy Server
RADIUS Server
Access Line DSLAM Access Line CX
ISP
ASP
NSP
As shown in Figure 5-1, the DSLAM supports ANCP, and the CX device, as an ANCP server, functions as the BRAS. In this case, the CX device supports the following functions: l Access line management Dynamic discovery of topologies
The CX device supports Hierarchical QoS (HQoS) so as to minimize congestion in an access network. HQoS requires the BRAS to detect topologies in the access network and the parameters of access lines. These parameters include the DSL link status, actual upstream and downstream rates for synchronized Digital Subscriber Line (DSL) links, and maximum upstream and downstream rates. All these can be reported dynamically to the BRAS by the DSLAM. Some parameters, such as the network rate for DSL links, are constantly changing. The operation and maintenance system cannot provide accurate information about parameters of this kind. Other parameters, such as the upstream bandwidth of the DSLAM, seldom change, but they still need to be strictly synchronized with the information stored on the BRAS. The operation and maintenance system, however, provides no reliable and scalable method for accomplishing this task. Dynamic discovery of topologies helps address this problem. Update of line information When the DSLAM re-sychronizes access line status with the Integrated Access Device (IAD), the DSLAM detects status changes of access lines and updates line parameters. The DSLAM then sends a Port up message to the BRAS instructing it to update line bandwidth. l Service management Access line parameters are generally fixed. When users need value-added services, such as triple-play services, the DSL lines need to be processed specially by the DSLAM. In addition, when users subscribe to services on self-service networks, line parameters must be updated automatically without manual intervention. When users go online, the DSLAM listens to DHCP or PPPoE control messages, and adds Option 82 or PPPoE+ information to the messages. The CX device then matches the Option 82 information in DHCP control messages or PPPoE+ information in PPPoE control messages with the access line IDs (defined as Access-Loop-Circuit-ID in ANCP). This allows the CX device to find the access line that is unique to a particular user. l Adjustment of user bandwidths and queue scheduling modes on downstream links The DSLAM uses ANCP packets to report information about user bandwidths and the CX device delivers a QoS policy through ANCP packets.
5-4
Issue 01 (2011-05-30)
ANCP Proxy
Figure 5-2 Networking diagram of configuring an ANCP proxy
Access Line
ANCP Session 1
ANCP Session 2
Policy Server
RADIUS Server ISP ASP
Access Line DSLAM Access Line CX BRAS
NSP
As shown in Figure 5-2, the DSLAM and the BRAS both support ANCP. As an ANCP proxy, the CX device sets up ANCP neighbor relationships with the DSLAM and the BRAS to aggregate ANCP lines. In this case, the CX device supports the following functions: l Discovery of topologies The DSLAM uses ANCP packets to report access line IDs and information about user bandwidths to the CX device. The CX device then sets up and maintains ANCP access line entries. The CX device forwards the access line IDs reported by the DSLAM to the BRAS through the ANCP neighbor. l HQoS QoS parameters can be adjusted by the CX device based on information about user bandwidths reported by the DSLAM. Alternatively, the BRAS can use ANCP packets to deliver a QoS policy to the CX device, and the QoS parameters can be adjusted accordingly. l OAM detection The CX device receives OAM detection packets sent by the BRAS and forwards these packets to the DSLAM. After a response from the DSLAM, the CX device sends the detection results back to the BRAS.
5.2 Configuring the ANCP Server

When it is configured as an ANCP server, the CX device functions as a BRAS. 5.2.1 Establishing the Configuration Task
Before configuring the CX device as an ANCP server, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. 5.2.2 Enabling ANCP The system can perform socket interception and processes TCP connection requests from a DSLAM only after being enabled with ANCP. 5.2.3 Configuring the Source Interface of an ANCP Connection The interface that is connected to a DSLAM to set up a TCP connection can only be a loopback interface. 5.2.4 (Optional) Configuring Parameters of ANCP Sessions You can configure an interval at which the local end sends an SYN or SYN-ACK packet to the peer and the maximum number of retransmissions. 5.2.5 Configuring ANCP Neighbor Profiles Configuring an ANCP neighbor profile for the CX device facilitates ANCP access line management. 5.2.6 (Optional) Configuring Bandwidth Adjustment Factors After bandwidth adjustment factors are configured, the ANCP neighbor profile adjusts bandwidth based on the configured link types. 5.2.7 (Optional) Configuring ANCP Message Damping Performance is degraded if the CX device frequently responds to messages reporting user bandwidth changes. Configure ANCP message damping on the CX device to avoid this problem. 5.2.8 (Optional) Configuring ANCP OAM Detection To test access line connections from a remote location, configure ANCP OAM detection. 5.2.9 (Optional) Adjusting the Upstream and Downstream Bandwidths of a User Automatically Automatic adjustment of downstream bandwidth for a user must be enabled in the AAA domain view of the user. 5.2.10 Checking the Configuration After the CX device is configured as an ANCP server, you can check information about ANCP neighbors, the ANCP neighbor profile, and line entries in the ANCP neighbor profile, as well as statistics about ANCP neighbors.

Before configuring the CX device as an ANCP server, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately.
If the DSLAM supports ANCP and the CX device needs to function as a BRAS to manage users and user services, and to detect the online or offline status of users, you must configure the CX device to function as an ANCP server.
Before configuring the CX device to function as an ANCP server, complete the following tasks:
l l
Configure physical parameters and link attributes to ensure that interfaces work properly Configure IP addresses and route discovery for interfaces
Data Preparation
To configure the CX device to function as an ANCP server, you need the following data. No. 1 2 3 4 5 6 7 8 9 10 11 12 Data Source interface on which the ANCP connection is set up (Optional) Timeout period before an ANCP session is set up and the maximum number of packet retransmissions Name of the ANCP neighbor profile IP address of the ANCP neighbor (Optional) Port number for TCP connection listening on the ANCP neighbor (Optional) Maximum number of lines permitted by each ANCP neighbor (Optional) Interval for sending Keepalive packets for ANCP sessions (Optional) Aging time of line entries (Optional) Timeout period to wait for a response to the delivered profile (Optional) Percentage of ANCP messages subject to damping (Optional) Number of OAM detections (Optional) Timeout period to wait for a response to OAM detection
5.2.2 Enabling ANCP

The system can perform socket interception and processes TCP connection requests from a DSLAM only after being enabled with ANCP.
Procedure
Step 1 Run:
system-view

ancp enable
ANCP is enabled. The system performs socket listening and processes TCP connection requests from the DSLAM only after ANCP is enabled. When ANCP is disabled, all ANCP TCP connections are severed, and socket listening is disabled.
By default, ANCP is disabled. ----End
5.2.3 Configuring the Source Interface of an ANCP Connection

The interface that is connected to a DSLAM to set up a TCP connection can only be a loopback interface.
Procedure
Step 1 Run:
system-view

ancp
The ANCP view is displayed. Step 3 Run:

source-interface loopback interface-number
The source interface is configured for setting up an ANCP connection. When the interface is connected to the DSLAM to set up a TCP connection, the source interface can only be a loopback interface. Changing the source-interface { loopback | virtualethernet | gigabitethernet } interface-number command or the IP address of the interface takes effect only when ANCP is disabled and then enabled again. ----End
5.2.4 (Optional) Configuring Parameters of ANCP Sessions

You can configure an interval at which the local end sends an SYN or SYN-ACK packet to the peer and the maximum number of retransmissions.
Procedure
Step 1 Run:
system-view

ancp

session { interval interval-value | retransmit retransmit-value }*
The timeout period for ANCP sessions and the maximum number of ANCP packet retransmissions are configured. After a TCP connection is established, CX device sends SYN packets to set up an ANCP session. If the local end does not receive the correct response, it resends SYN packets until an ANCP
session is successfully established. If an ANCP session has not been established when the number of SYN packet retransmissions reaches a preset upper threshold, the TCP connection will be closed. By default, the interval for sending SYN or SYN-ACK packets to the peer is 1 second, and the maximum number of retransmissions is 10. ----End
5.2.5 Configuring ANCP Neighbor Profiles

Configuring an ANCP neighbor profile for the CX device facilitates ANCP access line management.
Procedure
Step 1 Run:
system-view

ancp

neighbor-profile neighbor-profile-name
An ANCP neighbor profile is created and the ANCP neighbor view is displayed. ANCP neighbor profiles help the CX device to facilitate the management of ANCP access lines. Each neighbor profile can be configured with the IP address of a neighbor. If the IP address in a packet from a neighbor received by the CX device is the same as the configured IP address, the CX device associates the neighbor with the neighbor profile. Before a neighbor profile is created, the system checks whether a neighbor view with the same name already exists. If one does, the neighbor view is displayed; if one does not, a neighbor view is created and then displayed. A neighbor profile cannot be deleted when it is in use. Step 4 (Optional) Run:
tcp-listen port port-number
The port number for TCP connection listening is configured for the ANCP neighbor. Before the tcp-listen port port-number command is run, if the ANCP neighbor has already set up a TCP connection, the TCP connection will be cut off, and the ANCP neighbor will use the new listening port number to re-establish a TCP connection. By default, the port number for TCP connection listening is 6068.
NOTE
If a global source interface is configured in the ANCP view, the configuration of the tcp-listen port portnumber command is not supported.
Step 5 Run:
peer-id peer-id
The ID of the ANCP neighbor is configured.


max-access-loop value
The maximum number of access lines is configured for the ANCP neighbor. This means that the maximum number of lines that can access the CX device is configured. If the number of access lines configured in this command is smaller than the number of access lines that actually exist, existing access line entries are not affected, but no new access line entries can be created. By default, a maximum of 65536 access lines can be configured in a neighbor profile. Step 7 (Optional) Run:
keep-alive interval interval-value
The interval for sending Keepalive packets is configured. To detect the neighbor status (for example, whether the link is Up) after the ANCP session is set up, the CX device sends Keepalive packets to its neighbor (for example, the DSLAM) at a fixed interval. The default interval is 10 seconds. Step 8 (Optional) Run:
aging-time value
The aging time is set for line entries. When the ANCP neighbor line goes Down, the system needs to delete the line entry to make sure system resources are efficiently utilized. If the aging time of line entries is set to 0, the CX device deletes the line entry immediately when the neighbor line goes Down. If the aging time is set to a non-zero value, the line entry cannot be deleted until the aging timer expires. The default aging time of an ANCP neighbor line entry is 150 seconds.
NOTE
If the DSLAM needs to restart the lines after receiving service profile names from the CX device, then a longer aging time for ANCP line entries must be configured on the CX device.
----End
5.2.6 (Optional) Configuring Bandwidth Adjustment Factors

After bandwidth adjustment factors are configured, the ANCP neighbor profile adjusts bandwidth based on the configured link types.
Procedure
Step 1 Run:
system-view

ancp
The ANCP view is displayed.

Step 3 Run:
neighbor-profile neighbor-profile-name [ proxy ]
An ANCP neighbor profile is created and the ANCP neighbor view is displayed. Step 4 Run:
adjustment { adsl adjust-percentage | adsl2 adjust-percentage | adsl2plus adjustpercentage | vdsl1 adjust-percentage | vdsl2 adjust-percentage | sdsl adjustpercentage } *
The bandwidth adjustment percentages for different link types in the ANCP neighbor profile are configured.
NOTE
The types of physical links determine bandwidths reported to the CX device by the DSLAM. The CX device, however, uses the bandwidth of the Ethernet link as a basis for scheduling user traffic. This means that bandwidths need to be 'translated' to take account of the different types of physical links. Ethernet link bandwidth is set at 100%. Then, for example, if the bandwidth adjustment factor for ADSL is set to 77%, this means that when a user reports the link type as ADSL, the actual bandwidth that HQoS holds for the user is the reported bandwidth x 77%.
----End
5.2.7 (Optional) Configuring ANCP Message Damping

Performance is degraded if the CX device frequently responds to messages reporting user bandwidth changes. Configure ANCP message damping on the CX device to avoid this problem.
Context
If the DSLAM reports user bandwidth changes to the CX device, the CX device adjusts user bandwidth accordingly. If the DSLAM repeatedly sends such messages, CX device performance is affected. To prevent this problem, ANCP message damping needs to be configured on the CX device.
Procedure
Step 1 Run:
system-view

ancp

The neighbor view is displayed. Step 4 Run:

damping damping-percentage
ANCP message damping is configured. After ANCP message damping is configured, the CX device adjusts user bandwidth and delivers new configurations only when user bandwidth changes go beyond the specified percentage. The
CX device does not respond to ANCP messages that report user bandwidth changes within the specified percentage. No adjustments to user bandwidth are made in such cases. By default, ANCP messages are not damped. ----End
5.2.8 (Optional) Configuring ANCP OAM Detection

To test access line connections from a remote location, configure ANCP OAM detection.
Procedure
Step 1 Run:
system-view

ancp

oam [ count test-counter ] access-loop access-loop-circuit-id
OAM detection is configured for a specific access line. The number of times that OAM detection will be performed is also set. By default, the number of times that OAM detection will be performed is 5. Step 4 (Optional) Run:
The ANCP neighbor view is displayed. Step 5 (Optional) Run:

oam timeout time
The timeout period for the response to OAM detection is configured. ANCP OAM detection fails if the CX device receives no response to OAM detection during the timeout period. By default, the timeout period is 5s.
NOTE
The oam timeout command can be configured when the neighbor profile mode is server or proxy server.
----End
5.2.9 (Optional) Adjusting the Upstream and Downstream Bandwidths of a User Automatically
Automatic adjustment of downstream bandwidth for a user must be enabled in the AAA domain view of the user.
Procedure
Step 1 Run:
system-view

aaa
The AAA view is displayed. Step 3 Run:

domain domain-name
The domain view is displayed. Step 4 Run:

ancp auto-qos-adapt
Automatic adjustment of downstream bandwidth for a user is enabled. By default, automatic adjustment of downstream bandwidth for a user is not enabled. ----End

After the CX device is configured as an ANCP server, you can check information about ANCP neighbors, the ANCP neighbor profile, and line entries in the ANCP neighbor profile, as well as statistics about ANCP neighbors.
Procedure
Step 1 Run the display ancp neighbor [ profile neighbor-profile | id id-value ] command to view information about an ANCP neighbor. Step 2 Run the display ancp neighbor-profile [ neighbor-profile-name ] command to view information about an ANCP neighbor profile. Step 3 Run the display ancp access-loop [ access-loop-circuit- index | circuit-id circuit-id-text | circuit-id-include circuit-id-include-text | neighbor-profile neighbor-profile-name | neighborid neighbor-id ] command to view information about line entries in the ANCP neighbor profile. Step 4 Run the display ancp statistic [ neighbor-id ] command to view the statistics of an ANCP neighbor. ----End
Example
After running the display ancp neighbor command, you can view the status of an ANCP neighbor in a specified neighbor profile and the status of an ANCP neighbor with a specified neighbor ID. For example:
<HUAWEI> display ancp neighbor -------------------------------------------------------------------------Index Peer-ID State Role Line-num Profile -------------------------------------------------------------------------0 1.1.1.1 ESTAB sever 0 bras
Issue 01 (2011-05-30)
5-13
-------------------------------------------------------------------------The total is 1,printed is 1 <HUAWEI> display ancp neighbor id 1.1.1.1 Neighbor Profile name :bras Neighbor state :ESTAB Peer ID :1.1.1.1 Peer port :51729 Neighbor capacity :discovery;line-cfg;oam;Bulk Transacti on; Neighbor techtype :5(5 is DSL) Access loop circuit number :7 Session message interval :12(seconds) Session message retransmit :10 Max access loop number :65536 Access loop configure timeout :2(seconds) Access loop configure ack mandatory :false Access loop aging time :150(seconds) Access loop oam timeout :5(seconds) Keep-alive interval :10(seconds) Wait-ack timeout :30000(milliseconds) ANCP role :server
After running the display ancp neighbor-profile command, you can view the configuration of the specified neighbor profile. For example:
<HUAWEI> display ancp neighbor-profile bras Index :3 Neighbor Profile name :bras Neighbor Used state :used ANCP role :server ANCP source interface :LoopBack1 TCP-listen port number :6068 Damping percentage :0 Peer ID :1.1.1.1 Max access loop number :65536 Access loop configure timeout :2(seconds) Access loop configure ack mandatory :false Access loop aging time :150(seconds) Access loop oam timeout :5(seconds) Keep-alive interval :10(seconds)
After running the display ancp access-loop command, you can view information about access line entries. For example:
<HUAWEI> display ancp access-loop neighbor-id 1.1.1.1 ---------------------------------------------------------------Index State Peer-ID Circuit-ID ---------------------------------------------------------------80 UP 1.1.1.1 001882362CFF eth 1/3/1/5:5 81 UP 1.1.1.1 001882362CFF eth 1/3/0/1:1 ---------------------------------------------------------------The total is 2,printed is 2
After running the display ancp statistic command, you can view the statistics of ANCP neighbors. For example:
<HUAWEI> display ancp statistic 10.1.1.1 Received ack packet :307 Received syn packet :1 Received synack packet :1 Received reset ack packet :0 Received lineup packet :7 Received linedown packet :0 Received oam packet :0 Received line config packet :0 Received multicast packet :0 Received unknown packet :0 Send ack packet :307 Send synack packet :1 Send syn packet :1 Send reset ack packet :0 Send oam packet :0
5-14
Issue 01 (2011-05-30)

Send access loop config packet Send multicast packet Send failed packet :2 :0 :0
5.3 Configuring the ANCP Proxy

As an ANCP proxy, the CX device establish ANCP neighbor relationships with the DSLAM and the BRAS to aggregate ANCP lines. 5.3.1 Establishing the Configuration Task Before configuring the CX device as an ANCP proxy, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. 5.3.2 Enabling ANCP The system can perform socket interception and processes TCP connection requests from a DSLAM only after being enabled with ANCP. 5.3.3 Configuring the Source Interface of an ANCP Connection The interface that is connected to a DSLAM to set up a TCP connection can only be a loopback interface. 5.3.4 (Optional) Configuring Parameters of ANCP Sessions You can configure an interval at which the local end sends an SYN or SYN-ACK packet to the peer and the maximum number of retransmissions. 5.3.5 Configuring the ANCP Neighbor Profile To make the CX device function as an ANCP proxy, you need to create an ANCP neighbor profile and establish neighbor relationships with the upstream BRAS and the downstream DSLAM. 5.3.6 (Optional) Configuring Bandwidth Adjustment Factors After bandwidth adjustment factors are configured, the ANCP neighbor profile adjusts bandwidth based on the configured link types. 5.3.7 (Optional) Enabling the Function of Configuring ANCP Access Lines You can configure ANCP access lines and enable the CX device to deliver a line profile name to the peer DSLAM. 5.3.8 (Optional) Configuring ANCP Message Damping Performance is degraded if the CX device frequently responds to messages reporting user bandwidth changes. Configure ANCP message damping on the CX device to avoid this problem. 5.3.9 (Optional) Configuring ANCP OAM Detection To test access line connections from a remote location, configure ANCP OAM detection. 5.3.10 Checking the Configuration After the CX device is configured as an ANCP proxy, you can check information about ANCP neighbors, the ANCP neighbor profile, and line entries in the ANCP neighbor profile, as well as the statistics about ANCP neighbors.

Before configuring the CX device as an ANCP proxy, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately.
If both the DSLAM and the BRAS support ANCP and the CX device functions as the convergence device between them, , you must configure the CX device as an ANCP proxy. In this case, the CX device detects neither user services nor user login and logout.
Before configuring the CX device to function as an ANCP proxy, complete the following tasks: l l Configuring physical parameters and link attributes to ensure that interfaces work properly Configuring IP addresses and routing protocols for interfaces
Data Preparation
To configure the CX device to function as an ANCP proxy, you need the following data. No. 1 2 3 4 5 6 7 8 9 10 Data Source interface of the ANCP connection (Optional) Timeout period for an attempt to set up an ANCP session and the maximum number of packet retransmissions Name of the ANCP neighbor profile IP address of the ANCP neighbor (Optional) Maximum number of lines permitted by each ANCP neighbor (Optional) Interval for sending Keepalive packets for ANCP sessions (Optional) Aging time of line entries (Optional) Percentage of ANCP messages subject to damping (Optional) Number of OAM detections (Optional) Timeout period to wait for a response to OAM detection
5.3.2 Enabling ANCP

The system can perform socket interception and processes TCP connection requests from a DSLAM only after being enabled with ANCP.
Procedure
Step 1 Run:
system-view

ancp enable
5-16
Issue 01 (2011-05-30)
ANCP is enabled. The system performs socket listening and processes TCP connection requests from the DSLAM only after ANCP is enabled. When ANCP is disabled, all ANCP TCP connections are severed, and socket listening is disabled. By default, ANCP is disabled. ----End
5.3.3 Configuring the Source Interface of an ANCP Connection

The interface that is connected to a DSLAM to set up a TCP connection can only be a loopback interface.
Procedure
Step 1 Run:
system-view

ancp

source-interface loopback interface-number
The source interface is configured for setting up an ANCP connection. When the interface is connected to the DSLAM to set up a TCP connection, the source interface can only be a loopback interface. Changing the source-interface { loopback | virtualethernet | gigabitethernet } interface-number command or the IP address of the interface takes effect only when ANCP is disabled and then enabled again. ----End
5.3.4 (Optional) Configuring Parameters of ANCP Sessions

You can configure an interval at which the local end sends an SYN or SYN-ACK packet to the peer and the maximum number of retransmissions.
Procedure
Step 1 Run:
system-view

ancp

session { interval interval-value | retransmit retransmit-value }*
Issue 01 (2011-05-30)
5-17
The timeout period for ANCP sessions and the maximum number of ANCP packet retransmissions are configured. After a TCP connection is established, CX device sends SYN packets to set up an ANCP session. If the local end does not receive the correct response, it resends SYN packets until an ANCP session is successfully established. If an ANCP session has not been established when the number of SYN packet retransmissions reaches a preset upper threshold, the TCP connection will be closed. By default, the interval for sending SYN or SYN-ACK packets to the peer is 1 second, and the maximum number of retransmissions is 10. ----End
5.3.5 Configuring the ANCP Neighbor Profile

To make the CX device function as an ANCP proxy, you need to create an ANCP neighbor profile and establish neighbor relationships with the upstream BRAS and the downstream DSLAM.
Context
To facilitate management of ANCP access lines, the CX device uses ANCP neighbor profiles. Each neighbor profile can be configured with the IP address of a neighbor. If the IP address of a packet from a neighbor is the same as the configured IP address, the neighbor is considered to belong to the neighbor profile. Before a neighbor profile is created, the system checks whether a neighbor profile with the same name exists. If one exists, the neighbor view is displayed; if one does not exist, a neighbor view is created and then displayed. A neighbor profile cannot be deleted when it is in use.
Procedure
Step 1 Run:
system-view

ancp

neighbor-profile neighbor-profile-name proxy [ client ]
An ANCP neighbor profile in proxy mode is created and the neighbor view is displayed. If client is not specified, the neighbor profile works in proxy server mode and is used to set up a neighbor relationship with the downstream DSLAM. If client is specified, the neighbor profile works in proxy client mode and is used to set up a neighbor relationship with the upstream BRAS.
NOTE
In proxy mode, only one neighbor profile can be configured to work in proxy client mode.
5-18
Issue 01 (2011-05-30)

tcp-listen port port-number
The port number on an ANCP neighbor for TCP connection listening is configured. If the ANCP neighbor has an existing TCP connection set up when the tcp-listen port command is run, this TCP connection will be severed and the ANCP neighbor will use the new listening port to establish a new TCP connection. By default, the port number for TCP connection listening is 6068. Step 5 Run:
peer-id peer-id
The ID of the ANCP neighbor is configured. Step 6 (Optional) Run:

max-access-loop value
The maximum number of access lines is configured for the ANCP neighbor. If the number of access lines configured in this command is smaller than the number of access lines that actually exist, existing access line entries are not affected, but no new access line entries can be created. By default, a maximum of 65536 access lines can be configured in a neighbor profile. Step 7 (Optional) Run:
keep-alive interval interval-value
The interval for sending Keepalive packets is configured. To detect the neighbor status (for example, to detect whether the link is Up), after an ANCP session is set up, the CX device sends Keepalive packets to its neighbor (for example, the DSLAM) at a fixed interval. The default interval time is 10 seconds. Step 8 (Optional) Run:
aging-time value
The aging time is set for line entries. When an ANCP neighbor line goes Down, the system needs to delete the line entry to make sure system resources are efficiently utilized. If the aging time of a line entry is set to 0, the entry is deleted immediately when the line goes Down. If the aging time is set to a non-zero value, the line entry cannot be deleted until the aging timer expires. The default aging time of an ANCP neighbor line entry is 150 seconds. ----End
5.3.6 (Optional) Configuring Bandwidth Adjustment Factors

After bandwidth adjustment factors are configured, the ANCP neighbor profile adjusts bandwidth based on the configured link types.
Procedure
Step 1 Run:
system-view

ancp

An ANCP neighbor profile is created and the ANCP neighbor view is displayed. Step 4 Run:
adjustment { adsl adjust-percentage | adsl2 adjust-percentage | adsl2plus adjustpercentage | vdsl1 adjust-percentage | vdsl2 adjust-percentage | sdsl adjustpercentage } *
The bandwidth adjustment percentages for different link types in the ANCP neighbor profile are configured.
NOTE
The types of physical links determine bandwidths reported to the CX device by the DSLAM. The CX device, however, uses the bandwidth of the Ethernet link as a basis for scheduling user traffic. This means that bandwidths need to be 'translated' to take account of the different types of physical links. Ethernet link bandwidth is set at 100%. Then, for example, if the bandwidth adjustment factor for ADSL is set to 77%, this means that when a user reports the link type as ADSL, the actual bandwidth that HQoS holds for the user is the reported bandwidth x 77%.
----End
5.3.7 (Optional) Enabling the Function of Configuring ANCP Access Lines

You can configure ANCP access lines and enable the CX device to deliver a line profile name to the peer DSLAM.
Procedure
Step 1 Run:
system-view

ancp

access-loop-configure { circuit-id circuit-id | index index } service-profile profile-name
The name of the profile delivered to the peer is configured and the configuration of ANCP access lines is enabled.
The access-loop-configure { circuit-id circuit-id | index index } service-profile profilename command is used to enable ANCP access line configurations and to configure the CX device to deliver profile names to the DSLAM. When the access-loop-configure { circuit-id circuit-id | index index } service-profile profilename command is run on the ANCP server, the parameters in the profile, such as QoS parameters and bandwidths, need to be configured on the DSLAM. The parameters in the profile are valid for users that go online after the profile is delivered.
NOTE
If the DSLAM needs to restart a line after receiving a profile name from the CX device, you must run the aging-time command on the CX device to set a longer aging times for ANCP line entries.
Step 4 (Optional) Run either of the following commands as required. l Run the line-configure timeout time command and the timeout period for responses to delivered profiles is configured. If the CX device receives no response during the timeout period, it assumes that the delivery of the profile failed. l Run the line-configure ack-mandatory command, and no response to the delivered profile is required. By default, the timeout period is 5 seconds. ----End
5.3.8 (Optional) Configuring ANCP Message Damping

Performance is degraded if the CX device frequently responds to messages reporting user bandwidth changes. Configure ANCP message damping on the CX device to avoid this problem.
Context
If the DSLAM reports user bandwidth changes to the CX device, the CX device adjusts user bandwidth accordingly. If the DSLAM repeatedly sends such messages, CX device performance is affected. To prevent this problem, ANCP message damping needs to be configured on the CX device.
Procedure
Step 1 Run:
system-view

ancp

The neighbor view is displayed. Step 4 Run:

damping damping-percentage
ANCP message damping is configured. After ANCP message damping is configured, the CX device adjusts user bandwidth and delivers new configurations only when user bandwidth changes go beyond the specified percentage. The CX device does not respond to ANCP messages that report user bandwidth changes within the specified percentage. No adjustments to user bandwidth are made in such cases. By default, ANCP messages are not damped. ----End
5.3.9 (Optional) Configuring ANCP OAM Detection

To test access line connections from a remote location, configure ANCP OAM detection.
Procedure
Step 1 Run:
system-view

ancp

oam [ count test-counter ] access-loop access-loop-circuit-id
OAM detection is configured for a specific access line. The number of times that OAM detection will be performed is also set. By default, the number of times that OAM detection will be performed is 5. Step 4 (Optional) Run:
The ANCP neighbor view is displayed. Step 5 (Optional) Run:

oam timeout time
The timeout period for the response to OAM detection is configured. ANCP OAM detection fails if the CX device receives no response to OAM detection during the timeout period. By default, the timeout period is 5s.
NOTE
The oam timeout command can be configured when the neighbor profile mode is server or proxy server.
----End

After the CX device is configured as an ANCP proxy, you can check information about ANCP neighbors, the ANCP neighbor profile, and line entries in the ANCP neighbor profile, as well as the statistics about ANCP neighbors.
Procedure
Step 1 Run the display ancp neighbor [ profile neighbor-profile | id id-value ] command to view information about the ANCP neighbor. Step 2 Run the display ancp neighbor-profile [ neighbor-profile-name ] command to view the configuration of the ANCP neighbor profile. Step 3 Run the display ancp access-loop [ access-loop-circuit- index | circuit-id circuit-id-text | circuit-id-include circuit-id-include-text | neighbor-profile neighbor-profile-name | neighborid neighbor-id ] command to view information about line entries in the ANCP neighbor profile. Step 4 Run the display ancp statistic [ neighbor-id ] command to view the ANCP statistics about the neighbor. ----End
Example
After running the display ancp neighbor command, you can view the status of all ANCP neighbors, a neighbor with a specified neighbor profile, and a neighbor with a specified neighbor ID. For example:
<HUAWEI> display ancp neighbor Index Peer-ID State Role Line-num Profile -------------------------------------------------------------------------0 123.1.3.1 ESTAB proxy client 0 bras 1 10.1.1.1 ESTAB proxy server 2 dslam -------------------------------------------------------------------------The total is 2,printed is 2 <HUAWEI> display ancp neighbor id 10.1.1.1 Neighbor Profile name :dslam Neighbor state :ESTAB Peer ID :10.1.1.1 Peer port :49233 Neighbor capacity :discovery;line-cfg;oam; Neighbor techtype :5(5 is DSL) Access loop circuit number :2 Session message interval :20(seconds) Session message retransmit :5 Max access loop number :65536 Access loop configure timeout :5(seconds) Access loop configure ack mandatory :false Access loop aging time :47(seconds) Access loop oam timeout :50(seconds) Keep-alive interval :10(seconds) Wait-ack timeout :30000(milliseconds) ANCP role :proxy server
<HUAWEI> display ancp neighbor-profile dslam1 Index :1 Neighbor Profile name :dslam Neighbor Used state :used ANCP role :proxy server Auto-qos-adapt attribute :both
Issue 01 (2011-05-30)
5-23
TCP-listen port number Damping percentage Peer ID Max access loop number Access loop configure timeout Access loop configure ack mandatory Access loop aging time Access loop oam timeout Keep-alive interval

:6068 :0 :10.1.1.1 :65536 :5(seconds) :false :47(seconds) :50(seconds) :10(seconds)
<HUAWEI> display ancp access-loop neighbor-profile dslam ---------------------------------------------------------------Index State Peer-ID Circuit-ID ---------------------------------------------------------------10 UP 10.1.1.1 001882362CFF eth 0/3/0/1:10 11 UP 10.1.1.1 001882362CFF eth 0/3/0/2:6 ---------------------------------------------------------------The total is 2,printed is 2
After running the display ancp statistic command, you can view the ANCP statistics about a neighbor. For example:
<HUAWEI> display ancp statistic 10.1.1.1 Received ack packet :96 Received syn packet :0 Received synack packet :1 Received reset ack packet :0 Received lineup packet :2 Received linedown packet :0 Received oam packet :0 Received line config packet :0 Received multicast packet :0 Received unknown packet :0 Send ack packet :96 Send synack packet :1 Send syn packet :1 Send reset ack packet :0 Send oam packet :0 Send access loop config packet :0 Send multicast packet :0 Send failed packet :0
5.4 Configuring the Association Between ANCP and HQoS in the ANCP Proxy Scenario
After ANCP is associated with HQoS, ANCP can be used to control the traffic rate for downstream user lines and QoS parameters. 5.4.1 Establishing the Configuration Task Before associating ANCP with HQoS, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. 5.4.2 Configuring the Mode of the Association Between ANCP and HQoS This configuration is applicable only to an ANCP neighbor whose attribute is proxy server. 5.4.3 Configuring the QoS Profile and Scheduling Parameters This configuration is required only if ANCP is associated with HQoS on an ANCP neighbor whose attribute is proxy server. 5.4.4 Configuring the BRAS to Deliver the QoS Policy Name
This configuration only applies to an ANCP neighbor whose attribute is proxy server. 5.4.5 Applying the QoS Profile to the Interface This configuration is required only if a neighbor profile is configured with the proxy server attribute and ANCP is associated with HQoS in DSLAM mode. 5.4.6 Enabling ANCP on the Interface and Associating the Interface with the ANCP Neighbor Profile This configuration is required only if ANCP is associated with HQoS on an ANCP neighbor whose attribute is proxy server. 5.4.7 Checking the Configuration After ANCP is associated with HQoS, you can check information about ANCP neighbors, the ANCP neighbor profile, and line entries in the ANCP neighbor profile, as well as the statistics about ANCP neighbors.

Before associating ANCP with HQoS, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately.
When the CX device functions as an ANCP server or an ANCP proxy, you must configure ANCP to support HQoS if ANCP is required to control the traffic rate for downstream user lines and QoS scheduling parameters for various services. l l If the CX device functions as an ANCP server, only bandwidth adjustment factors need to be configured. If the CX device functions as an ANCP proxy, you must configure bandwidth adjustment factors, association between ANCP and HQoS, and a QoS profile and scheduling parameters. You must enable ANCP on the interface, associate the interface with the ANCP neighbor profile, and apply the QoS profile.
Before configuring ANCP functions, complete the following tasks: l l l Configuring the physical parameters and link attributes of interfaces to ensure that the interfaces work properly Configuring IP addresses and routing protocols for interfaces Enabling ANCP and configuring ANCP neighbor profiles
Data Preparation
To configure ANCP support for HQoS, you need the following data. No. 1 2
Issue 01 (2011-05-30)
Data Source interface of the ANCP connection Name of the ANCP neighbor profile
No. 3 4 5 6 7 8
Data IP address of the ANCP neighbor Bandwidth adjustment factor for the ANCP neighbor ANCP-enabled sub-interface Mode of the association between ANCP and HQoS Scheduling parameter in the QoS profile Interface to which the QoS profile is applied
5.4.2 Configuring the Mode of the Association Between ANCP and HQoS
This configuration is applicable only to an ANCP neighbor whose attribute is proxy server.
Context
If ANCP is associated with QoS and both the DSLAM and the BRAS report QoS messages, the mode of the association between ANCP and HQoS determines which QoS messages are selected by the device.
Procedure
Step 1 Run:
system-view

ancp

neighbor-profile neighbor-profile-name proxy
The neighbor profile view is displayed. Step 4 Run:

auto-qos-adapt{ dslam | bras | both }
The mode of the association between ANCP and HQoS is configured. If dslam is specified, apply the specified QoS profile name to the downstream interface for user services. The CX device is then able to restrict the downstream bandwidth of user services based on the actual physical bandwidth and the minimum value of HQoS reported by the ANCP line. If bras is specified, the BRAS delivers a QoS profile name to a user, and the CX device receives and applies the QoS policy.
If both are specified, the BRAS needs to deliver a QoS profile name to a user, and the CX device receives and applies the QoS policy. If the DSLAM then reports line update messages, ANCP adjusts user bandwidth based on the new bandwidth information. ----End
5.4.3 Configuring the QoS Profile and Scheduling Parameters

This configuration is required only if ANCP is associated with HQoS on an ANCP neighbor whose attribute is proxy server.
Procedure
Step 1 Run:
system-view

qos-profile qos-profile-name
A QoS profile is created and the QoS profile view is displayed. Step 3 You may configure user queue scheduling parameters or traffic assurance for users, as required. l Run the user-queue cir cir-value [ pir pir-value] [ flow-queue flow-queue name ] [ flowmapping flow-mapping name ] [ user-group-queue user-group-queue name ] [ servicetemplate service-template-name ]* [ inbound | outbound ] command to configure user queue scheduling parameters to implement HQoS on user services. l Run the car { cir cir-value [ pir pir-value] } [ cbs cbs-value pbs pbs-value ] [ green { discard | pass } | yellow { discard | pass } | red { discard | pass } ]* [ inbound | outbound ] command to set a committed access rate (CAR) to ensure that user traffic can be forwarded properly. l Run the broadcast-suppression cir cir-value [ cbs cbs-value ] [ inbound | outbound ] command to set the suppression rate for broadcast packets in the QoS profile. l Run the multicast-suppression cir cir-value [ cbs cbs-value ] [ inbound | outbound ] command to set a suppression rate for multicast packets in the QoS profile. l Run the unknown-unicast-suppression cir cir-value [ cbs cbs-value ] [ inbound | outbound ] command to set a suppression rate for unknown unicast packets in the QoS profile.
NOTE
l The car command and the user-queue command in the QoS profile are mutually exclusive. The two commands cannot both be configured. l If you have run the qos-profile command on an interface, you cannot run the user-queue command, run the car command, or enable the traffic suppression function on that interface. If the commands in Step 3 specify the traffic direction and the configured direction is different from the traffic direction to which the QoS profile is applied on the interface, the profile does not take effect. If the commands do not specify the traffic direction, the QoS profile will take effect in the direction that it is applied. l If uni-directional user queue scheduling (for either incoming or outgoing traffic) is already configured, you cannot configure user queue scheduling without specifying the traffic direction. Conversely, if directionless user queue scheduling is already configured, you cannot configure uni-directional user queue scheduling.
Issue 01 (2011-05-30)
5-27
For detailed QoS profile configurations, refer to the HUAWEI CX600 Configuration Guide QoS. ----End
5.4.4 Configuring the BRAS to Deliver the QoS Policy Name

This configuration only applies to an ANCP neighbor whose attribute is proxy server.
Procedure
Step 1 Run:
system-view

ancp

access-loop-configure { circuit-id circuit-id |index index } service-profile profile-name
Configure the BRAS to deliver the QoS policy name. ----End
5.4.5 Applying the QoS Profile to the Interface

This configuration is required only if a neighbor profile is configured with the proxy server attribute and ANCP is associated with HQoS in DSLAM mode.
Procedure
Step 1 Run:
system-view

interface interface-type interface-number [.sub-interface ]
The interface view for adjusting bandwidths is displayed. Step 3 Choose the appropriate command line to apply QoS profiles on interfaces of different types. l Run the qos-profile qos-profile-name { inbound | outbound } [ group group-name ] [ before-layer2-encapsulation ] command on GE interfaces, Eth-Trunk interfaces, Ethernet interfaces and their sub-interfaces to apply QoS profiles. l Run the qos-profile qos-profile-name { inbound | outbound } vlan vlan-id1 [ to vlan-id2 ] identifier { vlan-id | none } [ group group-name ] [ before-layer2-encapsulation ] command on Layer 2 GE interfaces, Layer 2 Eth-Trunk interfaces, Dot1q termination subinterfaces to apply QoS profiles. l Run the qos-profile profile-name { inbound | outbound } pe-vid pe-vid ce-vid ce-vid1 [ to ce-vid2 ] [ identifier { pe-vid | ce-vid | pe-ce-vid | none } ] [group group-name ] [
before-layer2-encapsulation ] command on QinQ termination sub-interfaces and QinQ mapping interfaces to apply QoS profiles. ----End
5.4.6 Enabling ANCP on the Interface and Associating the Interface with the ANCP Neighbor Profile
This configuration is required only if ANCP is associated with HQoS on an ANCP neighbor whose attribute is proxy server.
Procedure
Step 1 Run:
system-view

interface interface-type interface-number [.subinterface-number]

ancp enable neighbor-profile-name
The ANCP function is enabled on the interface, and an ANCP neighbor profile is associated with the interface. ----End

After ANCP is associated with HQoS, you can check information about ANCP neighbors, the ANCP neighbor profile, and line entries in the ANCP neighbor profile, as well as the statistics about ANCP neighbors.
Procedure
Step 1 Run the display ancp neighbor [ profile neighbor-profile | id id-value ] command to view information about an ANCP neighbor. Step 2 Run the display ancp neighbor-profile [ neighbor-profile-name ] command to view the configuration of an ANCP neighbor profile. Step 3 Run the display ancp access-loop [ access-loop-circuit- index | circuit-idcircuit-id-text | circuit-id-include circuit-id-include-text | neighbor-profile neighbor-profile-name | neighborid neighbor-id ] command to view information about line entries in an ANCP neighbor profile. Step 4 Run the display ancp statistic [ neighbor-id ] command to view the statistics of an ANCP neighbor. ----End
Example
After running the display ancp neighbor command, you can view the status of all neighbors. For example:
<HUAWEI> display ancp neighbor Index Peer-ID State Role Line-num Profile -------------------------------------------------------------------------0 123.1.3.1 ESTAB proxy client 0 bras 1 10.1.1.1 ESTAB proxy server 2 dslam -------------------------------------------------------------------------The total is 2,printed is 2
After running the display ancp neighbor id 10.1.1.1 command, you can view the status of the neighbor whose ID is 10.1.1.1.
<HUAWEI> display ancp neighbor id 10.1.1.1 Neighbor Profile name :dslam Neighbor state :ESTAB Peer ID :10.1.1.1 Peer port :49233 Neighbor capacity :discovery;line-cfg;oam; Neighbor techtype :5(5 is DSL) Access loop circuit number :2 Session message interval :20(seconds) Session message retransmit :5 Max access loop number :65536 Access loop configure timeout :5(seconds) Access loop configure ack mandatory :false Access loop aging time :47(seconds) Access loop oam timeout :50(seconds) Keep-alive interval :10(seconds) Wait-ack timeout :30000(milliseconds) ANCP role :proxy server
<HUAWEI> display ancp neighbor-profile dslam1 Index :1 Neighbor Profile name :dslam1 Neighbor Used state :used ANCP role :proxy server Auto-qos-adapt attribute :both TCP-listen port number :6068 Damping percentage :0 Peer ID :10.1.1.1 Max access loop number :65536 Access loop configure timeout :5(seconds) Access loop configure ack mandatory :false Access loop aging time :47(seconds) Access loop oam timeout :50(seconds) Keep-alive interval :10(seconds)
<HUAWEI> display ancp access-loop neighbor-profile dslam ---------------------------------------------------------------Index State Peer-ID Circuit-ID ---------------------------------------------------------------10 UP 10.1.1.1 001882362CFF eth 0/3/0/1:10 11 UP 10.1.1.1 001882362CFF eth 0/3/0/2:6 ---------------------------------------------------------------The total is 2,printed is 2
After running the display ancp statistic command, you can view the ANCP statistics of a neighbor. For example:
<HUAWEI> display ancp statistic 10.1.1.1 Received ack packet :96
5-30
Issue 01 (2011-05-30)

Received syn packet Received synack packet Received reset ack packet Received lineup packet Received linedown packet Received oam packet Received line config packet Received multicast packet Received unknown packet Send ack packet Send synack packet Send syn packet Send reset ack packet Send oam packet Send access loop config packet Send multicast packet Send failed packet :0 :1 :0 :2 :0 :0 :0 :0 :0 :96 :1 :1 :0 :0 :0 :0 :0
5.5 Maintaining ANCP

You may clear ANCP running information as part of ANCP maintenance. 5.5.1 Clearing ANCP Running Information To clear ANCP running information, run the reset commands in the ANCP view.
5.5.1 Clearing ANCP Running Information

To clear ANCP running information, run the reset commands in the ANCP view.
CAUTION
ANCP running information cannot be restored after it is cleared. Excercise caution when running the commands. To clear ANCP running information, run the following reset commands in the ANCP view. Action Clear information about ANCP access line entries. Clear information about ANCP neighbor entries. Clear statistics about ANCP . Command reset ancp access-loop [ circuit-id access-loopcircuit-id | neighbor-profile neighbor-profilename | neighbor-id neighbor-id ] reset ancp neighbor [ profile neighbor-profilename | id neighbor-id-value ] reset ancp statistic [ neighbor-id ]

ANCP configuration examples explain networking requirements and configuration procedures and provide networking diagrams, configuration notes, and configuration roadmaps. 5.6.1 Example for Configuring the ANCP Server
When configured as an ANCP server, the CX device functions as both a BRAS and an SR. As an SR, the CX device can sense the topology of the access network and the parameters of access line. This allows it to prevent congestion on the access network. As a BRAS, the CX device can automatically adjust policies on the DSLAM by updating user services on the ANCP. 5.6.2 Configuring CX device as the ANCP Proxy and Configuring ANCP-HQoS Association When configured as an ANCP proxy, the CX device can aggregate ANCP connections. Aggregation prevents too many DSLAMs from being connected to the BRAS. The ANCP-HQoS association can reduce the need for manual configuration. By automatically adjusting user bandwidths, the ANCP-HQoS association prevents traffic congestion on a DSLAM.
5.6.1 Example for Configuring the ANCP Server

When configured as an ANCP server, the CX device functions as both a BRAS and an SR. As an SR, the CX device can sense the topology of the access network and the parameters of access line. This allows it to prevent congestion on the access network. As a BRAS, the CX device can automatically adjust policies on the DSLAM by updating user services on the ANCP.
Prerequisite
Before configuring the ANCP server, routes between connected devices must be completely configured.
Networking requirements are changing as networks converge and tri-play services develop. As shown in Figure 5-3, the CX device needs to be deployed on the convergence layer at the edge of a broadband MAN. In this location, the CX device acts as the service control gateway as well as the authentication and accounting gateway for various types of broadband access users. The CX device is positioned to provide users with a wide range of both broadband access services and value added services. In addition, the CX device is able to implement bandwidth control, traffic policing, and QoS enforcement for user services. The DSLAM supports ANCP and the CX device functions as the BRAS to manage users. It detects user services and user login and logout. Other requirements are as follows: l l l l The maximum number of access lines for the DSLAM with IP address 10.1.1.1 is 3000. Lines accessed by the DSLAM can be configured on the CX device. When users log in, the CX device is able to use information about access lines to automatically adjust the downstream bandwidth for these users. The CX device is able to configure bandwidth adjustment factors based on the types of user services.
5-32
Issue 01 (2011-05-30)
Figure 5-3 Networking diagram of configuring the ANCP server phone
PC
ADSL/VDSL Modem 1 IPTV phone DSLAM CX IP/MPLS backbone
PC
ADSL/VDSL Modem 2 IPTV
The configuration roadmap is as follows: 1. 2. 3. 4. 5. Enable ANCP. Configure the source interface of the ANCP connection. Configure the ANCP session parameters. Configure the ANCP neighbor profile and parameters. Configure bandwidth adjustment factors.
Data Preparation
To complete the configuration, you need the following data: l l l l l IP address of the source interface of the ANCP connection ANCP neighbor name and IP address ANCP session parameter Maximum number of access lines, handshaking interval, and the timeout period to wait for a response to an access line configuration request for an ANCP neighbor Bandwidth adjustment factor
NOTE
The following describes the configuration of the CX device. For configurations of the ADSL/VDSL modem and DSLAM, see the relevant configuration guides.
Issue 01 (2011-05-30)
5-33
Procedure
Step 1 Configure ANCP. # Enable ANCP.
<HUAWEI> system-view [HUAWEI] ancp enable
# Configure the source interface of the ANCP connection.

[HUAWEI] interface loopback 1 [HUAWEI-LoopBack1] ip address 1.1.1.1 24 [HUAWEI-LoopBack1] quit [HUAWEI] ospf 82 [HUAWEI-ospf-82]area 0 [HUAWEI-ospf-82-area-0.0.0.0] network 1.1.1.1 0.0.0.0 [HUAWEI-ospf-82-area-0.0.0.0] quit [HUAWEI-ospf-82] quit [HUAWEI] ancp [HUAWEI-ancp] source-interface loopback 1
# Configure the ANCP session parameters.

[HUAWEI-ancp] session interval 10 retransmit 20
# Configure the ANCP neighbor profile and bandwidth adjustment factors.

[HUAWEI-ancp] neighbor-profile dslam1 [HUAWEI-ancp-neighbor-dslam1] peer-id 10.1.1.1 [HUAWEI-ancp-neighbor-dslam1] max-access-loop 3000 [HUAWEI-ancp-neighbor-dslam1] line-configure timeout 10 [HUAWEI-ancp-neighbor-dslam1] keep-alive interval 20 [HUAWEI-ancp-neighbor-dslam1] adjustment adsl 77 vdsl1 90 [HUAWEI-ancp-neighbor-dslam1] quit
NOTE
The IP address specified in peer-id must be the same as the IP address that is used by the peer to set up the TCP connection.
Step 2 Verify the configuration. # Check the configurations of the ANCP neighbor profile named dslam1.
<HUAWEI> display ancp neighbor-profile dslam1 Index Neighbor Profile name Neighbor Used state ANCP role TCP-listen port number Damping percentage Adjustment Peer ID Max access loop number Access loop configure timeout Access loop configure ack mandatory Access loop aging time Access loop oam timeout Keep-alive interval :0 :dslam1 :unused :server :6068 :0 :adsl 77 vdsl1 90 :10.1.1.1 :3000 :10(seconds) :false :150(seconds) :20(seconds) :20(seconds)
# Check the entry information about the access line named access1.
<HUAWEI> display ancp access-loop Circuit index Circuit ID Peer ID Dsl type Actual datarate upstream :1 :access1 :10.1.1.1 :ADSL2 :143(Kbps)
5-34
Issue 01 (2011-05-30)

Actual datarate downstream The total is 1,printed is 1 :153(Kbps)
When traffic flows on the network, forwarding of traffic on access line 1 is based on the QoS profile named test. This profile is configured by the DSLAM. ----End
Configuration Files
# sysname HUAWEI # ancp enable # interface LoopBack1 ip address 1.1.1.1 255.255.255.0 # ospf 82 area 0 network 1.1.1.1 0.0.0.0 # ancp source-interface LoopBack1 session interval 10 retransmit 20 neighbor-profile dslam1 peer-id 10.1.1.1 adjustment adsl 77 vdsl1 90 keep-alive interval 20 line-configure timeout 10 max-access-loop 3000 # return
5.6.2 Configuring CX device as the ANCP Proxy and Configuring ANCP-HQoS Association
When configured as an ANCP proxy, the CX device can aggregate ANCP connections. Aggregation prevents too many DSLAMs from being connected to the BRAS. The ANCP-HQoS association can reduce the need for manual configuration. By automatically adjusting user bandwidths, the ANCP-HQoS association prevents traffic congestion on a DSLAM.
Prerequisite
Before configuring the CX device as the ANCP proxy and configuring the ANCP-HQoS association, routes between connected devices must be completely configured.
To implement automatic topology discovery and automatic link configuration in the access network, you must configure ANCP between the DSLAM and BRAS. One BRAS can normally have hundreds of ANCP peers. If, however, too many DSLAMs are connected to a BRAS, the ANCP proxy needs to be configured on the CX device to aggregate ANCP connections. When a user customizes new services, ANCP-HQoS association automatically adjusts the user bandwidth on the CX device. This prevents traffic congestion on the DSLAM. As shown in Figure 5-4, both the DSLAM and the BRAS support ANCP. Functioning as the aggregation device, the CX device sets up ANCP neighbor relationships with the DSLAM and the BRAS. Other requirements are as follows:
l l l l l
The maximum number of access lines for the DSLAM with IP address 10.1.1.1 is 3000. Lines accessed by the DSLAM can be configured on the CX device. The CX device is able to configure bandwidth adjustment factors based on the types of user services. Traffic flows of different user services enter different QinQ sub-interfaces for QoS scheduling. Downstream traffic of the CX device is scheduled through ANCP based on the QoS policy delivered by the BRAS.
Figure 5-4 Networking diagram of configuring CX device as the ANCP proxy and configuring ANCP-HQoS association
phone
PC
ADSL/VDSL Modem 1 IPTV phone
GE1/0/0
IP/MPLS backbone CX BRAS
DSLAM
PC
ADSL/VDSL Modem 2 IPTV
The configuration roadmap is as follows: 1. 2. 3. 4. 5. 6. 7. 8.
5-36
Enable ANCP. Configure the source interface of the ANCP connection. Configure the ANCP session parameters. Configure the ANCP neighbor profile and parameters. Configure bandwidth adjustment factors. Configure the mode of the association between ANCP and HQoS. Enable ANCP on the interface and associate the ANCP neighbor with the interface. Configure the QoS profile and schedule parameters.
9.
(Optional) Configure the name of the QoS policy delivered by the BRAS.
10. Apply the QoS profile to the interface.
Data Preparation
To complete the configuration, you need the following data: l l l l l IP address of the source interface of the ANCP connection ANCP neighbor name and IP address ANCP session parameter Maximum number of access lines, handshaking interval, and the timeout period to wait for a response to an access line configuration request for an ANCP neighbor Bandwidth adjustment factors
Procedure
Step 1 Configure ANCP. # Enable ANCP.
<HUAWEI> system-view [HUAWEI] ancp enable
# Configure the source interface of an ANCP connection.

[HUAWEI] interface loopback 1 [HUAWEI-LoopBack1] ip address 1.1.1.1 24 [HUAWEI-LoopBack1] quit [HUAWEI] ospf 82 [HUAWEI-ospf-82]area 0 [HUAWEI-ospf-82-area-0.0.0.0] network 1.1.1.1 0.0.0.0 [HUAWEI-ospf-82-area-0.0.0.0] quit [HUAWEI-ospf-82] quit [HUAWEI] ancp [HUAWEI-ancp] source-interface loopback 1
# Configure the ANCP session parameters.

[HUAWEI-ancp] session interval 10 retransmit 20
# Configure profile parameters and bandwidth adjustment factors for the ANCP neighbor connected to the DSLAM.
[HUAWEI-ancp] neighbor-profile dslam1 proxy [HUAWEI-ancp-neighbor-dslam1] peer-id 10.1.1.1 [HUAWEI-ancp-neighbor-dslam1] max-access-loop 3000 [HUAWEI-ancp-neighbor-dslam1] line-configure timeout 10 [HUAWEI-ancp-neighbor-dslam1] keep-alive interval 20 [HUAWEI-ancp-neighbor-dslam1] adjustment adsl 77 vdsl1 90 [HUAWEI-ancp-neighbor-dslam1] quit
# Configure profile parameters and bandwidth adjustment factors for the ANCP neighbor connected to the BRAS.
[HUAWEI-ancp] neighbor-profile bras proxy client [HUAWEI-ancp-neighbor-bras] peer-id 10.1.1.2 [HUAWEI-ancp-neighbor-bras] quit
Step 2 Configure the mode of the association between ANCP and HQoS.
[HUAWEI-ancp] auto-qos-adapt bras
Issue 01 (2011-05-30)
5-37
Step 3 Configure parameters in the QoS profile. For detailed configurations of parameters in the QoS profile, refer to the HUAWEI CX600 Metro Services Platform Configuration Guide - QoS. Step 4 (Optional) Configure the name of the QoS policy delivered by the BRAS.
<HUAWEI> system-view [HUAWEI] ancp [HUAWEI-ancp] access-loop-configure circuit-id "text" service-profile test
Step 5 Apply the QoS profile to the interface and associate the ANCP neighbor with the interface.
<HUAWEI> system-view [HUAWEI] interface gigabitethernet 1/0/0 [HUAWEI-GigabitEthernet1/0/0] qos-profile test outbound pe-vid 1 ce-vid 1 to 100 [HUAWEI-GigabitEthernet1/0/0] ancp enable dslam1 [HUAWEI-GigabitEthernet1/0/0] quit
After the preceding configurations are completed, you can run the display qos-profile configuration test and display qos-profile application test slot 1 inbound commands to view the configurations of the QoS profile and its applications.
<HUAWEI> display qos-profile configuration test qos-profile : test user-queue cir 100000 flow-queue test flow-mapping test user-group-queue test broadcast-suppression cir 2000 multicast-suppression cir 2000 unknown-unicast-suppression cir 2000 Reference relationships: GigabitEthernet1/0/0 <HUAWEI> display qos-profile application test slot 1 inbound qos-profile : test intaface GigabitEthernet1/0/0, pe-vid 1, ce-vid 1 to 100
Step 6 Verify the configuration. # Check basic information about the ANCP neighbor profile.
<HUAWEI> display ancp neighbor-profile ---------------------------------------------------------------Index Peer-ID State Role Profile-name ---------------------------------------------------------------1 1.1.1.2 used proxy server dslam1 2 10.1.1.2 used proxy client bras ---------------------------------------------------------------The total is 1,printed is 1
# Check the configurations of the ANCP neighbor profile named dslam1.

<HUAWEI> display ancp neighbor-profile dslam1 Index :1 Neighbor Profile name :dslam1 Neighbor Used state :used ANCP role :proxy server ANCP source interface :LoopBack1 TCP-listen port number :6068 Damping percentage :0 Peer ID :10.1.1.1 Max access loop number :3000 Access loop configure timeout :5(seconds) Access loop configure ack mandatory :false Access loop aging time :30(seconds) Access loop oam timeout :5(seconds) Keep-alive interval :20(seconds)
----End
5-38
Issue 01 (2011-05-30)
Configuration Files
# sysname HUAWEI # ancp enable # ancp source-interface LoopBack1 session interval 10 retransmit 20 neighbor-profile bras proxy client peer-id 10.1.1.2 neighbor-profile dslam1 proxy peer-id 10.1.1.1 max-access-loop 3000 line-configure timeout 10 keep-alive interval 20 adjustment adsl 77 vdsl1 90 auto-qos-adapt bras # flow-wred test color green low-limit 70 high-limit 100 discard-percentage 100 color yellow low-limit 60 high-limit 90 discard-percentage 100 color red low-limit 50 high-limit 80 discard-percentage 100 # flow-mapping test map flow-queue af1 to port-queue ef # flow-queue test queue af1 lpq shaping 10000 flow-wred test queue ef pq shaping 30000 flow-wred test # user-group-queue test shaping 500000 inbound # service-template test network-header-length 12 inbound # qos-profile test user-queue cir 100000 pir 100000 flow-queue test flow-mapping test user-group queue test service-template test # port-wred test color green low-limit 70 high-limit 100 discard-percentage 100 color yellow low-limit 60 high-limit 90 discard-percentage 100 color red low-limit 50 high-limit 80 discard-percentage 100 # interface GigabitEthernet1/0/0 undo shutdown control-vid 1 qinq-termination qinq termination l2 symmetry user-mode qinq termination pe-vid 1 ce-vid 1 to 1000 qos-profile test outbound pe-vid 1 ce-vid 1 to 1000 ancp enable dslam1 # interface LoopBack1 ip address 1.1.1.1 255.255.255.0 # ospf 82 area 0 network 1.1.1.1 0.0.0.0 # return
Issue 01 (2011-05-30)
5-39
6 IP Performance Configuration
6
About This Chapter
IP Performance Configuration
By configuring IP performance, you can improve the performance of the device. 6.1 IP Performance Overview By configuring IP performance, you can improve the IP packet forwarding capability of the device. 6.2 Improving IP Performance By setting parameters for IP packets, you can optimize the performance of the network. 6.3 Configuring TCP By setting IP packets, you can improve the performance of the network. 6.4 Configuring Load Balancing for IP Packet Forwarding By configuring Equal-Cost Multiple Path (ECMP) or Unequal-Cost Multiple Path (UCMP), you can improve the packet forwarding capability of the network. 6.5 Maintaining IP Performance You can maintain IP performance by deleting IP performance statistics and monitoring the operation of IP performance. 6.6 Configuration Examples This section includes the networking requirements, precautions for configuration, and configuration roadmap.
Issue 01 (2011-05-30)
6-1
6.1 IP Performance Overview

By configuring IP performance, you can improve the IP packet forwarding capability of the device. 6.1.1 Introduction to IP Performance By configuring certain parameters and functions, you can improve the IP performance of the device. 6.1.2 IP Performance Supported by the CX600 By setting IP, TCP, and ICMP packets, you can improve the performance of the network.
6.1.1 Introduction to IP Performance

By configuring certain parameters and functions, you can improve the IP performance of the device. IP performance optimization should be performed on the basis of configurations of some parameters and enablement of related functions, for example, the interface MTU, ICMP attributes, and TCP attributes. Internet Control Message Protocol (ICMP) messages are used by either the IP layer or the higher layer protocol (TCP or UDP). ICMP communicates error messages or other information that require attention.
6.1.2 IP Performance Supported by the CX600

By setting IP, TCP, and ICMP packets, you can improve the performance of the network.
ICMP
l ICMP Host Unreachable messages When forwarding packets, the device discards the packets and returns an ICMP host unreachable message to the source to notify that the source must stop sending packets to this destination if the device encounters the following situations: There is no route to the destination. The packet is not for itself. l ICMP Redirection messages During packet forwarding, if the device finds the following situations, the device needs to send an ICMP redirection message to the source device and notices the host to reselect a correct device to send packets. The interfaces to receive and forward packets are the same. The selected route is not created or modified by the ICMP redirection packet. The selected route is not the route destined for the destination 0.0.0.0. The subnet mask bit of the source address is the same as that of the outgoing interface. l ICMP packet sending switches In normal circumstance, ICMP host unreachable and redirection messages can ensure normal packet transmission. However, when devices encounter the preceding conditions frequently, network traffic becomes heavy because devices send a large number of ICMP
messages. This increases the traffic burden. In the case of malicious attacks, network congestion becomes worse. To solve this problem, the ICMP host unreachable function can be deployed on the outbound interface. If this function is disabled, the device does not send out ICMP host unreachable messages and as a result the traffic burden of the network is released and malicious attacks to the network is prevented.
Unequal-Cost Load Balancing

The CX600 supports Unequal-Cost Multiple Path (UCMP) among all equal-cost routes to the same destination. UCMP supports only flow-based IP packet forwarding. UCMP applies to only equal-cost routes. It is independent of routing protocols. That is, it does not concern whether the Interior Gateway Protocol (IGP) or the Border Gateway Protocol (BGP) is used. Among the paths that perform UCMP, the bandwidth of each path must not be lower than 1/16 of the total bandwidth; otherwise, the path does not participate in UCMP. The unequal-cost load balancing is classified into interface unequal-cost load balancing and global unequal-cost load balancing. The differences between these two modes are described as follows: l For the interface unequal-cost load balancing, you need to enable the unequal-cost load balancing on all the outgoing interfaces that can forward packets. For the global unequalcost load balancing, you need to enable the unequal-cost load balancing only in the system view. After the interface unequal-cost load balancing is enabled, you need to restart any interface to trigger the delivery FIB entries. After the global unequal-cost load balancing is enabled, FIB entries can be delivered automatically.
The interface unequal-cost load balancing and the global unequal-cost load balancing are mutually exclusive. You cannot enable both of them.
6.2 Improving IP Performance

By setting parameters for IP packets, you can optimize the performance of the network. 6.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring IP performance optimization. 6.2.2 Configuring the Maximum Transmission Unit of the Interface The MTU of an interface determines whether a packet needs to be fragmented when passing through this interface. 6.2.3 Configuring ICMP Attributes Controlling the sending and receiving ICMP messages can protect ICMP messages against attacks. 6.2.4 Checking the Configuration You can view the configuration of IP performance optimization.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring IP performance optimization.
In some special network environments, you must adjust the IP parameters to achieve the best performance. Improving IP performance involves configurations of a series of parameters.
Before improving IP performance, complete the following tasks: l l l Configuring the physical parameters for related interfaces and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocol for related interfaces and ensuring that the status of the link layer protocol on the interface is Up Configuring the IP addresses for related interfaces
Data Preparation
To improve IP performance, you need the following data. No. 1 2 3 4 5 Data Number and MTU value of the interface Number of the interface which needs source address verification Number of the interface which needs to forward broadcast packets and ACL number Number of the interface which needs to clear the DF Number of the interface which needs to configure ICMP host-unreachable
6.2.2 Configuring the Maximum Transmission Unit of the Interface

The MTU of an interface determines whether a packet needs to be fragmented when passing through this interface.
Procedure
Step 1 Run:
system-view


Step 3 Run:
mtu mtu
The maximum transmission unit of the interface is configured. ----End
Follow-up Procedure
The default MTU value varies with the interface type. Use the display interface command to find out the value used.
NOTE
After configuring the MTU on an interface, you must restart the interface; otherwise, the configuration cannot take effect. To restart the interface, run the restart command or the shutdown and then undo shutdown commands.
6.2.3 Configuring ICMP Attributes

Controlling the sending and receiving ICMP messages can protect ICMP messages against attacks.
Context
By default, receiving ICMP messages, and sending ICMP host unreachable messages are enabled.
CAUTION
l If sending ICMP host unreachable messages is disabled, the device no longer sends the ICMP host unreachable message. l If receiving ICMP messages is disabled, the CX device does not receive ICMP messages in any condition. Do as follows on the CX device:
Procedure
Step 1 Run:
system-view

icmp receive
Receiving ICMP messages is enabled. Step 3 Run:


Step 4 Run:
icmp host-unreachable send
Sending ICMP host unreachable messages is enabled. ----End

You can view the configuration of IP performance optimization.
Prerequisite
The configurations of the improving IP performance function are complete.
Procedure
l l Run the display udp statistics command to check the UDP traffic statistics. Run the display ip interface [ interface-type interface-number ] command or display ip interface brief [ interface-type [ interface-number ] | slot slot-number [ card cardnumber ] ] command to check the table information of the IP layer interface. Run the display ip statistics [ slot slot-id ] command to check the IP traffic statistics. Run the display icmp statistics [ slot slot-id ] command to check the ICMP traffic statistics. Run the display rawlink statistics command to check the Rawlink statistics. Run the display ip socket [ monitor ] [ task-id task-id socket-id socket-id | socket-type socket-type ] command to check all the current socket API information.
l l l l
----End
Example
Run the display udp statistics command. If the UDP traffic statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display udp statistics Received packets: Total: 0 Total(64bit high-capacity counter): 0 checksum error: 0 shorter than header: 0, data length larger than packet: 0 unicast(no socket on port): 0 broadcast/multicast(no socket on port): 0 not delivered, input socket full: 0 input packets missing pcb cache: 0 Sent packets: Total: 0 Total(64bit high-capacity counter): 0
Run the display ip interface command. If the information about IP interfaces is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ip interface gigabitethernet 2/0/2 GigabitEthernet2/0/2 current state : UP Line protocol current state : UP The Maximum Transmit Unit : 1500 bytes input packets : 1338, bytes : 117744, multicasts : 1338 output packets : 1336, bytes : 106884, multicasts : 1336 Directed-broadcast packets:
6-6
Issue 01 (2011-05-30)

received packets: 0, sent packets: forwarded packets: 0, dropped packets: ARP packet input number: 0 Request packet: 0 Reply packet: 0 Unknown packet: 0 Internet Address is 120.1.1.1/24 Broadcast address : 120.1.1.255 TTL being 1 packet number: 0 TTL invalid packet number: 0 ICMP packet input number: 0 Echo reply: 0 Unreachable: 0 Source quench: 0 Routing redirect: 0 Echo request: 0 Router advert: 0 Router solicit: 0 Time exceed: 0 IP header bad: 0 Timestamp request: 0 Timestamp reply: 0 Information request: 0 Information reply: 0 Netmask request: 0 Netmask reply: 0 Unknown type: 0 DHCP packet deal mode: global
0 0
Run the display ip statistics command. If the IP traffic statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ip statistics
Run the display icmp statistics command. If the ICMP traffic statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display icmp statistics Input: bad formats 0 echo 0 source quench 0 echo reply 0 timestamp 0 mask requests 0 time exceeded 0 Mping request 0 Output:echo 0 source quench 0 echo reply 0 timestamp 0 mask requests 0 time exceeded 0 Mping request 0 bad checksum destination unreachable redirects parameter problem information request mask replies Mping reply destination unreachable redirects parameter problem information reply mask replies Mping reply 0 0 0 0 0 0 0 0 0 0 0 0 0
Run the display rawlink statistics command. If the Rawlink statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display rawlink statistics Received packets: Total: 1771645 ifnet is null: 0 input packets missing pcb cache: 1181096 not pass multicast: 0 no join multicast: 0 full sock and pstMBuf to be freed: 0 full sock and nothing to be freed: 0 full sock and other reason: 0 Send packets: Total: 125850
Issue 01 (2011-05-30)
6-7
6.3 Configuring TCP

By setting IP packets, you can improve the performance of the network. 6.3.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring TCP. 6.3.2 Configuring TCP Timer By setting two TCP timers, you can control TCP connection time. 6.3.3 Specifying the Size of a TCP Sliding Window By setting the sliding window size for TCP, you can set the sizes of the receiving buffer and transmitting buffer in the socket. In this manner, you can improve the security of the network. 6.3.4 Checking the Configuration You can view the configuration of TCP.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring TCP.
None.
None.
Data Preparation
To configure TCP, you need the following data. No. 1 Data SYN-WAIT timer, FIN-WAIT timer, receiving and sending buffer size of the socket
6.3.2 Configuring TCP Timer

By setting two TCP timers, you can control TCP connection time.
Context
The types of TCP timers are shown as follows: l The SYN-Wait timer: On sending SYN packets, the TCP starts the SYN-Wait timer. If response packets are not received before the SYN-Wait timer timeout, the TCP connection
6-8
is terminated. The SYN-Wait timer timeout ranges from 2 seconds to 600 seconds, and the default value is 75 seconds. l The FIN-Wait timer: When the TCP connection status turns from FIN_WAIT_1 to FIN_WAIT_2, the FIN-Wait timer starts. If FIN packets are not received before the FINWait timer timeout, the TCP connection is terminated. The FIN-Wait timer timeout ranges from 76 seconds to 3600 seconds, and the default value is 675 seconds.
Do as follows on the CX device:
Procedure
Step 1 Run:
system-view

tcp timer syn-timeout interval
The SYN-Wait timer of setting up TCP connections is configured. Step 3 Run:

tcp timer fin-timeout interval
The FIN_WAIT_2 timer of setting TCP connections is configured. ----End
6.3.3 Specifying the Size of a TCP Sliding Window

By setting the sliding window size for TCP, you can set the sizes of the receiving buffer and transmitting buffer in the socket. In this manner, you can improve the security of the network.
Procedure
Step 1 Run:
system-view

tcp window window-size
The receiving/sending buffer size of the TCP socket is configured. The receiving and sending window-size of the connection-oriented socket: It ranges from 1K bytes to 32K bytes, and the default value is 8K bytes. ----End

You can view the configuration of TCP.
Prerequisite
The configurations of TCP function are complete.
Procedure
l Run the display tcp status [ [ task-id task-id ] [ socket-id socket-id ] | [ local-ip ipv4address ] [ local-port local-port-number ] [ remote-ip ipv4-address ] [ remote-port remote-port-number ] ] command to check the TCP connection status. Run the display tcp statistics command to check the TCP traffic statistics.
----End
Example
Run the display tcp status command. If the information about the TCP connection status is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display tcp status TCPCB Tid/Soid Local Add:port 0a5d560c 30 /1 0.0.0.0:23 Foreign Add:port 0.0.0.0:0 VPNID State 14849 Listening
Run the display tcp statistics command. If the TCP traffic statistics are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display tcp statistics Received packets: Total: 0 Total(64bit high-capacity counter): 0 packets in sequence: 0 (0 bytes) window probe packets: 0, window update packets: 0 checksum error: 0, offset error: 0, short error: 0 duplicate packets: 0 (0 bytes), partially duplicate packets: 0 (0 bytes) out-of-order packets: 0 (0 bytes) packets of data after window: 0 (0 bytes) packets received after close: 0 ACK packets: 0 (0 bytes) duplicate ACK packets: 0, too much ACK packets: 0 Sent packets: Total: 0 Total(64bit high-capacity counter): 0 urgent packets: 0 control packets: 0 (including 0 RST) window probe packets: 0, window update packets: 0 data packets: 0 (0 bytes), data packets retransmitted: 0 (0 bytes) ACK-only packets: 0 (0 delayed) Other information: Retransmitted timeout: 0, connections dropped in retransmitted timeout: 0 Keep alive timeout: 0, keep alive probe: 0, Keep alive timeout, so conne ctions disconnected : 0 Initiated connections: 0, accepted connections: 0, established connectio ns: 0 Closed connections: 0 ( dropped: 0, initiated dropped: 0) Packets dropped with MD5 authentication: 0 Packets permitted with MD5 authentication: 0 Send Packets permitted with Keychain authentication: 0 Receive Packets permitted with Keychain authentication: 0 Receive Packets Dropped with Keychain authentication: 0
6.4 Configuring Load Balancing for IP Packet Forwarding

By configuring Equal-Cost Multiple Path (ECMP) or Unequal-Cost Multiple Path (UCMP), you can improve the packet forwarding capability of the network.
6.4.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for sharing loads of IP packet forwarding. 6.4.2 Configuring the Load Balancing Mode of IP Packet Forwarding Load balancing can be performed in either of two modes: per-flow and per-packet. Traffic is balanced on equal-cost routes evenly regardless of the difference in link bandwidths. 6.4.3 Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding If several equal-cost physical links with different bandwidths lead to the same destination, traffic is balanced among the physical links according to their bandwidths. In this manner, all links bear different amount of traffic depending on their bandwidths and optimal load balancing is achieved. After enabling UCMP on an interface, you have to shut down and reenable this interface. This causes traffic interruption. Therefore, you are recommended to enable UCMP globally. 6.4.4 Configuring Global Unequal-Cost Multiple Path During IP Packet Forwarding If several equal-cost physical links with different bandwidths lead to the same destination, traffic is balanced among the physical links according to their bandwidths. In this manner, all links bear different amount of traffic depending on their bandwidths and optimal load balancing is achieved. After load balancing is enabled globally, traffic is not interrupted because no interface needs to be shut down and then enabled again. 6.4.5 Checking the Configuration You can view the configuration of load balancing for IP packet forwarding.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for sharing loads of IP packet forwarding.
The Equal Cost Multipath Path (ECMP) involves evenly distributing traffic among multiple equal-cost paths, regardless of the difference in path bandwidth. This, however, usually leads to the traffic congestion on the low-bandwidth path. The Unequal Cost Multipath Path (UCMP) involves proportionally distributing traffic among multiple equal-cost paths by considering the difference in path bandwidth. This can achieve more reasonable load balancing because traffic is proportionally distributed among paths.
Before configuring load balancing for IP packet forwarding, complete the following tasks: l l Connecting interfaces and setting physical parameters for interfaces to ensure that the physical layer status of each interface is Up Setting parameters of the link layer protocol for interfaces to ensure that the status of the link layer protocol on each interface is Up
Data Preparation
To configure load balancing for IP packet forwarding, you need the following data.
No. 1 2
Data Interface type and interface number IP address and subnet mask for the interface
6.4.2 Configuring the Load Balancing Mode of IP Packet Forwarding

Load balancing can be performed in either of two modes: per-flow and per-packet. Traffic is balanced on equal-cost routes evenly regardless of the difference in link bandwidths.
Context
Load balancing can be enable during IP packet forwarding. When flow-based load balancing is carried out, the device considers the protocol type, source IP address and mask, destination IP and mask, source port range, and destination port range and then adopts the hash algorithm to calculate a value. Based on the calculated value, it chooses a link to forward the packets. When packet-based load balancing is carried out, choose diverse links based on packets from multiple links to forward packets. By default, flow-based load balancing is adopted.
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 Run: l l

load-balance { flow | packet } [ all | slot slot-id ]
Packets on the device are load balanced.

load-balance ip-enhance { all | slot slot-id }
Packets received on the device are load balanced. After the load-balance ip-enhance command is run, the device load balances the received packets based on the quintuple: the protocol type, the source IP address, the destination IP address, the source port, and the destination port. If the command is not run, the device load balances the received packets according to the source IP address, the destination IP address, the source port, and the destination port of the IP packet in flow-by-flow mode.
NOTE
When the outgoing interfaces are MP interfaces, the load-balance packet [ all | slot slot-id ] command cannot be run to implement packet-based load balancing among the interfaces. In this case, you can configure policy-based routing to implement packet-based load balancing.
----End
6.4.3 Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding

If several equal-cost physical links with different bandwidths lead to the same destination, traffic is balanced among the physical links according to their bandwidths. In this manner, all links bear different amount of traffic depending on their bandwidths and optimal load balancing is achieved. After enabling UCMP on an interface, you have to shut down and reenable this interface. This causes traffic interruption. Therefore, you are recommended to enable UCMP globally.
Procedure
Step 1 Run:
system-view


NOTE
The interface must be outgoing interfaces of equal-cost routes. The interface UCMP can be realized among paths only after all outgoing interfaces of equal-cost routes on the device are enabled with UCMP and FIB entry delivery is triggered; if one outgoing interface is not enabled with UCMP, Equal-Cost Multiple Path (ECMP) is performed among paths though FIB entry delivery is triggered.
Interface UCMP cannot be enabled globally or on logical interfaces. It can be enabled only on physical main interfaces. Step 3 Run:
load-balance unequal-cost enable
Interface UCMP is enabled for IP packet forwarding. Route recalculation and FIB entry delivery are not triggered at once after UCMP is enabled or disabled on the interface through command lines. FIB entry delivery is performed only after UCMP configurations are validated. Step 4 Run:
shutdown
The interface where UCMP is enabled is shut down. Step 5 Run:

undo shutdown
The interface is restarted for validating UCMP configurations. You can reset the interface where UCMP is enabled or disabled to trigger route recalculation and FIB entry delivery so that UCMP configurations can be validated.
NOTE
Restarting the interface is one method to trigger FIB entry delivery. You can also change the IP address of the interface to trigger FIB entry delivery and hence validate UCMP configurations.
----End
6.4.4 Configuring Global Unequal-Cost Multiple Path During IP Packet Forwarding

If several equal-cost physical links with different bandwidths lead to the same destination, traffic is balanced among the physical links according to their bandwidths. In this manner, all links bear different amount of traffic depending on their bandwidths and optimal load balancing is achieved. After load balancing is enabled globally, traffic is not interrupted because no interface needs to be shut down and then enabled again.
Context
Do as follows on the CX device to implement global UCMP:
Procedure
Step 1 Run:
system-view

load-balance unequal-cost enable
Global UCMP is enabled for IP packet forwarding. By default, global UCMP is disabled.
NOTE
l The interfaces that support the UCMP function are Ethernet interfaces, Gigabit Ethernet interfaces, POS interfaces, ATM interfaces, serial interfaces, MP interfaces, Eth-Trunk interfaces, and IP-Trunk interfaces and TE Tunnel interfaces. If UCMP is enabled on a TE tunnel interface, the bandwidth value cannot be changed between 0 and a non-zero value, but the bandwidth value can be changed between non-zero values. l Frequent enabling and then disabling UCMP on an interface greatly degrades the system performance. Therefore, the interval from enabling UCMP to disabling UCMP or from disabling UCMP to enabling UCMP must be equal to or longer than 5 minutes.
----End

You can view the configuration of load balancing for IP packet forwarding.
Prerequisite
All the load balancing configurations for IP packet forwarding are complete.
Procedure
l l l Run the display fib [ slot-id ] command to check the FIB table of the interface board. Run the display fib acl acl-number [ verbose ] command to check the filtered FIB information. Run the display fib [ slot-id ] destination-address1 [ desinationt-mask1 ] [ longer ] [ verbose ] command to check the FIB entry which matches a destination address.
6-14
Run the display fib [ slot-id ] destination-address1 destination-mask1 destinationaddress2 destination-mask2 [ verbose ] command to check the FIB entry whose destination address is in the range of destination-address1 destination-mask1 to destination-address2 destination-mask2. Run the display fib ip-prefix prefix-name [ verbose ] command to check the FIB entries that have passed filtering in a certain format according to the input IP prefix name. Run the display fib interface interface-type interface-number command to check the FIB entries that have passed filtering in a certain format according to the input interface type and interface number. Run the display fib next-hop ip-address command to check the FIB entries that have passed filtering in a certain format according to the input next hop address. Run the display fib [ slot-id ] statistics command to check the total number of FIB entries. Run the display fib [ slot-id ] command to check the summary of the FIB.
l l
l l l
----End
Example
Run the display fib command. If the brief information about the FIB is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display fib Route Flags: G - Gateway Route, H - Host Route, U - Up Route S - Static Route, D - Dynamic Route, B - Black Hole Route -----------------------------------------------------------------------------Destination/Mask Nexthop Flag TimeStamp Interface TunnelID 169.254.0.0/16 2.1.1.1 U t[0] GE1/0/0 0x0 2.0.0.0/16 2.1.1.1 U t[0] GE1/0/0 0x0 127.0.0.0/8 127.0.0.1 U t[0] InLoop0 0x0 <HUAWEI> display fib acl 2010 Route entry matched by access-list 2010: Summary counts: 1 Destination/Mask Nexthop Flag TimeStamp Interface TunnelID 127.0.0.0/8 127.0.0.1 U t[0] InLoop0 0x0
6.5 Maintaining IP Performance

You can maintain IP performance by deleting IP performance statistics and monitoring the operation of IP performance. 6.5.1 Clearing IP Performance Statistics By running the reset command, you can delete IP performance statistics. 6.5.2 Monitoring Network Operation Status of IP Performance By running the display command, you can monitor the operation of IP performance.
6.5.1 Clearing IP Performance Statistics

By running the reset command, you can delete IP performance statistics.
Issue 01 (2011-05-30)
6-15
Context
CAUTION
IP/TCP/UDP statistics cannot be restored after you clear it. So, confirm the action before you use the command.
Procedure
l l l l l l Run the reset ip statistics [ interface interface-type interface-number | slot slot-id ] command in the user view to clear the IP statistics. Run the reset ip socket monitor [ task-id task-id socket-id socket-id ] command in the user view to clear information on the socket monitor. Run the reset tcp statistics command in the user view to clear the TCP traffic statistics. Run the reset udp statistics command in the user view to clear the UDP traffic statistics. Run the reset rawlink statistics command in the user view to clear the Rawlink statistics. Run the reset rawip statistics command in the user view to clear the RawIP statistics.
----End
6.5.2 Monitoring Network Operation Status of IP Performance

By running the display command, you can monitor the operation of IP performance.
Context
In routine maintenance, you can run the following command in any view to check the operation of IP performance.
Procedure
l Run the display tcp status [ [ task-id task-id ] [ socket-id socket-id ] | [ local-ip ipv4address ] [ local-port local-port-number ] [ remote-ip ipv4-address ] [ remote-port remote-port-number ] ] command in any view to check TCP connection status. Run the display tcp statistics command in any view to check statistics about TCP traffic. Run the display udp statistics command in any view to check statistics about UDP traffic. Run the display ip interface [ interface-type interface-number ] command or display ip interface brief [ interface-type [ interface-number ] | slot slot-number [ card cardnumber ] ] command in any view to check information about IP interfaces. Run the display ip statistics [ slot slot-id ] command in any view to check statistics about IP traffic. Run the display icmp statistics [ slot slot-id ] command in any view to check statistics about ICMP traffic. Run the display rawlink statistics command in any view to check statistics about Rawlink. Run the display rawip statistics command in any view to check statistics about RawIP. Run the display fib [ slot-id ] command in any view to check the FIB on the specified interface board.
l l l
l l l l l
6-16
l l l
Run the display fib acl acl-number [ verbose ] command in any view to check the FIB information selectively through filtering. Run the display fib [ slot-id ] destination-address1 [ desinationt-mask1 ] [ longer ] [ verbose ] command in any view to filter FIB entries by matching destination IP addresses. Run the display fib [ slot-id ] destination-address1 destination-mask1 destinationaddress2 destination-mask2 [ verbose ] command in any view to check the FIB entries with the destination IP addresses in the range from destination-address1 destinationmask1 to destination-address2 destination-mask2. Run the display fib ip-prefix prefix-name [ verbose ] command in any view to check the FIB entries that have passed filtering in a certain format according to the input IP prefix name. Run the display fib interface interface-type interface-number command in any view to check the FIB entries that have passed filtering in a certain format according to the input interface type and interface number. Run the display fib next-hop ip-address command in any view to check the FIB entries that have passed filtering in a certain format according to the input next hop address. Run the display fib [ slot-id ] statistics command in any view to check the total number of FIB entries. Run the display fib [ slot-id ] command in any view to check brief information about the forwarding table. Run the display ip socket [ monitor ] [ task-id task-id socket-id socket-id | socket-type socket-type ] command in any view to check information about all the socket interfaces of the system.
l l l l
----End

Context
NOTE
6.6.1 Example for Limiting Transmission of ICMP Host-Unreachable Packets This part provides an example for configuring ICMP host-unreachable packets. 6.6.2 Example for Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding This part provides an example for configuring interface UCMP for IP packet forwarding. 6.6.3 Example for Configuring Global Unequal-Cost Load Balancing for IP Packet Forwarding This part provides an example for configuring global UCMP for IP packet forwarding.
6.6.1 Example for Limiting Transmission of ICMP HostUnreachable Packets

This part provides an example for configuring ICMP host-unreachable packets.
As shown in Figure 6-1, CX-A, CX-B and CX-C are connected with each other through their Ethernet ports to test limiting transmission of host-unreachable packets. Figure 6-1 Networking diagram of configuring ICMP host unreachable packets
CX-A
GE 1/0/0 1.1.1.1/24
Internet GE 1/0/0 2.2.2.2/24 GE 1/0/0 1.1.1.2/24
CX-C
CX-B
The configuration roadmap is as follows: 1. 2. 3. Configure IP addresses for the interfaces on devices. Configure static routes between devices that are not directly connected. Enable limiting transmission of ICMP Host-unreachable packets.
Data Preparation
To complete the configuration, you need the following data: l l Static routes between devices that are not directly connected IP addresses for the interfaces
Procedure
Step 1 Configure CX-A. # Configure static routes on CX-A.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ip route-static 2.2.2.2 24 1.1.1.2
# Configure an IP address for GE 1/0/0.

[CX-A] interface gigabitethernet 1/0/0 [CX-A-GigabitEthernet1/0/0] ip address 1.1.1.1 24 [CX-A-GigabitEthernet1/0/0] undo shutdown
6-18
Issue 01 (2011-05-30)

[CX-A-GigabitEthernet1/0/0] quit
Step 2 Configure CX-B. # Disable sending ICMP host unreachable packets on CX-B and configure an IP address for GE 1/0/0.
<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] interface gigabitethernet 1/0/0 [CX-B-GigabitEthernet1/0/0] undo icmp host-unreachable send [CX-B-GigabitEthernet1/0/0] ip address 1.1.1.2 24 [CX-B-GigabitEthernet1/0/0] undo shutdown [CX-B-GigabitEthernet1/0/0] quit [CX-B] quit
Step 3 Configure CX-C. # Configure an IP address for GE 1/0/0 on CX-C.

<HUAWEI> system-view [HUAWEI] sysname CX-C [CX-C] interface gigabitethernet 1/0/0 [CX-C-GigabitEthernet1/0/0] ip address 2.2.2.2 24 [CX-C-GigabitEthernet1/0/0] undo shutdown [CX-C-GigabitEthernet1/0/0] quit
Step 4 Verify the configuration. # Enable the debugging of the ICMP packets of CX-B.
<CX-B> debugging ip icmp
# Run the ping 2.2.2.2 command on CX-A. If you can view that CX-B does not send the host unreachable packets, it means that the configuration succeeds. For example:
[CX-A] ping 2.2.2.2
----End
Configuration Files
# sysname CX-A # interface GigabitEthernet1/0/0 undo shutdown ip address 1.1.1.1 255.255.255.0 # ip route-static 2.2.2.0 255.255.255.0 1.1.1.2 # return

# sysname CX-B # interface GigabitEthernet1/0/0 undo shutdown ip address 1.1.1.2 255.255.255.0 undo icmp host-unreachable send # return

#
Issue 01 (2011-05-30)
6-19
sysname CX-C # interface GigabitEthernet1/0/0 undo shutdown ip address 2.2.2.2 255.255.255.0 # return
6.6.2 Example for Configuring Interface Unequal-Cost Multiple Path During IP Packet Forwarding
This part provides an example for configuring interface UCMP for IP packet forwarding.
As shown in Figure 6-2, three paths exist between CX-A and CX-E. The three paths respectively travel through CX-B, CX-C, and CX-D. It is required that the three paths between CX-A and CX-E perform UCMP during IP packet forwarding. In the example, the unequal-cost load balancing refers to the interface unequal-cost load balancing. Figure 6-2 Networking diagram of configuring UCMP
CX-B POS1/0/0 CX-A POS4/0/0 CX-C POS2/0/0
POS4/0/0 CX-E GE3/0/0 GE1/0/0 GE2/0/0 GE3/0/0 GE1/0/0 GE1/0/0 10.1.1.1/24 20.1.1.1/24 GE2/0/0 GE2/0/0 CX-D GE1/0/0
CX device CX-A Interface POS4/0/0 GE3/0/0 GE2/0/0 CX-B CX-C CX-D CX-E POS1/0/0 POS2/0/0 GE1/0/0 GE2/0/0 GE1/0/0 GE2/0/0 POS4/0/0 GE3/0/0 GE2/0/0
GE2/0/0
IP address 30.1.1.1/24 40.1.1.1/24 50.1.1.1/24 30.1.1.2/24 60.1.1.2/24 40.1.1.2/24 70.1.1.2/24 50.1.1.2/24 80.1.1.2/24 60.1.1.1/24 70.1.1.1/24 80.1.1.1/24
6-20
Issue 01 (2011-05-30)
The configuration roadmap is as follows: 1. 2. Configure IGP on each device. Here, Intermediate System to Intermediate System (IS-IS) is taken as an example. Enable the UCMP function on each interface of CX-A so that the three paths between CXA and CX-E can perform UCMP during IP packet forwarding.
Data Preparation
To complete the configuration, you need the following data: l l l Interface type and number IP address of the interface IS-IS area ID and IS-IS level of each device
Procedure
Step 1 Configure an IP address for each interface. The detailed configuration procedure is not mentioned here. Step 2 Configure basic IS-IS functions. # Configure CX-A.
[CX-A] isis 1 [CX-A-isis-1] is-level level-1 [CX-A-isis-1] network-entity 10.0000.0000.0001.00 [CX-A-isis-1] quit [CX-A] interface gigabitethernet 1/0/0 [CX-A-GigabitEthernet1/0/0] isis enable 1 [CX-A-GigabitEthernet1/0/0] quit [CX-A] interface gigabitethernet 2/0/0 [CX-A-GigabitEthernet2/0/0] isis enable 1 [CX-A-GigabitEthernet2/0/0] quit [CX-A] interface pos 4/0/0 [CX-A-Pos4/0/0] isis enable 1 [CX-A-Pos4/0/0] quit [CX-A] interface gigabitethernet 3/0/0 [CX-A-GigabitEthernet3/0/0] isis enable 1 [CX-A-GigabitEthernet3/0/0] quit
# Configure CX-B.
[CX-B] isis 1 [CX-B-isis-1] is-level level-1 [CX-B-isis-1] network-entity 10.0000.0000.0002.00 [CX-B-isis-1] quit [CX-B] interface pos 1/0/0 [CX-B-Pos1/0/0] isis enable 1 [CX-B-Pos1/0/0] quit [CX-B] interface pos 2/0/0 [CX-B-Pos2/0/0] isis enable 1 [CX-B-Pos2/0/0] quit
# Configure CX-C.
[CX-C] isis 1 [CX-C-isis-1] is-level level-1 [CX-C-isis-1] network-entity 10.0000.0000.0003.00 [CX-C-isis-1] quit [CX-C] interface gigabitethernet 1/0/0
Issue 01 (2011-05-30)
6-21
[CX-C-GigabitEthernet1/0/0] isis enable 1 [CX-C-GigabitEthernet1/0/0] quit [CX-C] interface gigabitethernet 2/0/0 [CX-C-GigabitEthernet2/0/0] isis enable 1 [CX-C-GigabitEthernet2/0/0] quit
# Configure CX-D.
[CX-D] isis 1 [CX-D-isis-1] is-level level-1 [CX-D-isis-1] network-entity 10.0000.0000.0004.00 [CX-D-isis-1] quit [CX-D] interface gigabitethernet 1/0/0 [CX-D-GigabitEthernet1/0/0] isis enable 1 [CX-D-GigabitEthernet1/0/0] quit [CX-D] interface gigabitethernet 2/0/0 [CX-D-GigabitEthernet2/0/0] isis enable 1 [CX-D-GigabitEthernet2/0/0] quit
# Configure CX-E.
[CX-E] isis 1 [CX-E-isis-1] is-level level-1 [CX-E-isis-1] network-entity 10.0000.0000.0005.00 [CX-E-isis-1] quit [CX-E] interface gigabitethernet 1/0/0 [CX-E-GigabitEthernet1/0/0] isis enable 1 [CX-E-GigabitEthernet1/0/0] quit [CX-E] interface gigabitethernet 2/0/0 [CX-E-GigabitEthernet2/0/0] isis enable 1 [CX-E-GigabitEthernet2/0/0] quit [CX-E] interface pos 4/0/0 [CX-E-Pos4/0/0] isis enable 1 [CX-E-Pos4/0/0] quit [CX-E] interface gigabitethernet 3/0/0 [CX-E-GigabitEthernet3/0/0] isis enable 1 [CX-E-GigabitEthernet3/0/0] quit
Step 3 Check basic IS-IS configurations. # View IS-IS routing information on CX-A.
[CX-A] display isis route Route information for ISIS(1) ----------------------------ISIS(1) Level-1 Forwarding Table -------------------------------IPV4 Destination IntCost ExtCost ExitInterface NextHop Flags -------------------------------------------------------------------------------10.1.1.0/24 10 NULL GE1/0/0 Direct D/-/ L/-/20.1.1.0/24 30 NULL GE3/0/0 40.1.1.2 A/-/-/-/ C GE2/0/0 50.1.1.2 Pos4/0/0 30.1.1.2 30.1.1.0/24 10 NULL Pos4/0/0 Direct D/L/40.1.1.0/24 10 NULL GE3/0/0 Direct D/L/50.1.1.0/24 10 NULL GE2/0/0 Direct D/L/60.1.1.0/24 20 NULL Pos4/0/0 30.1.1.2 R/-/70.1.1.0/24 20 NULL GE3/0/0 40.1.1.2 A/-/-/-/80.1.1.0/24 20 NULL GE2/0/0 50.1.1.2 R/-/Flags: D-Direct, A-Added to URT, L-Advertised in LSPs, S-IGP Shortcut, U-Up/Down Bit Set, C-In Computing
# Ping 20.1.1.1 from CX-A. By viewing the display on the Network Management Station (NM Station), you can find that equal-cost load balancing is implemented among outgoing interfaces.
[CX-A] ping 20.1.1.1 PING 20.1.1.1: 56 data bytes, press CTRL_C to break Reply from 20.1.1.1: bytes=56 Sequence=1 ttl=254 time=16 ms Reply from 20.1.1.1: bytes=56 Sequence=2 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=3 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=4 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=5 ttl=254 time=64 ms --- 20.1.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/16/64 ms
Step 4 Enable UCMP on each outgoing interface of CX-A.

[CX-A] interface gigabitethernet 2/0/0 [CX-A-GigabitEthernet2/0/0] load-balance unequal-cost enable [CX-A-GigabitEthernet2/0/0] quit [CX-A] interface pos 4/0/0 [CX-A-Pos4/0/0] load-balance unequal-cost enable [CX-A-Pos4/0/0] quit [CX-A] interface gigabitethernet 3/0/0 [CX-A-GigabitEthernet3/0/0] load-balance unequal-cost enable [CX-A-GigabitEthernet3/0/0] quit
Step 5 Re-enable GigabitEthernet2/0/0, GigabitEthernet3/0/0, and POS4/0/0 to validate UCMP configurations on CX-A.
[CX-A] interface gigabitethernet 2/0/0 [CX-A-GigabitEthernet2/0/0] shutdown [CX-A-GigabitEthernet2/0/0] undo shutdown [CX-A-GigabitEthernet2/0/0] quit [CX-A] interface gigabitethernet 3/0/0 [CX-A-GigabitEthernet3/0/0] shutdown [CX-A-GigabitEthernet3/0/0] undo shutdown [CX-A-GigabitEthernet3/0/0] quit [CX-A]interface pos 4/0/0 [CX-A-Pos4/0/0] shutdown [CX-A-Pos4/0/0] undo shutdown
Step 6 Verify the configuration. # Ping 20.1.1.1 from CX-A. By viewing the display on the NM Station, you can find that UCMP is realized among outgoing interfaces.
[CX-A] ping 20.1.1.1 PING 20.1.1.1: 56 data bytes, press CTRL_C to break Reply from 20.1.1.1: bytes=56 Sequence=1 ttl=254 time=16 ms Reply from 20.1.1.1: bytes=56 Sequence=2 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=3 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=4 ttl=254 time=1 ms Reply from 20.1.1.1: bytes=56 Sequence=5 ttl=254 time=64 ms --- 20.1.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/16/64 ms
----End
Configuration Files
# sysname CX-A # isis 1
Issue 01 (2011-05-30)
6-23
is-level level-1 network-entity 10.0000.0000.0001.00 # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 isis enable 1 # interface GigabitEthernet2/0/0 undo shutdown load-balance unequal-cost enable ip address 50.1.1.1 255.255.255.0 isis enable 1 # interface GigabitEthernet3/0/0 undo shutdown load-balance unequal-cost enable ip address 40.1.1.1 255.255.255.0 isis enable 1 # interface Pos4/0/0 link-protocol ppp undo shutdown load-balance unequal-cost enable ip address 30.1.1.1 255.255.255.0 isis enable 1 # return

# sysname CX-B # isis 1 is-level level-1 network-entity 10.0000.0000.0002.00 # interface Pos1/0/0 undo shutdown link-protocol ppp ip address 30.1.1.2 255.255.255.0 isis enable 1 # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 60.1.1.2 255.255.255.0 isis enable 1 # return

# sysname CX-C # isis 1 is-level level-1 network-entity 10.0000.0000.0003.00 # interface GigabitEthernet1/0/0 undo shutdown ip address 40.1.1.2 255.255.255.0 isis enable 1 # interface GigabitEthernet2/0/0 undo shutdown ip address 70.1.1.2 255.255.255.0 isis enable 1
6-24
Issue 01 (2011-05-30)

# return
Configuration file of CX-D

# sysname CX-D # isis 1 is-level level-1 network-entity 10.0000.0000.0004.00 # interface GigabitEthernet1/0/0 undo shutdown ip address 50.1.1.2 255.255.255.0 isis enable 1 # interface GigabitEthernet2/0/0 undo shutdown ip address 80.1.1.2 255.255.255.0 isis enable 1 # return
Configuration file of CX-E

# sysname CX-E # isis 1 is-level level-1 network-entity 10.0000.0000.0005.00 # interface GigabitEthernet1/0/0 undo shutdown ip address 20.1.1.1 255.255.255.0 isis enable 1 # interface GigabitEthernet2/0/0 undo shutdown ip address 80.1.1.1 255.255.255.0 isis enable 1 # interface GigabitEthernet3/0/0 undo shutdown ip address 70.1.1.1 255.255.255.0 isis enable 1 # interface Pos4/0/0 link-protocol ppp undo shutdown ip address 60.1.1.1 255.255.255.0 isis enable 1 # return
6.6.3 Example for Configuring Global Unequal-Cost Load Balancing for IP Packet Forwarding
This part provides an example for configuring global UCMP for IP packet forwarding.
As shown in Figure 6-3, CX-A and CX-C are connected through two links. l
Issue 01 (2011-05-30)
GE 2/0/0 on CX-A and GE 2/0/0 on CX-B are connected through a physical link.
Eth-Trunk1 interface on CX-A has two member interfaces, GE 3/0/0 and GE 4/0/0; EthTrunk1 interface on CX-B has two member interfaces, GE 3/0/0 and GE 4/0/0.
Eth-Trunk1 interface has two GE interfaces, and thus the bandwidth of Eth-Trunk1 interface is twice that of a single physical link. It is aimed to perform unequal-cost load balancing for IP packet forwarding in the two links between CX-A and CX-C. In the example, unequal-cost load balancing refers to global unequal-cost load balancing. Figure 6-3 Networking diagram of configuring unequal-cost load balancing
CX-A GE2/0/0 GE3/0/0 GE10/0 10.1.1.1/24

Device Name CX-A CX-B
CX-B
EthTrunk1
CX-C GE2/0/2 GE2/0/2 GE1/0/0 20.1.1.1/24
GE2/0/0 GE3/0/0 GE4/0/0
GE4/0/0
Interface Name GE 2/0/0 Eth-Trunk1 GE 2/0/0 Eth-Trunk1 GE 2/0/2
IP Address 30.1.1.1/24 40.1.1.1/24 30.1.1.2/24 40.1.1.2/24 50.1.1.1/24 50.1.1.2/24
CX-C
GE 2/0/2
The configuration roadmap is as follows: 1. 2. Configure a static route on each device. Enable unequal-cost load balancing on CX-B so that the two links between CX-A and CXC can perform unequal-cost load balancing for IP packet forwarding.
Data Preparation
To complete the configuration, you need the following data: l l l Interface type and number IP address of each interface Number of the Eth-Trunk
Procedure
Step 1 Configure an IP address for each interface. The configuration details are not mentioned here. Step 2 Configure a static route. # Configure CX-A.
[CX-A] [CX-A] [CX-A] [CX-A] ip ip ip ip route-static route-static route-static route-static 20.1.1.0 20.1.1.0 50.1.1.0 50.1.1.0 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 gigabitethernet2/0/0 30.1.1.2 eth-trunk1 40.1.1.2 gigabitethernet2/0/0 30.1.1.2 eth-trunk1 40.1.1.2
6-26
Issue 01 (2011-05-30)
# Configure CX- B.
[CX-B] ip route-static 10.1.1.0 255.255.255.0 gigabitethernet2/0/0 30.1.1.1 [CX-B] ip route-static 10.1.1.0 255.255.255.0 eth-trunk1 40.1.1.1 [CX-B] ip route-static 20.1.1.0 255.255.255.0 gigabitethernet2/0/2 50.1.1.2
# Configure CX- C.
[CX-C] ip route-static 10.1.1.0 255.255.255.0 gigabitethernet2/0/2 50.1.1.1 [CX-C] ip route-static 30.1.1.0 255.255.255.0 gigabitethernet2/0/2 50.1.1.1 [CX-C] ip route-static 40.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.1
Step 3 Enable unequal-cost load balancing on CX-B.

[CX-B] load-balance unequal-cost enable
Step 4 Verify the configuration. # CX-C can ping through 10.1.1.1. Run the display fib verbose command to view bandwidth information of the outbound interface. The command output shows that the bandwidth of EthTrunk1 interface is twice that of GE 2/0/0. This indicates that unequal-cost load balancing is enabled.
[CX-C] ping -c 100 -t 10 -m 10 10.1.1.1 PING 10.1.1.1: 56 data bytes, press CTRL_C to break Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=254 time=3 ms Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=254 time=1 ms Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=254 time=1 ms ... --- 10.1.1.1 ping statistics --100 packet(s) transmitted 99 packet(s) received 1.00% packet loss round-trip min/avg/max = 1/1/6 ms [CX-B] display fib 10.1.1.1 verbose Route Entry Count: 2 Destination: 10.1.1.0 Mask : 255.255.255.0 Nexthop : 30.1.1.1 OutIf : GigabitEthernet2/0/2 LocalAddr : 30.1.1.2 LocalMask: 0.0.0.0 Flags : GSU Age : 11128sec ATIndex : 0 Slot : 2 LspFwdFlag : 0 LspToken : 0x0 InLabel : NULL OriginAs : 0 BGPNextHop : 0.0.0.0 PeerAs : 0 QosInfo : 0x0 OriginQos: 0x0 NexthopBak : 0.0.0.0 OutIfBak : [No Intf] LspTokenBak: 0x0 InLabelBak : NULL LspToken_ForInLabelBak : 0x0 EntryRefCount : 0 VlanId : 0x0 LspType : 0 Label_ForLspTokenBak : 0 MplsMtu : 0 Gateway_ForLspTokenBak : 0 NextToken : 0x0 IfIndex_ForLspTokenBak : 0 Label_NextToken : 0 Label : 0 LspBfdState : 0 OutIfSpeed(Kbits/sec) : 1000000 Destination: 10.1.1.0 Nexthop : 40.1.1.1 LocalAddr : 40.1.1.2 Flags : GSU ATIndex : 0 LspFwdFlag : 0 InLabel : NULL BGPNextHop : 0.0.0.0 QosInfo : 0x0 NexthopBak : 0.0.0.0 LspTokenBak: 0x0 LspToken_ForInLabelBak Mask : OutIf : LocalMask: Age : Slot : LspToken : OriginAs : PeerAs : OriginQos: OutIfBak : InLabelBak : 0x0 255.255.255.0 Eth-Trunk1 0.0.0.0 11128sec 0 0x0 0 0 0x0 [No Intf] : NULL
Issue 01 (2011-05-30)
6-27
EntryRefCount : 0 VlanId : 0x0 LspType : 0 MplsMtu : 0 NextToken : 0x0 Label_NextToken : 0 LspBfdState : 0 OutIfSpeed(Kbits/sec) : 2000000
Label_ForLspTokenBak : 0 Gateway_ForLspTokenBak : 0 IfIndex_ForLspTokenBak : 0 Label : 0
----End
Configuration Files
# sysname CX-A # interface Eth-Trunk1 ip address 40.1.1.1 255.255.255.0 # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 # interface GigabitEthernet2/0/0 undo shutdown ip address 30.1.1.1 255.255.255.0 # interface GigabitEthernet3/0/0 undo shutdown eth-trunk 1 # interface GigabitEthernet4/0/0 undo shutdown eth-trunk 1 # ip route-static 20.1.1.0 255.255.255.0 ip route-static 20.1.1.0 255.255.255.0 ip route-static 50.1.1.0 255.255.255.0 ip route-static 50.1.1.0 255.255.255.0 # return
GigabitEthernet2/0/0 30.1.1.2 Eth-Trunk1 40.1.1.2 GigabitEthernet2/0/0 30.1.1.2 Eth-Trunk1 40.1.1.2

# sysname CX-B # load-balance unequal-cost enable # interface Eth-Trunk1 ip address 40.1.1.2 255.255.255.0 # interface GigabitEthernet2/0/0 undo shutdown ip address 30.1.1.2 255.255.255.0 # interface GigabitEthernet2/0/2 undo shutdown ip address 50.1.1.1 255.255.255.0 # interface GigabitEthernet3/0/0 undo shutdown eth-trunk 1 # interface GigabitEthernet4/0/0 undo shutdown eth-trunk 1 #
6-28
Issue 01 (2011-05-30)
ip route-static 10.1.1.0 255.255.255.0 GigabitEthernet2/0/0 30.1.1.1 ip route-static 10.1.1.0 255.255.255.0 Eth-Trunk1 40.1.1.1 ip route-static 20.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.2 # return

# sysname CX-C # ip route-static 10.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.1 ip route-static 30.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.1 ip route-static 40.1.1.0 255.255.255.0 GigabitEthernet2/0/2 50.1.1.1 # interface GigabitEthernet1/0/0 undo shutdown ip address 20.1.1.1 255.255.255.0 # interface GigabitEthernet2/0/2 undo shutdown ip address 50.1.1.2 255.255.255.0 # return
Issue 01 (2011-05-30)
6-29
7 ACL Configuration
7
About This Chapter
ACL Configuration
You can distinguish packets through an ACL and process them in different manners. 7.1 ACL Overview An ACL can be applied to multiple purposes, including PBR and packet filtering. 7.2 Configuring an Interface-based ACL An interface-based ACL is an ACL that specifies rules according to interfaces that receive packets. 7.3 Configuring a Basic ACL When defining rules in a basic ACL, you can specify only source IP addresses. 7.4 Configuring an Advanced ACL An advanced ACL defines rules based on the source address, destination address, type of the protocol over IP, and protocol features, for example, the source port and destination port of TCP and the type and code of ICMP. 7.5 Configuring an ACL Based on the Ethernet Frame Header This section describes how to configure an Ethernet frame header-based ACL. 7.6 Configuring an UCL This section describes how to configure a UCL. 7.7 Configuring a Named ACL A named ACL is an advanced ACL. A named ACL defines rules based on the source address, destination address, type of the protocol over IP, and protocol features, for example, the source port and destination port of TCP and the type and code of ICMP. 7.8 Configuring a MPLS-based ACL MPLS-based ACL defines rules to filter packets based on the Exp value, Label value, and TTL value of MPLS packets. 7.9 Configuration Examples This section includes the networking requirements, precautions for configuration, and configuration roadmap.
Issue 01 (2011-05-30)
7-1
7 ACL Configuration
7.1 ACL Overview

An ACL can be applied to multiple purposes, including PBR and packet filtering. 7.1.1 Introduction to ACL An ACL is a list of rules. An ACL classifies packets according to ACL rules, and then a device determines whether to accept the classified packets according to the rules in the ACL. 7.1.2 ACL Supported by the CX600 According to the differences in filtering rules, ACLs can be categorized into interface-based ACLs, basic ACLs, and advanced ACLs.
7.1.1 Introduction to ACL

An ACL is a list of rules. An ACL classifies packets according to ACL rules, and then a device determines whether to accept the classified packets according to the rules in the ACL. An ACL includes a group of orderly rules that consist of rule { deny | permit } clauses. The rules are described with some parameters, such as based on the source address, the destination address, and the port number of data packets. The ACL classifies data packets according to these rules. After these rules are applied to the device, the device can determine whether to receive or deny packets. The ACL is classified into these types: l l l l l Basic ACL: classifies packets based on the source address. Advanced ACL: classifies packets more detailedly based on the source address, destination address, source port number, destination port number, and protocol type. Interface-based ACL: classifies packets based on the interface from which the packets are received. Ethernet Frame Header ACL: classifies packets more detailedly based on the source MAC address and destination MAC address. User ACL: classifies packets more detailedly based on user groups.
NOTE
Actually, an ACL is a group of rules used to define classes of packets. It cannot be used to filter packet. For detailed processing methods of packets, you need to import detailed functions of ACL. In the CX600, the ACL must be in conjunction with some functions, such as policy-based routing (PBR), firewall, and traffic classification to filter packets. The default action defined in the ACL rule is deny. Therefore, to allow the subsequent flows to pass, you need to specify the action in the ACL rule to permit.
7.1.2 ACL Supported by the CX600

According to the differences in filtering rules, ACLs can be categorized into interface-based ACLs, basic ACLs, and advanced ACLs. The CX600 supports an interface-based ACLs, basic ACLs, advanced ACLs, Ethernet frame header-based ACLs, and ACL-based users (UCLs).
7-2
Issue 01 (2011-05-30)
7 ACL Configuration
7.2 Configuring an Interface-based ACL

An interface-based ACL is an ACL that specifies rules according to interfaces that receive packets. 7.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an interface-based ACL. 7.2.2 (Optional) Creating a Time Range By performing this configuration task, you can specify the time range when an ACL remains valid. 7.2.3 Creating an Interface-based ACL This part describes how to create an interface-based ACL, whose number ranges from 1000 to 1999, and specify filtering rules according to the packet-receiving interface. 7.2.4 (Optional) Configuring ACL Descriptions By configuring ACL descriptions, you can know the purpose of an ACL when viewing the configuration of the ACL. 7.2.5 (Optional) Configuring ACL Step An ACL step is the difference between two adjacent automatically-assigned ACL numbers. 7.2.6 Checking the Configuration You can view the configuration of an interface-based ACL.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an interface-based ACL.
An ACL can be applied to various services such as route policies and packet filtering. It distinguishes different kinds of packets for different processing.
None.
Data Preparation
To configure an ACL, you need the following data. No. 1 2
Issue 01 (2011-05-30)
Data (Optional) Name of the time range in which the Interface-based ACL takes effect and the start time and end time of the time range Rule ID of the Interface-based ACL, permit or deny rule
7 ACL Configuration
No. 3 4 5
Data Interface type and Interface number of the interface in which the Interface-based ACL takes effect (Optional) Description of the Interface-based ACL (Optional) Step of the Interface-based ACL
7.2.2 (Optional) Creating a Time Range

By performing this configuration task, you can specify the time range when an ACL remains valid.
Procedure
Step 1 Run:
system-view

time-range time-name { start-time to end-time days | from time1 date1 [ to time2 date2 ] }
An ACL time range is created. You can configure multiple time ranges at the same name. ----End
7.2.3 Creating an Interface-based ACL

This part describes how to create an interface-based ACL, whose number ranges from 1000 to 1999, and specify filtering rules according to the packet-receiving interface.
Procedure
Step 1 Run:
system-view

acl [ number ] acl-number [ match-order { auto | config } ]
An interface-based ACL is created. Step 3 Run:

rule [ rule-id ] { deny | permit } interface { interface-type interface-number | any } [ logging | time-range time-name ] *
ACL rules are defined.

7 ACL Configuration
interface-type interface-number indicates the specified interface type and interface number. any indicates any interface. logging takes effect on only software-based forwarding such as the application of a routing policy. ----End
7.2.4 (Optional) Configuring ACL Descriptions

By configuring ACL descriptions, you can know the purpose of an ACL when viewing the configuration of the ACL.
Procedure
Step 1 Run:
system-view

acl acl-number
The ACL view is displayed. Step 3 Run:

description text
ACL description is created. The ACL description covers the function of ACL rules. Its length should be less than 127 characters. ----End
7.2.5 (Optional) Configuring ACL Step

An ACL step is the difference between two adjacent automatically-assigned ACL numbers.
Procedure
Step 1 Run:
system-view


step step
ACL step is configured. Note the following when modifying ACL configurations: l The undo step command restores the step to the default and realigns ACL rules.
7 ACL Configuration
l The default step of the ACL rule is 5. ----End

You can view the configuration of an interface-based ACL.
Prerequisite
The configurations of the ACL function are complete.
Procedure
l l l Run the display acl { acl-number | all } command to check the configured ACL rule. Run the display statistics acl { acl-number | all }control-plane command to check the statistics about the packets matching the ACL rule in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
Run the display acl command. If the ACL number, the number of rules, and detailed step description, and ACL rules are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display acl 1200 Interface Based ACL 1200, 1 rule Acl's step is 5 rule 5 permit interface Pos4/0/0
Using the display statistics acl control-plane command, you can view the statistics about the packets matching the ACL rule in soft forwarding.
<HUAWEI> display statistics acl 1000 control-plane Interface Based ACL 1000, 1 rule Acl's step is 5 rule 5 deny interface any (10 times matched)
Run the display time-range command. If the configuration and status of the current time range are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display time-range all Current time is 14:19:16 3-15-2006 Wednesday Time-range : time1 ( Inactive ) 10:00 to 12:00 daily Time-range : time2 ( Inactive ) from 13:00 2006/4/1 to 23:59 2099/12/31 Time-range : active1 ( Active ) 14:00 to 00:00 daily
7.3 Configuring a Basic ACL

When defining rules in a basic ACL, you can specify only source IP addresses. 7.3.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a basic ACL.
7 ACL Configuration
7.3.2 (Optional) Creating a Time Range By performing this configuration task, you can specify the time range when an ACL remains valid. 7.3.3 Creating a Basic ACL This part describes how to create a basic ACL, whose number ranges from 2000 to 2999, and specify filtering rules according to source interfaces. 7.3.4 (Optional) Configuring ACL Descriptions By configuring ACL descriptions, you can know the purpose of an ACL when viewing the configuration of the ACL. 7.3.5 (Optional) Configuring ACL Step An ACL step is the difference between two adjacent automatically-assigned ACL numbers. 7.3.6 Checking the Configuration You can view the configuration of a basic ACL.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a basic ACL.
An ACL can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types. When defining rules for a basic ACL, you need to specify source IP addresses.
None.
Data Preparation
To configure a basic ACL, you need the following data. No. 1 2 3 4 5 Data (Optional) Name of the time range in which the basic ACL takes effect and the start time and end time of the time range Number of the basic ACL Rule ID of the basic ACL, permit or deny rule, and source IP address (Optional) Description of the basic ACL (Optional) Step of the basic ACL

7 ACL Configuration
Procedure
Step 1 Run:
system-view

7.3.3 Creating a Basic ACL

This part describes how to create a basic ACL, whose number ranges from 2000 to 2999, and specify filtering rules according to source interfaces.
Procedure
Step 1 Run:
system-view

A basic ACL is created. Step 3 Run:

rule [ rule-id ] { deny | permit } [ fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | time-range time-name | vpn-instance vpn-instance-name ]*
ACL rules are defined. ----End

Procedure
Step 1 Run:
system-view

acl acl-number
7-8
Issue 01 (2011-05-30)
7 ACL Configuration

description text

Procedure
Step 1 Run:
system-view


step step
ACL step is configured. Note the following when modifying ACL configurations: l The undo step command restores the step to the default and realigns ACL rules. l The default step of the ACL rule is 5. ----End

You can view the configuration of a basic ACL.
Prerequisite
Procedure
----End
7 ACL Configuration
Example
<HUAWEI> display acl 2000 Basic ACL 2000, 1 rule Acl's step is 5 rule 5 deny source 10.1.1.1 0
<HUAWEI> display statistics acl 2000 control-plane Basic ACL 2000, 1 rule Acl's step is 5 rule 5 deny source 10.1.1.1 0 (234 times matched)
7.4 Configuring an Advanced ACL

An advanced ACL defines rules based on the source address, destination address, type of the protocol over IP, and protocol features, for example, the source port and destination port of TCP and the type and code of ICMP. 7.4.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an advanced ACL. 7.4.2 (Optional) Creating a Time Range By performing this configuration task, you can specify the time range when an ACL remains valid. 7.4.3 Creating an Advanced ACL This part describes how to create an advanced ACL, whose number ranges from 3000 to 3999, and specify filtering rules according to the source address, destination address, type of the protocol over IP, for example, the source port and destination port of TCP and the type of ICMP. 7.4.4 (Optional) Configuring ACL Descriptions By configuring ACL descriptions, you can know the purpose of an ACL when viewing the configuration of the ACL. 7.4.5 (Optional) Configuring ACL Step An ACL step is the difference between two adjacent automatically-assigned ACL numbers. 7.4.6 Checking the Configuration You can view the configuration of an advanced ACL.
7 ACL Configuration

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an advanced ACL.
Application Environment
An ACL can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types. When defining rules for an advanced ACL, you need to specify the source IP address, destination IP address, IP bearer protocol type, TCP source port, TCP destination port, or ICMP message type and code.
None.
Data Preparation
To configure an advanced ACL, you need the following data. No. 1 2 3 4 Data (Optional) Name of the time range in which the advanced ACL takes effect and the start time and end time of the time range Number of the advanced ACL Rule ID of the advanced ACL, permit or deny rule IP bearer protocol type, source and destination ports, source and destination IP address, and source IP address fragmented or not, or ICMP message type and code, packet priority, ToS, and timeout period of the ACL rule (Optional) Description of the advanced ACL (Optional) Step of the advanced ACL
5 6

Procedure
Step 1 Run:
system-view

An ACL time range is created.

7 ACL Configuration
You can configure multiple time ranges at the same name. ----End
7.4.3 Creating an Advanced ACL

This part describes how to create an advanced ACL, whose number ranges from 3000 to 3999, and specify filtering rules according to the source address, destination address, type of the protocol over IP, for example, the source port and destination port of TCP and the type of ICMP.
Procedure
Step 1 Run:
system-view

An advanced ACL is created. Step 3 Perform the following as required. l When protocol is specified as TCP or UDP Run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag | time-range time-name | vpn-instance vpn-instance-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag | time-range time-name | vpn-instance vpn-instance-name | dscp dscp | precedence precedence |tos tos ] * ACL rules are defined. syn-flag syn-flag applies to TCP only. l When protocol is specified as ICMP Run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name | icmp-type icmp-code } | source { source-ip-address source-wildcard | any } | time-range time-name | vpn-instance vpn-instance-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name |icmp-type icmp-code } |source { source-ip-address source-wildcard | any } | time-range time-name | vpn-instance vpn-instance-name | precedence precedence | tos tos ] * ACL rules are defined. l When protocol is specified as other protocol except TCP, UDP or ICMP Run:
7 ACL Configuration
rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | vpn-instance vpn-instance-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | vpn-instance vpn-instance-name | precedence precedence | tos tos ] * ACL rules are defined. Configure different advanced ACLs on the device for different protocols over IP. Different protocols have different parameters combination. For example, TCP and UDP have optional parameter [ source-port operator port ] [ destination-port operator port ] while other protocols do not. ----End

Procedure
Step 1 Run:
system-view

acl acl-number

description text

Procedure
Step 1 Run:
system-view

Issue 01 (2011-05-30)
7-13
7 ACL Configuration

step step

You can view the configuration of an advanced ACL.
Prerequisite
Procedure
----End
Example
<HUAWEI> display acl 3000 Advanced ACL 3000, 1 rule Acl's step is 5 rule 5 deny ip source 10.1.1.1 0
<HUAWEI> display statistics acl 3000 control-plane Advanced ACL 3000, 1 rule Acl's step is 5 rule 5 permit ip (1305 times matched)
7-14
Issue 01 (2011-05-30)
7 ACL Configuration
7.5 Configuring an ACL Based on the Ethernet Frame Header

This section describes how to configure an Ethernet frame header-based ACL. 7.5.1 Establishing the Configuration Task 7.5.2 Creating an ACL Based on the Ethernet Frame Header 7.5.3 (Optional) Configuring ACL Descriptions By configuring ACL descriptions, you can know the purpose of an ACL when viewing the configuration of the ACL. 7.5.4 (Optional) Configuring ACL Step An ACL step is the difference between two adjacent automatically-assigned ACL numbers. 7.5.5 Checking the Configuration

An ACL can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types. The rules for an ACL based on the Ethernet frame header are defined on the basis of source MAC addresses, destination MAC addresses, and protocol types of packets.
None.
Data Preparation
To configure an Ethernet frame header-based ACL, you need the following data. No. 1 2 3 4 Data Number of the Ethernet frame header-based ACL Source MAC addresses, destination MAC addresses, and protocol types (Optional) Description of the Ethernet frame header-based ACL (Optional) Step of the Ethernet frame header-based ACL
7.5.2 Creating an ACL Based on the Ethernet Frame Header

Context
The acl-number, based on an Ethernet frame header, ranges from 4000 to 4099.
7 ACL Configuration
Procedure
Step 1 Run:
system-view

An Ethernet frame header-based ACL is created. Step 3 Run:

rule [ rule-id ] { deny | permit } [ type type type-mask | source-mac source-mac sourcemac-mask | dest-mac dest-mac destmac-mask ]
ACL rules are defined. ----End

Procedure
Step 1 Run:
system-view

acl acl-number

description text

Procedure
Step 1 Run:
system-view
7-16
Issue 01 (2011-05-30)
7 ACL Configuration


step step

Prerequisite
The configurations of an Ethernet frame header-based ACL function are complete.
Procedure
l l Run the display acl { acl-number | all } command to check the configured ACL rule. Run the display statistics acl control-plane { acl-number | all } control-plane [ | { begin | include | exclude } regular-expression ] command to check the statistics for the packets matching the ACL rule in soft forwarding.
----End
Example
Run the display aclcommand. If the ACL number, the number of rules, step description, and ACL rules are displayed, then the configuration has succeeded. For example:
<HUAWEI> display acl 4000 Ethernet frame ACL 4000, 2 rules Acl's step is 5 rule 5 deny source-mac 0000-0000-0000 0002-0002-0002 dest-mac 0002-0002-0002 00 03-0003-0003 rule 10 deny type 0200 0222 dest-mac 0000-0000-0000 0002-0002-0002
Using the display statistics acl control-plane command, you can view the statistics for the packets matching the ACL rule in soft forwarding.
<HUAWEI> display statistics acl 4000 control-plane Ethernet frame ACL 4000, 2 rules Acl's step is 5 rule 5 deny source-mac 0000-0000-0000 0002-0002-0002 dest-mac 0002-0002-0002 0003-0003-0003(45 times matched) rule 10 deny type 0200 0222 dest-mac 0000-0000-0000 0002-0002-0002(76 times matched)
Issue 01 (2011-05-30)
7-17
7 ACL Configuration
7.6 Configuring an UCL

This section describes how to configure a UCL. 7.6.1 Establishing the Configuration Task 7.6.2 (Optional) Creating a Time Range 7.6.3 Creating an UCL 7.6.4 (Optional) Configuring ACL Descriptions 7.6.5 (Optional) Configuring ACL Step 7.6.6 Checking the Configuration

After being configured with the user-based ACL (UCL), the device can provide different services to different user groups. Similar to the configuration for advanced ACL, you need to specify either the source IP address, destination IP address, IP bearer protocol type, TCP source port, TCP destination port, or the ICMP message type and code for the UCL.
None.
Data Preparation
To configure an UCL, you need the following data. No. 1 2 3 4 Data (Optional) Name of the time range during which the advanced UCL takes effect and the start time and end time of the time range Number of the UCL Rule ID of the UCL, permit or deny rule Either IP bearer protocol type, source and destination ports, source and destination IP address, and source IP address whether fragmented or not, or the ICMP message type and code, packet priority, ToS, and timeout period of the ACL rule (Optional) Description of the UCL (Optional) Step of the UCL
5 6

7 ACL Configuration
Context
Procedure
Step 1 Run:
system-view

An ACL time range is created. You can configure multiple time ranges with the same name. ----End
7.6.3 Creating an UCL

Context
The range of acl-number for a UCL is 6000 to 9999. Do as follows on the CX device:
Procedure
Step 1 Run:
system-view

A UCL is created. Step 3 Perform the following as required. l If protocol is specified as TCP or UDP rule [ rule-id ] { deny | permit } protocol source user-group source-group-name [ destination { any | ip-address { destination-ip-address destination-wildcard | any } } | destination-port operator port | fragment-type fragment-type-name | logging | sourceport operator port | syn-flag syn-flag | time-range time-name | vpn-instance vpn-instancename | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol source user-group source-group-name [ destination { any | ip-address { destination-ip-address destination-wildcard | any } } | destination-port operator port | fragment-type fragment-type-name | logging | sourceport operator port | syn-flag syn-flag | time-range time-name | vpn-instance vpn-instancename | precedence precedence | tos tos ] * syn-flag syn-flag applies to TCP only.
7 ACL Configuration
l If protocol is specified as ICMP rule [ rule-id ] { deny | permit } protocol source user-group source-group-name [ destination { any | ip-address { destination-ip-address destination-wildcard | any } } | fragment-type fragment-type-name | icmp-type { icmp-name | icmp-type icmp-code } | logging | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol source user-group source-group-name [ destination { any | ip-address { destination-ip-address destination-wildcard | any } } | fragment-type fragment-type-name | icmp-type { icmp-name | icmp-type icmp-code } | logging | time-range time-name | precedence precedence | tos tos ] * l If protocolis specified as a protocol other than TCP, UDP or ICMP rule [ rule-id ] { deny | permit } protocol source user-group source-group-name [ destination { any | ip-address { destination-ip-address destination-wildcard | any } } | fragment-type fragment-type-name } | logging | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol source user-group source-group-name [ destination { any | ip-address { destination-ip-address destination-wildcard | any } } | fragment-type fragment-type-name } | logging | time-range time-name | precedence precedence | tos tos ] * Configure different UCLs on the device for different IP protocols. Different protocols have different combinations of parameters. For example, TCP and UDP have the optional parameter [ source-port operator port ] [ destination-port operator port ] while other protocols do not. ----End

Context
Procedure
Step 1 Run:
system-view

acl acl-number

description text
An ACL description is created. The ACL description covers the functions of ACL rules. Its length should be less than 127 characters. ----End
7 ACL Configuration

Context
Procedure
Step 1 Run:
system-view


step step
ACL step is configured. Note the following when modifying ACL configurations: l The undo step command restores the step to the default and realigns ACL rules. l The default step for ACL rules is 5. ----End

Prerequisite
The configurations of the UCL function are complete.
Procedure
l l Run the display acl { acl-number | all } command to check the configured ACL rule. Run the display time-range { time-name | all } command to check the time range.
----End
Example
Run the display acl command. If the ACL number, the number of rules, step description, and ACL rules are displayed, then the configuration has succeeded. For example:
<HUAWEI> display acl 6000 Ucl ACL 6000, 1 rule Acl's step is 5 rule 5 deny tcp source user-group 1
Run the display time-rangecommand. If the configuration and status of the current time range are displayed, then the configuration has succeeded. For example:
<HUAWEI> display time-range all
Issue 01 (2011-05-30)
7-21
7 ACL Configuration
Current time is 14:19:16 3-15-2006 Wednesday Time-range : time1 ( Inactive ) 10:00 to 12:00 daily Time-range : time2 ( Inactive ) from 13:00 2006/4/1 to 23:59 2099/12/31 Time-range : active1 ( Active ) 14:00 to 00:00 daily
7.7 Configuring a Named ACL

A named ACL is an advanced ACL. A named ACL defines rules based on the source address, destination address, type of the protocol over IP, and protocol features, for example, the source port and destination port of TCP and the type and code of ICMP. 7.7.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a named ACL. 7.7.2 (Optional) Creating a Time Range By performing this configuration task, you can specify the time range when an ACL remains valid. 7.7.3 Creating a Named ACL This part describes how to create an ACL whose name is a character string and how to specify filtering rules according to the source address, destination address, type of the protocol over IP, for example, the source port and destination port of TCP and the type of ICMP. 7.7.4 (Optional) Configuring named ACL Descriptions By configuring ACL descriptions, you can know the purpose of an ACL when viewing the configuration of the ACL. 7.7.5 (Optional) Configuring named ACL Step An ACL step is the difference between two adjacent automatically-assigned ACL numbers. 7.7.6 Checking the Configuration You can view the configuration of a named ACL.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a named ACL.
An ACL can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types. Named ACLs are advanced ACLs because you need to define rules for the named ACLs by specifying the source IP address, destination IP address, IP bearer protocol type, TCP source port, TCP destination port, or ICMP protocol type and code.
None.
7-22
Issue 01 (2011-05-30)
7 ACL Configuration
Data Preparation
To configure a named ACL, you need the following data. No. 1 2 3 4 5 Data (Optional) Name of the time range in which the named ACL takes effect and the start time and end time of the time range Rule ID of the named ACL, permit or deny rule, and source IP address IP bearer protocol type, source and destination ports, destination IP address, or ICMP message type and code, packet priority, ToS, and timeout period of the ACL rule (Optional) Description of the named ACL (Optional) Step of the named ACL

Procedure
Step 1 Run:
system-view

7.7.3 Creating a Named ACL

This part describes how to create an ACL whose name is a character string and how to specify filtering rules according to the source address, destination address, type of the protocol over IP, for example, the source port and destination port of TCP and the type of ICMP.
Procedure
Step 1 Run:
system-view

acl name acl-name [ number acl-number ] [ match-order { auto | config } ]
Issue 01 (2011-05-30)
7-23
7 ACL Configuration
A named ACL is created and the named ACL view is displayed. Step 3 Perform the following steps as required to configure rules for the named ACL. One ACL can be configured with multiple rules. l When protocol is TCP or UDP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | vpninstance vpn-instance-name | syn-flag syn-flag time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag time-range time-name | vpn-instance vpn-instance-name | precedence precedence |tos tos ] * syn-flagsyn-flag needs to be specified only when TCP is used. l When protocol is ICMP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name | icmp-type icmp-code } | source { source-ip-address source-wildcard | any } | time-range time-name | vpn-instance vpn-instance-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name |icmp-type icmp-code } |source { source-ip-address source-wildcard | any } | time-range time-name | vpn-instance vpn-instance-name | precedence precedence | tos tos ] * l When protocol is not TCP, UDP, or ICMP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | vpn-instance vpn-instance-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | vpn-instance vpn-instance-name | precedence precedence | tos tos ] * Configure different advanced ACLs on the device for different protocols over IP. Different protocols have different parameters combination. For example, TCP and UDP have optional parameter [ source-port operator port ] [ destination-port operator port ] while other protocols do not. ----End
7.7.4 (Optional) Configuring named ACL Descriptions

Procedure
Step 1 Run:
system-view
7-24
Issue 01 (2011-05-30)
7 ACL Configuration

acl name acl-name
The named ACL view is displayed. Step 3 Run:

description text
The named ACL description is created. The ACL description covers the function of ACL rules. Its length should be less than 127 characters. ----End
7.7.5 (Optional) Configuring named ACL Step

Procedure
Step 1 Run:
system-view

acl name acl-name
The named ACL view is displayed. Step 3 Run:

step step
ACL step is configured. Note the following when modifying named ACL configurations: l The undo step command restores the step to the default and realigns ACL rules. l The default step of the ACL rule is 5. ----End

You can view the configuration of a named ACL.
Prerequisite
Procedure
l
Issue 01 (2011-05-30)
Run the display acl name acl-name command to check the configured ACL rule.
7 ACL Configuration
Run the display statistics acl { acl-number | all | name acl-name }control-plane command to check the statistics about the packets matching the ACL rule in soft forwarding.
----End
Example
# Check the configurations of named ACL, whose name is test.
<HUAWEI> display acl name test Advanced Name ACL test, 1 rule Acl's step is 5 rule 5 permit ip
# View the statistics about the packets matching ACL named test in soft forwarding.
<HUAWEI> display statistics acl name test control-plane Advanced ACL test, 2 rules Acl's step is 5 rule 5 deny ip destination 1.1.5.0 0.0.0.255 (10 times matched) rule 10 deny ip destination 1.1.6.0 0.0.0.255 (23 times matched)
7.8 Configuring a MPLS-based ACL

MPLS-based ACL defines rules to filter packets based on the Exp value, Label value, and TTL value of MPLS packets. 7.8.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a MPLS-based ACL. 7.8.2 Creating a MPLS-based ACL This part describes how to create a MPLS-based ACL, whose number ranges from 10000 to 10999. 7.8.3 Configuring Rules for a MPLS-based ACL MPLS-based ACL defines rules to filter packets based on the Exp value, Label value, and TTL value of MPLS packets. 7.8.4 Checking the Configuration You can view the configuration of a MPLS-based ACL.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a MPLS-based ACL.
An MPLS-based ACL can be applied to QoS service, defines rules to filter packets based on the Exp value, Label value, and TTL value of MPLS packets.
None.
7 ACL Configuration
Data Preparation
To configure a MPLS-based ACL, you need the following data. No. 1 2 Data Rule ID of the MPLS ACL, rules that are defined to deny or permit packets. Exp value, Label value, and TTL value of MPLS packets.
7.8.2 Creating a MPLS-based ACL

This part describes how to create a MPLS-based ACL, whose number ranges from 10000 to 10999.
Procedure
Step 1 Run:
system-view

acl [ number ] acl-number
A MPLS-based ACL is created. ----End
7.8.3 Configuring Rules for a MPLS-based ACL

MPLS-based ACL defines rules to filter packets based on the Exp value, Label value, and TTL value of MPLS packets.
Procedure
Step 1 Run:
system-view

acl [ number ] acl-number
The MPLS-based ACL view is displayed. Step 3 Run:

rule [ rule-id ] { deny | permit } [ exp { exp-value | any } &<1-4> | label { labelvalue | any } &<1-4> | ttl { ttl-operator ttl-value | any } &<1-3> ] *
Rules for the MPLS-based ACL are configured. ----End

7 ACL Configuration

You can view the configuration of a MPLS-based ACL.
Prerequisite
The configuration of the MPLS-based ACL is complete.
Procedure
l Run the display acl { acl-number | all } command to check the configured ACL rule. ----End
Example
After running the preceding command, you can view the ACL number, number of ACL rules, and rule contents.
<HUAWEI> display acl 10001 Mpls ACL 10001, 2 rules Acl's step is 5 rule 5 permit exp 2 any any any (0 times matched) rule 10 permit ttl gt 2 any any (0 times matched)

Context
NOTE
7.9.1 Example for Configuring a Traffic Policy Based on Complex Traffic Classification This section provides an example for configuring traffic classifiers and traffic behaviors and applying them in complex traffic classification. 7.9.2 Example for Configuring the Security Function of Access Devices This section provides an example of configuring the security function of access devices. 7.9.3 Example for Configuring an ACL Rule that Is Based on the VPN Instance This section provides an example of configuring an ACL rule that is based on the VPN instance.
7.9.1 Example for Configuring a Traffic Policy Based on Complex Traffic Classification
This section provides an example for configuring traffic classifiers and traffic behaviors and applying them in complex traffic classification.
7-28
Issue 01 (2011-05-30)
7 ACL Configuration
As shown in Figure 7-1, PE1, P, and PE2 are CX devices on an MPLS backbone network; CE1 and CE2 are access CX devices on the edge of the backbone network. Three users from the local network access the Internet through CE1. l l l l l l On CE1, the CIR of the users from the network segment 1.1.1.0 is limited to 10 Mbit/s and the CBS is limited to 150000 bytes. On CE1, the CIR of the users from the network segment 2.1.1.0 is limited to 5 Mbit/s and the CBS is limited to 100000 bytes. On CE1, the CIR of the users from the network segment 3.1.1.0 is limited to 2 Mbit/s and the CBS is limited to 100000 bytes. On CE1, the DSCP values of the service packets from the three network segments are marked to 40, 26, and 0. PE1 accesses the MPLS backbone network at the CIR of 15 Mbit/s, the CBS of 300000 bytes, the PIR of 20 Mbit/s, and the PBS of 500000 bytes. On CE1, the CIR of the UDP packets (except DNS, SNMP, SNMP Trap, and Syslog packets) is limited to 5 Mbit/s, the CBS is limited to 100000 bytes, and the PIR is limited to 15 Mbit/s.
Figure 7-1 Diagram for configuring a traffic policy based on complex traffic classification
Loopback0 11.11.11.11/32
Loopback0 33.33.33.33/32
Loopback0 22.22.22.22/32
PE1 GE1/0/0 10.1.1.2/24 CE1 GE1/0/0
POS2/0/0 100.1.1.1/24 POS1/0/0 100.1.1.2/24 GE2/0/0 10.1.1.1/24 GE4/0/0 GE3/0/0
POS2/0/0 110.1.1.1/24 P POS2/0/0 110.1.1.2/24
PE2 GE1/0/0 20.1.1.2/24 GE2/0/0 20.1.1.1/24 CE2
1.1.1.0
3.1.1.0
2.1.1.0
7 ACL Configuration
1. 2. 3. 4. 5.
Configure ACL rules. Configure traffic classifiers. Configure traffic behaviors. Configure traffic policies. Apply traffic policies to interfaces.
Data Preparation
To complete the configuration, you need the following data: l l l l l l ACL numbers 2001, 2002, 2003, 3001, and 3002 DSCP values of the packets from the three network segments, which are re-marked to be 40, 26, and 0 respectively CIRs (10 Mbit/s, 5 Mbit/s, and 2 Mbit/s) and CBSs (150000 bytes, 100000 bytes, and 100000 bytes) of the traffic from the three network segments CIR (5 Mbit/s), CBS (100000 bytes), and PIR (15 Mbit/s) of the UDP packets (except DNS, SNMP, SNMP Trap, and Syslog packets) on CE1 CIR (15 Mbit/s), CBS (300000 bytes), PIR (20 Mbit/s), and PBS (500000 bytes) of traffic on PE1 Names of traffic classifiers, traffic behaviors, and traffic policies, and numbers of interfaces to which traffic policies are applied
Procedure
Step 1 Configure IP addresses of interfaces, routes, and basic MPLS functions. The detailed configurations are not mentioned. Step 2 Configure complex traffic classification on CE1 to control the traffic that accesses CE1 from the three local networks. # Define ACL rules.
<CE1> system-view [CE1] acl number 2001 [CE1-acl-basic-2001] rule [CE1-acl-basic-2001] quit [CE1] acl number 2002 [CE1-acl-basic-2002] rule [CE1-acl-basic-2002] quit [CE1] acl number 2003 [CE1-acl-basic-2003] rule [CE1-acl-basic-2003] quit [CE1] acl number 3001 [CE1-acl-basic-3001] rule [CE1-acl-basic-3001] rule [CE1-acl-basic-3001] rule [CE1-acl-basic-3001] rule [CE1-acl-basic-3001] quit [CE1] acl number 3002 [CE1-acl-basic-3002] rule [CE1-acl-basic-3002] quit
permit source 1.1.1.0 0.0.0.255 permit source 2.1.1.0 0.0.0.255 permit source 3.1.1.0 0.0.0.255 0 1 2 3 permit permit permit permit udp udp udp udp destination-port destination-port destination-port destination-port eq eq eq eq dns snmp snmptrap syslog
4 permit udp
# Configure traffic classifiers and define ACL-based matching rules.

[CE1] traffic classifier a [CE1-classifier-a] if-match acl 2001 [CE1-classifier-a] quit [CE1] traffic classifier b
7-30
Issue 01 (2011-05-30)

[CE1-classifier-b] if-match acl 2002 [CE1-classifier-b] quit [CE1] traffic classifier c [CE1-classifier-c] if-match acl 2003 [CE1-classifier-c] quit [CE1]traffic classifier udplimit [CE1-classifier-udplimit] if-match acl 3001 [CE1-classifier-udplimit] quit [CE1] traffic classifier udplimit1 [CE1-classifier-udplimit1] if-match acl 3002 [CE1-classifier-udplimit1] quit
7 ACL Configuration
After the preceding configuration, you can run the display traffic classifier command to view the configuration of the traffic classifiers.
[CE1] display traffic classifier user-defined User Defined Classifier Information: Classifier: a Operator: OR Rule(s): if-match acl 2001 Classifier: c Operator: OR Rule(s): if-match acl 2003 Classifier: b Operator: OR Rule(s): if-match acl 2002 Classifier: udplimit Operator: OR Rule(s) : if-match acl 3001 Classifier: udplimit1 Operator: OR Rule(s) : if-match acl 3002
# Define traffic behaviors, configure traffic policing, and re-mark DSCP values.
[CE1] traffic behavior e [CE1-behavior-e] car cir 10000 cbs 150000 pbs 0 [CE1-behavior-e] remark dscp 40 [CE1-behavior-e] quit [CE1] traffic behavior f [CE1-behavior-f] car cir 5000 cbs 100000 pbs 0 [CE1-behavior-f] remark dscp 26 [CE1-behavior-f] quit [CE1] traffic behavior g [CE1-behavior-g] car cir 2000 cbs 100000 pbs 0 [CE1-behavior-g] remark dscp 0 [CE1-behavior-g] quit [CE1] traffic behavior udplimit [CE1-behavior-udplimit] permit [CE1-behavior-udplimit] quit [CE1] traffic behavior udplimit1 [CE1-behavior-udplimit1] car cir 5000 cbs 100000 pbs 150000 green pass yellow discard red discard [CE1-behavior-udplimit1] quit
# Define traffic policies and associate the traffic classifiers with the traffic behaviors.
[CE1] traffic policy 1 [CE1-trafficpolicy-1] classifier a behavior e [CE1-trafficpolicy-1] quit [CE1] traffic policy 2 [CE1-trafficpolicy-2] classifier b behavior f [CE1-trafficpolicy-2] quit [CE1] traffic policy 3 [CE1-trafficpolicy-3] classifier c behavior g [CE1-trafficpolicy-3] quit [CE1] traffic policy udplimit [CE1-trafficpolicy-udplimit] classifier udplimit behavior udplimit [CE1-trafficpolicy-udplimit] classifier udplimit1 behavior udplimit1 [CE1-trafficpolicy-3] quit
Issue 01 (2011-05-30)
7-31
7 ACL Configuration
After the preceding configuration, run the display traffic policy command to view the configuration of the traffic policies, traffic classifiers defined in the traffic policies, and the traffic behaviors associated with traffic classifiers.
[CE1] display traffic policy user-defined User Defined Traffic Policy Information: Policy: 1 Classifier: default-class Behavior: be -noneClassifier: a Behavior: e Committed Access Rate: CIR 10000 (Kbps), PIR 0 (Kbps), CBS 15000 (byte), PBS 0 (byte) Conform Action: pass Yellow Action: pass Exceed Action: discard Marking: Remark DSCP cs5 Policy: 2 Classifier: default-class Behavior: be -noneClassifier: b Behavior: f Committed Access Rate: CIR 5000 (Kbps), PIR 0 (Kbps), CBS 100000 (byte), PBS 0 (byte) Conform Action: pass Yellow Action: pass Exceed Action: discard Marking: Remark DSCP af31 Policy: 3 Classifier: default-class Behavior: be -noneClassifier: c Behavior: g Committed Access Rate: CIR 2000 (Kbps), PIR 0 (Kbps), CBS 100000 (byte), PBS 0 (byte) Conform Action: pass Yellow Action: pass Exceed Action: discard Marking: Remark DSCP default Policy: udplimit Classifier: default-class Behavior: be -noneClassifier: udplimit Behavior: udplimit Firewall: permit Classifier: udplimit1 Behavior: udplimit1 Committed Access Rate: CIR 5000 (Kbps), PIR 0 (Kbps), CBS 10000 (byte), PBS 15000 (byte) Conform Action: pass Yellow Action: discard Exceed Action: discard
# Apply the traffic policies to the inbound interfaces.

[CE1] interface gigabitethernet 1/0/0 [CE1-GigabitEthernet1/0/0] undo shutdown [CE1-GigabitEthernet1/0/0] traffic-policy 1 inbound [CE1-GigabitEthernet1/0/0] quit [CE1] interface gigabitethernet 3/0/0 [CE1-GigabitEthernet3/0/0] undo shutdown
7-32
Issue 01 (2011-05-30)

[CE1-GigabitEthernet3/0/0] traffic-policy 2 inbound [CE1-GigabitEthernet3/0/0] quit [CE1] interface gigabitethernet 4/0/0 [CE1-GigabitEthernet4/0/0] undo shutdown [CE1-GigabitEthernet4/0/0] traffic-policy 3 inbound [CE1] interface gigabitethernet 2/0/0 [CE1-GigabitEthernet2/0/0] undo shutdown [CE1-GigabitEthernet2/0/0] traffic-policy udplimit outbound
7 ACL Configuration
Step 3 Configure complex traffic classification on PE1 to control the traffic that goes to the MPLS backbone network. # Configure traffic classifiers and define matching rules.
<PE1> system-view [PE1] traffic classifier pe [PE1-classifier-pe] if-match any [PE1-classifier-pe] quit
After the preceding configuration, you can run the display traffic classifier command to view the configuration of the traffic classifiers.
[PE1] display traffic classifier user-defined User Defined Classifier Information: Classifier: pe Operator: OR Rule(s): if-match any
# Define traffic behaviors and configure traffic policing.

[PE1] traffic behavior pe [PE1-behavior-pe] car cir 15000 pir 20000 cbs 300000 pbs 500000 [PE1-behavior-pe] quit
# Define traffic policies and associate the traffic classifiers with the traffic behaviors.
[PE1] traffic policy pe [PE1-trafficpolicy-pe] classifier pe behavior pe [PE1-trafficpolicy-pe] quit
After the preceding configuration, you can run the display traffic policy command to view the configuration of the traffic policies, traffic classifiers defined in the traffic policies, and the traffic behaviors associated with the traffic classifiers.
[PE1] display traffic policy user-defined User Defined Traffic Policy Information: Policy: pe Classifier: default-class Behavior: be -noneClassifier: pe Behavior: pe Committed Access Rate: CIR 15000 (Kbps), PIR 20000 (Kbps), CBS 300000 (byte), PBS 500000 (byte) Conform Action: pass Yellow Action: pass Exceed Action: discard
# Apply the traffic policies to the inbound interfaces.

[PE1] interface gigabitethernet 1/0/0 [PE1-GigabitEthernet1/0/0] undo shutdown [PE1-GigabitEthernet1/0/0] traffic-policy pe inbound [PE1-GigabitEthernet1/0/0] quit
Step 4 Verify the configuration.

7 ACL Configuration
Run the display interface command on CE1 and PE1. You can view that the traffic on the interfaces is controlled according to the configured traffic policies. ----End
Configuration Files
l Configuration file of CE1
# sysname CE1 # acl number 2001 rule 5 permit source 1.1.1.0 0.0.0.255 acl number 2002 rule 5 permit source 2.1.1.0 0.0.0.255 acl number 2003 rule 5 permit source 3.1.1.0 0.0.0.255 acl number 3001 rule 0 permit udp destination-port eq dns rule 1 permit udp destination-port eq snmp rule 2 permit udp destination-port eq snmptrap rule 3 permit udp destination-port eq syslog acl number 3302 rule 4 permit udp # traffic classifier a operator or if-match acl 2001 traffic classifier c operator or if-match acl 2003 traffic classifier b operator or if-match acl 2002 traffic classifier udp-limit operator or if-match acl 3001 traffic classifier udp-limit1 operator or if-match acl 3002 # traffic behavior e car cir 10000 cbs 150000 pbs 0 green pass red discard remark dscp cs5 traffic behavior g car cir 2000 cbs 100000 pbs 0 green pass red discard remark dscp default traffic behavior f car cir 5000 cbs 100000 pbs 0 green pass red discard remark dscp af31 traffic behavior udp-limit traffic behavior udp-limit1 car cir 5000 cbs 100000 pbs 150000 green pass yellow discard red discard # traffic policy 3 classifier c behavior g traffic policy 2 classifier b behavior f traffic policy 1 classifier a behavior e traffic policy udp-limit classifier udp-limit behavior udp-limit classifier udp-limit1 behavior udp-limit1 # interface GigabitEthernet1/0/0 undo shutdown ip address 1.1.1.1 255.255.255.0 traffic-policy 1 inbound # interface GigabitEthernet2/0/0 undo shutdown ip address 10.1.1.1 255.255.255.0 traffic-policy udplimit outbound
7-34
Issue 01 (2011-05-30)

# interface GigabitEthernet3/0/0 undo shutdown ip address 2.1.1.1 255.255.255.0 traffic-policy 2 inbound # interface GigabitEthernet4/0/0 undo shutdown ip address 3.1.1.1 255.255.255.0 traffic-policy 3 inbound # ospf 1 area 0.0.0.0 network 1.1.1.0 0.0.0.255 network 2.1.1.0 0.0.0.255 network 3.1.1.0 0.0.0.255 network 10.1.1.0 0.0.0.255 # return
7 ACL Configuration
Configuration file of PE1

# sysname PE1 # mpls lsr-id 11.11.11.11 mpls # mpls ldp # traffic classifier pe operator or if-match any # traffic behavior pe car cir 15000 pir 20000 cbs 300000 pbs 500000 green pass yellow pass red discard # traffic policy pe classifier pe behavior pe # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.2 255.255.255.0 traffic-policy pe inbound # interface Pos2/0/0 undo shutdown ip address 100.1.1.1 255.255.255.0 mpls mpls ldp # interface LoopBack0 ip address 11.11.11.11 255.255.255.255 # ospf 1 area 0.0.0.0 network 10.1.1.0 0.0.0.255 network 100.1.1.0 0.0.0.255 network 11.11.11.11 0.0.0.0 # return
Configuration file of P
# sysname P # mpls lsr-id 33.33.33.33 mpls # mpls ldp #
Issue 01 (2011-05-30)
7-35
7 ACL Configuration
interface Pos1/0/0 link-protocol ppp ip address 100.1.1.2 255.255.255.0 mpls mpls ldp # interface Pos2/0/0 link-protocol ppp ip address 110.1.1.1 255.255.255.0 mpls mpls ldp # interface LoopBack0 ip address 33.33.33.33 255.255.255.255 # ospf 1 area 0.0.0.0 network 100.1.1.0 0.0.0.255 network 110.1.1.0 0.0.0.255 network 33.33.33.33 0.0.0.0 # return

# sysname PE2 # mpls lsr-id 22.22.22.22 mpls # mpls ldp # interface GigabitEthernet1/0/0 undo shutdown ip address 20.1.1.2 255.255.255.0 # interface Pos2/0/0 undo shutdown ip address 110.1.1.1 255.255.255.0 mpls mpls ldp # interface LoopBack0 ip address 22.22.22.22 255.255.255.255 # ospf 10 area 0.0.0.0 network 110.1.1.0 0.0.0.255 network 20.1.1.0 0.0.0.255 network 22.22.22.22 0.0.0.0 # return
Configuration file of CE2

# sysname CE2 # interface GigabitEthernet2/0/0 undo shutdown ip address 20.1.1.1 255.255.255.0 # ospf 1 area 0.0.0.0 network 20.1.1.0 0.0.0.255 # return
7-36
Issue 01 (2011-05-30)
7 ACL Configuration
7.9.2 Example for Configuring the Security Function of Access Devices

This section provides an example of configuring the security function of access devices.
As shown in Figure 7-2, CX-A, CX-B, CX-C are access devices; CX-D, CX-E, and CX-F are core devices; Access devices are connected to core devices by 10G interfaces. The network provides voice and 3G services. Security policies need to be configured on access devices to control the access of users and to guarantee the security of both the network and devices. Figure 7-2 Networking of configuring the security function of access devices
Internet
GE1/0/0 CX-D
CX-C
GE1/0/0 Internet CX-F CX-A CX-E
GE1/0/0 Internet CX-B
The configuration roadmap is as follows: 1. 2. 3. Set the passwords to be used for login in NMS and CLI modes. Log information about login failures. Create an Access Control List (ACL) to deny specified services carried on TCP and UDP interfaces (to defend virus).
Data Preparation
To complete the configuration, you need the following data: l l
Issue 01 (2011-05-30)
IP address of each interface Passwords to be used for login in NMS and CLI modes
7 ACL Configuration
Procedure
Step 1 Configure an IP address for each interface. The configuration details are not mentioned here. Step 2 Set the passwords to be used for login in NMS and CLI modes.
<CX-A> system-view [CX-A] user-interface console 0 [CX-A-ui-con0] shell [CX-A-ui-con0] authentication mode password [CX-A-ui-con0] set authentication password cipher huawei [CX-A-ui-con0] idle-timeout 30 0 [CX-A-ui-con0] quit [CX-A] user-interface maximum-vty 15 [CX-A] user-interface vty 5 14 [CX-A-ui-vty5-14] shell [CX-A-ui-vty5-14] authentication mode password [CX-A-ui-vty5-14] set authentication password cipher huawei [CX-A-ui-vty5-14] idle-timeout 30 0 [CX-A-ui-vty5-14] quit
NOTE
Configurations for each access devices are similar. Take CX-A for example.
Step 3 Set logs to be exported to the control console.

[CX-A] [CX-A] [CX-A] [CX-A] <CX-A> info-center enable info-center source default channel 9 log level warnings info-center logfile channel channel9 quit terminal logging
Step 4 Configure the ACL to prevent devices from being attacked from specified TCP and UDP interfaces.
NOTE
Configuring the ACL must be performed on the access device interface that is on the access side.
<CX-A> system-view [CX-A] acl number 3001 [CX-A-acl-adv-3001] description anti-virus [CX-A-acl-adv-3001] rule 5 deny tcp destination-port eq 445 [CX-A-acl-adv-3001] rule 10 deny udp destination-port eq 445 [CX-A-acl-adv-3001] rule 15 deny tcp destination-port eq 135 [CX-A-acl-adv-3001] rule 20 deny udp destination-port eq 135 [CX-A-acl-adv-3001] rule 25 deny tcp destination-port eq 137 [CX-A-acl-adv-3001] rule 30 deny udp destination-port eq netbios-ns [CX-A-acl-adv-3001] rule 35 deny tcp destination-port eq 139 [CX-A-acl-adv-3001] rule 40 deny udp destination-port eq netbios-ssn [CX-A-acl-adv-3001] rule 45 deny udp destination-port eq 1433 [CX-A-acl-adv-3001] rule 50 deny udp destination-port eq 1434 [CX-A-acl-adv-3001] rule 55 deny tcp destination-port eq 4444 [CX-A-acl-adv-3001] rule 60 deny tcp destination-port eq 5554 [CX-A-acl-adv-3001] rule 65 deny udp destination-port eq 5554 [CX-A-acl-adv-3001] rule 70 deny tcp destination-port eq 9996 [CX-A-acl-adv-3001] rule 75 deny udp destination-port eq 9996 [CX-A-acl-adv-3001] rule 110 permit ip [CX-A-acl-adv-3001] quit [CX-A] traffic classifier anti-virus operator or [CX-A-classifier-anti-virus] if-match acl 3001 [CX-A-classifier-anti-virus] quit [CX-A] traffic behavior anti-virus [CX-A-behavior-anti-virus] quit [CX-A] traffic policy anti-virus [CX-A-trafficpolicy-anti-virus] classifier anti-virus behavior anti-virus [CX-A-trafficpolicy-anti-virus] quit [CX-A] interface gigabitethernet 1/0/0
7-38
Issue 01 (2011-05-30)

[CX-A-GigabitEthernet1/0/0] traffic-policy anti-virus inbound [CX-A-GigabitEthernet1/0/0] traffic-policy anti-virus outbound
7 ACL Configuration
----End
Configuration Files
NOTE
Only the configuration file on the CX-A is provided.
Configuration file of CX-A
# sysname CX-A # info-center source default channel 9 log level warning # acl number 3001 description anti-virus rule 5 deny tcp destination-port eq 445 rule 10 deny udp destination-port eq 445 rule 15 deny tcp destination-port eq 135 rule 20 deny udp destination-port eq 135 rule 25 deny tcp destination-port eq 137 rule 30 deny udp destination-port eq netbios-ns rule 35 deny tcp destination-port eq 139 rule 40 deny udp destination-port eq netbios-ssn rule 45 deny udp destination-port eq 1433 rule 50 deny udp destination-port eq 1434 rule 55 deny tcp destination-port eq 4444 rule 60 deny tcp destination-port eq 5554 rule 65 deny udp destination-port eq 5554 rule 70 deny tcp destination-port eq 9996 rule 75 deny udp destination-port eq 9996 rule 110 permit ip # traffic classifier anti-virus operator or if-match acl 3001 # traffic behavior anti-virus # traffic policy anti-virus classifier anti-virus behavior anti-virus # interface GigabitEthernet1/0/0 undo shutdown traffic-policy anti-virus inbound traffic-policy anti-virus outbound # user-interface maximum-vty 15 user-interface con 0 authentication-mode password set authentication password cipher N`C55QK<`=/Q=^Q`MAF4<1!! idle-timeout 30 0 user-interface vty 0 4 user-interface vty 5 14 set authentication password cipher N`C55QK<`=/Q=^Q`MAF4<1!! idle-timeout 30 0 user-interface vty 16 20 # return
7.9.3 Example for Configuring an ACL Rule that Is Based on the VPN Instance
This section provides an example of configuring an ACL rule that is based on the VPN instance.
7 ACL Configuration
As shown in Figure 7-3, two VPN instances are configured on the PE. CE1 belongs to VPN-A, whose VPN-target is 111:1; CE2 belongs to VPN-B, whose VPN-target is 222:2. An ACL rule is configured on the PE to permit users in VPN-A to log in to the PE through Telnet and to prevent users in VPN-B from logging in to the PE. Users in different VPNs cannot communicate with each other. Figure 7-3 Typical networking of configuring an ACL rule
AS: 65410 VPN-A CE1 GE1/0/0 10.1.1.2/24
PE1
AS: 65420
VPN-B CE2
GE1/0/0 10.1.1.1/24 AS: 100
GE2/0/0 11.1.1.1/24
GE1/0/0 11.1.1.2/24
The configuration roadmap is as follows: 1. 2. 3. Configure VPN instances. Define the ACL rule. Configure users in different VPNs with different authorities for logging into the PE.
Data Preparation
To complete the configuration, you need the following data: l l ACL number VPN instance name
Procedure
Step 1 Configure VPN instances on the PE and connect CE1 and CE2 to the PE. # Configure VPN-A.
<HUAWEI> system-view [HUAWEI] sysname PE [PE] ip vpn-instance vpna [PE-vpn-instance-vpna] route-distinguisher 100:1 [PE-vpn-instance-vpna] vpn-target 111:1 both [PE-vpn-instance-vpna] quit [PE] interface gigabitethernet 1/0/0 [PE-GigabitEthernet1/0/0] ip binding vpn-instance vpna [PE-GigabitEthernet1/0/0] ip address 10.1.1.1 24 [PE-GigabitEthernet1/0/0] quit
# Configure VPN-B.
[PE] ip vpn-instance vpnb
7-40
Issue 01 (2011-05-30)

[PE-vpn-instance-vpnb] route-distinguisher 100:2 [PE-vpn-instance-vpnb] vpn-target 222:2 both [PE-vpn-instance-vpnb] quit [PE] interface gigabitethernet 2/0/0 [PE-GigabitEthernet2/0/0] ip binding vpn-instance vpnb [PE-GigabitEthernet2/0/0] ip address 11.1.1.1 24 [PE-GigabitEthernet2/0/0] quit
7 ACL Configuration
Step 2 Configure an ACL rule and then apply the rule on the PE. After that, users in VPN-A can log in to the PE through Telnet; whereas users in VPN-B cannot log in to the PE.
[PE] acl number 2001 [PE-acl-adv-2001] rule permit vpn-instance vpna [PE-acl-adv-2001] rule deny vpn-instance vpnb [PE-acl-adv-2001] quit
Step 3 Use the ACL rule configured on the PE to control the login of users to the PE through Telnet.
[PE] user-interface vty 0 4 [PE-ui-vty0-4] authentication-mode none [PE-ui-vty0-4] acl 2001 inbound
Step 4 Verify the configuration. # Telnet CE1 to the PE.

<CE1> telnet 10.1.1.1 Trying 10.1.1.1 ... Press CTRL+K to abort Connected to 10.1.1.1 ... *********************************************************** * Copyright (C) 2000-2009 Huawei Technologies Co., Ltd * * Without the owner's prior written consent, * * no decompiling or reverse-engineering shall be allowed. * * Notice: * * This is a private communication system. * * Unauthorized access or use may lead to prosecution. * *********************************************************** Info: The max number of VTY users is 10, and the number of current VTY users on line is 1. <PE>
CE1 can log in to the PE through Telnet. # Telnet CE2 to the PE.
<CE2> telnet 10.1.1.1 Trying 10.1.1.1 ... Press CTRL+K to abort Error: Failed to connect to the remote host.
CE2 cannot log in to the PE through Telnet. ----End
Configuration Files
l Configuration file of the PE
# sysname PE # ip vpn-instance vpna route-distinguisher 100:1 vpn-target 111:1 export-extcommunity vpn-target 111:1 import-extcommunity ip vpn-instance vpnb route-distinguisher 100:2 vpn-target 222:2 export-extcommunity vpn-target 222:2 import-extcommunity
Issue 01 (2011-05-30)
7-41
7 ACL Configuration
# acl number 2001 rule 5 permit vpn-instance vpna rule 10 deny vpn-instance vpnb # aaa authentication-scheme default # authorization-scheme default # accounting-scheme default # domain default # # interface GigabitEthernet1/0/0 undo shutdown ip binding vpn-instance vpna ip address 10.1.1.1 255.255.255.0 # interface GigabitEthernet2/0/0 undo shutdown ip binding vpn-instance vpnb ip address 11.1.1.1 255.255.255.0 # user-interface con 0 user-interface vty 0 4 acl 2001 inbound authentication-mode none user-interface vty 16 20 # return

# sysname CE1 # aaa authentication-scheme default # authorization-scheme default # accounting-scheme default # domain default # # interface GigabitEthernet1/0/0 undo shutdown ip address 10.1.1.2 255.255.255.0 # user-interface con 0 user-interface vty 0 4 user-interface vty 16 20 # return

# sysname CE2 # aaa authentication-scheme default # authorization-scheme default # accounting-scheme default # domain default #
7-42
Issue 01 (2011-05-30)

# interface GigabitEthernet1/0/0 undo shutdown ip address 11.1.1.2 255.255.255.0 # user-interface con 0 user-interface vty 0 4 user-interface vty 16 20 # return
7 ACL Configuration
Issue 01 (2011-05-30)
7-43
8 Basic IPv6 Configuration
8
About This Chapter
Basic IPv6 Configuration
The IPv6 protocol stack is a support for routing protocols and application protocols on an IPv6 network. 8.1 Basic IPv6 Overview Internet Protocol version 6 (IPv6) is a proposed next generation for the Internet Protocol, which was introduced by the Internet Engineering Task Force (IETF) and formerly known as IPng. 8.2 Configuring an IPv6 Address for an Interface Assigning an IPv6 address to a device on a network enables the device to communicate with the other devices on the network. 8.3 Configuring an IPv6 Address Selection Policy Table If multiple addresses are configured on an interface of the device, the IPv6 address selection policy table can be used to select source and destination addresses for packets. 8.4 Configuring IPv6 Neighbor Discovery IPv6 neighbor discovery (ND) is a packet transmission process to identify the relationship between neighboring nodes. The Neighbor Discovery Protocol (NDP) replaces the Address Resolution Protocol (ARP), ICMP Router Discovery messages, and ICMP Redirect messages, and introduces neighbor reachability detection. 8.5 Configuring IPv6 SEND The SEcure Neighbor Discovery (SEND) protocol is a security extension of the Neighbor Discovery Protocol (NDP) in IPv6. 8.6 Configuring PMTU By setting the PMTU, you can select a proper MTU for packet transmission. In this manner, packets do not have to be fragmented during transmission and loads on intermediate devices are reduced. In addition, network resources are used more efficiently and the network throughput reaches the optimal value. 8.7 Configuring TCP6 By setting TCP6 packets, you can improve the performance of the network. 8.8 Maintaining IPv6 This section describes how to maintain IPv6. Detailed operations include deleting information about IPv6 operation and monitoring IPv6 operation.
8.9 Configuration Examples This section includes the networking requirements, precautions for configuration, and configuration roadmap.
8-2
Issue 01 (2011-05-30)
8.1 Basic IPv6 Overview

Internet Protocol version 6 (IPv6) is a proposed next generation for the Internet Protocol, which was introduced by the Internet Engineering Task Force (IETF) and formerly known as IPng. 8.1.1 Introduction to IPv6 IPv6 is an upgraded version of IPv4 and solves many problems with IPv4. 8.1.2 IPv6 Supported by the CX600 The basic functions of IPv6 include IPv6 address configuration, IPv6 neighbor discovery, duplicate address detection, router advertisement, ICMPv6 packet control, and Path MTU (PMTU) configuration. The IPv6 protocol stack is a support for routing protocols and application protocols.
8.1.1 Introduction to IPv6

IPv6 is an upgraded version of IPv4 and solves many problems with IPv4. Internet Protocol Version 6 (IPv6), also called IP Next Generation (IPng), is the standard network protocol of the second generation. It is a set of specifications designed by the Internet Engineering Task Force (IETF). IPv6 is the upgraded version of IPv4. The most remarkable difference between IPv6 and IPv4 is that the IP address lengthens from 32 bits to 128 bits.
8.1.2 IPv6 Supported by the CX600

The basic functions of IPv6 include IPv6 address configuration, IPv6 neighbor discovery, duplicate address detection, router advertisement, ICMPv6 packet control, and Path MTU (PMTU) configuration. The IPv6 protocol stack is a support for routing protocols and application protocols. The CX600 supports the IPv6 protocol suite and TCP6 protocol suite.
IPv6 Address
A 128-bit IPv6 address has the following formats: l X:X:X:X:X:X:X:X In this format, a 128-bit IP address is divided into eight groups. The 16 bits of each group are represented by four hexadecimal characters, that is, 0 to 9, and A to F. The groups are separated by colons. Every "X" represents a group of hexadecimal values. l X:X:X:X:X:X:d.d.d.d This format is for the following types of addresses: IPv4-compatible IPv6 address IPv4-mapped IPv6 address IPv4-compatible IPv6 address is used to configure an IPv6 over IPv4 tunnel. In this type of address, "X" represents the first six groups of numbers. Each "X" stands for 16 bits that are represented by hexadecimal numbers. "d" represents the subsequent four group of numbers. Each "d" stands for eight bits that are represented by decimal numbers. "d.d.d.d" is a standard IPv4 address. An IPv6 address can be divided into two parts:
l l
Network prefix: equals the network ID of an IPv4 address. It is of n bits. Interface identifier: equals the host ID in an IPv4 address. It is of 128-n bits.
Selection of Source and Destination Addresses

When network administrators need to specify or plan a source and a destination addresses, they can define a group of address selection rules. An address selection policy table can be created based on these rules. Similar to a routing table, this table can be queried based on the longest match rule. The address is selected based on a source and a destination addresses.
IPv6 Neighbor Discovery

The IPv6 neighbor discovery (ND) is a group of messages and processes that define the relationship between neighboring nodes. ND replaces the Address Resolution Protocol (ARP) messages and the Internet Control Message Protocol (ICMP) device discovery messages. It also provides additional functions.
IPv6 SEND
The SEcure Neighbor Discovery (SEND) protocol is a security extension of the Neighbor Discovery Protocol (NDP) in IPv6.
IPv6 PMTU
Generally, the problem that different networks have different Maximum Transmission Units (MTU) can be solved in the following ways: l Devices fragment packets as required. The source host only needs to fragment packets; however, the intermediate CX device not only needs to fragment packets, but also to reassemble packets. The source host sends packets based on a proper MTU so that packets need not be fragmented on the intermediate CX device. In such a case, packet processing burden on the intermediate CX device can be reduced. During IPv6 packet transmission, only this way can be adopted because IPv6 intermediate CX devices do not support packet fragmentation.
The Path MTU (PMTU) Discovery mechanism aims at finding a proper MTU value on the path from the source to the destination.
IPv6 FIB
Connecting network topologies of different types needs the configuration of different routing protocols. This brings about Routing Information Base (RIB). The RIB is a base of the Forwarding Information Base (FIB). Guided by route management policies, a device extracts a minimum of necessary forwarding information from RIB and adds the information to the FIB. Through the route management module, you can also add static routes into the FIB. A FIB contains a group of minimum information needed by a device during packet forwarding. An FIB entry usually contains the destination address, prefix length, transport port, next-hop address, route flag, and time stamp. A device forwards packets according to FIB entries. The FIB mechanism consists of two parts: FIB agent (used on the control plane) and FIB container (used on the forwarding plane). A FIB agent is responsible for interacting with the RM module for delivering FIB entries to the forwarding engine, and to the I/O board in a distributed system.
A FIB contains the following information: l l l l l l Destination address: indicates the network or host a packet is destined for. Prefix length: indicates the length of the destination address prefix. From the prefix length, you can infer that the destination address is a network address or a host address. Nexthop: indicates the address of the close next hop through which the packet reaches the destination. Flag(s): identifies route features. Interface: indicates the outgoing interface of the packet. Timestamp: Indicates the time when an FIB entry is established.
8.2 Configuring an IPv6 Address for an Interface

Assigning an IPv6 address to a device on a network enables the device to communicate with the other devices on the network. 8.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for assigning an IPv6 address to an interface. 8.2.2 Enabling IPv6 Packet Forwarding Capability You can perform other IPv6 configurations on an interface only when IPv6 is enabled in the interface view. To enable IPv6 packet forwarding on an interface, you must configure IPv6 in the system view. 8.2.3 Configuring an IPv6 Link-Local Address for an Interface The local address of a link is used in the neighbor discovery protocol, and in the communications between nodes on the local end of the link in stateless address auto-configuration. The local address of a link is valid only for the link. A packet with a link-local address as the source or destination address is forwarded only along the local link. 8.2.4 Configuring an IPv6 Global Unicast Address for an Interface A global unicast IP address is equal to an Internet IPv4 address and can be used for links whose route prefixes can be aggregated. In this manner, routing entries can be reduced. 8.2.5 Configuring an IPv6 Anycast Address for an Interface An anycast address is used to identify a group of interfaces. 8.2.6 Checking the Configuration You can view the configuration of the IPv6 address for an interface.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for assigning an IPv6 address to an interface.
When a device communicates with an IPv6 device, you need to configure IPv6 address for the interface. The CX600 supports configuring IPv6 addresses for the following interfaces: l
Issue 01 (2011-05-30)
Gigabit-Ethernet interfaces and sub-interfaces

l l l l l
POS interfaces (Only the POS interfaces configured with PPP or HDLC as the link protocol support IPv6.) Tunnel interfaces Loopback interfaces Eth-Trunk interfaces, Eth-Trunk sub-interfaces, and IP-Trunk interfaces VLANIF interfaces
You can configure 10 addresses for one interface. Addresses can be the link-local address and the global unicast address. The link-local address is used in ND, and in the communication between nodes on the local link in the stateless address auto-configuration. The packets using the link-local address as the source or destination address are not forwarded to other links. The link-local address can be automatically generated or manually configured. After being enable with automatic address generation capability, the system automatically generates a linklocal address. The link-local address configured manually must be a valid link-local address (FE80::/10). It is recommended to automatically generate a link-local address because the link-local address is used only for the communication between link-local nodes. Commonly, it is used to implement communication requirements of protocol and is not directly related to the communication between users. The global unicast address is equivalent to the IPv4 public address. It is used for data forwarding across the pubic network, which is necessary for the communication between users. An EUI-64 address has the same function as an global unicast address. The difference is that only the network bits need to be specified for the EUI-64 address and the host bits are transformed from the MAC addresses of the interface while a complete 128-bit address need to be specified for the global unicast address. Note that the prefix length of the network bits in an EUI-64 address must not be longer than 64 bits. The EUI-64 address and the global unicast address can be configured simultaneously or alternatively. However, the IP addresses configured for one interface cannot be in the same network segment.
Before configuring IPv6 addresses, complete the following tasks: l l Configuring the physical features of the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up
Data Preparation
To configure IPv6 addresses for an interface, you need the following data. No. 1
8-6
Data Number of the interface

No. 2 3
Data Link-local address configured manually Global unicast address and prefix length
8.2.2 Enabling IPv6 Packet Forwarding Capability

You can perform other IPv6 configurations on an interface only when IPv6 is enabled in the interface view. To enable IPv6 packet forwarding on an interface, you must configure IPv6 in the system view.
Context
To enable a device to forward IPv6 packets, you must enable the IPv6 capability in both the system view and the interface view. This is because: l If you run the ipv6 command only in the system view, only the IPv6 packet forwarding capability is enabled on a device. The IPv6 function, however, is not enabled on the interface and hence you cannot perform any IPv6 configurations. If you run the ipv6 enable command only in the interface view, the IPv6 capability is enabled only on an interface but the IPv6 protocol status on the interface is Down. Therefore, the device cannot forward IPv6 data.
Procedure
Step 1 Run:
system-view

ipv6
The IPv6 packet forwarding capability is enabled. By default, the IPv6 packet forwarding capability is disabled. To enable a device to forward IPv6 packets, you must run this command in the system view; otherwise, the IPv6 protocol status of the interface is Down and the device cannot forward IPv6 packets although you enable IPv6 on the interface. Step 3 Run:
The view of the interface to be enabled with the IPv6 capability is displayed. Step 4 Run:
ipv6 enable
The IPv6 capability is enabled on the interface. Before performing IPv6 configurations in the interface view, you must enable the IPv6 capability in the interface view.
By default, the IPv6 capability is disabled on the interface. ----End
8.2.3 Configuring an IPv6 Link-Local Address for an Interface

The local address of a link is used in the neighbor discovery protocol, and in the communications between nodes on the local end of the link in stateless address auto-configuration. The local address of a link is valid only for the link. A packet with a link-local address as the source or destination address is forwarded only along the local link.
Procedure
Step 1 Run:
system-view

The interface view is displayed. Step 3 Perform the following as required. Run:
ipv6 address auto link-local
Auto generation of the IPv6 link-local address is enabled. Or Run:

ipv6 address ipv6-address link-local
The IPv6 link-local address is manually configured. Besides configuring a link-local address through the preceding two commands, you can also configure a global unicast IPv6 address for auto generating a link-local address. For details, see Configuring an IPv6 Global Unicast Address for an Interface. ----End
8.2.4 Configuring an IPv6 Global Unicast Address for an Interface

A global unicast IP address is equal to an Internet IPv4 address and can be used for links whose route prefixes can be aggregated. In this manner, routing entries can be reduced.
Procedure
Step 1 Run:
system-view

8-8
Issue 01 (2011-05-30)

ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } or ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } eui-64
The global unicast address is configured on the interface. ----End
8.2.5 Configuring an IPv6 Anycast Address for an Interface

An anycast address is used to identify a group of interfaces.
Context
Anycast addresses and unicast addresses are in the same address range. An anycast address is used to identify a group of interfaces on different nodes. l l Similar to a multicast address, an anycast address is listened to by multiple nodes. Therefore, it is only used as a destination address. The packets destined for an anycast address are transmitted to an interface that is in the interface group identified by the anycast address and is closest to the source node. (The distance between an interface and the source node is calculated based on the routing protocol). The packets destined for a multicast address are transmitted to a group of interfaces with the multicast address.
When the 6to4 tunnel is used for the communication between the 6to4 network and the native IPv6 network, the CX600 supports the configuration of an anycast address with the prefix of 2002:c058:6301:: on the tunnel interface of the 6to4 relay route device. Alternatively, you can configure a 6to4 address on the tunnel interface of the 6to4 relay route device. When multiple 6to4 relay route devices are configured on the network, the difference between the two methods is as follows: l l If an 6to4 address is used, you need to configure different addresses for tunnel interfaces of all devices. If an anycast address is used, you need to configure the same address for the tunnel interfaces of all devices. In this manner, the number of addresses is reduced.
Procedure
Step 1 Run:
system-view


ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } anycast
An IPv6 anycast address is assigned to an interface. ----End


You can view the configuration of the IPv6 address for an interface.
Prerequisite
The configurations of the IPv6 addresses are complete.
Procedure
l l Run the display ipv6 interface [ interface-type interface-number | brief ] command to check the IPv6 information of an interface. Run the display ipv6 statistics [ slot slot-id | interface interface-type interface-number ] command to check the IPv6 packet statistics.
----End
Example
Run the display ipv6 interface command. If the IPv6 address of the interface is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ipv6 interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP , IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::200:1FF:FE04:5D00 Global unicast address(es): 2001::1, subnet is 2001::/64 Joined group address(es): FF02::1:FF00:1 FF02::1:FF04:5D00 FF02::2 FF02::1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
Run the display ipv6 interface command. If the configured IPv6 address and interface status are displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 interface brief *down: administratively down !down: FIB overload down (l): loopback (s): spoofing Interface Physical GigabitEthernet2/0/2 up [IPv6 Address] 2030::101:101 GigabitEthernet2/0/3 up [IPv6 Address] 2001::1 LoopBack0 up [IPv6 Address] Unassigned
Protocol up up up(s)
Run the display ipv6 statistics command. If the statistics on IPv6 packets is displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 statistics IPv6 Protocol: Sent packets: Total : 3630
8-10
Issue 01 (2011-05-30)

Local sent out Raw packets Fragmented Fragments failed Received packets: Total Hop count exceeded Too big Address error Truncated Fragments Reassembly timeout : : : : : : : : : : : 3630 0 0 0 3630 0 0 0 0 0 0 Forwarded Discarded Fragments Multicast Local host Header error Routing failed Protocol error Option error Reassembled Multicast : : : : : : : : : : : 0 0 0 0
3630 0 0 0 0 0 0
8.3 Configuring an IPv6 Address Selection Policy Table

If multiple addresses are configured on an interface of the device, the IPv6 address selection policy table can be used to select source and destination addresses for packets.
IPv6 addresses can be classified into different types based on different applications. l l l l Link local addresses and global unicast addresses based on the effective range of the IPv6 addresses Temporary addresses and public addresses based on security levels Home addresses and care-of addresses based on the application in the mobile IPv6 field Physical interface addresses and logical interface addresses based on the interface attributes
The preceding IPv6 addresses can be configured on the same interface of the CX device. In this case, the device must select a source address or a destination addresses from multiple addresses on the interface. If the device supports the IPv4/IPv6 dual-stack, it also must select IPv4 addresses or IPv6 addresses for communication. For example, if a domain name maps both an IPv4 address and an IPv6 address, the system must select an address to respond to the DNS request of the client. An IPv6 address selection policy table solves the preceding problems. It defines a group of address selection rules. The source and destination addresses of packets can be specified or planned based on these rules. This table, similar to a routing table, can be queried by using the longest matching rule. The address is selected based on the source and destination addresses. l The label parameter can be used to determine the result of source address selection. The address whose label value is the same as the label value of the destination address is selected preferably as the source address. The destination address is selected based on both the label and the precedence parameters. If label values of the candidate addresses are the same, the address whose precedence value is largest is selected preferably as the destination address.
None.
Issue 01 (2011-05-30)
8-11
Procedure
Step 1 Run:
system-view

ipv6 address-policy [ vpn-instance vpn-instance-name ] ipv6-address prefix-length precedence label
The source or destination address selection policies are configured. By default, only default address selection policy entries are contained. These entries are prefixed with ::1, ::, 2002::, FC00::, and ::ffff:0:0. A maximum of 50 address selection policy entries are supported by the system. ----End
Checking the Configuration

Run the following commands to check the previous configuration. l Run the display ipv6 address-policy [ vpn-instance vpn-instance-name ] { all | ipv6address prefix-length } command to check address selection policy entries.
Run the display ipv6 address-policy all command, and you can check all address selection policy entries, including the default address selection policy entries and the address selection policy entry configured by ipv6 address-policy command whose prefix is 3::.
<HUAWEI> display ipv6 address-policy all Policy Table : Total:6 ------------------------------------------------------------------------------Prefix : :: PrefixLength : 0 Precedence : 40 Label : 1 Default : Yes Prefix : ::1 Precedence : 50 Default : Yes Prefix : ::FFFF:0.0.0.0 Precedence : 10 Default : Yes Prefix : 3:: Precedence : 40 Default : No Prefix : 2002:: Precedence : 30 Default : Yes Prefix : FC00:: Precedence : 20 Default : Yes PrefixLength Label PrefixLength Label PrefixLength Label PrefixLength Label PrefixLength Label : 128 : 0 : 96 : 4 : 64 : 20 : 16 : 2 : 7 : 3
-------------------------------------------------------------------------------
8-12
Issue 01 (2011-05-30)
8.4 Configuring IPv6 Neighbor Discovery

IPv6 neighbor discovery (ND) is a packet transmission process to identify the relationship between neighboring nodes. The Neighbor Discovery Protocol (NDP) replaces the Address Resolution Protocol (ARP), ICMP Router Discovery messages, and ICMP Redirect messages, and introduces neighbor reachability detection. 8.4.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for IPv6 neighbor discovery. 8.4.2 Configuring Static Neighbors By configuring a static neighbor, you can obtain the mapping of the IPv6 address and MAC address of the neighbor. 8.4.3 Enabling RA Message Advertising After being enabled with CX device advertisement, the device can send router advertisement messages, providing prefixes for hosts. 8.4.4 Setting the Interval for Advertising RA Messages The device periodically sends router advertisement messages containing information such as prefixes and flag bits. 8.4.5 Enabling Stateful Auto Configuration After being enabled with stateful auto-configuration, the host can obtain an IPv6 address through stateful auto-configuration, for example, the DHCP server. 8.4.6 Configuring the Address Prefixes to Be Advertised Nodes of the local links can perform address auto-configuration by using prefixes of these addresses. 8.4.7 Configuring Other Information to Be Advertised A router advertisement message carries information such as the maximum number of hops, prefix option, neighbor hold time, and keepalive time. 8.4.8 Configuring the Default Router Priority and Route Information RA packets that carry the default router priority and route information can be transmitted over the local link. In this manner, a proper CX device can be selected to forward packets of a host. 8.4.9 (Optional) Configuring Routed Proxy ND This configuration can be used if an enterprise has two physical networks in different subnets of the same IP network, but separated by a device. You must enable the proxy ND on the device interface connected to the physical networks for the two networks to communicate. 8.4.10 Checking the Configuration You can view the configuration of IPv6 neighbor discovery.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for IPv6 neighbor discovery.
Most of the ND configurations are implemented based on the interfaces.
The IPv6 ND configuration is supported on the following interfaces: l l l l l l Gigabit-Ethernet interfaces and their sub-interfaces POS interfaces (Only the POS interfaces configured with PPP or HDLC as the link protocol support IPv6.) Tunnel interfaces Loopback interfaces Eth-Trunk interfaces, Eth-Trunk sub-interfaces, and IP-Trunk interfaces VLANIF interfaces
NOTE
Though the POS interfaces can be configured with IPv6 ND-related commands, packet sending or packet forwarding on these interfaces actually do not require neighbor entries.
Before configuring IPv6 neighbor discovery, complete the following tasks: l l l Configuring the physical features for the interface and ensuring that the status of the physical layer of the interface is Up Configuring link layer parameters for the interface Configuring the IPv6 address for the interface
Data Preparation
To configure IPv6 neighbor discovery, you need the following data. No. 1 2 3 4 5 6 7 8 9 Data Number of interface which needs to be configured with IPv6 ND IPv6 address and MAC address of the static neighbor Intervals, prefix, and life duration of RA messages Flag bit of automatic configuration Hop limit of ND Sending times of DAD Intervals for re-transmitting NS messages NUD reachable time Interface MTU
8.4.2 Configuring Static Neighbors

By configuring a static neighbor, you can obtain the mapping of the IPv6 address and MAC address of the neighbor.
Procedure
Step 1 Run:
system-view

The interface view is displayed. Step 3 Run one of the following commands as required: l To configure a static neighbor entry on a common Layer 3 interface, run the ipv6 neighbor ipv6-address mac-address command. l To configure a static neighbor entry on a VLANIF interface, run the ipv6 neighbor ipv6address mac-address vid vlan-id interface-type interface-number command. l To configure a static neighbor entry on a sub-interface for QinQ VLAN tag termination, run the ipv6 neighbor ipv6-address mac-address vid vid [ cevid cevid ] command.
NOTE
If an interface is configured with dynamic QinQ, you cannot configure a static neighbor entry on it.
Static neighbors can be configured for interfaces and their sub-interfaces. You can configure up to 300 neighbors on each interface. ----End
8.4.3 Enabling RA Message Advertising

After being enabled with CX device advertisement, the device can send router advertisement messages, providing prefixes for hosts.
Procedure
Step 1 Run:
system-view


undo ipv6 nd ra halt
The function of advertising RA messages is enabled. ----End
8.4.4 Setting the Interval for Advertising RA Messages

The device periodically sends router advertisement messages containing information such as prefixes and flag bits.
Procedure
Step 1 Run:
system-view


ipv6 nd ra { max-interval maximum-interval | min-interval minimum-interval }
The interval for advertising RA messages is configured. By default, the maximum interval is 600 seconds and the minimum interval is 200 seconds. The maximum interval can not be shorter than the minimum interval. When the maximum interval is less than 9 seconds, the minimum interval is set to the same value as the maximum interval. ----End
8.4.5 Enabling Stateful Auto Configuration

After being enabled with stateful auto-configuration, the host can obtain an IPv6 address through stateful auto-configuration, for example, the DHCP server.
Procedure
Step 1 Run:
system-view


ipv6 nd autoconfig managed-address-flag
The flag bit for stateful auto configuration addresses is set. If this flag is set, hosts use the stateful protocol for address auto-configuration in addition to any addresses auto-configured using stateless address auto-configuration. Step 4 Run:
ipv6 nd autoconfig other-flag
The flag bit for other stateful configurations is set. When this flag is set, hosts use the stateful protocol for auto-configuration of other (non-address) information. ----End
8.4.6 Configuring the Address Prefixes to Be Advertised

Nodes of the local links can perform address auto-configuration by using prefixes of these addresses.
Procedure
Step 1 Run:
system-view


ipv6 nd ra prefix { ipv6-address ipv6-prefix-length | ipv6-prefix/ipv6-prefixlength } valid-lifetime preferred-lifetime [ no-autoconfig ] [ off-link ]
The prefix of RA messages is configured. ----End
8.4.7 Configuring Other Information to Be Advertised

A router advertisement message carries information such as the maximum number of hops, prefix option, neighbor hold time, and keepalive time.
Context
Duplicate Address Detect (DAD) is a process of IPv6 automatic address configuration. You can configure the number of DAD messages which are sent continuously. Set the interval of sending Neighbor Solicitation (NS) messages on the device. By default, NS re-transmitting time interval is 1000ms. Neighbor Unreachability Detection (NUD) checks the reachability of neighbors. By default, NUD value is 30000ms. The MTU of the interface determines whether to fragment IP packets on the interface. Default MTUs vary with interface types. The MTU on an GigabitEthernet interface defaults to be 1500 bytes.
Procedure
Step 1 Run:
system-view

ipv6 nd hop-limit limit
ND hop limit is configured.

The value of limit ranges from 1 to 255. By default, it is 64. Step 3 Run:

ipv6 nd ra hop-limit limit
ND hop limit is configured. The value of limit ranges from 0 to 255. By default, it is 64.
NOTE
l If the ipv6 nd ra hop-limit command has been run on an interface, the hop limit for an RA message uses the value configured on the interface. l If the ipv6 nd ra hop-limit command has not been run on an interface, the hop limit for an RA message uses the value configured globally, that is, the value configured in the ipv6 nd hop-limit command.
Step 5 Run:
ipv6 nd ra router-lifetime ra-lifetime
The life duration of RA messages is configured.

NOTE
l When the ipv6 nd ra command is run to set the interval for advertising RA messages, the interval must be less than or equal to the life duration. l By default, the maximum interval is 600 seconds, and the minimum interval is 200 seconds. l By default, the life duration of RA messages is 1800 seconds. If the prefix is configured, the duration is still 1800 seconds.
Step 6 Run:
ipv6 nd dad attempts value
Times to send DAD messages are configured. Step 7 Run:

ipv6 nd ns retrans-timer interval
The interval for re-sending NS messages is set. Step 8 Run:

ipv6 nd nud reachable-time value
The NUD reachable time is set. Step 9 Run:

ipv6 mtu mtu
MTU of the interface is configured. The IPv6 MTU should be smaller than 9600 bytes on the GigabitEthernet of the LPUF-20. ----End
Follow-up Procedure
If the IPv6 MTU value is changed, run the shutdown command and the undo shudown command orderly in the interface view to validate the configuration.
8.4.8 Configuring the Default Router Priority and Route Information

RA packets that carry the default router priority and route information can be transmitted over the local link. In this manner, a proper CX device can be selected to forward packets of a host.
Context
If a host is connected to multiple CX devices, the host must select a CX device to forward packets based on the destination addresses of packets. The CX device can advertise the default router priority and specified route information to the host so that the host can select a proper forwarding CX device based on the destination addresses of packets. After receiving the RA packets carrying the route information, the host updates its routing table. When sending packets to another device, the host queries the routing table and selects a proper route to send packets. When receiving the RA packets that carry the priority of default routers, the host updates its default router table. When sending packets to another device, if there is no route to be selected, the host queries the default router table. Then, the host selects a CX device with the highest priority on the local link to send packets. If the CX device is faulty, the host selects another CX device in descending order of priority.
Procedure
Step 1 Run:
system-view


ipv6 nd ra preference { high | medium | low }
The default router priority is configured in RA packets. Step 4 Run:

ipv6 nd ra route-information ipv6-address prefix-length lifetime route-lifetime [ preference { high | medium | low } ]
Route information is configured in RA packets. ----End
8.4.9 (Optional) Configuring Routed Proxy ND

This configuration can be used if an enterprise has two physical networks in different subnets of the same IP network, but separated by a device. You must enable the proxy ND on the device interface connected to the physical networks for the two networks to communicate.
Procedure
Step 1 Run:
system-view


bas
A BAS interface is created and the BAS interface view is displayed. Step 4 Run:
nd-proxy enable
Routed proxy ND is enabled. ----End

You can view the configuration of IPv6 neighbor discovery.
Prerequisite
The configurations of the IPv6 neighbor discovery function are complete.
Procedure
l Run the display ipv6 neighbors [ ipv6-address | [ vid vlan-id ] interface-type interfacenumber | vpn-instance vpn-instance-name ], display ipv6 neighbors [ interface-type interface-number [ vid vid [ cevid cevid ] ] ], or display ipv6 neighbors slot slot-id [ verbose ] [ [vid vlan-id ] [ interface-type interface-number ] ] command to check the neighbor information in the cache. Run the display ipv6 neighbors[ [ vid vlan-id] interface-type interface-number ] command to check the neighbor information in the cache. Run the display ipv6 interface [ interface-type interface-number | brief ] command to check the IPv6 information of an interface.
l l
----End
Example
Run the display ipv6 neighbors command. If the cache of the neighbor information contains neighbors' IPv6 addresses and the specified interfaces, it means that the configuration succeeds.
<HUAWEI> display ipv6 neighbors gigabitEthernet1/0/0 -------------------------------------------------------IPv6 Address : 3003::2 Link-layer : 00e0-fc89-fe6e State : STALE Interface : GE1/0/0 Age : 7 VLAN : CEVLAN: VPN name : vpn1 Is Router: TRUE Secure FLAG : UN-SECURE
8-20
Issue 01 (2011-05-30)
IPv6 Address : FE80::2E0:FCFF:FE89:FE6E Link-layer : 00e0-fc89-fe6e State : STALE Interface : GE1/0/0 Age : 7 VLAN : CEVLAN: VPN name : vpn1 Is Router: TRUE Secure FLAG : UN-SECURE --------------------------------------------------------Total: 2 Dynamic: 2 Static: 0
Run the display ipv6 interface command. If information about the IPv6 address on the interface is displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::200:1FF:FE04:5D00 Global unicast address(es): 2001::1, subnet is 2001::/64 Joined group address(es): FF02::1:FF00:1 FF02::1:FF04:5D00 FF02::2 FF02::1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
Run the display ipv6 interface brief command. If information about the IPv6 address on the interface and interface status are displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 interface brief *down: administratively down !down: FIB overload down (l): loopback (s): spoofing Interface Physical GigabitEthernet2/0/2 up [IPv6 Address] 2030::101:101 GigabitEthernet2/0/3 up [IPv6 Address] 2001::1 LoopBack0 up [IPv6 Address] Unassigned
Protocol up up up(s)
8.5 Configuring IPv6 SEND

The SEcure Neighbor Discovery (SEND) protocol is a security extension of the Neighbor Discovery Protocol (NDP) in IPv6. 8.5.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure of IPv6 SEND. 8.5.2 Configuring a CGA IPv6 Address To enable IPv6 SEND to protect ND messages that carry CGA and RSA options, you need to configure a CGA IPv6 address on an interface that sends ND messages. 8.5.3 Configuring Strict IPv6 SEND After the rate limit for processing received ND messages, the key length allowed on the interface, and the timestamp in the ND messages are set, the system considers the received ND messages that do not meet these requirements invalid.
8.5.4 Checking the Configuration The IPv6 SEND configurations can be checked.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure of IPv6 SEND.
IPv6 nodes use the Neighbor Discovery Protocol (NDP) to discover other nodes on the link and to ensure reachability between neighbors. Therefore, NDP must be secured. IPSec can protect NDP, but this requires too many complicated configurations. Therefore, IPv6 SEND can be configured to protect NDP. The SEND protocol is designed to address the following attacks to NDP: l Redirect attack: Neighbor Solicitation (NS) or Neighbor Advertisement (NA) spoofing, malicious last hop router, spoofed redirect message, and replay attack An attacking node causes packets of legitimate nodes to be sent to some other link-layer addresses. This can be done by either sending an NS message with a different source linklayer address option, or sending an NA message with a different destination link-layer address option. l Denial-of-Service (DoS) attack: Neighbor Unreachability Detection (NUD) failure, Duplicate Address Detection (DAD) attack, bogus address configuration prefix, and parameter spoofing An attacker keeps sending fabricated NA messages in response to NUD NS messages. After having failed to send NS messages for several times, a host deletes the neighbor entries of the attacked node, which causes the attacked node to fail to communicate with the host. An attacker can also respond to every DAD attempt, simulating that it (the attacker) has already taken the address claimed by the attacked node into use. In this case, the attacked node may be unable to obtain an IP address and fail to work properly. To counter the preceding security threats, SEND introduces two new options: a Cryptographically Generated Addresses (CGA) option and a Rivest Shamir Adleman (RSA) option. l l CGAs are used to make sure that the sender of a Neighbor Discovery (ND) message is the "owner" of the claimed address. (The address is the source address of the ND message.) RSA is a digital signature of an ND message, and is used to verify the integrity of the ND message and the validity of the ND message sender.
To encounter the threats to NDP, SEND also defines two options in an ND message: l Nonce option: used to prevent replay attacks by assuring that a particular NA message is linked to the NS message that triggered it. For example, during the exchange of NS and NA messages, both the NS and NA messages carry a Nonce option. The NS message sender then determines whether the received NA message is valid based on the carried Nonce option. Timestamp option: used to protect unsolicited advertisement and redirect messages. A sender must ensure that each received message contains a latest timestamp.
Currently, IPv6 SEND is supported on the following types of interfaces:

l l l l l l
Ethernet interface and its sub-interfaces GigabitEthernet interface and its sub-interfaces Serial interface whose link protocol is PPP or HDLC POS interface whose link protocol is PPP or HDLC Eth-Trunk interface, Eth-Trunk sub-interfaces, and IP-Trunk interface VLANIF interface
NOTE
IPv6 ND related commands can be run on serial and POS interfaces, and no neighbor entries are needed when packets are being sent or forwarded from these interfaces.
Before configuring IPv6 SEND, complete the following tasks: l l Setting parameters for the link layer protocols on the interfaces to ensure that the link layer protocols are Up Configuring IPv6 ND
Data Preparation
To configure IPv6 SEND, you need the following data. No. 1 2 3 4 5 6 7 Data RSA key pair name and associated parameter Number of the interface where IPv6 SEND is configured Modifier value and security level of a CGA address CGA IPv6 address Rate limit for processing received ND messages Key length allowed on an interface Timestamp parameters in an ND message
8.5.2 Configuring a CGA IPv6 Address

To enable IPv6 SEND to protect ND messages that carry CGA and RSA options, you need to configure a CGA IPv6 address on an interface that sends ND messages.
Context
If a CGA IPv6 address is configured on an interface, the ND message sent by the interface will carry CGA and RSA options. After receiving the ND message, the remote interface checks the validity of the ND message sender and the integrity of the ND message based on the CGA and RSA options.
Procedure
Step 1 Run:
system-view

rsa key-pair label label-name modulus modulus-bits
An RSA key pair is created. Step 3 Run:

The view of the interface where a CGA IPv6 address needs to be configured is displayed. Step 4 Run:
ipv6 security rsakey-pair key-label
The RSA key pair is bound to the interface to generate a CGA address. Step 5 Run:
ipv6 security modifier sec-level sec-value [ modifier-value ]
The modifier value and security level are configured for the CGA address. The modifier value can be manually configured only when the security level of the CGA address is 0. Step 6 Run:
ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } cga
Or
ipv6 address ipv6-address link-local cga
A CGA IPv6 address is configured. ----End
Follow-up Procedure
Run the ipv6 nd security strict command to enable the strict security mode on the interface.
NOTE
If a local device is enabled with the strict security mode whereas the remote device is not, the local device considers the messages sent by the remote device invalid and discards them.
8.5.3 Configuring Strict IPv6 SEND

After the rate limit for processing received ND messages, the key length allowed on the interface, and the timestamp in the ND messages are set, the system considers the received ND messages that do not meet these requirements invalid.
Context
When working in strict security mode, an interface regards the received ND message insecure and discards it in the following cases:
l l l
The rate of processing the received ND message exceeds the rate limit of the system. The key length in the received ND message is out of the length range allowed on the interface. The difference between the receive time and the send time of the ND message is out of the time range allowed on the interface.
NOTE
On a link, device A is configured with strict IPv6 SEND whereas device B is not. In this case, device A regards the ND messages sent from device B insecure and rejects them.
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 (Optional) Run:

ipv6 nd security rate-limit ratelimit-value
The rate limit for processing received ND messages is set. Step 3 Run:
The interface view is displayed. Step 4 (Optional) Run:

ipv6 nd security key-length { minimum keylen-value | maximum keylen-value }
*
The key length allowed on the interface is set. Step 5 (Optional) Run:
ipv6 nd security timestamp drift-value } * { fuzz-factor fuzz-value | delta delta-value | drift
The timestamp configuration parameters are set Step 6 Run:

ipv6 nd security strict
The strict security mode is enabled on the interface. ----End

The IPv6 SEND configurations can be checked.
Prerequisite
The configurations of IPv6 SEND are complete.
Procedure
l Run the display ipv6 security interface interface-type interface-number command to check the IPv6 SEND configurations.
----End
Example
Run the display ipv6 security interface interface-type interface-number command, and you can check the IPv6 SEND configurations.
<HUAWEI> display ipv6 security gigabitethernet 1/0/0 (L) : Link local address SEND information for the interface : GigabitEthernet1/0/0 ---------------------------------------------------------------------------IPv6 address PrefixLength Collision Count ---------------------------------------------------------------------------FE80::18A8:19F0:C5A4:7A52 (L) 10 0 1::18F5:E2FA:63CF:31DE 64 0 ---------------------------------------------------------------------------SEND sec value : 0 SEND security modifier value : 1::1 SEND RSA key label bound : huawei SEND ND minimum key length value : 1280 SEND ND maximum key length value : 2000 SEND ND Timestamp delta value : 100 SEND ND Timestamp fuzz value : 2 SEND ND Timestamp drift value : 2 SEND ND fully secured mode : enabled
8.6 Configuring PMTU

By setting the PMTU, you can select a proper MTU for packet transmission. In this manner, packets do not have to be fragmented during transmission and loads on intermediate devices are reduced. In addition, network resources are used more efficiently and the network throughput reaches the optimal value. 8.6.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring the PMTU. 8.6.2 Creating Static PMTU Entries You can configure a static PMTU according to the lowest MTU of the path that a packet is to traverse. This speeds up packet transmission. 8.6.3 Configuring PMTU Aging Time By setting the PMTU aging time, you can change the keepalive time of dynamic PMTU entries in the cache. A static PMTU entry never ages. 8.6.4 Checking the Configuration You can view the configuration of a PMTU.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring the PMTU.
By setting PMTUs on interfaces, you can enable devices to send packets based on proper MTUs across the network. This avoids packet fragmentation, reduces the burden of the devices, implements efficient usage of network resources and achieves the best throughput.
8-26
Issue 01 (2011-05-30)
Before configuring PMTUs, complete the following tasks: l l Configuring the physical features for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocol for the interface
Data Preparation
To configure PMTUs, you need the following data. No. 1 2 Data IPv6 address and PMTU value to be configured PMTU aging time
8.6.2 Creating Static PMTU Entries

You can configure a static PMTU according to the lowest MTU of the path that a packet is to traverse. This speeds up packet transmission.
Procedure
Step 1 Run:
system-view

ipv6 pathmtu ipv6-address [ path-mtu ]
The PMTU value of a specified IPv6 address is configured. By default, the PMTU of the IPv6 address is 1500 bytes. l The maximum number of static PMTU entries is 300. l The maximum number of static PMTU entries of each VPN instance is 32. l The maximum number of dynamic and static PMTU entries on the public network is 1024. l The maximum number of PMTU entries in all VPN instances is 50000. ----End
8.6.3 Configuring PMTU Aging Time

By setting the PMTU aging time, you can change the keepalive time of dynamic PMTU entries in the cache. A static PMTU entry never ages.
Procedure
Step 1 Run:
system-view
Issue 01 (2011-05-30)
8-27

ipv6 pathmtu age age-time
The aging time of PMTU is configured. By default, the dynamic PMTU aging time is 10 minutes. If the static PMTU exist, the dynamic PMTU dose not take effect. ----End

You can view the configuration of a PMTU.
Prerequisite
The configurations of the PMTU are complete.
Procedure
l l Run the display ipv6 pathmtu { ipv6-address | all | dynamic | static } command to check all PMTU items. Run the display ipv6 interface [ interface-type interface-number | brief ] command to check the current MTU of the interface.
----End
Example
Run the display ipv6 pathmtu command. If the destination IPv6 address, the PMTU value, the aging time and type are displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 pathmtu all IPv6 Destination Address ZoneID fe80::12 0 2222::3 0 PathMTU 1300 1280 Age 40 -Type Dynamic Static
Run the display ipv6 interface command. If the current MTU of the interface is displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP , IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::200:1FF:FE04:5D00 Global unicast address(es): 2001::1, subnet is 2001::/64 Joined group address(es): FF02::1:FF00:1 FF02::1:FF04:5D00 FF02::2 FF02::1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
8-28
Issue 01 (2011-05-30)
8.7 Configuring TCP6

By setting TCP6 packets, you can improve the performance of the network. 8.7.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring TCP6. 8.7.2 Configuring TCP6 Timers By setting two TCP6 timers, you can control the TCP connection time. 8.7.3 Configuring the Size of the TCP6 Sliding Window By setting the sliding window size for TCP6, you can set the sizes of the receiving buffer and transmitting buffer in the socket. In this manner, you can improve the performance of the network. 8.7.4 Checking the Configuration You can view the configuration of TCP6.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring TCP6.
To optimize network performance, you need to adjust the TCP6 parameters.
Before configuring TCP6, complete the following tasks: l l Connecting and configuring the physical features for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocol parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up
Data Preparation
To configure TCP6, you need the following data. No. 1 2 3 Data Value of TCP6 FIN-WAIT timer Value of TCP6 SYN-WAIT timer Size of TCP6 Sliding Window
Issue 01 (2011-05-30)
8-29
8.7.2 Configuring TCP6 Timers

By setting two TCP6 timers, you can control the TCP connection time.
Procedure
Step 1 Run:
system-view

tcp ipv6 timer syn-timeout timer-value
The TCP6 SYN-WAIT timer is set. By default, the SYN-WAIT timer is 75s. Step 3 Run:
tcp ipv6 timer fin-timeout timer-value
The TCP6 FIN-WAIT timer is set. By default, the FIN-WAIT timer is 675s. ----End
8.7.3 Configuring the Size of the TCP6 Sliding Window

By setting the sliding window size for TCP6, you can set the sizes of the receiving buffer and transmitting buffer in the socket. In this manner, you can improve the performance of the network.
Procedure
Step 1 Run:
system-view

tcp ipv6 window window-size
The size of the TCP6 sliding window is configured. The size of the TCP6 sliding window ranges from 1 KB to 32 KB. By default, the size of the TCP6 sliding window is 8 KB. ----End

You can view the configuration of TCP6.
Prerequisite
The configurations of the TCP6 function are complete.
Procedure
l l l l Run the display tcp ipv6 statistics command to check related TCP6 statistics. Run the display tcp ipv6 status command to check the TCP6 connection status. Run the display udp ipv6 statistics command to check related UDP6 statistics. Run the display ipv6 socket [ socktype socket-type ] [ task-id task-id socket-id socketid ] command to check the information of the specified socket.
----End
Example
Run the display tcp ipv6 statistics, display tcp ipv6 status, and display udp ipv6 statistics commands. If the connection status and statistic of TCP6 and UDP6 are displayed, it means that the configuration succeeds.
<HUAWEI> display tcp ipv6 statistics Received packets: total: 0 packets in sequence: 0 (0 bytes) window probe packets: 0 window update packets: 0 checksum error: 0 offset error: 0 short error: 0 duplicate packets: 0 (0 bytes) partially duplicate packets: 0 (0 bytes) out-of-order packets: 0 (0 bytes) packets with data after window: 0 (0 bytes) packets after close: 0 ACK packets: 0 (0 bytes) duplicate ACK packets: 0 too much ACK packets: 0 packets dropped due to MD5 authentication failure: 0 packets receieved with MD5 Signature Option: 0 Sent packets: total: 0 urgent packets: 0 control packets: 0 (including 0 RST) window probe packets: 0 window update packets: 0 data packets: 0 (0 bytes) data packets retransmitted: 0 (0 bytes) ACK only packets: 0 (0 delayed) packets sent with MD5 Signature Option: 0 Other Statistics: retransmitted timeout: 0 connections dropped in retransmitted timeout: 0 keepalive timeout: 0 keepalive probe: 0 keepalive timeout, so connections disconnected: 0 initiated connections: 0 accepted connections: 0 established connections: 0 closed connections: 0 (dropped: 0, initiated dropped: 0) <HUAWEI> display tcp ipv6 status TCP6CB Local Address Foreign Address State 09e39ae4 3000::2->179 3000::1->49158 Time_Wait 09e36f24 3000::2->49152 3000::1->179 Established 07da08f8 ::->179 ::->0 Listening 07d96da8 ::->23 ::->0 Listening <HUAWEI> display udp ipv6 statistics Received packets:
Issue 01 (2011-05-30)
8-31
total: 0 total(64bit high-capacity counter): 0 checksum error: 0 shorter than header: 0 invalid message length: 0 no socket on port: 0 no multicast port: 0 not delivered, input socket full: 0 input packets missing pcb cache: 0 packets sent for external pre processing: 1 Sent packets: total: 0 total(64bit high-capacity counter): 0
Run the display ipv6 socket command. If the related socket information is displayed, it means that the configuration succeeds.
<HUAWEI> display ipv6 socket SOCK_STREAM: Task = VTYD(14), socketid = 4, Proto = 6, LA = ::->22, FA = ::->0, sndbuf = 8192, rcvbuf = 8192, sb_cc = 0, rb_cc = 0, socket option = SO_ACCEPTCONN SO_REUSEPORT SO_SENDVPNID, socket state = SS_PRIV SS_ASYNC Task = VTYD(14), socketid = 3, Proto = 6, LA = ::->23, FA = ::->0, sndbuf = 8192, rcvbuf = 8192, sb_cc = 0, rb_cc = 0, socket option = SO_ACCEPTCONN SO_REUSEPORT SO_SENDVPNID, socket state = SS_PRIV SS_ASYNC SOCK_DGRAM: SOCK_RAW:
8.8 Maintaining IPv6

This section describes how to maintain IPv6. Detailed operations include deleting information about IPv6 operation and monitoring IPv6 operation. 8.8.1 Resetting IPv6 This section describes clearance of information about IPv6 operation through the reset command. 8.8.2 Monitoring Network Operation Status of IPv6 This section describes IPv6 operation monitoring through the display command.
8.8.1 Resetting IPv6

This section describes clearance of information about IPv6 operation through the reset command.
Context
CAUTION
IPv6 statistics cannot restore after you clear it. So, confirm the action before you use the command.
8-32
Issue 01 (2011-05-30)
Procedure
l l l l l l l Run the reset ipv6 statistics [ slot slot-id ] command in the user view to clear statistics of processing IPv6 packets after you confirm it. Run the reset ipv6 pathmtu { all | dynamic | static } command in the user view to clear PMTU entries in the cache after you confirm it. Run the reset ipv6 address-policy [ vpn-instance vpn-instance-name ] command in the user view to clear address selection policy entries. Run the reset ipv6 nd security statistics interface-type interface-number command in the user view to clear statistics on IPv6 SEND messages on a specified interface. Run the reset ipv6 nd security timestamp interface-type interface-number command in the user view to clear the timestamp of an IPv6 SEND message on a specified interface. Run the reset ipv6 nd security nonce interface-type interface-number command in the user view to clear the Nonce value of an IPv6 SEND message on a specified interface. Run the reset ipv6 neighbors { all | dynamic | static | vid vlan-id [ interface-type interfacenumber] | interface-type interface-number [ dynamic | static ] } command in the user view to clear IPv6 neighbor entries in the cache after you confirm it. Run the reset tcp ipv6 statistics command in the user view to clear all TCP6 statistics after you confirm it. Run the reset udp ipv6 statistics command in the user view to clear all UDP6 statistics after you confirm it.
l l
----End
8.8.2 Monitoring Network Operation Status of IPv6

This section describes IPv6 operation monitoring through the display command.
Context
In routine maintenance, you can run the following command in any view to check the operation of IPv6.
Procedure
l l l l Run the display ipv6 interface [ interface-type interface-number | brief ] command in any view to check the IPv6 information about the interface. Run the display ipv6 statistics [ slot slot-id | interface interface-type interface-number ] command in any view to check IPv6 packet statistics. Run the display icmpv6 statistics [ slot slot-id | interface interface-type interfacenumber ] command in any view to check the operation of ICMPv6 packet statistics. Run the display ipv6 neighbors [ ipv6-address | [ vid vlan-id ] interface-type interfacenumber ], display ipv6 neighbors [ interface-type interface-number [ vid vid [ cevid cevid ] ] ], or display ipv6 neighbors slot slot-id [ verbose ] [ [vid vlan-id ] [ interfacetype interface-number ] ] command in any view to check contents about the neighbor cache. Run the display ipv6 address-policy [ vpn-instance vpn-instance-name ] { all | ipv6address prefix-length } command in any view to check address selection policy entries. Run the display ipv6 security interface interface-type interface-number command in any view to check the IPv6 SEND configuration on a specified interface.
l l
Issue 01 (2011-05-30)
l l l l l l l l l l
Run the display ipv6 nd security timestamp interface-type interface-number command in any view to check the timestamp of an IPv6 SEND message. Run the display ipv6 nd security nonce interface-type interface-number command in any view to check the Nonce value of an IPv6 SEND message. Run the display ipv6 nd security statistics interface-type interface-number command in any view to check the statistics on IPv6 SEND messages. Run the display ipv6 neighbors [ [ vid vlan-id ] interface-type interface-number ] command in any view to check contents about the neighbor cache. Run the display ipv6 pathmtu { ipv6-address | all | dynamic | static } command in any view to check all PMTU entries. Run the display tcp ipv6 statistics command in any view to check TCP6 statistics. Run the display tcp ipv6 status command in any view to check TCP6 connection status. Run the display udp ipv6 statistics command in any view to check UDP6 statistics. Run the display ipv6 socket [ socktype socket-type ] [ task-id task-id socket-id socketid ] command in any view to check information about the specified socket. Run the display ipv6 fib [ spt ] [ slot-id ] command in any view to check information about the FIB.
----End

Context
NOTE
8.9.1 Example for Configuring an IPv6 Address for an Interface This part provides an example for configuring the IPv6 address of an interface. 8.9.2 Example for Configuring IPv6 Neighbor Discovery This section provides an example of configuring IPv6 Neighbor Discovery. 8.9.3 Example for Configuring IPv6 Address Selection Policy Table This part describes how to configure IPv6 address selection policy table. 8.9.4 Example for Configuring IPv6 SEND This section provides examples for configuring IPv6 SEND. 8.9.5 Example for Configuring Default Router Priority and Route Information This part describes how to configure default router priorities and route information.
8.9.1 Example for Configuring an IPv6 Address for an Interface

This part provides an example for configuring the IPv6 address of an interface.
8-34
Issue 01 (2011-05-30)
Networking Requirement
As shown in Figure 8-1, CX-A and CX-B are connected through POS interfaces. It is required to configure IPv6 global unicast addresses for the interfaces and test the connectivity between them. The IPv6 global unicast addresses to be configured for the interfaces are 3001::1/64 and 3001::2/64. Figure 8-1 Networking diagram of configuring an IPv6 address for an interface
POS 1/0/0 3001::1/64 CX-A
POS 1/0/0 3001::2/64 CX-B
The configuration roadmap is as follows: 1. 2. Enable IPv6 forwarding capability on devices. Configure IPv6 global unicast addresses for the interfaces.
Data Preparation
To complement the configuration, you need the following data: l Global unicast addresses of the interfaces
Procedure
Step 1 Enable IPv6 packet forwarding on CX-A and CX-B. # Configure CX-A
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6
# Configure CX-B
<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] ipv6
Step 2 Configure IPv6 global unicast addresses for the interfaces. # Configure CX-A.
[CX-A] interface pos [CX-A-Pos1/0/0] ipv6 [CX-A-Pos1/0/0] ipv6 [CX-A-Pos1/0/0] undo [CX-A-Pos1/0/0] quit 1/0/0 enable address 3001::1/64 shutdown
# Configure CX-B.

[CX-B] interface pos [CX-B-Pos1/0/0] ipv6 [CX-B-Pos1/0/0] ipv6 [CX-B-Pos1/0/0] undo [CX-B-Pos1/0/0] quit 1/0/0 enable address 3001::2/64 shutdown
Step 3 Verify the configuration. If the configuration succeeds, you can view the configured IPv6 global unicast addresses and status of the interface and the IPv6 protocol are both Up. # Display interface information of CX-A.
[CX-A] display ipv6 interface pos 1/0/0 Pos1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::C964:0:B8B6:1 Global unicast address(es): 3001::1, subnet is 3001::/64 Joined group address(es): FF02::1:FF00:1 FF02::1:FFB6:1 FF02::2 FF02::1 MTU is 4470 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# Display interface information of CX-B.

[CX-B] display ipv6 interface pos 1/0/0 Pos1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::2D6F:0:7AF3:1 Global unicast address(es): 3001::2, subnet is 3001::/64 Joined group address(es): FF02::1:FF00:2 FF02::1:FFF3:1 FF02::2 FF02::1 MTU is 4470 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# On CX-A, ping the link-local address of CX-B. Note that you need to use the parameter -i to specify the interface.
[CX-A] ping ipv6 fe80::2d6f:0:7af3:1 -i pos 1/0/0 PING FE80::2D6F:0:7AF3:1 : 56 data bytes, press CTRL_C to break Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=1 hop limit=64 time = 60 ms Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=4 hop limit=64 time = 30 ms Reply from FE80::2D6F:0:7AF3:1 bytes=56 Sequence=5 hop limit=64 time = 1 ms --- FE80::2D6F:0:7AF3:1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/38/60 ms
8-36
Issue 01 (2011-05-30)
# On CX-A, ping the global unicast IPv6 address of CX-B.

[CX-A] ping ipv6 3001::2 PING 3001::2 : 56 data bytes, press CTRL_C to break Reply from 3001::2 bytes=56 Sequence=1 hop limit=64 time = 30 ms Reply from 3001::2 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from 3001::2 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from 3001::2 bytes=56 Sequence=4 hop limit=64 time = 20 ms Reply from 3001::2 bytes=56 Sequence=5 hop limit=64 time = 40 ms --- 3001::2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 20/38/50 ms
----End
Configuration Files
# sysname CX-A # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3001::1/64 # return

# sysname CX-B # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3001::2/64 # return
8.9.2 Example for Configuring IPv6 Neighbor Discovery

This section provides an example of configuring IPv6 Neighbor Discovery.
As shown in Figure 8-2, device is directly connected to the PC by GE 1/0/10. This PC runs the Windows XP operating system.
Issue 01 (2011-05-30)
8-37
Figure 8-2 Example for configuring IPv6 neighbor discovery
CX600
GE1/0/10 3000::/64 eui-64
PC
The configuration roadmap is as follows: 1. 2. Configure the local unicast addresses of the link and EUI-64 site separately on GE 1/0/10. Configure the RA prefix message to be advertised on GE 1/0/10 and enable the advertisement of the RA prefix message.
Data Preparation
To complete the configuration, you need the following data: l l Local unicast addresses of the link and EUI-64 site on GE 1/0/10 RA prefix message to be advertised
Procedure
Step 1 Enable the IPv6 forwarding on devices.
<HUAWEI> system-view [HUAWEI] ipv6
Step 2 Configure the local unicast address of the link on GE 1/0/10.

[HUAWEI] interface gigabitethernet 1/0/10 [HUAWEI-GigabitEthernet1/0/10] undo shutdown [HUAWEI-GigabitEthernet1/0/10] ipv6 enable [HUAWEI-GigabitEthernet1/0/10] ipv6 address auto link-local
Step 3 Configure the local unicast address of the EUI-64 site on GE 1/0/10 and the prefix in the RA message.
NOTE
A PC can automatically obtain the RA prefix message from devices only after the Router Advertisement (RA) prefix message to be advertised is configured and the advertisement of the RA prefix message is enabled on devices.
[HUAWEI-GigabitEthernet1/0/10] ipv6 address 3000::/64 eui-64 [HUAWEI-GigabitEthernet1/0/10] ipv6 nd ra prefix 3000::/64 1000 1000 [HUAWEI-GigabitEthernet1/0/10] undo ipv6 nd ra halt
Step 4 Verify the configuration. If configurations are successful, you can view the configured local unicast address of the link and the EUI-64 site and find that GE 1/0/10 is Up and IPv6 is Up. # Display information about interfaces of devices.
[HUAWEI-GigabitEthernet1/0/10] display this ipv6 interface GigabitEthernet1/0/10 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::2E0:FCFF:FE7D:A497
8-38
Issue 01 (2011-05-30)
Global unicast address(es): 3000::2E0:FCFF:FE7D:A497, subnet is 3000::/64 Joined group address(es): FF02::1:FF7D:A497 FF02::2 FF02::1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisement max interval 600 seconds, min interval 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses
# Display information about PCs.

Ethernet adapter 1: Connection-specific Description . . . . rnet NIC #2 Physical Address. . Dhcp Enabled. . . . IP Address. . . . . Subnet Mask . . . . IP Address. . . . . IP Address. . . . . IP Address. . . . . Default Gateway . . DNS Servers . . . . DNS Suffix . : . . . . . . . : Realtek RTL8139 Family PCI Fast Ethe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . : : : : : : : : : 00-E0-4C-77-A1-B6 No 110.1.1.33 255.0.0.0 3000::78b3:4397:c0c4:f078 3000::2e0:4cff:fe77:a1b6 fe80::2e0:4cff:fe77:a1b6%6 fe80::288:ff:fe10:b%6 fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1
# Ping the local unicast address of the link on the PC from the device with the use of the parameter -i which specifies the interface corresponding to the local unicast address.
[HUAWEI-GigabitEthernet1/0/10] ping ipv6 fe80::2e0:4cff:fe77:a1b6 -i gigabitethernet1/0/10 PING FE80::2E0:4CFF:FE77:A1B6: 56 data bytes, press CTRL_C to break Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=1 hop limit=64 time = 60 ms Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=4 hop limit=64 time = 30 ms Reply from FE80::2E0:4CFF:FE77:A1B6 bytes=56 Sequence=5 hop limit=64 time = 1 ms --- FE80::2E0:4CFF:FE77:A1B6 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/38/60 ms
# Ping the local unicast address of the EUI-64 site of the PC from the device.
[HUAWEI-GigabitEthernet1/0/10] ping ipv6 3000::78b3:4397:c0c4:f078 PING 3000::78B3:4397:C0C4:F078 : 56 data bytes, press CTRL_C to break Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=1 hop limit=64 time = 30 ms Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from 3000::78B3:4397:C0C4:F078 bytes=56 Sequence=4 hop limit=64 time = 20 ms Reply from 3000::78B3:4397:C0C4:F078
Issue 01 (2011-05-30)
8-39
bytes=56 Sequence=5 hop limit=64 time = 40 ms --- 3000::78B3:4397:C0C4:F078 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 20/38/50 ms
----End
Configuration Files
Configuration file of HUAWEI
# sysname HUAWEI # ipv6 # interface GigabitEthernet1/0/10 undo shutdown ipv6 enable ipv6 address 3000::/64 eui-64 ipv6 address auto link-local ipv6 nd ra prefix 3000::/64 1000 1000 undo ipv6 nd ra halt # return
8.9.3 Example for Configuring IPv6 Address Selection Policy Table

This part describes how to configure IPv6 address selection policy table.
As shown in Figure 8-3, the domain name (huawei.com) of Server A maps multiple IPv6 addresses. When CX-A, as an IPv6 DNS client, accesses Server A by using the domain name (huawei.com), the DNS Server sends all IPv6 addresses of Server A to CX-A. Then,CX-A queries the IPv6 address selection policy table to select a proper IPv6 address as the destination address of Server A. Figure 8-3 Networking diagram for configuring an IPv6 address selection policy table
DNS Server
DNS Client CX-A Ethernet

GE1/0/0 2001:2::2/64 fed0:1::2/64 abcd::7764
abcd::1234/64
a::1/64 b::1/64 2001::1/64
huawei.com Server A
8-40
Issue 01 (2011-05-30)
Configuration Notes
None
The configuration roadmap is as follows: 1. 2. Configure IPv6 address selection policy entries. Configure dynamic IPv6 DNS services.
Data Preparation
To complete the configuration, you need the following data: l l l IPv6 addresses on the interface of CX-A Addresses, label values and precedence values of IPv6 address selection policy entries IPv6 addresses of the DNS server
Procedure
Step 1 Configure IPv6 address selection policy entries # Configure IPv6 addresses for the interface.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6 [CX-A] interface gigabitethernet [CX-A-GigabitEthernet1/0/0] undo [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] quit
1/0/0 shutdown enable address fe80::1 link-local address fed0:1::2 64 address 2001:2::2 64 address abcd::77 64
# Configure destination address selection policies.

[CX-A] ipv6 address-policy fed0:1::2 128 100 100 [CX-A] ipv6 address-policy 2001::1 128 100 100
Step 2 Configure dynamic IPv6 DNS services.

[CX-A] [CX-A] [CX-A] [CX-A] dns resolve dns server ipv6 abcd::1234 dns domain com quit
Step 3 Verify the configuration. # Run the ping ipv6 huawei.com command on CX-A, and you can find that Server A can be pinged successfully, with the destination IP address being 2001::1.
<CX-A> ping ipv6 huawei.com Resolved Host (huawei.com -> 2001::1) PING huawei.com : 56 data bytes, press CTRL_C to Reply from 2001::1: bytes=56 Sequence=1 ttl=126 Reply from 2001::1: bytes=56 Sequence=2 ttl=126 Reply from 2001::1: bytes=56 Sequence=3 ttl=126
break time=6 ms time=4 ms time=4 ms
Issue 01 (2011-05-30)
8-41
Reply from 2001::1: bytes=56 Sequence=4 ttl=126 time=4 ms Reply from 2001::1: bytes=56 Sequence=5 ttl=126 time=4 ms --- huawei.com ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 4/4/6 ms
# Run the display ipv6 interface gigabitethernet 1/0/0 command on CX-A, and you can view information about the IPv6 address of GigabitEthernet 1/0/0.
<CX-A> display ipv6 interface gigabitethernet 1/0/0 GigabitEthernet1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): FED0:1::2, subnet is FED0:1::/64 2001:2::2, subnet is 2001:2::/64 ABCD::77, subnet is ABCD::/64 Joined group address(es): FF02::1:FF00:77 FF02::2 FF02::1 FF02::1:FF00:2 FF02::1:FF00:1 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# Run the display ipv6 address-policy all command on CX-A, and you can view information about address selection policy entries.
<CX-A> display ipv6 address-policy all Policy Table : Total:7 ------------------------------------------------------------------------------Prefix : :: PrefixLength : 0 Precedence : 40 Label : 1 Default : Yes Prefix : ::1 Precedence : 50 Default : Yes Prefix : ::FFFF:0.0.0.0 Precedence : 10 Default : Yes Prefix : 2001::1 Precedence : 100 Default : No Prefix : 2002:: Precedence : 30 Default : Yes Prefix : FC00:: Precedence : 20 Default : Yes Prefix : FED0:1::2 Precedence : 100 Default : No PrefixLength Label PrefixLength Label PrefixLength Label PrefixLength Label PrefixLength Label PrefixLength Label : 128 : 0 : 96 : 4 : 128 : 100 : 16 : 2 : 7 : 3 : 128 : 100
8-42
Issue 01 (2011-05-30)
-------------------------------------------------------------------------------
----End
Configuration Files
# sysname CX-A # ipv6 # dns resolve dns server ipv6 abcd::1234 dns domain com # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 address FED0:1::2/64 ipv6 address 2001:2::2/64 ipv6 address 1001::1/64 ipv6 address FE80::1 link-local # ipv6 address-policy 2001::1 128 100 100 ipv6 address-policy FED0:1::2 128 100 100 # return
8.9.4 Example for Configuring IPv6 SEND

This section provides examples for configuring IPv6 SEND.
As shown in Figure 8-4, IPv6 SEND is configured on CX-A. Assume that CX-B is an attacker. When CX-B sends messages to CX-A, CX-A regards them invalid and discards them. Figure 8-4 Networking diagram for configuring IPv6 SEND
SEND enabled GE 1/0/0 1::1/64 3000::/64 cga GE 1/0/0 1::2/64 3000::2/64
Attacker
CX-A
CX-B
Configuration Notes
None.
The configuration roadmap is as follows: 1. 2.
Issue 01 (2011-05-30)
Configure a CGA IPv6 address and a common IPv6 address on CX-A. Enable the strict security mode on an interface of CX-A.
3.
Configure an IPv6 address for an interface on CX-B.
Data Preparation
To complete the configuration, you need the following data: l l l l RSA key pair name Modifier value and security level of a CGA address CGA IPv6 address IPv6 address of CX-B
Procedure
Step 1 Configure a CGA IPv6 address on CX-A.
<HUAWEIA> system-view [HUAWEIA] sysname CX-A [CX-A] ipv6 [CX-A] rsa key-pair label huawei NOTES: If the key modulus is greater than 512, It may take few minutes. Please wait Key Successfully Created [CX-A] interface gigabitethernet [CX-A-GigabitEthernet1/0/0] undo [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 1/0/0 shutdown enable security rsakey-pair huawei security modifier sec-level 1 address fe80::3 link-local cga address 3000::2/64 cga address 1::1/64
Step 2 Enable the strict security mode on an interface of CX-A.

[CX-A-GigabitEthernet1/0/0] ipv6 nd security strict
Step 3 Configure an IPv6 address of CX-B.

<HUAWEIB> system-view [HUAWEIB] sysname CX-B [CX-B] ipv6 [CX-B] interface gigabitethernet [CX-B-GigabitEthernet1/0/0] undo [CX-B-GigabitEthernet1/0/0] ipv6 [CX-B-GigabitEthernet1/0/0] ipv6 [CX-B-GigabitEthernet1/0/1] ipv6 [CX-B-GigabitEthernet1/0/1] ipv6
1/0/0 shutdown enable address auto link-local address 3000::2/64 address 1::2/64
Step 4 Verify the configuration. If the configuration is successful, you can view that the IPv6 address and IPv6 SEND have been configured and the interface status and IPv6 protocol status are Up. # View information about GE 1/0/0 on CX-A.
[CX-A-GigabitEthernet1/0/0] display this ipv6 interface GigabitEthernet1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::3057:B5D6:6BD6:6CA8 Global unicast address(es): 3000::2092:84CE:827B:D5A4, subnet is 3000::/64 1::1, subnet is 1::/64 Joined group address(es): FF02::1:FF7B:D5A4 FF02::2 FF02::1
8-44
Issue 01 (2011-05-30)

FF02::1:FFD6:6CA8 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# View the IPv6 SEND configuration on GE 1/0/0 of CX-A.

[CX-A-GigabitEthernet1/0/0] display ipv6 security interface gigabitethernet 1/0/0 (L) : Link local address SEND information for the interface : GigabitEthernet1/0/0 ---------------------------------------------------------------------------IPv6 address PrefixLength Collision Count ---------------------------------------------------------------------------FE80::3057:B5D6:6BD6:6CA8 (L) 10 0 3000::2092:84CE:827B:D5A4 64 0 ---------------------------------------------------------------------------SEND sec value : 1 SEND security modifier value : 585D:9EA0:328:2792:B763:1DE3:BBC4:D22D SEND RSA key label bound : huawei SEND ND minimum key length value : 512 SEND ND maximum key length value : 2048 SEND ND Timestamp delta value : 300 SEND ND Timestamp fuzz value : 1 SEND ND Timestamp drift value : 1 SEND ND fully secured mode : enabled
# View information about GE 1/0/0 on CX-B.

[CX-B-GigabitEthernet1/0/0] display this ipv6 interface GigabitEthernet1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::2E0:E6FF:FE13:8100 Global unicast address(es): 3000::2, subnet is 3000::/64 1::2, subnet is 1::/64 Joined group address(es): FF02::1:FF00:2 FF02::2 FF02::1 FF02::1:FF13:8100 MTU is 1500 bytes ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# Ping the CGA link-local address of CX-A from CX-B. The ping fails because IPv6 SEND is configured on CX-A.
[CX- B-GigabitEthernet1/0/0] ping ipv6 FE80::3057:B5D6:6BD6:6CA8 -i gigabitethernet 1/0/0 PING FE80::3057:B5D6:6BD6:6CA8 : 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out --- FE80::3057:B5D6:6BD6:6CA8 ping statistics --5 packet(s) transmitted 0 packet(s) received 100.00% packet loss round-trip min/avg/max = 0/0/0 ms
# Ping the CGA global unicast address of CX-A from CX-B. The ping fails because IPv6 SEND is configured on CX-A.
[CX- B-GigabitEthernet1/0/0] ping ipv6 3000::2092:84CE:827B:D5A4 PING 3000::2092:84CE:827B:D5A4 : 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out --- 3000::2092:84CE:827B:D5A4 ping statistics --5 packet(s) transmitted 0 packet(s) received 100.00% packet loss round-trip min/avg/max = 0/0/0 ms
# Ping the common global unicast address of CX-A from CX-B. The ping fails because IPv6 SEND is configured on CX-A.
[CX- B-GigabitEthernet1/0/0] ping ipv6 1::1 PING 1::1 : 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out --- 3000::2092:84CE:827B:D5A4 ping statistics --5 packet(s) transmitted 0 packet(s) received 100.00% packet loss round-trip min/avg/max = 0/0/0 ms
# Disable IPv6 SEND on CX-A. The ping from CX-B to CX-A is successful. The following part provides an example of pinging the CGA global unicast address of CX-A.
[CX-A-GigabitEthernet1/0/0] undo ipv6 nd security strict [CX- B-GigabitEthernet1/0/0] ping ipv6 3000::2092:84CE:827B:D5A4 PING 3000::2092:84CE:827B:D5A4 : 56 data bytes, press CTRL_C to break Reply from 3000::2092:84CE:827B:D5A4 bytes=56 Sequence=1 hop limit=64 time = 1 ms Reply from 3000::2092:84CE:827B:D5A4 bytes=56 Sequence=2 hop limit=64 time = 20 ms Reply from 3000::2092:84CE:827B:D5A4 bytes=56 Sequence=3 hop limit=64 time = 1 ms Reply from 3000::2092:84CE:827B:D5A4 bytes=56 Sequence=4 hop limit=64 time = 1 ms Reply from 3000::2092:84CE:827B:D5A4 bytes=56 Sequence=5 hop limit=64 time = 1 ms --- 3000::2092:84CE:827B:D5A4 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/4/20 ms
----End
Configuration Files
# sysname CX-A # ipv6 # rsa key-pair label huawei
8-46
Issue 01 (2011-05-30)
# interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 security rsakey-pair huawei ipv6 security modifier sec-level 1 585D:9EA0:328:2792:B763:1DE3:BBC4:D22D ipv6 address 3000::/64 cga ipv6 address 1::1/64 ipv6 address FE80::3057:B5D6:6BD6:6CA8 link-local cga ipv6 nd security strict # return

# sysname CX-B # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 address 3000::2/64 ipv6 address 1::2/64 ipv6 address auto link-local # return
8.9.5 Example for Configuring Default Router Priority and Route Information
This part describes how to configure default router priorities and route information.
As shown in Figure 8-5, a PC is connected to CX-A and CX-B by using Switch A. The PC selects a proper CX device to forward packets based on destination addresses of packets. Figure 8-5 Networking of Configuring Default Router Priorities and Route Information
GE1/0/0 GE1/0/0 2002::2/64 4004::2/64 CX-A CX-B SwitchA 2002::1/64 4004::1/64
PC
Issue 01 (2011-05-30)
8-47
Configuration Notes
The PC supports RFC 4191, by which it can learn the default router priorities and route information in RA packets.
The configuration roadmap is as follows: 1. Configure default router priorities and route information on CX-A and CX-B.
Data Preparation
To complete the configuration, you need the following data: l l IPv6 addresses of interfaces on CX-A and CX-B Default router priorities and route information
Procedure
Step 1 Configure default router priorities and route information. # Configure CX-A.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6 [CX-A] interface gigabitethernet [CX-A-GigabitEthernet1/0/0] undo [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] undo [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 [CX-A-GigabitEthernet1/0/0] ipv6 preference high [CX-A-GigabitEthernet1/0/0] quit
1/0/0 shutdown enable ipv6 nd ra halt address fe80::1 link-local address 2002::2/64 nd ra preference high nd ra route-information 2002:: 64 lifetime 2000
# Configure CX-B.
<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] ipv6 [CX-B] interface gigabitethernet [CX-B-GigabitEthernet1/0/0] undo [CX-B-GigabitEthernet1/0/0] ipv6 [CX-B-GigabitEthernet1/0/0] undo [CX-B-GigabitEthernet1/0/0] ipv6 [CX-B-GigabitEthernet1/0/0] ipv6 [CX-B-GigabitEthernet1/0/0] ipv6 [CX-B-GigabitEthernet1/0/0] ipv6 preference high [CX-A-GigabitEthernet1/0/0] quit
1/0/0 shutdown enable ipv6 nd ra halt address fe80::2 link-local address 4004::2/64 nd ra preference low nd ra route-information 4004:: 64 lifetime 2000
Step 2 Verify the configuration. # Check the configuration of the PC, and you can find that the default gateway of the PC is CXA.
C:\Documents and Settings\Administrator>ipconfig /all Ethernet adapter 1: Connection-specific DNS Suffix . :
8-48
Issue 01 (2011-05-30)

Description . . . rnet NIC #2 Physical Address. Dhcp Enabled. . . IP Address. . . . Subnet Mask . . . IP Address. . . . IP Address. . . . IP Address. . . . IP Address. . . . IP Address. . . . Default Gateway . DNS Servers . . .

. . . . . . . . : Realtek RTL8139 Family PCI Fast Ethe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . : : : : : : : : : : : 00-E0-4C-77-A1-B6 No 110.1.1.33 255.0.0.0 3000::78b3:4397:c0c4:f078 3000::2e0:4cff:fe77:a1b6 2002::1 4004::1 fe80::2e0:4cff:fe77:a1b6%6 2002::2 fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1
# Check the routing table of the PC, and you can find the routing entries learned by the PC.
C:\Documents and Settings\Administrator>netsh netsh>interface ipv6 netsh interface ipv6>show route Querying active state... Publish ------no no yes yes Type -------Manual Manual Manual Manual Met ---3 3 3 3 Prefix -----------------------4004::/64 2002::/64 1414::/64 1212::/64 Idx --4 4 4 4 Gateway/Interface Name --------------------fe80::2 fe80::1 Local Area Connection Local Area Connection
----End
Configuration Files
# sysname CX-A # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 address 2002::2/64 ipv6 address FE80::1 link-local ipv6 nd ra preference high ipv6 nd ra route-information 2002:: 64 lifetime 2000 preference high undo ipv6 nd ra halt # return

# sysname CX-B # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 address 4004::2/64 ipv6 address FE80::2 link-local ipv6 nd ra preference low ipv6 nd ra route-information 4004:: 64 lifetime 2000 preference high undo ipv6 nd ra halt # return
Issue 01 (2011-05-30)
8-49
9 IPv6 DNS Configuration
9
About This Chapter
IPv6 DNS Configuration
By configuring the IPv6 Domain Name System (DNS), you can enable network devices to communicate with other through their domain names. 9.1 IPv6 DNS Overview The DNS is a host naming mechanism. It assigns an easy-to-memorize name of significance to each host on the Internet in a hierarchical manner. 9.2 Configuring IPv6 DNS By configuring the IPv6 DNS, you can set up a mapping between a domain name and an IPv6 address. In this manner, you can enable the device to communicate with other devices. 9.3 Maintaining IPv6 DNS This section describes how to maintain the IPv6 DNS. Detailed operations include deleting IPv6 DNS entries and monitoring IPv6 DNS operation. 9.4 Configuration Examples This section includes the networking requirements, precautions for configuration, and configuration roadmap.
Issue 01 (2011-05-30)
9-1
9.1 IPv6 DNS Overview

The DNS is a host naming mechanism. It assigns an easy-to-memorize name of significance to each host on the Internet in a hierarchical manner. 9.1.1 Introduction to IPv6 DNS After each host on the Internet is assigned a domain name, you can set up mapping between the domain name and IP address of a host. In this manner, you can use domain names, which are easy to memorize and are of significance, instead of complicated IP addresses. 9.1.2 IPv6 DNS Supported by the CX600 IPv6 domain name resolution can be performed in either dynamic mode or static mode.
9.1.1 Introduction to IPv6 DNS

After each host on the Internet is assigned a domain name, you can set up mapping between the domain name and IP address of a host. In this manner, you can use domain names, which are easy to memorize and are of significance, instead of complicated IP addresses. IPv6 DNS has two resolution modes: dynamic IPv6 DNS resolution and static IPv6 DNS resolution. To resolve a domain name, the system first uses static IPv6 DNS resolution. If this mode fails, the system uses dynamic IPv6 DNS resolution. To improve resolution efficiency, you can put common domain names in a static domain name resolution table.
9.1.2 IPv6 DNS Supported by the CX600

IPv6 domain name resolution can be performed in either dynamic mode or static mode. IPv6 domain name system (DNS) is similar to IPv4 DNS. For configurations of IPv4 DNS, refer to "DNS Configuration."
9.2 Configuring IPv6 DNS

By configuring the IPv6 DNS, you can set up a mapping between a domain name and an IPv6 address. In this manner, you can enable the device to communicate with other devices. 9.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring the IPv6 DNS. 9.2.2 Configuring a Static IPv6 DNS Entry You can create a table of mappings between domain names and IPv6 addresses and add common domain names to this table. When a client needs to use the IPv6 address corresponding to a domain name, the client can search the table for the required IPv6 address. This improves the efficiency of domain name resolution. 9.2.3 Configuring the Dynamic IPv6 DNS Services To perform dynamic domain name resolution, you need a special domain name resolution server, which runs a server program. This server provides mappings between domain names and IPv6 addresses and receives resolution requests from the client. 9.2.4 Checking the Configuration
You can view the configuration of the IPv6 DNS.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring the IPv6 DNS.
DNS needs to be configured if the local users log on to a device using domain names to communicate with other devices. The IPv6 DNS entries show the mapping between domain names and IPv6 addresses. If users seldom use the domain name to access other devices, or if the DNS server is unavailable, a static DNS needs to be configured. To configure a static IPv6 DNS, the network administrator needs to know the relation between domain names and IPv6 addresses, and manually modify the IPv6 DNS entry when the relation changes. If the users need to use the domain name to access many devices, and the DNS server is available, a dynamic DNS can be configured. The dynamic DNS needs to be supported by a DNS server.
Before configuring IPv6 DNS, configure the route between a local device and a DNS server.
Data Preparation
To configure IPv6 DNS, you need the following data. No. 1 2 3 Data Domain name of the static IPv6 DNS entry and the corresponding IPv6 address IPv6 address of the IPv6 DNS server Domain name of the dynamic IPv6 DNS or the domain name list
9.2.2 Configuring a Static IPv6 DNS Entry

You can create a table of mappings between domain names and IPv6 addresses and add common domain names to this table. When a client needs to use the IPv6 address corresponding to a domain name, the client can search the table for the required IPv6 address. This improves the efficiency of domain name resolution.
Procedure
Step 1 Run:
system-view

ipv6 host host-name ipv6-address
Issue 01 (2011-05-30)
9-3
The host name and the corresponding IPv6 address are configured. If the same host is configured with IPv6 addresses for several times, the IPv6 address configured earliest is used when needing to find the host with the IPv6 address, such as ping this host. ----End
9.2.3 Configuring the Dynamic IPv6 DNS Services

To perform dynamic domain name resolution, you need a special domain name resolution server, which runs a server program. This server provides mappings between domain names and IPv6 addresses and receives resolution requests from the client.
Context
If the IPv6 DNS server is configured with a link-local address, the interface name should also be configured with the IPv6 address. Figure 9-1 DNS server connecting IPv4 and IPv6 networks
DNS IPv4 client IPv4 link
DNS server
DNS IPv6 client IPv6 link
CAUTION
If multiple DNS servers are configured, the servers are queried in the order of configuration till proper response is received. If both IPv4 and IPv6 servers are configured, the A query is first sent to the IPv4 server, while AAAA query packets are first sent to the IPv6 server. The DNS domains are configured on a device and the domain names can be searched. If the DNS fails in searching for a host name, it appends a domain name to the host name following a "." and continues the DNS search. You can configure some commonly used domain names like "com", and "net". For example, if the search for the host name "huawei" fails, the system then searches for "huawei.com" or "huawei.net". Do as follows on the CX device:
Procedure
Step 1 Run:
system-view

dns resolve
The dynamic domain name resolution is enabled.

Step 3 Run:
dns server ipv6 ipv6-address [ interface-type interface-number ]
The IPv6 DNS server is configured. Step 4 Run:

dns server ipv6 source-ip ipv6-address
The IPv6 address of the local device is specified. After the source IPv6 address is specified for the local device, the local device uses the specified source IPv6 address to communicate with the IPv6 DNS server to ensure the security of check. Step 5 Run:
dns domain domain-name
The suffix of domain names is added. ----End

You can view the configuration of the IPv6 DNS.
Prerequisite
The configurations of the IPv6 DNS function are complete.
Procedure
l l l l Run the display ipv6 host command to check the static IPv6 DNS table. Run the display dns server command to check the configuration of the DNS server. Run the display dns domain command to check the configuration of the suffix list of the domain name. Run the display dns ipv6 dynamic-host command to check the cache of the dynamic domain name.
----End
Example
Run the display ipv6 host command. If the static IPv6 DNS entries, including the host name and the IPv6 address, are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display ipv6 host Host Age RTB 0 RTA 0 Flags static static IPv6Address (es) 20::1 20::2
Run the display dns server command. If the IPv6 addresses of all DNS servers are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns server IPv4 Dns Servers : Domain-server IpAddress 1 169.254.65.125 IPv6 Dns Servers: Domain-server Ipv6Address 1 3001::2 2 FE80::2
(Interface Name) GigabitEthernet6/0/0
Issue 01 (2011-05-30)
9-5
Run the display dns domain command. If the suffixes of the domain names are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns domain No Domain-name 1 com 2 net
Run the display dns ipv6 dynamic-host command. If information about the cache of the dynamic domain name is displayed, it means that the configuration succeeds. For example:
<HUAWEI> display dns ipv6 dynamic-host No Domain-name Ipv6address TTL 1 huawei6 3001::2 6
9.3 Maintaining IPv6 DNS

This section describes how to maintain the IPv6 DNS. Detailed operations include deleting IPv6 DNS entries and monitoring IPv6 DNS operation. 9.3.1 Clearing IPv6 DNS Entries This section describes IPv6 DNS entry clearance through the reset command. 9.3.2 Monitoring Network Operation Status of IPv6 DNS This section describes IPv6 DNS operation monitoring through the display command.
9.3.1 Clearing IPv6 DNS Entries

This section describes IPv6 DNS entry clearance through the reset command.
Context
CAUTION
IPv6 DNS entries cannot be restored after being cleared. So, confirm the action before you use this command.
Procedure
Step 1 Run the reset dns ipv6 dynamic-host command in the user view to clear dynamic IPv6 DNS entries statistics in the domain name cache. ----End
9.3.2 Monitoring Network Operation Status of IPv6 DNS

This section describes IPv6 DNS operation monitoring through the display command.
Context
In routine maintenance, you can run the following commands in any view to check the operation of IPv6 DNS.
Procedure
l Run:
display dns domain
Domain names are checked. l Run:

display dns server
Configurations of the DNS server are checked. l Run:

display dns ipv6 dynamic-host
Contents about the cache of the IPv6 dynamic domain names are checked. l Run:
display ipv6 host
The static DNS table is checked. ----End

Context
NOTE
9.4.1 Example for Configuring IPv6 DNS This section provides an example of configuring the IPv6 DNS.
9.4.1 Example for Configuring IPv6 DNS

This section provides an example of configuring the IPv6 DNS.
As shown in Figure 9-2, CX- A, functioning as the IPv6 DNS client and working jointly whose IPv6 DNS server, can access the host with the IP address as 2002::1/64 based on the domain name huawei.com. On CX-A, the static IPv6 DNS entries of CX- B and CX- C are configured. This ensures that CX- A can manage both the routers based on the domain names CX-B and CX-C.
Issue 01 (2011-05-30)
9-7
Figure 9-2 Networking diagram of IPv6 DNS configurations
GE1/0/0 CX- B 2001::1/64
CX- C
GE1/0/0 2002::2/64
GE1/0/1 2003::1/64 GE1/0/0 DNS Server 2002::3/64 2003::2/64
DNS Client 2001::2/64 CX- A
GE1/0/1
huawei.com
2002::1/64
The configuration roadmap is as follows: 1. 2. 3. 4. Configure static IPv6 DNS entries. Enable the DNS resolution function. Configure IPv6 address of the IPv6 DNS server. Set the domain name suffix.
Data Preparation
To complete the configuration, you need the following data: l l l Domain names of CX- B and CX- C IPv6 address of the IPv6 DNS server Domain name suffix
Procedure
Step 1 Configure CX- A. # Configure static IPv6 DNS entries.
<CX-A> system-view [CX-A] ipv6 host CX-B 2001::2 [CX-A] ipv6 host CX-C 2002::3
# Enable the DNS resolution function.

[CX-A] dns resolve
# Configure the IPv6 address of the IPv6 DNS server.

[CX-A] dns server ipv6 2003::2
# Set the domain name suffix to ".net".

[CX-A] dns domain net
# Set the domain name suffix to ".com".


[CX-A] dns domain com [CX-A] quit
NOTE
To resolve the domain name, you also need to configure the route from CX- A to the IPv6 DNS server. For details of how to configure the route, refer to the CX600 Metro Services Platform Configuration Guide - IP Routing.
Step 2 Verify the configuration. # Run the ping ipv6 huawei.com command on CX- A. You can find that the Ping operation succeeds, and the destination IP address is 2002::1.
<CX-A> ping ipv6 huawei.com Resolved Host ( huawei.com -> 2002::1) PING huawei.com : 56 data bytes, press CTRL_C to Reply from 2002::1: bytes=56 Sequence=1 ttl=126 Reply from 2002::1: bytes=56 Sequence=2 ttl=126 Reply from 2002::1: bytes=56 Sequence=3 ttl=126 Reply from 2002::1: bytes=56 Sequence=4 ttl=126 Reply from 2002::1: bytes=56 Sequence=5 ttl=126 --- huawei.com ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 4/4/6 ms
break time=6 time=4 time=4 time=4 time=4
ms ms ms ms ms
# Run the display ipv6 host command on CX- A. You can view the mapping relationships between the host names in static IPv6 DNS entries and the IPv6 addresses.
<CX-A> display ipv6 host Host Age CX-B 0 CX-C 0 Flags IPv6Address (es) static 2001::2 static 2002::3
Run the display dns ipv6 dynamic-host command on CX- A. You can view information about dynamic IPv6 DNS entries in the dynamic cache.
<CX-A> display dns ipv6 dynamic-host No Domain-name Ipv6address 1 huawei.com 2002::1
NOTE
TTL 3579
TTL in the command output indicates the life time of the entry, in seconds.
----End
Configuration Files
l Configuration file of CX- A
# sysname CX-A # ipv6 # ipv6 host CX-B 2001::2 ipv6 host CX-C 2002::3 # dns resolve dns server ipv6 2003::2 dns domain net dns domain com # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable
Issue 01 (2011-05-30)
9-9

ipv6 address 2001::1/64 ripng 1 enable # ripng 1 # return
Configuration file of CX- B

# sysname CX-B # ipv6 # interface GigabitEthernet1/0/1 undo shutdown ipv6 enable ipv6 address 2001::2/64 ripng 1 enable # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 address 2002::2/64 ripng 1 enable # ripng 1 # return
Configuration file of CX- C

# sysname CX-C # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ipv6 address 2002::3/64 ripng 1 enable # interface GigabitEthernet1/0/1 undo shutdown ipv6 address 2003::1/64 ripng 1 enable # ripng 1 # return
9-10
Issue 01 (2011-05-30)
10 ACL6 Configuration
10
About This Chapter
ACL6 Configuration
You can distinguish packets through an ACL6 and process them in different manners. 10.1 ACL6 Overview An ACL can be applied to multiple purposes, including PBR and packet filtering. 10.2 Configuring an Interfaced-based ACL6 An interface-based ACL6 is an ACL that specifies rules according to interfaces that receive packets. 10.3 Configuring a Basic ACL6 When defining rules in a basic ACL6, you can specify only source IP addresses. 10.4 Configuring an Advanced ACL6 An advanced ACL6 defines rules based on the source address, destination address, type of the protocol over IP, and protocol features, for example, the source port and destination port of TCP and the type and code of ICMP. 10.5 Configuring a Named ACL6 A named ACL is an advanced ACL6. A named ACL defines rules based on the source address, destination address, type of the protocol over IP, and protocol features, for example, the source port and destination port of TCP and the type and code of ICMP. 10.6 Maintaining ACL6 This section describes how to maintain an ACL6. Detailed operations include deleting ACL6 statistics and monitoring the ACL6 operation. 10.7 Configuration Examples Familiarize yourself with the configuration procedures against the networking diagram. Each configuration example consists of the networking requirements, configuration precautions, configuration roadmap, configuration procedures, and configuration files.
Issue 01 (2011-05-30)
10-1
10.1 ACL6 Overview

An ACL can be applied to multiple purposes, including PBR and packet filtering. 10.1.1 Introduction to ACL6 An ACL is a list of rules. An IPv6 ACL classifies packets according to ACL rules, and then a router determines whether to accept the classified packets according to these ACL rules. 10.1.2 ACL6 Supported by the CX600 According to the differences in filtering rules, ACLs can be categorized into interface-based ACL6s, basic ACL6s, and advanced ACL6s.
10.1.1 Introduction to ACL6

An ACL is a list of rules. An IPv6 ACL classifies packets according to ACL rules, and then a router determines whether to accept the classified packets according to these ACL rules.
NOTE
In this manual, ACL applies to filter IPv4 packets and ACL6 applies to filter IPv6 packets.
10.1.2 ACL6 Supported by the CX600

According to the differences in filtering rules, ACLs can be categorized into interface-based ACL6s, basic ACL6s, and advanced ACL6s. ACL6 is classified into the following types based on application goals: l l l Basic ACL6: classifies data packets only based on the source IP addresses. Advanced ACL6: classifies data packets more detailedly based on the source and destination IP addresses, source and destination port numbers, and protocol type. Interface-based ACL6: classifies data packets based on the interfaces that receive packets.
10.2 Configuring an Interfaced-based ACL6

An interface-based ACL6 is an ACL that specifies rules according to interfaces that receive packets. 10.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an interface-based ACL6. 10.2.2 (Optional) Configuring the Valid Time Range of ACL6 By performing this configuration task, you can specify the time range when an ACL6 remains valid. 10.2.3 Creating an Interfaced-based ACL6 This part describes how to create an interface-based ACL6, whose number ranges from 1000 to 1999, and specify filtering rules according to the packet-receiving interface. 10.2.4 Checking the Configuration You can view the configuration of an interface-based ACL6.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an interface-based ACL6.
An ACL6 can be applied to the following tasks: l l l Configuring the packet filtering policy Configuring the policy-based routing Configuring the routing policy
Before configuring ACL6, complete the following task: l Starting the device normally
Data Preparation
To configure an ACL6, you need the following data: No. 1 2 3 Data (Optional) Name of the time range in which the Interface-based ACL6 takes effect and the start time and end time of the time range ACL6 number, permit or deny rules Type and number of the interface where the ACL6 is applied
10.2.2 (Optional) Configuring the Valid Time Range of ACL6

By performing this configuration task, you can specify the time range when an ACL6 remains valid.
Procedure
Step 1 Run:
system-view

A time rang is created. ----End

10.2.3 Creating an Interfaced-based ACL6

This part describes how to create an interface-based ACL6, whose number ranges from 1000 to 1999, and specify filtering rules according to the packet-receiving interface.
Procedure
Step 1 Run:
system-view

acl ipv6 [ number ] acl6-number [ match-order { auto | config } ]
The interface-based ACL6 is created and the corresponding view is displayed. Step 3 Run:
rule [ rule-id ] { deny | permit } interface { interface-type interface-number | any } [ logging | time-range time-name ]*
ACL6 rules are defined. ----End

You can view the configuration of an interface-based ACL6.
Prerequisite
The configurations of the interface-based ACL6 function are complete.
Procedure
l l l Run the display acl ipv6 { acl6-number | all } command to check the ACL6 rules. Run the display statistics acl ipv6 { acl-number | all } control-plane command to check the statistics about the packets matching ACL6 in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
After the configuration, run the preceding command. You can view ACL6 number, ACL6 step, contents of the rules, and matching times of the rules.
<HUAWEI> display acl ipv6 1000 Interface Based IPv6 ACL 1000, 1 rule Acl's step is 5 rule 5 permit interface Pos4/0/0
After the preceding configurations, the statistics about the packets matching ACL6 in soft forwarding is displayed after the display statistics acl ipv6 control-plane command is used.
<HUAWEI> display statistics acl ipv6 1000 control-plane Interface Based IPv6 ACL 1000, 3 rules rule 0 deny interface any (1035 times matched)
10-4
Issue 01 (2011-05-30)
rule 1 permit interface Pos6/0/3 (586 times matched) rule 2 permit interface GigabitEthernet3/0/11 (103 times matched)
10.3 Configuring a Basic ACL6

When defining rules in a basic ACL6, you can specify only source IP addresses. 10.3.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a basic ACL6. 10.3.2 (Optional) Configuring the Valid Time Range of ACL6 By performing this configuration task, you can specify the time range when an ACL6 remains valid. 10.3.3 Creating a Basic ACL6 This part describes how to create a basic ACL6, whose number ranges from 2000 to 2999, and specify filtering rules according to source interfaces. 10.3.4 Checking the Configuration You can view the configuration of a basic ACL6.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a basic ACL6.
Before configuring an ACL6, start the device normally.
Data Preparation
To configure an ACL6, you need the following data.
No. 1 2
Data (Optional) Name of the time range in which the basic ACL takes effect and the start time and end time of the time range ACL6 number, permit or deny rules, source IP address

Procedure
Step 1 Run:
system-view

A time rang is created. This configuration task is used to create a time range. Multiple time ranges with the same name can be created. ----End
10.3.3 Creating a Basic ACL6

This part describes how to create a basic ACL6, whose number ranges from 2000 to 2999, and specify filtering rules according to source interfaces.
Procedure
Step 1 Run:
system-view

A basic ACL6 is created and the basic ACL6 view is displayed. Step 3 Run:
rule [ rule-id ] { deny | permit } [ fragment | logging | source { source-ipv6address prefix-length | source-ipv6-address/prefix-length | any } | time-range timename | vpn-instance vpn-instance-name ] *
ACL6 rules are defined.

Defining ACL6 rules for the basic ACL6 is based only on the source IP address. ----End

You can view the configuration of a basic ACL6.
Prerequisite
The configurations of the Basic ACL6 function are complete.
Procedure
l l l Run the display acl ipv6 { acl6-number | all } command to check the configured ACL6 rule. Run the display statistics acl ipv6 { acl-number | all } control-plane command to check the statistics about the packets matching ACL6 in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
Run the display acl ipv6 command. If the ACL6 number, the number of rules, detailed step description, and ACL6 rules are displayed, it means that the configuration succeeds. For example:
<HUAWEI> display acl ipv6 2200 Basic IPv6 ACL 2200, 1 rule Acl's step is 5 rule 5 permit
<HUAWEI> display statistics acl ipv6 2200 control-plane Basic IPv6 ACL 2200, 3 rules rule 0 permit source 2030:5060::9050/64 (235 times matched) rule 1 deny source 4050:7080::4060/96 (560 times matched) rule 80 permit source FE80::9040/32 (729 times matched)
10.4 Configuring an Advanced ACL6

An advanced ACL6 defines rules based on the source address, destination address, type of the protocol over IP, and protocol features, for example, the source port and destination port of TCP and the type and code of ICMP.
10.4.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an advanced ACL6. 10.4.2 (Optional) Configuring the Valid Time Range of ACL6 By performing this configuration task, you can specify the time range when an ACL6 remains valid. 10.4.3 Creating an Advanced ACL6 This part describes how to create an advanced ACL6, whose number ranges from 3000 to 3999, and specify filtering rules according to the source address, destination address, type of the protocol over IP, for example, the source port and destination port of TCP and the type of ICMP. 10.4.4 Checking the Configuration You can view the configuration of an advanced ACL6.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an advanced ACL6.
Before configuring an ACL6, complete the following task: l Starting the device normally
Data Preparation
To configure an ACL6, you need the following data: No. 1 2 3 Data (Optional) Name of the time range in which the advanced ACL takes effect and the start time and end time of the time range ACL6 number, permit or deny rules Protocol type, source and destination port numbers, source and destination IP address, and source IP address fragment or not, ICMP message type and coding, priority, ToS, and valid time
10-8
Issue 01 (2011-05-30)

Procedure
Step 1 Run:
system-view

10.4.3 Creating an Advanced ACL6

This part describes how to create an advanced ACL6, whose number ranges from 3000 to 3999, and specify filtering rules according to the source address, destination address, type of the protocol over IP, for example, the source port and destination port of TCP and the type of ICMP.
Procedure
Step 1 Run:
system-view

The advance ACL6 is created and the advanced ACL6 view is displayed. Step 3 Perform the following configuration as required. l When protocol is specified as TCP or UDP Run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6-address prefixlength | destination-ipv6-address/prefix-length | any } | destination-port operator port | fragment | logging | source { source-ipv6-address prefix-length | source-ipv6-address/ prefix-length | any } | source-port operator port | time-range time-name | vpn-instance vpn-instance-name | precedence precedence | tos tos ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6-address prefixlength | destination-ipv6-address/prefix-length | any } | destination-port operator port | fragment | logging | source { source-ipv6-address prefix-length | source-ipv6-address/ prefix-length | any } | source-port operator port | time-range time-name | vpn-instance vpn-instance-name | dscp dscp ] *
ACL6 rules are defined. l When protocol is specified as ICMPv6 Run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6-address prefixlength | destination-ipv6-address/prefix-length | any } | fragment | icmpv6-type { icmp6type-name | icmp6-type icmp6-code } | logging | source { source-ipv6-address prefixlength | source-ipv6-address/prefix-length | any } | time-range time-name | vpn-instance vpn-instance-name | precedence precedence | tos tos ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6-address prefixlength | destination-ipv6-address/prefix-length | any } | fragment | icmpv6-type { icmp6type-name | icmp6-type icmp6-code } | logging | source { source-ipv6-address prefixlength | source-ipv6-address/prefix-length | any } | time-range time-name | vpn-instance vpn-instance-name | dscp dscp ] * ACL6 rules are defined. l When protocol is specified as other protocols except TCP, UDP, and ICMPv6 Run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6-address prefixlength | destination-ipv6-address/prefix-length | any } | fragment | logging | source { sourceipv6-address prefix-length | source-ipv6-address/prefix-length | any } | time-range timename | vpn-instance vpn-instance-name | precedence precedence | tos tos ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ipv6-address prefixlength | destination-ipv6-address/prefix-length | any } | fragment | logging | source { sourceipv6-address prefix-length | source-ipv6-address/prefix-length | any } | time-range timename | vpn-instance vpn-instance-name | dscp dscp ] * ACL6 rules are defined. ----End

You can view the configuration of an advanced ACL6.
Prerequisite
The configurations of the Advanced ACL6 function are complete.
Procedure
l l l Run the display acl ipv6 { acl6-number | all } command to check the configured ACL6 rule. Run the display statistics acl ipv6 { acl-number | all } control-plane command to check the statistics about the packets matching ACL6 in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
Run the display acl ipv6 command. If the ACL6 number, the number of rules, detailed step description, and ACL6 rules are displayed, it means that the configuration succeeds. For example:

<HUAWEI> display acl ipv6 3100 Advanced IPv6 ACL 3100, 3 rules, rule 0 permit icmpv6 rule 1 permit ipv6 source 3001::/16 destination 4001::/16 rule 2 permit tcp source 5001::/16
<HUAWEI> display statistics acl ipv6 3000 control-plane Advanced IPv6 ACL 3000, 1 rule rule 1 permit ipv6 source 4001::/16 (137 times matched)
10.5 Configuring a Named ACL6

A named ACL is an advanced ACL6. A named ACL defines rules based on the source address, destination address, type of the protocol over IP, and protocol features, for example, the source port and destination port of TCP and the type and code of ICMP. 10.5.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a named ACL6. 10.5.2 (Optional) Configuring the Valid Time Range of ACL6 By performing this configuration task, you can specify the time range when an ACL6 remains valid. 10.5.3 Creating a Named ACL6 This part describes how to create an ACL6 whose name is a character string and how to specify filtering rules according to the source address, destination address, type of the protocol over IP, for example, the source port and destination port of TCP and the type of ICMP. 10.5.4 Checking the Configuration You can view the configuration of a named ACL6.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring a named ACL6.
An ACL6 can be applied to various services, such as routing policies and packet filtering, to implement differentiated packet processing based on packet types.. Named ACL6s are advanced ACL6s because you need to define rules for the named ACL6s by specifying the source IP address, destination IP address, IP bearer protocol type, TCP source port, TCP destination port, or ICMP protocol type and code.
None.
Data Preparation
To configure a named ACL6, you need the following data. No. 1 2 3 4 5 Data (Optional) Name of the time range in which the named ACL6 takes effect and the start time and end time of the time range Rule ID of the named ACL6, permit or deny rule, and source IP address IP bearer protocol type, source and destination ports, destination IP address, or ICMP message type and code, packet priority, ToS, and timeout period of the ACL rule (Optional) Description of the named ACL6 (Optional) Step of the named ACL6

Procedure
Step 1 Run:
system-view

10.5.3 Creating a Named ACL6

This part describes how to create an ACL6 whose name is a character string and how to specify filtering rules according to the source address, destination address, type of the protocol over IP, for example, the source port and destination port of TCP and the type of ICMP.
Context
A named ACL6 is an advanced ACL6 and its acl-number ranges from 42768 to 45767.
Procedure
Step 1 Run:
system-view

acl ipv6 name acl-name [ number acl-number ] [ match-order { auto | config } ]
A named ACL6 is created and the named ACL view is displayed. Step 3 Perform the following steps as required to configure rules for the named ACL6: l When protocol is TCP or UDP, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | destination-port operator port | fragment-type fragment-type-name | source { source-ip-address source-wildcard | any } | source-port operator port | syn-flag syn-flag time-range time-name | precedence precedence |tos tos ] * syn-flagsyn-flag needs to be specified only when TCP is used. l When protocol is ICMPv6, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name | icmp-type icmp-code } | source { source-ip-address source-wildcard | any } | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | icmp-type { icmp-name |icmp-type icmp-code } |source { source-ip-address source-wildcard | any } | time-range time-name | precedence precedence | tos tos ] * l When protocol is not TCP, UDP, or ICMPv6, run: rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | dscp dscp ] * rule [ rule-id ] { deny | permit } protocol [ destination { destination-ip-address destinationwildcard | any } | fragment-type fragment-type-name | source { source-ip-address sourcewildcard | any } | time-range time-name | precedence precedence | tos tos ] * Configure different advanced ACLs on the device for different protocols over IP. Different protocols have different parameters combination. For example, TCP and UDP have optional parameter [ source-port operator port ] [ destination-port operator port ] while other protocols do not. ----End

You can view the configuration of a named ACL6.
Prerequisite
The configurations of the ACL6 function are complete.
Procedure
l l l Run the display acl ipv6 name acl-name command to check the configured ACL6 rule. Run the display statistics acl ipv6 { acl-number | all | name acl-name } control-plane command to check the statistics about the packets matching ACL6 in soft forwarding. Run the display time-range { time-name | all } command to check the time range.
----End
Example
# Check the configurations of named ACL6, whose name is test.
<HUAWEI> display acl ipv6 name test Advanced IPv6 Name ACL test, 1 rule Acl's step is 5 rule 5 permit ip
# View the statistics about the packets matching ACL6 3000 in soft forwarding.
<HUAWEI> display statistics acl ipv6 3000 control-plane Advanced IPv6 ACL 3000, 1 rule rule 0 permit ipv6 (335 times matched)
# View the statistics about the packets matching ACL6 named test in soft forwarding.
<HUAWEI> display statistics acl ipv6 name test control-plane Advanced IPv6 ACL test, 2 rules, rule 0 permit 1 (10 times matched) rule 1 permit ipv6 (23 times matched)
10.6 Maintaining ACL6

This section describes how to maintain an ACL6. Detailed operations include deleting ACL6 statistics and monitoring the ACL6 operation. 10.6.1 Clearing ACL6 Statistics This section describes clearance of ACL6 statistics through the reset command. 10.6.2 Monitoring Network Operation Status of ACL6 This section describes ACL6 operation monitoring through the display command.
10.6.1 Clearing ACL6 Statistics

This section describes clearance of ACL6 statistics through the reset command.
Context
CAUTION
Statistics cannot be restored after you clear it. So, confirm the action before you use the command.
Procedure
Step 1 Run the reset acl ipv6 counter { acl6-number | name acl-name | all } command in the user view to clear the ACL6 counter. ----End
10.6.2 Monitoring Network Operation Status of ACL6

This section describes ACL6 operation monitoring through the display command.
Context
In routine maintenance, you can run the following command in any view to check the operation of ACL6.
Procedure
l l Run the display acl ipv6 { acl6-number | name acl-name | all } command in any view to check the configured ACL6 rules. Run the display statistics acl ipv6 { acl6-number | all | name acl-name } control-plane command in any view to check the statistics about the packets matching ACL6 in soft forwarding.
----End

Familiarize yourself with the configuration procedures against the networking diagram. Each configuration example consists of the networking requirements, configuration precautions, configuration roadmap, configuration procedures, and configuration files.
Context
NOTE
10.7.1 Example for Configuring an ACL6 to Filter IPv6 Packets

This section provides an example for configuring an ACL6 and IPv6 packet filtering.
10.7.1 Example for Configuring an ACL6 to Filter IPv6 Packets

This section provides an example for configuring an ACL6 and IPv6 packet filtering.
As shown in Figure 10-1, CX-A and CX-B are connected through POS interfaces. Configure ACL6 rules on CX-A to prevent the IPv6 packets with the source IP address 3001::2 from entering POS1 /0/0 of CX-A. Figure 10-1 Networking diagram of configuring an ACL6 to filter IPv6 packets
CX-A POS1/0/0 3001::1/64
POS1/0/0 CX-B 3001::2/64
Loopback2 3002::2/64
The configuration roadmap is as follows: 1. 2. 3. Define an ACL6 number. Define rules in the ACL6. Set the traffic classifier, behavior, and policy.
Data Preparation
To complete the configuration, you need the following data: l l ACL6 number Source IPv6 address denied by the ACL6 rule
Procedure
Step 1 Enable IPv6 forwarding capabilities on CX-A and CX-B, configure interface parameters, and check connectivity between them. # Configure CX-A.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6 [CX-A] interface pos 1/0/0 [CX-A-Pos1/0/0] ipv6 enable [CX-A-Pos1/0/0] ipv6 address 3001::1 64 [CX-A-Pos1/0/0] undo shutdown [CX-A-Pos1/0/0] quit
# Configure a static route on CX-A.

[CX-A] ipv6 route-static 3002:: 64 3001::2
# Configure CX-B.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] ipv6 [CX-B] interface loopback 2 [CX-B-LoopBack2] ipv6 enable [CX-B-LoopBack2] ipv6 address 3002::2 64 [CX-B-LoopBack2] quit [CX-B] interface pos 1/0/0 [CX-B-Pos1/0/0] ipv6 enable [CX-B-Pos1/0/0] ipv6 address 3001::2 64 [CX-B-Pos1/0/0] undo shutdown [CX-B-Pos1/0/0] quit
# Ping POS 1/0/0 of CX-A from POS 1/0/0 of CX-B.

[CX-B] ping ipv6 -a 3001::2 3001::1 PING 3001::1 : 56 data bytes, press CTRL_C to break Reply from 3001::1 bytes=56 Sequence=1 hop limit=64 time = 80 ms Reply from 3001::1 bytes=56 Sequence=2 hop limit=64 time = 50 ms Reply from 3001::1 bytes=56 Sequence=3 hop limit=64 time = 40 ms Reply from 3001::1 bytes=56 Sequence=4 hop limit=64 time = 30 ms Reply from 3001::1 bytes=56 Sequence=5 hop limit=64 time = 1 ms --- 3001::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/40/80 ms
The ping succeeds without timeout or abnormal delay. # Ping POS 1/0/0 of CX-A from loopback2 of CX-B.
The ping succeeds without timeout or abnormal delay. Step 2 Create an ACL6 rule and apply the rule on the interface to prevent the IPv6 packets from 3001::2. # Configure CX-A.
[CX-A] acl ipv6 number 3001 [CX-A-acl6-adv-3001] rule deny ipv6 source 3001::2/128 [CX-A-acl6-adv-3001] quit [CX-A] traffic classifier bb [CX-A-classifier-bb] if-match ipv6 acl 3001 [CX-A-classifier-bb] quit [CX-A] traffic behavior aa [CX-A-behavior-aa] permit [CX-A-behavior-aa] quit
Issue 01 (2011-05-30)
10-17
[CX-A] traffic policy cc [CX-A-trafficpolicy-cc] classifier bb behavior aa [CX-A-trafficpolicy-cc] quit [CX-A] interface pos 1/0/0 [CX-A-Pos1/0/0] traffic-policy cc inbound [CX-A-Pos1/0/0] quit
Step 3 Verify the configuration. # Ping POS 1/0/0 of CX-A from POS 1/0/0 of CX-B.
[CX-B] ping ipv6 -a 3001::2 3001::1 PING 3001::1 : 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out --- 3001::1 ping statistics --5 packet(s) transmitted 0 packet(s) received 100.00% packet loss round-trip min/avg/max = 0/0/0 ms
The ping fails. # Ping POS 1/0/0 of CX-A from loopback2 of CX-B.
The ping succeeds without timeout or abnormal delay. ----End
Configuration Files
# sysname CX-A # ipv6 # acl ipv6 number 3001 rule 0 deny ipv6 source 3001::2/128 # traffic classifier bb operator or if-match ipv6 acl 3001 # traffic behavior aa # traffic policy cc undo share-mode classifier bb behavior aa
10-18
Issue 01 (2011-05-30)

# interface pos1/0/0 link-protocol ppp undo shutdown traffic-policy cc inbound ipv6 enable ipv6 address 3001::1/64 # ipv6 route-static 3002:: 64 3001::2 # return

# sysname CX-B # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3001::2/64 # interface LoopBack2 ipv6 enable ipv6 address 3002::2/64 # return
Issue 01 (2011-05-30)
10-19
11 IPv6 over IPv4 Tunnel Configuration
11
IPv6 over IPv4 Tunnel Configuration
About This Chapter

The IPv6 over IPv4 tunnel technology is developed to address the problem in the transition from IPv4 networks to IPv6 networks. 11.1 IPv6 over IPv4 Tunnel Overview The IPv6 over IPv4 tunnel technology provides connectivity for isolated IPv6 networks by using existing IPv4 networks. 11.2 Configuring IPv4/IPv6 Dual Stacks To establish an IPv6 over IPv4 tunnel, you need to configure both the IPv4 protocol suite and the IPv6 protocol suite on the devices where an IPv4 network borders an IPv6 network. 11.3 Configuring an IPv6 over IPv4 Tunnel You can interconnect IPv6 networks by using IPv4 networks. 11.4 Configuring 6PE By performing this configuration task, you can interconnect IPv6 networks through the existing MPLS network. 11.5 Maintaining IPv6 over IPv4 Tunnels This section describes how to maintain an IPv6 over IPv4 tunnel, including how to monitor an IPv6 over IPv4 tunnel. 11.6 Configuration Examples This section includes the networking requirements, configuration notes, and configuration roadmap.
Issue 01 (2011-05-30)
11-1
11.1 IPv6 over IPv4 Tunnel Overview

The IPv6 over IPv4 tunnel technology provides connectivity for isolated IPv6 networks by using existing IPv4 networks. 11.1.1 Introduction to IPv6 over IPv4 An IPv6 packet is transparently transmitted after being encapsulated into an IPv4 packet. 11.1.2 IPv6 over IPv4 Supported by the CX600 You can configure manual IPv6 over IPv4 tunnels or 6to4 tunnels to interconnect IPv6 networks.
11.1.1 Introduction to IPv6 over IPv4

An IPv6 packet is transparently transmitted after being encapsulated into an IPv4 packet. During the transition from the IPv4 Internet to the IPv6 Internet, IPv4 networks have been widely deployed while IPv6 domains are isolated and dispersed around the world. It is not economical to connect these isolated sites with private lines. The usual method is tunnel technology. This technology creates tunnels over IPv4 networks to connect isolated IPv6 domains. This is similar to the situation where the tunnel technology is used to deploy VPNs on the IP networks. The tunnel used to connect isolated IPv6 domains over IPv4 networks is called IPv6 over IPv4 tunnel. To implement this tunnel, enable IPv4/IPv6 dual stacks on the devices at the border of the IPv4 network and the IPv6 network.
11.1.2 IPv6 over IPv4 Supported by the CX600

You can configure manual IPv6 over IPv4 tunnels or 6to4 tunnels to interconnect IPv6 networks.
NOTE
Configuring an IPV6 over IPv4 GRE Tunnel cannot be configured on the X1 and X2 models of the CX600.
Dual Stacks
The simplest way for an IPv6 node to remain compatible with an IPv4 node is to reserve a complete IPv4 protocol stack. In this way, the IPv6 node maintains a dual-stack structure. Figure 11-1 shows a single stack structure and a dual stack structure. Figure 11-1 Single stack and dual stack structures (Ethernet)
IPv4 Application UDP
IPv4/IPv6 Application TCP UDP
TCP
IPv4 Protocol ID: 0x0800 Ethernet IPv4 Stack

11-2
IPv4
IPv6 Protocol ID: Protocol ID: 0x86DD 0x0800 Ethernet Dual Stack
Issue 01 (2011-05-30)
The characteristics of the dual-stack structure are as follows: l Supported by multiple link layer protocols Multiple link layer protocols, such as Ethernet, support dual stacks. The link layer in the above diagram is the Ethernet. For an Ethernet frame with the protocol ID field value of 0x0800 indicates that the network layer has IPv4 packets. The ID field value of 0x86DD indicates that the network has IPv6 packets. l Supported by multiple applications Multiple applications such as DNS, FTP and Telnet support dual stacks. The upper application, such as DNS, can select TCP or UDP as its transport layer protocol. However, it prefers the IPv6 protocol stack rather than IPv4 to be the network layer protocol.
IPv6 over IPv4 Tunnel

Figure 11-2 shows principles of the IPv6 over IPv4 tunnel technology. 1. 2. Enabling IPv4/IPv6 dual stacks Enable IPv4/IPv6 dual stacks on the border device. Encapsulating IPv6 packets After receiving a packet from the IPv6 network, the border device takes the received IPv6 packet as the payload, adds an IPv4 packet header before the payload and encapsulates it into an IPv4 packet if it finds that the destination of the packet is not for itself. 3. 4. Transmitting the encapsulated packet In the IPv4 network, the encapsulated packet is transmitted to the peer border device. Decapsulating the packet The peer border device decapsulates the packet, removes the IPv4 packet header, and forwards the resulting IPv6 packet to the remote IPv6 network. Figure 11-2 Schematic diagram of IPv6 over IPv4 tunnel
Dual Stack CX600 IPv6 IPv6 host IPv6 Header IPv6 Data IPv4 Header
IPv4 Tunnel
Dual Stack CX600 IPv6 IPv6 Header IPv6 host IPv6 Data
IPv6 Header
IPv6 Data
The virtual tunnel that transmits IPv6 packets between the border devices is called the IPv6 over IPv4 tunnel. Tunnels can be classified according to their setup modes. The common IPv6 over IPv4 tunnel modes include: l l
Issue 01 (2011-05-30)
IPv6 over IPv4 manual tunnels IPv6 over IPv4 GRE tunnels (GRE tunnels)
l l l
IPv6 over IPv4 tunnel automatic tunnels 6to4 tunnels Intrasite Automatic Tunnel Addressing Protocol (ISATAP) tunnels
IPv6 over IPv4 Manual Tunnel

An IPv6 over IPv4 manual tunnel is set up by configuring the border devices of two tunnel ends. The source IPv4 address and destination IPv4 address of such a tunnel must be configured statically. A manual tunnel is equivalent to a permanent link between two IPv6 networks over an IPv4 backbone network. It is the fixed channel for regular and secure communication between the two border devices. The manual tunnel can be used between isolated IPv6 networks. It can also be used between a border device and a host. In this case, the host and the device on both ends of the tunnel must support the IPv4 and the IPv6 protocol stacks.
IPv6 over IPv4 GRE Tunnel

The IPv6 traffic can be carried over the IPv4 GRE tunnels. When carrying the IPv6 traffic, the IPv4 GRE tunnels are called IPv6 over IPv4 GRE tunnels (GRE tunnel for short). Like the IPv6 over IPv4 manual tunnel, a GRE tunnel is a link between two nodes, with a separate tunnel for each link. The tunnels are not tied to a specific passenger or transport protocol, and only carry IPv6 as the passenger protocol and GRE as the carrier protocol. The GRE tunnel is also manually created on the border devices at the tunnels. You need to statically specify the source IPv4 address and destination IPv4 address of the GRE tunnel. Unlike the manual tunnel, the GRE tunnel can be set to check the GRE packet header and to authenticate the tunnel keyword to enhance the tunnel security. The GRE tunnel is used to connect border devices, or connect a border device and a host system. Both the host and the device on both the ends of the tunnel must support the IPv4 and the IPv6 protocol stacks.
IPv6 over IPv4 Automatic Tunnel

To create an IPv6 over IPv4 automatic tunnel, you need a special kind of IPv6 address, namely an IPv4-compatible IPv6 address. The format of IPv4-compatible IPv6 address is as follows: 0:0:0:0:0:0:IPv4-address Its high-order 96 bits are all 0s, and its low-order 32 bits form an IPv4 address. This IPv4 address must be reachable in the IPv4 network, and cannot be a multicast address, a broadcast address, a loopback address or an unspecified address (0.0.0.0). To configure an automatic tunnel, specify just the source address of the tunnel on a border device or a host. The destination address of the tunnel is automatically obtained from the destination IP address field carried in the original IPv6 packet. The IPv6 over IPv4 automatic tunnel is usually used when an isolated IPv4/IPv6 dual stack host needs to access a remote IPv6 network over an IPv4 network. The automatic tunnel needs to be configured between the isolated IPv4/IPv6 host and the IPv4/IPv6 device.
While setting up an automatic tunnel, configure the IPv4-compatible IPv6 address on both the ends of the tunnel. The IPv4-compatible IPv6 address depends on the IPv4 address of the physical interface of the tunnel. It is limited to the shortage of the IPv4 address. Therefore, it has certain limitations.
6to4 Tunnel
A 6to4 tunnel is a mechanism that connects several isolated IPv6 domains to each other over an IPv4 network. The 6to4 tunnel can be configured on the border device between the isolated IPv6 network and the IPv4 network. The border device on both the ends of the 6to4 tunnel must support the IPv4 and the IPv6 dual protocol stacks at the same time. The key difference between the 6to4 tunnel and the manual tunnel is that the former can be a point-to-multipoint connection, and the latter is only a point-to-point connection. Hence, the devices of the 6to4 tunnel are not configured in pairs. The 6to4 tunnel can automatically find another end of the tunnel, like the automatic tunnel. You need not specify the IPv4-compatible IPv6 address for it. The 6to4 tunnel uses a kind of special IPv6 address, namely the 6to4 address with the following format: 2002:IPv4 address: subnet ID:interface ID The prefix of the 6to4 address is 2002:IPv4 address with the length of 48 bits. Of these, the IPv4 address is a globally unique one requested for an isolated IPv6 domain. This IPv4 address must be configured on the IPv6/IPv4 border device's physical interface that is connected with the IPv4 network. The length of the subnet ID is 16 bits, and that of the interface ID is 64 bits. Both the subnet ID and the interface ID are allocated in the isolated IPv6 domains. As shown in Figure 11-3, Site1 and Site2 are 6to4 networks, and hosts and devices in the 6to4 network are allocated with 6to4 addresses. The IPv4 address contained in the 6to4 address of the host or device in Site1 is the IPv4 address of the interface through which CX-A accesses the IPv4 network. Similarly, the IPv4 address contained in the 6to4 address of the host or device in Site2 is the IPv4 address of the interface through which CX-B accesses the IPv4 network. CXA and CX-B are both 6to4 devices. Figure 11-3 6to4 tunnel and 6to4 relay
6to4 CX600 6to4 CX600 IPv4 Network CX-A 6to4 Relay
6to4 Network Site2 CX-B CX-C IPv6 Internet Site3
6to4 Network Site1
Issue 01 (2011-05-30)
11-5
When the host in Site1 accesses the host in Site2, the process concerned is as follows: 1. 2. 3. The IPv6 packet is transmitted to CX-A. CX-A checks the destination address of the IPv6 packet and finds that the address is the 6to4 address, from which CX-A obtains the remote IPv4 address of the 6to4 tunnel. CX-A encapsulates this IPv6 packet into the IPv4 packet. The destination address of IPv4 packet header is the remote IPv4 address of the tunnel, and its source address is the local IPv4 address of the tunnel. CX-A forwards the IPv4 packet in the IPv4 network to CX-B. CX-B decapsulates it to obtain the previous IPv6 packet, and then sends the IPv6 packet to the destination host in Site2.
4. 5.
The above process implements the communication between the 6to4 networks. To implement the communication between the 6to4 network and native IPv6 network, a 6to4 relay device is needed. The so-called native IPv6 network means that both its internal host and device are not configured with the 6to4 address. The 6to4 relay device is the gateway between the 6to4 network and the native IPv6 network. One side of the 6to4 relay device is connected to the native IPv6 network; the other side is connected to the IPv4 network and creates the 6to4 tunnel with the 6to4 device. As shown in Figure 11-3, when the host in the 6to4 network accesses the IPv6 Internet, the process concerned is as follows: 1. 2. 3. 4. The IPv6 packet is routed to CX-A. A 6to4 tunnel is created between CX-A and CX-C. The IPv6 packet is encapsulated into the IPv4 packet and is sent to CX-C. CX-C decapsulates the IPv4 packet to obtain the previous IPv6 packet, and sends the IPv6 packet to the destination host in the IPv6 Internet.
ISATAP Tunnel
The ISATAP tunnel is used when the IPv4/IPv6 host in an IPv4 network accesses an IPv6 network. The ISATAP tunnel can be created between an ISATAP host and an ISATAP device. The ISATAP format address is needed to create the ISATAP tunnel. Its structure is as follows: Prefix (64bit)::5EFE:IPv4-Address When the ISATAP tunnel is created (since the IPv4/IPv6 host and the ISATAP device are in a same IPv4 network), the IPv4 address embedded into the ISATAP address can be either a public network address or a private network address. As shown in Figure 11-4, the process for an IPv4/IPv6 host to obtain an IPv6 address is as follows: 1. The IPv4/IPv6 host sends a request message to a device. The IPv4/IPv6 host uses the link-local address in the ISATAP format to send a router request message to the ISATAP device. It encapsulates the message into the IPv4 packet. 2. The ISATAP device responds to the request message. The ISATAP device uses a router notification message to respond to the request. The router notification message contains the ISATAP prefix, which is manually configured on the device.
3.
The IPv4/IPv6 host obtains its IPv6 address. The IPv4/IPv6 host obtains its own IPv6 address by combining the ISATAP prefix with 5EFE:IPv4-Address, and uses this address to access the IPv6 host.
Figure 11-4 ISATAP tunnel
IPv6 Network ISATAP CX600
IPv4 Network ISATAP Tunnel IPv4/IPv6 Host 2.1.1.1 FE80::5EFE:0201:0101 3FFE::5EFE:0201:0101
IPv6 Host
The principle of an IPv4 or IPv6 host accessing an IPv6 network is as follows: 1. 2. 3. The IPv4 or IPv6 host in the IPv4 network obtains an IPv6 address based on the steps given above. The IPv4 or IPv6 host sends packets that are encapsulated in an IPv4 packet to the host in the IPv6 network. An ISATAP device decapsulates the IPv4 packet and sends the IPv6 packets to the IPv6 host.
6PE
On an IPv4 backbone network where the MPLS is deployed, the ISP can use the IPv6 Provider Edge (6PE) technology to provide the interconnection capacity for the IPv6 networks of dispersed users. 6PE is the PE with the IPv6 capacity. Figure 11-5 shows the principle of interconnecting isolated IPv6 domains through 6PE. 1. When the 6PE device receives an IPv6 packet from the CE, it directly labels the packet to translate the packet into an MPLS packet that can be transmitted over the IPv4 backbone network. The MPLS packet is forwarded to the remote 6PE through the LSP. The remote 6PE removes the label and finds the IPv6 routing table according to the destination address in the resulting IPv6 packet header. The remote 6PE then sends the packet to the destination host in the remote IPv6 network through the remote CE.
2. 3. 4.
Issue 01 (2011-05-30)
11-7
Figure 11-5 Networking diagram of 6PE
6PE CX600
IPv4/MPLS IBGP
6PE CX600
CE PE IPv6 Customer site
CE IPv6 Customer site
Note the following points when you connect isolated IPv6 sites through a 6PE tunnel: l l l l Enable IPv4, MPLS and IPv6 on 6PE. MP-BGP also needs to be enabled between 6PEs to receive or send IPv6 routes from/to the remote 6PE. The IGP over ISP's IPv4 backbone network can be OSPF or IS-IS. Static routing protocol, IGP or EBGP can work between CE and 6PE.
When ISPs tend to extend their IPv4 or MPLS networks with IPv6 traffic exchange capability on MPLS, they only need to update their PE devices.
11.2 Configuring IPv4/IPv6 Dual Stacks

To establish an IPv6 over IPv4 tunnel, you need to configure both the IPv4 protocol suite and the IPv6 protocol suite on the devices where an IPv4 network borders an IPv6 network. 11.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for the IPv4/IPv6 dual protocol stack. 11.2.2 Enabling IPv6 Packet Forwarding To enable IPv6 packet forwarding, you need to enable IPv6 in both the interface view and the system view. 11.2.3 Configuring IPv4 and IPv6 Addresses for the Interface You need to configure IPv4 and IPv6 addresses separately on the IPv4 and IPv6 networks.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for the IPv4/IPv6 dual protocol stack.
If a device has both IPv4 and IPv6 connections, the IPv4/IPv6 dual protocol stacks need to be enabled on the device.
Enabling the IPv4/IPv6 dual protocol stacks on the CX600 is a simple process. Enable the IPv6 packet forwarding capacity in the system view and configure an IPv4 address or IPv6 address on the corresponding interface. The device can then forward IPv4 and IPv6 packets on the corresponding interface.
Before configuring IPv6 tunnels, complete the following tasks: l l Configuring the physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer parameters for the interface
Data Preparation
To configure IPv4/IPv6 dual stacks, you need the following data. No. 1 2 3 4 Data Type and number of the interface connected with the IPv4 network IPv4 address and mask of the interface connected with the IPv4 network Type and number of the interface connected with the IPv6 network IPv6 address and prefix of the interface connected with the IPv6 network
11.2.2 Enabling IPv6 Packet Forwarding

To enable IPv6 packet forwarding, you need to enable IPv6 in both the interface view and the system view.
Context
To enable a device to forward IPv6 packets, you must enable the IPv6 capability in both the system view and the interface view. This is because: l If you run the ipv6 command only in the system view, only the IPv6 packet forwarding capability is enabled on a device. The interface on the device is not of the IPv6 capability and hence you cannot perform any IPv6 configurations. If you run the ipv6 enable command only in the interface view, the IPv6 capability is enabled only on an interface but the IPv6 protocol status on the interface is Down and the device cannot forward IPv6 data.
Procedure
Step 1 Run:
system-view

ipv6
Issue 01 (2011-05-30)
11-9
The IPv6 packet forwarding capability is enabled. To enable a device to forward IPv6 packets, you must run this command in the system view; otherwise, the IPv6 protocol status on the interface is Down and the device cannot forward IPv6 packets although the interface is configured with an IPv6 address. By default, the IPv6 packet forwarding capability is disabled. Step 3 Run:
The view of the interface to be enabled with the IPv6 capability is displayed. Step 4 Run:
ipv6 enable
The IPv6 capability is enabled on the interface. Before performing IPv6 configurations in the interface view, you must enable the IPv6 capability in the interface view. By default, the IPv6 capability is disabled on the interface. ----End
11.2.3 Configuring IPv4 and IPv6 Addresses for the Interface

You need to configure IPv4 and IPv6 addresses separately on the IPv4 and IPv6 networks.
Procedure
Step 1 Run:
system-view

The interface view of the IPv4 network is displayed. Step 3 Run:

An IPv4 address is assigned to the interface. Step 4 Run:

quit
Return to the system view. Step 5 Run:

The interface view of the IPv6 network is displayed. Step 6 Perform the following configuration as required. l Run:
ipv6 address auto link-local
11-10
Issue 01 (2011-05-30)
The link-local address is set to be automatically generated. l Run:

ipv6 address ipv6-address link-local
The link-local address of the interface is configured. l Run:

ipv6 address { ipv6-address | prefix-length }
The global unicast address is configured. l Run:

ipv6 address { ipv6-address | prefix-length } eui-64
The IPv6 EUI-64 address is configured. ----End
11.3 Configuring an IPv6 over IPv4 Tunnel

You can interconnect IPv6 networks by using IPv4 networks.
Context
NOTE
Configuring an IPV6 over IPv4 GRE Tunnel cannot be configured on the X1 and X2 models of the CX600.
11.3.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an IPv6 over IPv4 tunnel. 11.3.2 Configuring an IPv6 over IPv4 Manual Tunnel A manual IPv6 over IPv4 tunnel is a P2P tunnel. The source address and destination address of a manual IPv6 over IPv4 tunnel are both manually assigned. The source address and destination address of a manual IPv6 over IPv4 tunnel on the same device must be unique. A manual IPv6 over IPv4 tunnel acts as a permanent link that crosses an IPv4 network and connects two IPv6 networks. Border devices can communicate with each other securely and regularly through manual IPv6 over IPv4 tunnels. 11.3.3 Configuring an IPV6 over IPv4 GRE Tunnel Through the IPv6 over IPv4 GRE technology, the IPv6 traffic can be carried over the IPv4 GRE tunnels. 11.3.4 Configuring an IPv6 over IPv4 Automatic Tunnel By configuring an automatic IPv6 over IPv4 tunnel, you can enable an isolated IPv4/IPv6 dual stack host to access a remote IPv6 network through an IPv4 network. IPv6 over IPv4 automatic tunnels do not support IPv6 packet forwarding. 11.3.5 Configuring a 6to4 Tunnel A 6to4 tunnel is a P2MP tunnel and can interconnect IPv6 networks which are isolated from each other through an IPv4 network. 11.3.6 Configuring an ISATAP Tunnel Intra-site Automatic Tunnel Addressing Protocol (ISATAP) tunnels are used in the situation where IPv4/IPv6 hosts in an IPv4 network need to access an IPv6 network. An ISATAP tunnel can be established between an ISATAP host and an ISATAP device. 11.3.7 Configuring Routes in the Tunnel
Packets can be normally forwarded only when routes exist on both the source device and destination device of the tunnel. 11.3.8 Checking the Configuration You can view the configuration of an IPv6 over IPv4 tunnel.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an IPv6 over IPv4 tunnel.
To enable communication between two IPv6 networks over the IPv4 network, configure an IPv6 over IPv4 tunnel on the border device of the IPv4 and IPv6 networks.
Before configuring an IPv6 over IPv4 tunnel, complete the following tasks: l l l Configuring the physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocol for the interface and ensuring that the status of the link layer protocol on the interface is Up Configuring the IPv4/IPv6 dual-protocol stacks
Data Preparation
To configure an IPv6 over IPv4 tunnel, you need the following data. No. 1 2 3 4 5 Data Number, IPv6 address and prefix length of the tunnel Encapsulation mode of packets over the tunnel Source IPv4 address or interface number of the tunnel Destination IPv4 address of the tunnel Authentication word of the GRE tunnel (only for the GRE tunnel)
11.3.2 Configuring an IPv6 over IPv4 Manual Tunnel

A manual IPv6 over IPv4 tunnel is a P2P tunnel. The source address and destination address of a manual IPv6 over IPv4 tunnel are both manually assigned. The source address and destination address of a manual IPv6 over IPv4 tunnel on the same device must be unique. A manual IPv6 over IPv4 tunnel acts as a permanent link that crosses an IPv4 network and connects two IPv6 networks. Border devices can communicate with each other securely and regularly through manual IPv6 over IPv4 tunnels.
Context
Note the following when configuring an IPv6 over IPv4 manual tunnel: l l l l Before configuring other parameters of an IPv6 tunnel, you must create a tunnel interface. The source interface of the tunnel must be specified by the address or number of the loopback interface on the local route. The destination interface of the tunnel must be specified by the address of the loopback interface on the peer device. You need to conduct the following configurations on the devices on both the ends of the tunnel. During the configuration, note that the source address of the local tunnel end is the destination address set for the remote tunnel end; the destination address of the local tunnel end is the source address set for the remote tunnel end. To support dynamic routing protocol, you also need to configure the tunnel interface with a network address.
Procedure
Step 1 Run:
system-view

interface tunnel interface-number
The tunnel interface is created. Step 3 Run:

tunnel-protocol ipv6-ipv4
The tunnel is specified be an IPv6 over IPv4 manual tunnel. Step 4 Run:
source { ip-address | interface-type interface-number }
The source address or source interface of the tunnel is specified.

NOTE
For the actual implementation on the CX600, the source interface of the tunnel can only be a loopback interface but the source address of the tunnel can be either the address of a physical interface or the address of a loopback interface.
Step 5 Run:
destination dest-ip-address
The destination address of the tunnel is specified.

NOTE
The destination address of the tunnel can be the address of a physical interface or the address of a loopback interface.
Step 6 Run:
ipv6 enable
IPv6 is enabled on the interface.

Step 7 Run:
ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }
The tunnel interface is configured with an IPv6 address. ----End
11.3.3 Configuring an IPV6 over IPv4 GRE Tunnel

Through the IPv6 over IPv4 GRE technology, the IPv6 traffic can be carried over the IPv4 GRE tunnels.
Context
l Note the following when configuring an IPv6 over IPv4 GRE tunnel: Before configuring other parameters of an IPv6 tunnel, you must create a tunnel interface. The slot number of the created tunnel interface must be the same as that of the SPUC. You need to create the loopback interface and assign an IP address to it. The source interface of the tunnel must be specified by the address or number of the loopback interface on the local route. The destination interface of the tunnel must be specified by the address of the loopback interface on the peer device. You need to conduct the following configurations on the devices on both the ends of the tunnel. During the configuration, note that the source address of the local tunnel end is the destination address set for the remote tunnel end; the destination address of the local tunnel end is the source address set for the remote tunnel end. To make the tunnel support the routing protocol, configure an IP address for the tunnel interface. l Setting the key word of the GRE packet header The configuration of key word of GRE packet header is also optional. If the key word is configured, the receiver checks the KEY field in the GRE packet header. If the key word in the packet header is similar to the one configured locally, the receiver continues to process the packet. Otherwise, it discards the packet.
Procedure
Step 1 Run:
set board-type slot slot-id tunnel
The service mode of the SPUC is set to Tunnel. Step 2 Run:

system-view

The tunnel interface is created.

The slot number of the created tunnel interface must be the same as that of the SPUC. For instance, when the SPUC is inserted in slot 2, the slot number of the tunnel interface must be 2. Step 4 Run:
tunnel-protocol gre
The tunnel is specified as a GRE tunnel. When you configure an IPv6 over IPv4 GRE tunnel, you must run the target-boardslotnumber and binding tunnel gre commands respectively on the loopback interface to bind the SPUC to GRE. Step 5 Run:
The source address or source interface of the tunnel is specified. The source address specified by sourceipv4-address must be the IPv4 address of the loopback interface bound to the SPUC through the target-board command; the source interface specified by sourceinterface-type interface-number must be the loopback interface bound to the SPUC through the target-board command. Step 6 Run:
destination dest-ip-address
The destination address of the tunnel is specified. Step 7 (Optional) Run:

gre key key-number
The key word of the GRE packets header is set. Step 8 Run:
ipv6 enable
IPv6 is enabled on the interface. Step 9 Run:

The IPv6 address of the tunnel interface is configured. ----End
11.3.4 Configuring an IPv6 over IPv4 Automatic Tunnel

By configuring an automatic IPv6 over IPv4 tunnel, you can enable an isolated IPv4/IPv6 dual stack host to access a remote IPv6 network through an IPv4 network. IPv6 over IPv4 automatic tunnels do not support IPv6 packet forwarding.
Context
Note the following when configuring an IPv6 over IPv4 automatic tunnel: l l Before configuring the other parameters of an IPv6 tunnel, you must create a tunnel interface. The source interface of the tunnel must be specified by the address or number of the loopback interface on the local route.
Issue 01 (2011-05-30)
When configuring an IPv6 over IPv4 automatic tunnel, you can specify only the source address of the tunnel. The destination address of the tunnel is automatically obtained from the destination IP address field carried in the original IPv6 packet. Note that the source interface of the IPv6 over IPv4 automatic tunnel must be unique. The IPv6 address configured for the automatic tunnel must be an IPv4-compatible IPv6 address. That is, the high-order 96 bits are 0 and the low-order 32 bits represent an IPv4 address of an interface in the IPv4 network.
Procedure
Step 1 Run:
system-view

A tunnel interface is configured. Step 3 Run:

tunnel-protocol ipv6-ipv4 auto-tunnel
The tunnel is specified as an IPv6 over IPv4 automatic tunnel. Step 4 Run:
The source address or source interface of the tunnel is specified. Step 5 Run:
ipv6 enable

The tunnel interface is configured with an IPv6 address. ----End
11.3.5 Configuring a 6to4 Tunnel

A 6to4 tunnel is a P2MP tunnel and can interconnect IPv6 networks which are isolated from each other through an IPv4 network.
Context
Note the following when configuring a 6to4 tunnel: l l l Before configuring other parameters of the tunnel, create a tunnel interface. When the specified source interface of the tunnel is a physical interface, it is recommended to set the tunnel ID to be the same as the number of the physical interface. The source tunnel interface must be specified by the address or number of the loopback interface on the local route.
11-16
When configuring a 6to4 tunnel, you need to specify only the source tunnel interface. The destination address of the tunnel is automatically obtained from the destination IP address field carried in the original IPv6 packet. Note that the source interface of the 6to4 tunnel must be unique. On the border device, configure a 6to4 address on the interface that is connected with the 6to4 network, and configure an IPv4 address on the interface that is connected with the IPv4 network. To make the tunnel support the routing protocol, configure an IP address for the tunnel interface.
Procedure
Step 1 Run:
system-view

A tunnel interface is created. Step 3 Run:

tunnel-protocol ipv6-ipv4 6to4
The tunnel is specified as a 6to4 tunnel. Step 4 Run:

ipv6 enable

The interface is configured with an IPv6 address.

NOTE
The prefix of the IPv6 address configured for the interface must be the same as the 6to4 network prefix of the border device.
----End
Follow-up Procedure
The configuration of 6to4 relay needed to access the IPv6 network, is similar to the 6to4 tunnel. For the configuration example, see "Example for Configuring 6to4 Relay."
11.3.6 Configuring an ISATAP Tunnel

Intra-site Automatic Tunnel Addressing Protocol (ISATAP) tunnels are used in the situation where IPv4/IPv6 hosts in an IPv4 network need to access an IPv6 network. An ISATAP tunnel can be established between an ISATAP host and an ISATAP device.
Context
Note the following when configuring an ISATAP tunnel: l l l Before configuring other parameters of the tunnel, create a tunnel interface. When the specified source interface of the tunnel is a physical interface, it is recommended to set the tunnel ID to be the same as the number of the physical interface. When configuring an ISATAP tunnel, you need to specify only the source address of the tunnel. The destination address of the tunnel is automatically obtained from the destination IP address field carried in the original IPv6 packet. Note that the source interface of the ISATAP tunnel must be unique. The IPv6 address configured on the tunnel interface is an ISATAP address with a prefix length of 64 bits.
Procedure
Step 1 Run:
system-view

A tunnel interface is created. Step 3 Run:

tunnel-protocol ipv6-ipv4 isatap
The tunnel is specified as an ISATAP tunnel. Step 4 Run:

The tunnel interface is configured with an IPv6 address. Step 6 Run:

undo ipv6 nd ra halt
The device is allowed to advertise routes. ----End
11.3.7 Configuring Routes in the Tunnel

Packets can be normally forwarded only when routes exist on both the source device and destination device of the tunnel.
Context
Configuring routes in the tunnel comprises configuring static routes and dynamic routes.
To configure the static route, you need to configure the route from the IP address of the local loopback interface (the source address) to the destination address (IP address of the peer loopback interface). You can enable dynamic routing protocol on the tunnel interface connected to the private networks and on the device interface.

You can view the configuration of an IPv6 over IPv4 tunnel.
Prerequisite
The configurations of the IPv6 over IPv4 Tunnel function are complete.
Procedure
Step 1 Run the display device slot-id command to check whether the service mode of the SPUC is Tunnel. Step 2 Run the display ipv6 interface tunnel interface-number command to check the IPv6 attributes of a tunnel interface. ----End
Example
If the service mode of the SPUC is Tunnel, run the display device 3 command, and you can view that the type of the SPUC on the CX device is displayed as General.
<HUAWEI> display device 3 SPU3's detail information: - - - - - - - - - - - - - - - - - - - - Description: Board status: Register: Uptime: CPU Utilization(%): Mem Usage(%): Clock information: State item Current syn-clock: Current line-clock: Syn-clock state: Syn-clock 17 state: Syn-clock 18 state: Line-clock 23 state: Line-clock 24 state: Statistic information: Statistic item SERDES interface link lost: Mpu switchs: Syn-clock switchs: - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - Line Processing Unit - General Normal Registered 2009/02/26 18:33:23 3% 19% State 17 23 Locked Actived Inactived Inactived Inactived
VCXO_OK
REF_OK
Statistic number 0 0 0 - - - - - - - - - - - - - - - - -
Run the display ipv6 interface tunnel command. If the IPv6 packets forwarding is enabled, you can see the state of tunnel interface is Up, the state of IPv6 protocol is Up, source address and ND parameters.
<HUAWEI> display ipv6 interface tunnel 3/0/0 Tunnel3/0/0 current state : UP , IPv6 protocol current state : UP
Issue 01 (2011-05-30)
11-19
IPv6 is enabled, link-local address is FE80::201:102 Global unicast address(es): ::2.1.1.2, subnet is ::/96 Joined group address(es): FF02::1:FF01:102 FF02::2 FF02::1 MTU is 1500 bytes ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
11.4 Configuring 6PE

By performing this configuration task, you can interconnect IPv6 networks through the existing MPLS network. 11.4.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring 6PE. 11.4.2 Configuring IPv4/IPv6 Dual Protocol Stacks You need to enable the IPv4/IPv6 dual stack on the border device of the IPv4 and IPv6 networks. 11.4.3 Configuring MPLS This section describes how to configure the basic functions of MPLS including LSP setup and LDP enabling. 11.4.4 Enabling 6PE Peer By configuring a particular 6PE peer, you can configure a particular 6PE peer to exchange routing information with the peer configured in the IPv6 view.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring 6PE.
To interconnect IPv6 networks over the existing MPLS network, 6PE must be configured on the PE devices.
Before configuring 6PE, complete the following tasks: l l l l Configuring the physical features of interfaces and ensuring that the status of the physical layer of the interface is Up Configuring the link layer protocols on interface and ensuring that the status of the link layer protocol on the interface is Up Configuring routes from 6PE to CE Configuring routes to the backbone network
Data Preparation
To configure 6PE, you need the following data.
No. 1 2 3 4 5
Data Interface number and IPv6 address of the 6PE's interface connected with CE devices Interface number and IPv4 address of the 6PE's interface Interface number and IPv4 address of the loopback interface to be created LSP triggering policy IPv4 address of the peer of the 6PE
11.4.2 Configuring IPv4/IPv6 Dual Protocol Stacks

You need to enable the IPv4/IPv6 dual stack on the border device of the IPv4 and IPv6 networks.
Procedure
Step 1 Run:
system-view

ipv6
The IPv6 packet forwarding is enabled. Step 3 Run:


The interface is configured with an IPv4 address. Step 5 Run:

quit


ipv6 enable

ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } eui-64
Or
The interface is configured with an IPv6 address. Step 9 Run:

quit
Return to the system view. ----End
11.4.3 Configuring MPLS

This section describes how to configure the basic functions of MPLS including LSP setup and LDP enabling.
Procedure
Step 1 Run:
system-view

mpls lsr-id ip-address
The LSR ID is specified. Step 3 Run:

mpls
MPLS is enabled and the MPLS view is displayed. Step 4 Run:

quit

mpls ldp
MPLS LDP is enabled. Step 6 Run:

quit
Exit the system view. Step 7 Run:


mpls
MPLS is enabled on the interface. Step 9 Run:

mpls ldp
11-22
Issue 01 (2011-05-30)
MPLS LDP is enabled on the interface. ----End
11.4.4 Enabling 6PE Peer

By configuring a particular 6PE peer, you can configure a particular 6PE peer to exchange routing information with the peer configured in the IPv6 view.
Procedure
Step 1 Run:
system-view

bgp as-number
The BGP view is displayed. Step 3 Run:

peer ipv4-address as-number as-number
The IP address and the AS number of a specified BGP peer are specified. Step 4 Run:
peer ipv4-address connect-interface interface-type interface-number
PE peer is specified to connect with a specified interface. Step 5 Run:

ipv6-family
The BGP-IPv6 unicast address family view is displayed. Step 6 Run:

peer peer-ipv4-address enable
6PE peer is enabled. Step 7 Run:

peer peer-ipv4-address label-route-capability
Label routing capacity is enabled for 6PE. ----End
11.5 Maintaining IPv6 over IPv4 Tunnels

This section describes how to maintain an IPv6 over IPv4 tunnel, including how to monitor an IPv6 over IPv4 tunnel. 11.5.1 Monitoring the Running Status of IPv6 over IPv4 Tunnel This section describes how to monitor an IPv6 over IPv4 tunnel.
11.5.1 Monitoring the Running Status of IPv6 over IPv4 Tunnel

This section describes how to monitor an IPv6 over IPv4 tunnel.
Context
In routine maintenance, you can run the following command in any view to check the operation of IPv6 over IPv4 tunnel.
Procedure
Step 1 Run the display ipv6 interface tunnel { interface-number } command in any view to check the operation status of the tunnel interface. ----End

This section includes the networking requirements, configuration notes, and configuration roadmap.
Context
NOTE
11.6.1 Example for Configuring an IPv6 over IPv4 Manual Tunnel This section provides an example for configuring a manual IPv6 over IPv4 tunnel. 11.6.2 Example for Configuring an IPv6 over IPv4 GRE Tunnel 11.6.3 Example for Configuring an IPv6 over IPv4 Automatic Tunnel 11.6.4 Example for Configuring a 6to4 Tunnel This section provides an example for configuring a 6to4 tunnel. 11.6.5 Example for Configuring 6to4 Relay This section provides an example for configuring 6to4 relay. 11.6.6 Example for Configuring an ISATAP Tunnel This section provides an example for configuring an ISATAP tunnel. 11.6.7 Example for Configuring 6PE This section provides an example of configuring the 6PE.
11.6.1 Example for Configuring an IPv6 over IPv4 Manual Tunnel

This section provides an example for configuring a manual IPv6 over IPv4 tunnel.
As shown in Figure 11-6, two IPv6 networks are connected to CX-B in the IPv4 backbone network respectively through CX-A and CX-C. To enable communication between two IPv6 networks, configure an IPv6 over IPv4 manual tunnel between CX-A and CX-C.

NOTE
It is recommended that in an actual networking environment, the source address of the tunnel is specified as the IP address of the loopback interface of the local device or the source interface of the tunnel is specified as the loopback interface on the local device. It is also recommended that in an actual networking environment, the destination address of the tunnel is specified as the IP address of the loopback interface of the peer device.
Figure 11-6 Networking diagram of the IPv6 over IPv4 manual tunnel
IPv4 network CX-B GE1/0/0 192.168.50.1/24 GE1/0/0 192.168.50.2/24 CX-A Dual Stack IPv6 GE2/0/0 192.168.51.1/24 GE1/0/0 192.168.51.2/24 CX-C Dual Stack IPv6
The configuration roadmap of IPv6 over IPv4 manual tunnel is as follows: 1. 2. 3. Configure IP addresses for physical interfaces. Configure IPv6 addresses, the source interface, and the destination addresses for the tunnel interfaces. Set the tunnel protocol as IPv6-IPv4.
Data Preparation
To complete the configuration, you need the following data: l l IP addresses of interfaces IPv6 addresses, the source interfaces and the destination addresses of the tunnel interfaces
Procedure
Step 1 Configure CX-A. # Configure an IP address for the interface.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6 [CX-A] interface gigabitethernet 1/0/0 [CX-A-GigabitEthernet1/0/0] ip address 192.168.50.2 255.255.255.0 [CX-A-GigabitEthernet1/0/0] undo shutdown [CX-A-GigabitEthernet1/0/0] quit
# Set the tunnel protocol as IPv6-IPv4.


[CX-A] interface tunnel 1/0/0 [CX-A-Tunnel1/0/0] tunnel-protocol ipv6-ipv4
# Configure the IPv6 address, source interface, and destination address for the tunnel interface.
[CX-A-Tunnel1/0/0] [CX-A-Tunnel1/0/0] [CX-A-Tunnel1/0/0] [CX-A-Tunnel1/0/0] [CX-A-Tunnel1/0/0] ipv6 enable ipv6 address 3001::1/64 source 192.168.50.2 destination 192.168.51.2 quit
# Configure static routes.

[CX-A] ip route-static 192.168.51.2 255.255.255.0 192.168.50.1
Step 2 Configure CX-B. # Configure an IP address for the interface.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] interface gigabitethernet 1/0/0 [CX-B-GigabitEthernet1/0/0] ip address 192.168.50.1 255.255.255.0 [CX-B-GigabitEthernet1/0/0] undo shutdown [CX-B-GigabitEthernet1/0/0] quit [CX-B] interface gigabitethernet 2/0/0 [CX-B-GigabitEthernet2/0/0] ip address 192.168.51.1 255.255.255.0 [CX-B-GigabitEthernet2/0/0] undo shutdown [CX-B-GigabitEthernet2/0/0] quit
Step 3 Configure CX-C. # Configure an IP address for the interface.

<HUAWEI> system-view [HUAWEI] sysname CX-C [CX-C] ipv6 [CX-C] interface gigabitethernet 1/0/0 [CX-C-GigabitEthernet1/0/0] ip address 192.168.51.2 255.255.255.0 [CX-C-GigabitEthernet1/0/0] undo shutdown [CX-C-GigabitEthernet1/0/0] quit
# Set the tunnel protocol as IPv6-IPv4.

[CX-C] interface tunnel 1/0/0 [CX-C-Tunnel1/0/0] tunnel-protocol ipv6-ipv4
# Configure the IPv6 address, source interface, and destination address for the tunnel interface.
[CX-C-Tunnel1/0/0] [CX-C-Tunnel1/0/0] [CX-C-Tunnel1/0/0] [CX-C-Tunnel1/0/0] [CX-C-Tunnel1/0/0] ipv6 enable ipv6 address 3001::2/64 source 192.168.51.2 destination 192.168.50.2 quit

[CX-C] ip route-static 192.168.50.2 255.255.255.0 192.168.51.1
Step 4 Verify the configuration. # On CX-C, ping the IPv4 address of the interface GE 1/0/0 of CX-A. CX-C can receive response packets from CX-A.
[CX-C] ping 192.168.50.2 PING 192.168.50.2: 56 data bytes, press CTRL_C to break Reply from 192.168.50.2: bytes=56 Sequence=1 ttl=255 time=84 ms Reply from 192.168.50.2: bytes=56 Sequence=2 ttl=255 time=27 ms Reply from 192.168.50.2: bytes=56 Sequence=3 ttl=255 time=25 ms
11-26
Issue 01 (2011-05-30)
Reply from 192.168.50.2: bytes=56 Sequence=4 ttl=255 time=3 ms Reply from 192.168.50.2: bytes=56 Sequence=5 ttl=255 time=24 ms --- 192.168.50.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 3/32/84 ms
# On CX-C, ping the IPv6 address of Tunnel 1/0/0 of CX-A. CX-C can receive response packets from CX-A.
[CX-C] ping ipv6 3001::1 PING 3001::1 : 56 data bytes, press Reply from 3001::1 bytes=56 Sequence=1 hop limit=255 Reply from 3001::1 bytes=56 Sequence=2 hop limit=255 Reply from 3001::1 bytes=56 Sequence=3 hop limit=255 Reply from 3001::1 bytes=56 Sequence=4 hop limit=255 Reply from 3001::1 bytes=56 Sequence=5 hop limit=255 --- 3001::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 26/26/28 ms CTRL_C to break time = 28 ms time = 27 ms time = 26 ms time = 27 ms time = 26 ms
----End
Configuration File
# sysname CX-A # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ip address 192.168.50.2 255.255.255.0 # interface Tunnel1/0/0 ipv6 enable ipv6 address 3001::1/64 tunnel-protocol ipv6-ipv4 source 192.168.50.2 destination 192.168.51.2 # ip route-static 192.168.51.0 255.255.255.0 192.168.50.1 # return

# sysname CX-B # interface GigabitEthernet1/0/0 undo shutdown ip address 192.168.50.1 255.255.255.0 # interface GigabitEthernet2/0/0 undo shutdown ip address 192.168.51.1 255.255.255.0 # return
Issue 01 (2011-05-30)
11-27

# sysname CX-C # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ip address 192.168.51.2 255.255.255.0 # interface Tunnel1/0/0 ipv6 enable ipv6 address 3001::2/64 tunnel-protocol ipv6-ipv4 source 192.168.51.2 destination 192.168.50.2 # ip route-static 192.168.50.0 255.255.255.0 192.168.51.1 # return
11.6.2 Example for Configuring an IPv6 over IPv4 GRE Tunnel

NOTE
An IPV6 over IPv4 GRE Tunnel cannot be configured on the X1 and X2 models of the CX600.
As shown in Figure 11-7, two IPv6 networks are connected to CX-B in the IPv4 network through CX-A and CX-C, respectively. To allow the two IPv6 networks to communicate with each other, configure an IPv6 over IPv4 GRE tunnel between CX-A and CX-C.
NOTE
When configuring an IPv6 over IPv4 GRE tunnel, you must set the service mode of the SPUC to Tunnel and bind the SPUC to the tunnel.
Figure 11-7 Networking diagram of the IPv6 over IPv4 GRE tunnel
IPv4 network
GE1/0/0 192.168.50.1/24 GE1/0/0 192.168.50.2/24 Dual Stack GE2/0/0 192.168.51.1/24 GE1/0/0 192.168.51.2/24 Dual Stack
CX-B
IPv6
CX-A
CX-C
IPv6
Loopback1 1.1.1.1/32
Loopback1 2.2.2.2/32
11-28
Issue 01 (2011-05-30)
The configuration roadmap is as follows: 1. 2. 3. Configure IP addresses for interfaces. Configure IPv6 addresses, the source interface, and the destination address of the tunnel interfaces. Set the tunnel protocol as GRE.
Data Preparation
To complete the configuration, you need the following data: l l IP addresses of interfaces IPv6 addresses and the source interface, and the destination address
Procedure
Step 1 Configure CX-A. # Configure an IP address for the interface.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6 [CX-A] interface pos 1/0/0 [CX-A-Pos1/0/0] ip address 192.168.50.2 255.255.255.0 [CX-A-Pos1/0/0] undo shutdown [CX-A-Pos1/0/0] quit
# Create a loopback interface and assign an IPv4 address to it.

[CX-A] interface Loopback 1 [CX-A-LoopBack1] ip address 1.1.1.1 32 [CX-A-LoopBack1] quit
# Configure a static route from CX-A to CX-C.

[CX-A] ip route-static 192.168.51.2 255.255.255.0 192.168.50.1 [CX-A] ip route-static 2.2.2.2 255.255.255.255 192.168.50.1 [CX-A] quit
# Set the service mode of the SPUC to Tunnel and the tunnel protocol mode to GRE.
<CX-A> set board-type slot 6 tunnel [CX-A] system-view [CX-A] interface tunnel 6/0/0 [CX-A-Tunnel6/0/0] tunnel-protocol gre
# Configure the IPv6 address, source interface, and destination address for the tunnel interface. Bind the tunnel to the SPUC.
[CX-A] interface Loopback 1 [CX-A-LoopBack1] target-board 6 [CX-A-LoopBack1] binding tunnel gre [CX-A-LoopBack1] quit [CX-A] interface Tunnel 6/0/0 [CX-A-Tunnel6/0/0] ipv6 enable [CX-A-Tunnel6/0/0] ipv6 address 3001::1 64 [CX-A-Tunnel6/0/0] source loopback 1 [CX-A-Tunnel6/0/0] destination 2.2.2.2 [CX-A-Tunnel6/0/0] quit
Issue 01 (2011-05-30)
11-29

NOTE
The device supports tunnel binding only on the loopback interface.
Step 2 Configure CX-B. # Configure an IP address for the interface.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] interface pos 1/0/0 [CX-B-Pos1/0/0] ip address 192.168.50.1 255.255.255.0 [CX-B-Pos1/0/0] undo shutdown [CX-B-Pos1/0/0] quit [CX-B] interface pos 2/0/0 [CX-B-Pos2/0/0] ip address 192.168.51.1 255.255.255.0 [CX-B-Pos2/0/0] undo shutdown [CX-B-Pos2/0/0] quit
Step 3 Configure CX-C. # Configure an IP address for the interface.

<HUAWEI> system-view [HUAWEI] sysname CX-C [CX-C] ipv6 [CX-C] interface pos 1/0/0 [CX-C-Pos1/0/0] ip address 192.168.51.2 255.255.255.0 [CX-C-Pos1/0/0] undo shutdown [CX-C-Pos1/0/0] quit

[CX-C] interface Loopback 1 [CX-C-LoopBack1] ip address 2.2.2.2 32 [CX-C-LoopBack1] quit
# Configure a static route from CX-C to CX-A.

[CX-C] ip route-static 192.168.50.2 255.255.255.0 192.168.51.1 [CX-C] ip route-static 1.1.1.1 255.255.255.255 192.168.51.1 [CX-C] quit
On CX-C, ping the IPv4 address of POS 1/0/0 on CX-A. CX-C receives the response packets from CX-A.
[CX-C] ping 192.168.50.2 PING 192.168.50.2: 56 data bytes, press CTRL_C to break Reply from 192.168.50.2: bytes=56 Sequence=1 ttl=255 time=1 Reply from 192.168.50.2: bytes=56 Sequence=2 ttl=255 time=1 Reply from 192.168.50.2: bytes=56 Sequence=3 ttl=255 time=1 Reply from 192.168.50.2: bytes=56 Sequence=4 ttl=255 time=1 Reply from 192.168.50.2: bytes=56 Sequence=5 ttl=255 time=1 --- 192.168.50.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/1/1 ms [CX-C] ping 1.1.1.1 PING 1.1.1.1.2: 56 data bytes, press CTRL_C to break Reply from 1.1.1.1: bytes=56 Sequence=1 ttl=255 time=1 Reply from 1.1.1.1: bytes=56 Sequence=2 ttl=255 time=1 Reply from 1.1.1.1: bytes=56 Sequence=3 ttl=255 time=1 Reply from 1.1.1.1: bytes=56 Sequence=4 ttl=255 time=1 Reply from 1.1.1.1: bytes=56 Sequence=5 ttl=255 time=1 --- 1.1.1.1 ping statistics --5 packet(s) transmitted 5 packet(s) received
ms ms ms ms ms
ms ms ms ms ms
11-30
Issue 01 (2011-05-30)

0.00% packet loss round-trip min/avg/max = 1/1/1 ms
This indicates that a reachable route exists between CX-A and CX-C. # Set the service mode of the SPUC to Tunnel and the tunnel protocol mode to GRE.
<CX-C> set board-type slot 6 tunnel [CX-C] system-view [CX-C] interface tunnel 6/0/0 [CX-C-Tunnel6/0/0] tunnel-protocol gre
# Configure the IPv6 address, source interface, and destination IP address of the tunnel interface. Bind the tunnel to the SPUC.
[CX-C] interface Loopback 1 [CX-C-LoopBack1] target-board 6 [CX-C-LoopBack1] binding tunnel gre [CX-C-LoopBack1] quit [CX-C] interface Tunnel 6/0/0 [CX-C-Tunnel6/0/0] ipv6 enable [CX-C-Tunnel6/0/0] ipv6 address 3001::2 64 [CX-C-Tunnel6/0/0] source loopback 1 [CX-C-Tunnel6/0/0] destination 1.1.1.1 [CX-C-Tunnel6/0/0] quit
NOTE
Step 4 Verify the configuration # On CX-C, ping the IPv6 address of Tunnel 1/0/0 on CX-A. CX-C receives the response packets from CX-A.
[CX-C] ping ipv6 3001::1 PING 3001::1 : 56 data bytes, press Reply from 3001::1 bytes=56 Sequence=1 hop limit=255 Reply from 3001::1 bytes=56 Sequence=2 hop limit=255 Reply from 3001::1 bytes=56 Sequence=3 hop limit=255 Reply from 3001::1 bytes=56 Sequence=4 hop limit=255 Reply from 3001::1 bytes=56 Sequence=5 hop limit=255 --- 3001::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 26/26/28 ms CTRL_C to break time = 28 ms time = 27 ms time = 26 ms time = 27 ms time = 26 ms
----End
Configuration Files
# sysname CX-A # ipv6 # interface pos1/0/0 link-protocol ppp ip address 192.168.50.2 255.255.255.0 # interface LoopBack1
Issue 01 (2011-05-30)
11-31
ip address 1.1.1.1 255.255.255.255 target-board 6 binding tunnel gre # interface Tunnel6/0/0 ipv6 enable ipv6 address 3001::1/64 tunnel-protocol gre source loopback 1 destination 2.2.2.2 # ip route-static 192.168.51.2 255.255.255.0 192.168.50.1 ip route-static 2.2.2.2 255.255.255.255 192.168.50.1 # return

# sysname CX-B # interface Pos1/0/0 link-protocol ppp ip address 192.168.50.1 255.255.255.0 # interface Pos2/0/0 link-protocol ppp ip address 192.168.51.1 255.255.255.0 # return

# sysname CX-C # ipv6 # interface pos1/0/0 link-protocol ppp ip address 192.168.51.2 255.255.255.0 # interface LoopBack1 ip address 2.2.2.2 255.255.255.255 target-board 6 binding tunnel gre # interface Tunnel6/0/0 ipv6 enable ipv6 address 3001::2/64 tunnel-protocol gre source loopback 1 destination 1.1.1.1 # ip route-static 192.168.50.0 255.255.255.0 192.168.51.1 ip route-static 1.1.1.1 255.255.255.255 192.168.51.1 # return
11.6.3 Example for Configuring an IPv6 over IPv4 Automatic Tunnel

As shown in Figure 11-8, two IPv6 networks are connected with the IPv4 backbone network through CX-A and CX-B, respectively. To enable communications between the two IPv6 networks, configure an IPv6 over IPv4 automatic tunnel between CX-A and CX-B.
The interfaces connecting CX-A and CX-B to the IPv4 backbone network should be configured with public IPv4 addresses.
NOTE
One of the following choices is recommended for real world networking environments. The source address of the tunnel should be specified as the IP address of the loopback interface of the local device or the source interface of the tunnel should be specified as the loopback interface on the local device. It is also recommended that the destination address of the tunnel be specified as the IP address of the loopback interface of the peer device in a real world networking environment.
Figure 11-8 Networking diagram of the IPv6 over IPv4 automatic tunnel
loopback1 3.3.3.3/32 Dual Stack loopback1 4.4.4.4/32 Dual Stack
IPv4
CX-A
IPv6
POS1/0/0 POS1/0/0 2.1.1.2/8 2.1.1.1/8 Tunnel 1/0/0 Tunnel 1/0/0 ::2.1.1.1/96 ::2.1.1.2/96
CX-B
IPv6
The configuration roadmap is as follows: 1. 2. 3. Configure IP addresses for interfaces. Configure the IPv6 addresses and source interface of the tunnel interface. Set the tunnel protocol as automatic tunnel protocol.
Data Preparation
To complete the configuration, you need the following data: l l IP addresses of interfaces IPv6 address and source interface of the tunnel interface
To configure an automatic tunnel, the source interface of the tunnel rather than the destination interface must be specified.
Procedure
Step 1 Configure CX-A. # Configure the IPv4/IPv6 dual protocol stacks.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6 [CX-A] interface pos 1/0/0 [CX-A-pos1/0/0] ip address 2.1.1.1 255.0.0.0 [CX-A-pos1/0/0] quit


[CX-A] interface loopback 1 [CX-A-LoopBack1] ip address 3.3.3.3 32 [CX-A-LoopBack1] quit
# Configure a static route from CX-A to CX-B.

[CX-A] ip route-static 2.1.1.2 255.0.0.0 2.1.1.2 [CX-A] ip route-static 4.4.4.4 255.255.255.255 2.1.1.2
# Configure an automatic tunnel.

[CX-A] interface tunnel 1/0/0 [CX-A-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 auto-tunnel [CX-A-Tunnel1/0/0] ipv6 enable [CX-A-Tunnel1/0/0] ipv6 address ::3.3.3.3/96 [CX-A-Tunnel1/0/0] source loopback 1 [CX-A-Tunnel1/0/0] quit
Step 2 Configure CX-B. # Configure the IPv4/IPv6 dual protocol stacks.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] ipv6 [CX-B] interface pos 1/0/0 [CX-B-pos1/0/0] ip address 2.1.1.2 255.0.0.0 [CX-B-Pos1/0/0] quit

[CX-B] interface loopback 1 [CX-B-LoopBack1] ip address 4.4.4.4 32 [CX-B-LoopBack1] quit
# Configure a static route from CX-B to CX-A.

[CX-B] ip route-static 2.1.1.1 255.0.0.0 2.1.1.1 [CX-B] ip route-static 3.3.3.3 255.255.255.255 2.1.1.1
# Configure an automatic tunnel.

[CX-B] interface tunnel 1/0/0 [CX-B-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 auto-tunnel [CX-B-Tunnel1/0/0] ipv6 enable [CX-B-Tunnel1/0/0] ipv6 address ::4.4.4.4/96 [CX-B-Tunnel1/0/0] source loopback 1 [CX-B-Tunnel1/0/0] quit
Step 3 Verify the configuration. # On CX-A, view the status of Tunnel 1/0/0 and find it is Up.
[CX-A] display ipv6 interface tunnel 1/0/0 Tunnel1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::201:101 Global unicast address(es): ::3.3.3.3, subnet is ::/96 Joined group address(es): FF02::1:FF01:101 FF02::2 FF02::1 MTU is 1500 bytes ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# On CX-A, ping the IPv4-compatible IPv6 address of tunnel peer.

[CX-A] ping ipv6 ::4.4.4.4 PING ::4.4.4.4 : 56 data bytes, press CTRL_C to break Reply from ::4.4.4.4 bytes=56 Sequence=1 hop limit=64 time = 30 ms Reply from ::4.4.4.4 bytes=56 Sequence=2 hop limit=64 time = 40 ms Reply from ::4.4.4.4 bytes=56 Sequence=3 hop limit=64 time = 50 ms Reply from ::4.4.4.4 bytes=56 Sequence=4 hop limit=64 time = 1 ms Reply from ::4.4.4.4 bytes=56 Sequence=5 hop limit=64 time = 50 ms --- ::4.4.4.4 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/34/50 ms
----End
Configuration File
# sysname CX-A # ipv6 # interface pos1/0/0 link-protocol ppp ip address 2.1.1.1 255.0.0.0 # interface LoopBack1 ip address 3.3.3.3 255.255.255.255 # interface Tunnel 1/0/0 ipv6 enable ipv6 address ::3.3.3.3/96 tunnel-protocol ipv6-ipv4 auto-tunnel source loopback 1 # ip route-static 2.1.1.2 255.0.0.0 2.1.1.2 ip route-static 4.4.4.4 255.255.255.255 2.1.1.2 # return

# sysname CX-B # ipv6 # interface pos1/0/0 link-protocol ppp ip address 2.1.1.2 255.0.0.0 # interface LoopBack1 ip address 4.4.4.4 255.255.255.255 # interface Tunnel 1/0/0 ipv6 enable ipv6 address ::4.4.4.4/96 tunnel-protocol ipv6-ipv4 auto-tunnel source loopback 1 # ip route-static 2.1.1.1 255.0.0.0 2.1.1.1 ip route-static 3.3.3.3 255.255.255.255 2.1.1.1
Issue 01 (2011-05-30)
11-35

# return
11.6.4 Example for Configuring a 6to4 Tunnel

This section provides an example for configuring a 6to4 tunnel.
As shown in Figure 11-9, two IPv6 networks are both 6to4 networks. CX-A and CX-B are connected with the 6to4 network and the IPv4 network. To enable communication between the hosts in the two 6to4 network, it is required to set up a 6to4 tunnel between CX-A and CX-B. To enable communication between 6to4 networks, configure 6to4 addresses for the hosts in the 6to4 network. A 6to4 address has a 48-bit prefix composed of 2002:IPv4 address:. As shown in Figure 11-9, the IPv4 address of the interface through which A is connected to the IPv4 network is 2.1.1.1. Therefore, the 6to4 address of A in the 6to4 network should start with 2002:0201:0101::.
NOTE
Figure 11-9 Networking diagram of the 6to4 tunnel
POS1/0/0 2.1.1.2 CX-B GE2/0/0 6to4 6to4 GE2/0/0 2002:201:101:1::1/64 CX600 CX600 2002:201:102:1::1/64 Tunnel 1/0/0 Tunnel 1/0/0 2002:201:101::1/64 2002:201:102::1/64 PC1 2002:201:101:1::2 2002:201:102:1::2 IPv6 PC2 IPv6
POS1/0/0 CX-A 2.1.1.1
IPv4
The configuration roadmap is as follows: 1. 2. 3. Configure IPv4/IPv6 dual-protocol stacks. Configure the tunnel protocol as 6to4. Configure related routes.
Data Preparation
To complete the configuration, you need the following data:
l l
IPv4 or IPv6 addresses of interfaces Source tunnel interface
Procedure
Step 1 Configure CX-A. # Configure IPv4/IPv6 dual protocol stacks.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6 [CX-A] interface pos 1/0/0 [CX-A-pos1/0/0] ip address 2.1.1.1 8 [CX-A-pos1/0/0] undo shutdown [CX-A-pos1/0/0] quit [CX-A] interface gigabitethernet 2/0/0 [CX-A-GigabitEthernet2/0/0] ipv6 enable [CX-A-GigabitEthernet2/0/0] ipv6 address 2002:0201:0101:1::1/64 [CX-A-GigabitEthernet2/0/0] undo shutdown [CX-A-GigabitEthernet2/0/0] quit
# Configure a 6to4 tunnel.

[CX-A] interface tunnel 1/0/0 [CX-A-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 6to4 [CX-A-Tunnel1/0/0] ipv6 enable [CX-A-Tunnel1/0/0] ipv6 address 2002:0201:0101::1/64 [CX-A-Tunnel1/0/0] source 2.1.1.1 [CX-A-Tunnel1/0/0] quit
# Configure a route to other 6to4 networks.

[CX-A] ipv6 route-static 2002:: 16 tunnel 1/0/0
Step 2 Configure CX-B. # Configure IPv4/IPv6 dual protocol stacks.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] ipv6 [CX-B] interface pos 1/0/0 [CX-B-pos1/0/0] ip address 2.1.1.2 8 [CX-B-pos1/0/0] undo shutdown [CX-B-pos1/0/0] quit [CX-B] interface gigabitethernet 2/0/0 [CX-B-GigabitEthernet2/0/0] ipv6 enable [CX-B-GigabitEthernet2/0/0] ipv6 address 2002:0201:0102:1::1/64 [CX-B-GigabitEthernet2/0/0] undo shutdown [CX-B-GigabitEthernet2/0/0] quit

[CX-B] interface tunnel 1/0/0 [CX-B-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 6to4 [CX-B-Tunnel1/0/0] ipv6 enable [CX-B-Tunnel1/0/0] ipv6 address 2002:0201:0102::1/64 [CX-B-Tunnel1/0/0] source 2.1.1.2 [CX-B-Tunnel1/0/0] quit
# Configure a route to other 6to4 networks.

[CX-B] ipv6 route-static 2002:: 16 tunnel 1/0/0
Issue 01 (2011-05-30)
11-37

NOTE
There must be an accessible route between CX-A and CX-B. In this example, both the devices are directly connected; therefore, no routing protocol needs to be configured.
Step 3 Verify the configuration. # Check the IPv6 state of Tunnel 1/0/0 on CX-A and find it is UP.
[CX-A] display ipv6 interface tunnel 1/0/0 Tunnel1/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::201:101 Global unicast address(es): 2002:201:101::1, subnet is 2002:201:101::/64 Joined group address(es): FF02::1:FF01:101 FF02::1:FF00:1 FF02::2 FF02::1 MTU is 1500 bytes ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds Hosts use stateless autoconfig for addresses
# CX-A can ping through the 6to4 address of GE 2/0/0 of CX-B.

[CX-A] ping ipv6 2002:0201:0102:1::1 PING 2002:0201:0102:1::1 : 56 data bytes, press CTRL_C to break Reply from 2002:201:102:1::1 bytes=56 Sequence=1 hop limit=255 time = 8 ms Reply from 2002:201:102:1::1 bytes=56 Sequence=2 hop limit=255 time = 25 ms Reply from 2002:201:102:1::1 bytes=56 Sequence=3 hop limit=255 time = 4 ms Reply from 2002:201:102:1::1 bytes=56 Sequence=4 hop limit=255 time = 5 ms Reply from 2002:201:102:1::1 bytes=56 Sequence=5 hop limit=255 time = 5 ms --- 2002:0201:0102:1::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 4/9/25 ms
----End
Configuration Files
# sysname CX-A # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ip address 2.1.1.1 255.0.0.0 # interface GigabitEthernet 2/0/0 undo shutdown ipv6 enable ipv6 address 2002:201:101:1::1/64 # interface Tunnel 1/0/0 ipv6 enable ipv6 address 2002:201:101::1/64
11-38
Issue 01 (2011-05-30)

tunnel-protocol ipv6-ipv4 6to4 source 2.1.1.1 # ipv6 route-static 2002:: 16 Tunnel 1/0/0 # return

# sysname CX-B # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ip address 2.1.1.2 255.0.0.0 # interface GigabitEthernet2/0/0 undo shutdown ipv6 enable ipv6 address 2002:201:102:1::1/64 # interface Tunnel 1/0/0 ipv6 enable ipv6 address 2002:201:102::1/64 tunnel-protocol ipv6-ipv4 6to4 source 2.1.1.2 # ipv6 route-static 2002:: 16 Tunnel 1/0/0 # return
11.6.5 Example for Configuring 6to4 Relay

This section provides an example for configuring 6to4 relay.
As shown in Figure 11-10, CX-A is a 6to4 device and is connected with an IPv6 network. As a 6to4 relay device, CX-B is connected with the IPv6 Internet (2001::/64). To enable communication between the host in the 6to4 network and the host in the IPv6 Internet, configure a 6to4 tunnel between CX-A and CX-B. The configuration of the tunnel between a 6to4 relay device and a common 6to4 device is similar to that between common 6to4 devices. A static route to the IPv6 Internet shall be configured on the common 6to4 device so that the 6to4 network and the IPv6 network can communicate with each other.
NOTE
Issue 01 (2011-05-30)
11-39
Figure 11-10 Networking diagram of accessing the IPv6 network through 6to4 relay
IPv4 POS1/0/0 POS1/0/0 2.1.1.1 2.1.1.2 CX-A CX-B 6to4 6to4 GE2/0/0 GE2/0/0 CX600 Relay 2002:201:101:1::1/64 2001::1/64 Tunnel 1/0/0 Tunnel 1/0/0 2002:201:101::1/64 2002:201:102::1/64 PC1 PC2 2001::2 2002:201:101:1::2 6to4 IPv6
The configuration roadmap is as follows: 1. 2. 3. Configure IPv4/IPv6 dual protocol stacks. Configure a 6to4 tunnel. Configure related static routes.
Data Preparation
To complete the configuration, you need the following data: l l l IPv4 or IPv6 addresses of interfaces Source tunnel interface Static routes to the devices that are not directly connected
Procedure
Step 1 Configure CX-A. # Configure IPv4/IPv6 dual protocol stacks.
<HUAWEI> system-view [HUAWEI] sysname CX-A [CX-A] ipv6 [CX-A] interface pos 1/0/0 [CX-A-Pos1/0/0] ip address 2.1.1.1 255.0.0.0 [CX-A-Pos1/0/0] undo shutdown [CX-A-Pos1/0/0] quit [CX-A] interface gigabitethernet 2/0/0 [CX-A-GigabitEthernet2/0/0] ipv6 enable [CX-A-GigabitEthernet2/0/0] ipv6 address 2002:0201:0101:1::1/64 [CX-A-GigabitEthernet2/0/0] undo shutdown [CX-A-GigabitEthernet2/0/0] quit

[CX-A] interface tunnel 1/0/0
11-40
Issue 01 (2011-05-30)

[CX-A-Tunnel1/0/0] [CX-A-Tunnel1/0/0] [CX-A-Tunnel1/0/0] [CX-A-Tunnel1/0/0] [CX-A-Tunnel1/0/0]

tunnel-protocol ipv6-ipv4 6to4 ipv6 enable ipv6 address 2002:0201:0101::1/64 source 2.1.1.1 quit
# Configure a static route to 2002::/16.

[CX-A] ipv6 route-static 2002:: 16 tunnel 1/0/0
# Configure a default route to the IPv6 network.

[CX-A] ipv6 route-static :: 0 2002:0201:0102::1
Step 2 Configure CX-B. # Configure IPv4/IPv6 dual protocol stacks.

<HUAWEI> system-view [HUAWEI] sysname CX-B [CX-B] ipv6 [CX-B] interface pos 1/0/0 [CX-B-Pos1/0/0] ip address 2.1.1.2 255.0.0.0 [CX-B-Pos1/0/0] undo shutdown [CX-B-Pos1/0/0] quit [CX-B] interface gigabitethernet 2/0/0 [CX-B-GigabitEthernet2/0/0] ipv6 enable [CX-B-GigabitEthernet2/0/0] ipv6 address 2001::1/64 [CX-B-GigabitEthernet2/0/0] undo shutdown [CX-B-GigabitEthernet2/0/0] quit

[CX-B] interface tunnel 1/0/0 [CX-B-Tunnel1/0/0] tunnel-protocol ipv6-ipv4 6to4 [CX-B-Tunnel1/0/0] ipv6 enable [CX-B-Tunnel1/0/0] ipv6 address 2002:0201:0102::1/64 [CX-B-Tunnel1/0/0] source 2.1.1.2 [CX-B-Tunnel1/0/0] quit
# Configure a static route to 2002::/16.

[CX-B] ipv6 route-static 2002:: 16 tunnel1/0/0
Step 3 Verify the configuration. # CX-A can ping through the IPv6 address of GE 2/0/0 on CX-B.
[CX-A] ping ipv6 2001::1 PING 2001::1 : 56 data bytes, press Reply from 2001::1 bytes=56 Sequence=1 hop limit=255 Reply from 2001::1 bytes=56 Sequence=2 hop limit=255 Reply from 2001::1 bytes=56 Sequence=3 hop limit=255 Reply from 2001::1 bytes=56 Sequence=4 hop limit=255 Reply from 2001::1 bytes=56 Sequence=5 hop limit=255 --- 2001::1 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 5/14/29 ms CTRL_C to break time = 29 ms time = 5 ms time = 5 ms time = 5 ms time = 26 ms
----End
Configuration Files
# sysname CX-A # ipv6 # interface pos1/0/0 link-protocol ppp undo shutdown ip address 2.1.1.1 255.0.0.0 # interface GigabitEthernet2/0/0 undo shutdown ipv6 enable ipv6 address 2002:201:101:1::1/64 # interface Tunnel 1/0/0 ipv6 enable ipv6 address 2002:201:101::1/64 tunnel-protocol ipv6-ipv4 6to4 source 2.1.1.1 # # ipv6 route-static :: 0 2002:201:102::1 # ipv6 route-static 2002:: 16 Tunnel 1/0/0 # return

# sysname CX-B # ipv6 # source 2.1.1.2 # link-protocol ppp undo shutdown ip address 2.1.1.2 255.0.0.0 # interface GigabitEthernet2/0/0 undo shutdown ipv6 enable ipv6 address 2001::1/64 # interface Tunnel 1/0/0 ipv6 enable ipv6 address 2002:201:102::1/64 tunnel-protocol ipv6-ipv4 6to4 source Pos1/0/0 # ipv6 route-static 2002:: 16 Tunnel 1/0/0 # return
11.6.6 Example for Configuring an ISATAP Tunnel

This section provides an example for configuring an ISATAP tunnel.
Network Requirements
As shown in Figure 11-11, an IPv6 host in the IPv4 network running the Windows XP system needs to access the IPv6 network through a border device. Both the IPv6 host and the border
device support ISATAP. Then you need to set up an ISATAP tunnel between the IPv6 host and the border device. Figure 11-11 Networking diagram of the ISATAP tunnel
IPv6 network IPv6 Host 3001::2
ISATAP CX600
IPv4 network ISATAP Host FE80::5EFE:0201:0102 2.1.1.2 2001::5EFE:0201:0102
GE1/0/0 GE2/0/0 3001::1/64 2.1.1.1/8
The configuration roadmap is as follows: 1. 2. 3. Configure IPv4/IPv6 dual protocol stacks. Configure an ISATAP tunnel. Configure static routes from the IPv6 host to the ISATAP host.
Data Preparation
To complete the configuration, you need the following data: l l IPv4 or IPv6 addresses of interfaces Source interface of the tunnel
Procedure
Step 1 Configure the ISATAP device. # Enable IPv4/IPv6 dual protocol stacks and configure an IP address for each interface.
<HUAWEI> system-view [HUAWEI] sysname Router [Router] ipv6 [Router] interface gigabitethernet 1/0/0 [Router-GigabitEthernet1/0/0] ipv6 enable [Router-GigabitEthernet1/0/0] ipv6 address 3001::1/64 [Router-GigabitEthernet1/0/0] undo shutdown [Router-GigabitEthernet1/0/0] quit [Router] interface gigabitethernet 2/0/0 [Router-GigabitEthernet2/0/0] ip address 2.1.1.1 255.0.0.0 [Router-GigabitEthernet2/0/0] undo shutdown [Router-GigabitEthernet2/0/0] quit
# Configure an ISATAP tunnel.

[Router] interface tunnel 2/0/0 [Router-Tunnel2/0/0] tunnel-protocol ipv6-ipv4 isatap [Router-Tunnel2/0/0] ipv6 enable [Router-Tunnel2/0/0] ipv6 address 2001::/64 eui-64 [HUAWEI-Tunnel2/0/0] source 2.1.1.1
Issue 01 (2011-05-30)
11-43

[Router-Tunnel2/0/0] undo ipv6 nd ra halt [Router-Tunnel2/0/0] quit
Step 2 Configure the ISATAP host. # Configure a static route to the border device. (The pseudo interface number of the host is 2. You can run the ipv6 if command to view the interface corresponding to the automatic tunneling pseudo interface.
C:\> ipv6 rlu 2 2.1.1.1
Step 3 Configure the IPv6 host. # Configure a static route on the IPv6 host to the border device, so hosts in different networks can communicate through the ISATAP tunnel.
C:\> ipv6 rtu 2001::/64 6/3001::1
Step 4 Verify the configuration. Check the status of the Tunnel 2/0/0 on the ISATAP device and find it is Up.
[Router] display ipv6 interface tunnel 2/0/0 Tunnel2/0/0 current state : UP IPv6 protocol current state : UP IPv6 is enabled, link-local address is FE80::5EFE:201:101 Global unicast address(es): 2001::5EFE:201:101, subnet is 2001::/64 Joined group address(es): FF02::1:FF01:101 FF02::2 FF02::1 MTU is 1500 bytes ND reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisement max interval 600 seconds, min interval 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses
# On the ISATAP device, ping the global unicast IP address of the tunnel interface on the ISATAP host.
[Router] ping ipv6 2001::5efe:2.1.1.2 PING 2001::5efe:2.1.1.2 : 56 data bytes, press CTRL_C to break Reply from 2001::5EFE:201:102 bytes=56 Sequence=1 hop limit=64 time = 4 ms Reply from 2001::5EFE:201:102 bytes=56 Sequence=2 hop limit=64 time = 3 ms Reply from 2001::5EFE:201:102 bytes=56 Sequence=3 hop limit=64 time = 2 ms Reply from 2001::5EFE:201:102 bytes=56 Sequence=4 hop limit=64 time = 2 ms Reply from 2001::5EFE:201:102 bytes=56 Sequence=5 hop limit=64 time = 2 ms --- 2001::5efe:2.1.1.2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 2/2/4 ms
# On the ISATAP host, ping the global unicast IP address of the ISATAP device.
C:\> ping6 2001::5efe:2.1.1.1 Pinging 2001::5efe:2.1.1.1 from 2001::5efe:2.1.1.2 with 32 bytes of data: Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
11-44
Issue 01 (2011-05-30)
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms Ping statistics for 2001::5efe:2.1.1.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 1ms, Maximum = 1ms, Average = 1ms
# The ISATAP host can ping through the IPv6 host.

C:\> ping6 3001::2 Pinging 3001::2 with 32 bytes of data: Reply from 3001::2: time<1ms Reply from 3001::2: time<1ms Reply from 3001::2: time<1ms Reply from 3001::2: time<1ms Ping statistics for 3001::2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
----End
Configuration Files
The configuration file of the ISATAP device is as follows:
# sysname ISATAP # ipv6 # interface GigabitEthernet1/0/0 undo shutdown ipv6 enable ipv6 address 3001::1/64 # interface GigabitEthernet2/0/0 undo shutdown ip address 2.1.1.1 255.0.0.0 # interface Tunnel2/0/0 ipv6 enable ipv6 address 2001::/64 eui-64 undo ipv6 nd ra halt tunnel-protocol ipv6-ipv4 isatap source 2.1.1.1 # return
11.6.7 Example for Configuring 6PE

This section provides an example of configuring the 6PE.
As shown in Figure 11-12, PE1 and PE2 support the 6PE features and CE1 and CE2 support the IPv6 protocol. IPv4 IBGP connections need to be established between PEs in the IPv4/MPLS network. Run the OSPF protocol in the IPv4/MPLS network. CEs are in the IPv6 networks, Using the IPv6 address, CEs exchange the routing information with PEs along the static routes. It is required to use the 6PE feature to connect the IPv6 networks of the user over the IPv4/MPLS network of the ISP.
Figure 11-12 Networking diagram of 6PE
IPv4/MPLS PE1 POS1/0/0 3000:435::1/64 CE1 IPv6 Customer site POS1/0/0 3000:435::2/64 POS1/0/0 3000:1065::2/64 POS2/0/0 4.3.5.1/24 POS2/0/0 4.3.5.2/24 PE2 POS1/0/0 3000:1065::1/64 CE2 IPv6 Customer site
The configuration roadmap is as follows: 1. 2. 3. 4. Configure 6PE, enable IPv6 capability, and configure IPv4/IPv6 dual protocol stacks. Configure 6PE and enable MPLS capability. Configure the 6PE peer. Configure an IPv6 address for the interface and a static route on CE.
Data Preparation
To complete the configuration, you need the following data: l l IP addresses of interfaces LSR ID
Procedure
Step 1 Configure 6PE, enable IPv6 capability, and configure IPv4/IPv6 dual protocol stacks. # Configure PE1 and enable its IPv6 capability.
<HUAWEI> system-view [HUAWEI] sysname PE1 [PE1] ipv6
# Configure PE2 and enable its IPv6 capability.

<HUAWEI> system-view [HUAWEI] sysname PE2 [PE2] ipv6
# Configure an IPv6 address for POS 1/0/0 on PE1 and an IP address for loopback0.
[PE1] interface pos 1/0/0 [PE1-Pos1/0/0] ipv6 enable [PE1-Pos1/0/0] ipv6 address 3000:435::1 64 [PE1-Pos1/0/0] undo shutdown [PE1-Pos1/0/0] quit [PE1] interface loopback 0
11-46
Issue 01 (2011-05-30)
[PE1-LoopBack0] ip address 1.1.1.9 255.255.255.255 [PE1-LoopBack0] quit
# Configure an IPv6 address for POS 1/0/0 on PE2 and an IP address for loopback0.
[PE2] interface pos 1/0/0 [PE2-Pos1/0/0] ipv6 enable [PE2-Pos1/0/0] ipv6 address 3000:1065::1 64 [PE2-Pos1/0/0] undo shutdown [PE2-Pos1/0/0] quit [PE2] interface loopback 0 [PE2-LoopBack0] ip address 2.2.2.9 255.255.255.255 [PE2-LoopBack0] quit
Step 2 Configure 6PE and enable MPLS capability. # Configure an IP address for POS 2/0/0 on PE1 and enable MPLS and LDP on it.
[PE1] mpls lsr-id 1.1.1.9 [PE1] mpls Mpls starting, please wait... OK! [PE1-mpls] quit [PE1] mpls ldp [PE1-mpls-ldp] quit [PE1] interface pos 2/0/0 [PE1-Pos2/0/0] ip address 4.3.5.1 255.255.255.0 [PE1-Pos2/0/0] mpls [PE1-Pos2/0/0] mpls ldp [PE1-Pos2/0/0] undo shutdown [PE1-Pos2/0/0] quit
# Configure an IP address for POS 2/0/0 on PE2 and enable MPLS and LDP on it.
[PE2] mpls lsr-id 2.2.2.9 [PE2] mpls Mpls starting, please wait... OK! [PE2-mpls] quit [PE2] mpls ldp [PE2-mpls-ldp] quit [PE2] interface pos 2/0/0 [PE2-Pos2/0/0] ip address 4.3.5.2 255.255.255.0 [PE2-Pos2/0/0] mpls [PE2-Pos2/0/0] mpls ldp [PE2-Pos2/0/0] undo shutdown [PE2-Pos2/0/0] quit
# Configure OSPF on PE1 and trigger the setup of LSPs.

[PE1] ospf [PE1-ospf-1] area 0 [PE1-ospf-1-area-0.0.0.0] network 1.1.1.9 0.0.0.0 [PE1-ospf-1-area-0.0.0.0] network 4.3.5.0 0.0.0.255 [PE1-ospf-1-area-0.0.0.0] quit [PE1-ospf-1] quit
# Configure OSPF on PE2 and trigger the setup of LSPs.

[PE2] ospf [PE2-ospf-1] area 0 [PE2-ospf-1-area-0.0.0.0] network 2.2.2.9 0.0.0.0 [PE2-ospf-1-area-0.0.0.0] network 4.3.5.0 0.0.0.255 [PE2-ospf-1-area-0.0.0.0] quit [PE2-ospf-1] quit
Step 3 Configure the 6PE peer. # Configure IBGP on PE1 and enable 6PE capability on the peer and import IPv6 direct routes and static routes from each other.
[PE1] bgp 65100
Issue 01 (2011-05-30)
11-47
[PE1-bgp] peer 2.2.2.9 as-number 65100 [PE1-bgp] peer 2.2.2.9 connect-interface loopback 0 [PE1-bgp] ipv6-family [PE1-bgp-af-ipv6] import-route direct [PE1-bgp-af-ipv6] import-route static [PE1-bgp-af-ipv6] peer 2.2.2.9 enable [PE1-bgp-af-ipv6] peer 2.2.2.9 label-route-capability [PE1-bgp-af-ipv6] quit [PE1-bgp] quit
# Configure IBGP on PE2 and enable 6PE capability on the peer and import IPv6 direct routes and static routes from each other.
[PE2] bgp 65100 [PE2-bgp] peer 1.1.1.9 as-number 65100 [PE2-bgp] peer 1.1.1.9 connect-interface loopback 0 [PE2-bgp] ipv6-family [PE2-bgp-af-ipv6] import-route direct [PE2-bgp-af-ipv6] import-route static [PE2-bgp-af-ipv6] peer 1.1.1.9 enable [PE2-bgp-af-ipv6] peer 1.1.1.9 label-route-capability [PE2-bgp-af-ipv6] quit [PE2-bgp] quit
Step 4 Configure an IPv6 address for the interface and a static route on CE. # Configure CE1 and set up an IPv6 connection between CE1 and PE1.
<HUAWEI> system-view [HUAWEI] sysname CE1 [CE1] ipv6 [CE1] interface pos 1/0/0 [CE1-Pos1/0/0] ipv6 enable [CE1-Pos1/0/0] ipv6 address 3000:435::2 64 [CE1-Pos1/0/0] undo shutdown [CE1-Pos1/0/0] quit [CE1] ipv6 route-static :: 0 pos 1/0/0
# Configure CE2 and set up an IPv6 connection between CE2 and PE2.
<HUAWEI> system-view [HUAWEI] sysname CE2 [CE2] ipv6 [CE2] interface pos 1/0/0 [CE2-Pos1/0/0] ipv6 enable [CE2-Pos1/0/0] ipv6 address 3000:1065::2 64 [CE2-Pos1/0/0] undo shutdown [CE2-Pos1/0/0] quit [CE2] ipv6 route-static :: 0 pos 1/0/0
Step 5 Verify the configuration. # Display the LSP information on PE1.

[PE1] display mpls lsp ----------------------------------------------------------LSP Information: LDP LSP ----------------------------------------------------------FEC In/Out Label In/Out IF Vrf Name 2.2.2.9/32 NULL/3 -/Pos2/0/0 2.2.2.9/32 3/NULL -/----------------------------------------------------------LSP Information: BGP IPV6 LSP ----------------------------------------------------------FEC : 3000:435::/64 In Label : 109568 Out Label : ----In Interface : ----OutInterface : ----Vrf Name :
# Display the IPv6 routing information on PE1.


[PE1] display bgp ipv6 routing-table Total Number of Routes: 5
BGP Local router ID is 1.1.1.9 Status codes: * - valid, > - best, d - damped, h - history, i - internal, s - suppressed, S - Stale Origin : i - IGP, e - EGP, ? - incomplete *> Network NextHop MED Label Path/Ogn Network NextHop MED Label Path/Ogn Network NextHop MED Label Path/Ogn : : : : : : : : : : : : : : : : : : : : : : : : : ::1 :: 0 ? 3000:435:: :: 0 NULL/109568 ? 3000:435::1 :: 0 ? 3000:1065:: ::FFFF:2.2.2.9 0 109568/NULL ? FE80:: :: 0 ? PrefixLen : 64 LocPrf : 100 PrefVal : 0 PrefixLen : 64 LocPrf : PrefVal : 0 PrefixLen : 128 LocPrf : PrefVal : 0
*>
*>
PrefixLen : 128 LocPrf : PrefVal : 0
*>i Network NextHop MED Label Path/Ogn *> Network NextHop MED Label Path/Ogn
PrefixLen : 10 LocPrf : PrefVal : 0
# CE1 can ping through the IPv6 address of CE2.

[CE1] ping ipv6 3000:1065::2 PING 3000:1065::2 : 56 data bytes, press CTRL_C to break Reply from 3000:1065::2 bytes=56 Sequence=1 hop limit=63 time = 50 ms Reply from 3000:1065::2 bytes=56 Sequence=2 hop limit=63 time = 1 ms Reply from 3000:1065::2 bytes=56 Sequence=3 hop limit=63 time = 1 ms Reply from 3000:1065::2 bytes=56 Sequence=4 hop limit=63 time = 1 ms Reply from 3000:1065::2 bytes=56 Sequence=5 hop limit=63 time = 1 ms --- 3000:1065::2 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/10/50 ms
----End
Configuration Files
l Configuration file of PE1
# sysname PE1 #
Issue 01 (2011-05-30)
11-49

ipv6 # mpls lsr-id 1.1.1.9 mpls # mpls ldp # interface Pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3000:435::1 # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 4.3.5.1 255.255.255.0 mpls mpls ldp # interface LoopBack0 ip address 1.1.1.9 255.255.255.255 # bgp 65100 peer 2.2.2.9 as-number 65100 peer 2.2.2.9 connect-interface LoopBack0 # ipv4-family unicast undo synchronization peer 2.2.2.9 enable # ipv6-family undo synchronization import-route direct import-route static peer 2.2.2.9 enable peer 2.2.2.9 label-route-capability # ospf 1 area 0.0.0.0 network 1.1.1.9 0.0.0.0 network 4.3.5.0 0.0.0.255 # return

# sysname PE2 # ipv6 # mpls lsr-id 2.2.2.9 mpls # mpls ldp # interface Pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3000:1065::1 # interface Pos2/0/0 link-protocol ppp undo shutdown ip address 4.3.5.2 255.255.255.0 mpls mpls ldp # interface LoopBack0
11-50
Issue 01 (2011-05-30)

ip address 2.2.2.9 255.255.255.255 # bgp 65100 peer 1.1.1.9 as-number 65100 peer 1.1.1.9 connect-interface LoopBack0 # ipv4-family unicast undo synchronization peer 1.1.1.9 enable # ipv6-family undo synchronization import-route direct import-route static peer 1.1.1.9 enable peer 1.1.1.9 label-route-capability # ospf 1 area 0.0.0.0 network 2.2.2.9 0.0.0.0 network 4.3.5.0 0.0.0.255 # return

# sysname CE1 # ipv6 # interface Pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3000:435::2 # ipv6 route-static :: 0 Pos1/0/0 # return

# sysname CE2 # ipv6 # interface Pos1/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 3000:1065::2 # ipv6 route-static :: 0 Pos1/0/0 # return
Issue 01 (2011-05-30)
11-51
12
Context
IPv4 over IPv6 Tunnel Configuration
About This Chapter

The IPv4 over IPv6 tunnel technology is used to interconnect isolated IPv4 networks during the transition from IPv4 Internet into the IPv6 Internet.
NOTE
IPv4 over IPv6 Tunnel cannot be configured on the X1 and X2 models of the CX600.
12.1 IPv4 over IPv6 Tunnel Overview The principle of the IPv4 over IPv6 tunnel technology is that IPv4 packets are encapsulated into IPv6 packets at the ingress of the tunnel. 12.2 Configuring an IPv4 over IPv6 Tunnel This configuration task enables transmission of an IPv4 packet added with an IPv6 header on the device configured with the IPv4/IPv6 dual stack. 12.3 Maintaining IPv4 over IPv6 Tunnels This section describes how to maintain an IPv4 over IPv6 tunnel, including how to monitor an IPv4 over IPv6 tunnel. 12.4 Configuration Examples This section includes the networking requirements, configuration notes, and configuration roadmap.
Issue 01 (2011-05-30)
12-1
12.1 IPv4 over IPv6 Tunnel Overview

The principle of the IPv4 over IPv6 tunnel technology is that IPv4 packets are encapsulated into IPv6 packets at the ingress of the tunnel. 12.1.1 Introduction to IPv4 over IPv6 You can create tunnels on the IPv6 networks to connect IPv4 isolated sites so that IPv4 isolated sites can access other IPv4 networks through the IPv6 Internet. 12.1.2 IPv4 over IPv6 Supported by the CX600 This section describes how to interconnect IPv4 networks through IPv6 networks.
12.1.1 Introduction to IPv4 over IPv6

You can create tunnels on the IPv6 networks to connect IPv4 isolated sites so that IPv4 isolated sites can access other IPv4 networks through the IPv6 Internet. During the transition from the IPv4 Internet to the IPv6 Internet, IPv6 networks have been widely deployed, whereas IPv4 networks are isolated. The tunnel technology can be adopted to establish tunnels over IPv6 networks to connect isolated IPv4 networks. This is similar to the situation where the tunnel technology is used to deploy VPNs on IP networks. The tunnel used to connect isolated IPv4 networks over IPv6 networks is called an IPv4 over IPv6 tunnel.
12.1.2 IPv4 over IPv6 Supported by the CX600

This section describes how to interconnect IPv4 networks through IPv6 networks. The CX600 supports the enabling of IPv4 and IPv6 protocol stacks on the devices at the border of IPv6 and IPv4 networks. Figure 12-1 Networking diagram of an IPv4 over IPv6 tunnel
Dual Stack CX600 IPv4 network IPv4 Host IPv6 network
Dual Stack CX600 IPv4 network IPv4 Host
IPv4 over IPv6 Tunnel
IPv4 Header IPv4 Payload
IPv6 Header IPv4 Header IPv4 Payload
IPv4 Header IPv4 Payload
12-2
Issue 01 (2011-05-30)
Figure 12-1 shows the principles of the IPv4 over IPv6 tunnel technology. 1. 2. Enabling IPv4/IPv6 dual stacks Enable IPv4 and IPv6 protocol stacks on the border device. Encapsulating IPv6 packets After receiving a packet from the IPv4 network, the border device takes the received IPv4 packet as the payload, adds an IPv6 packet header before the payload, and encapsulates it into an IPv6 packet if the device finds that the destination of the packet is not itself. 3. 4. Transmitting the encapsulated packet In the IPv6 network, the encapsulated packet is transmitted to the peer border device. Decapsulating the packet The peer border device decapsulates the packet, removes the IPv6 packet header, and forwards the decapsulated IPv4 packet to the remote IPv4 network.
12.2 Configuring an IPv4 over IPv6 Tunnel

This configuration task enables transmission of an IPv4 packet added with an IPv6 header on the device configured with the IPv4/IPv6 dual stack. 12.2.1 Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an IPv6 over IPv4 tunnel. 12.2.2 Configuring a Tunnel Interface To configure a tunnel interface, you need to configure the source and destination addresses of the tunnel. 12.2.3 Configuring Routes in the Tunnel Packets can be normally forwarded only when routes exist on both the source device and destination device of the tunnel. Do as follows on the devices on both ends of the tunnel. 12.2.4 Configuring Other Items for an IPv4 over IPv6 Tunnel The other configurations of an IPv4 over IPv6 tunnel include the number of times that IPv6 encapsulation is performed for an IPv4 packet, traffic flag, maximum hops, and traffic class. Do as follows on the devices on both ends of the tunnel. 12.2.5 Checking the Configuration You can view the configuration of an IPv4 over IPv6 tunnel.

This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring an IPv6 over IPv4 tunnel.
To implement communication between IPv4 networks over the IPv6 network, configure an IPv4 over IPv6 tunnel on the border device of IPv4 and IPv6 networks.
Before configuring an IPv4 over IPv6 tunnel, complete the following tasks:
l l
Implementing the IP connectivity between the source and destination interfaces Configuring IPv4 and IPv6 protocol stacks
Data Preparation
To configure an IPv4 over IPv6 tunnel, you need the following data. No. 1 2 3 4 Data Number of the tunnel interface Source IPv6 address or source interface of the tunnel interface Destination IPv6 address of the tunnel interface IPv4 address of the tunnel interface or the interface from which the IPv4 address is borrowed
12.2.2 Configuring a Tunnel Interface

To configure a tunnel interface, you need to configure the source and destination addresses of the tunnel.
Procedure
Step 1 Run:
set board-type slot slot slot-id tunnel
The service mode of the SPUC is set to Tunnel. Step 2 Run:

system-view

The tunnel interface is created and the tunnel interface view is displayed. The slot number of the created tunnel interface must be the same as that of the SPUC. For instance, when the SPUC is inserted in slot 2, the slot number of the tunnel interface must be 2. Step 4 Run:
tunnel-protocol ipv4-ipv6
The tunnel is specified as an IPv4 over IPv6 tunnel. When you configure an IPv4 over IPv6 GRE tunnel, you must run the target-board slotnumber command on the loopback interface to bind the SPUC to 4 over 6 protocol. Step 5 Run:
source { source-ip-address | interface-type interface-number }
The source IPv6 address or source interface of the tunnel interface is specified.
The source address specified by sourceip-address must be the IPv6 address of the loopback interface bound to the SPUC through the target-board command; the source interface specified by sourceinterface-type must be the loopback interface bound to the SPUC through the targetboard command. Step 6 Run:
destination ip-address
The destination IPv6 address of the Tunnel interface is configured. Step 7 Run one of the following commands to specify the IP address of the tunnel interface: l Run the ip address ip-address { mask | mask-length } [ sub ] command to configure the IPv4 address of the tunnel interface. l Run the ip address unnumbered interface interface-type interface-number command to configure the tunnel interface to borrow an IPv4 address. ----End
12.2.3 Configuring Routes in the Tunnel

Packets can be normally forwarded only when routes exist on both the source device and destination device of the tunnel. Do as follows on the devices on both ends of the tunnel.
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 Choose one of the following methods to configure the route with the outgoing interface as the tunnel interface: l Run the ip route-static ip-address { mask | mask-length } tunnel interface-number command to configure static routes. When configuring the static routes, you must configure the both ends of the tunnel. Note that the destination address is the destination IPv4 address of the packet to be encapsulated with the IPv4 over IPv6 tunnel; the next hop is the local tunnel interface. l Configure dynamic routes. You can use the Border Gateway Protocol (BGP) or the Interior Gateway Protocol (IGP), excluding Intermediate System-to-Intermediate System (IS-IS). Detailed configurations are not mentioned here. When configuring a dynamic routing protocol, you must enable it on the tunnel interface and the interface on the link through which the IPv4 network is connected to the IPv6 network. ----End
12.2.4 Configuring Other Items for an IPv4 over IPv6 Tunnel

The other configurations of an IPv4 over IPv6 tunnel include the number of times that IPv6 encapsulation is performed for an IPv4 packet, traffic flag, maximum hops, and traffic class. Do as follows on the devices on both ends of the tunnel.
Issue 01 (2011-05-30)
12-5
Procedure
Step 1 Run:
system-view

The tunnel interface view is displayed. Step 3 Run:

tunnel ipv4-ipv6 flow-label label-value
The flow label value is set. By default, the flow label value is 0. Step 4 Run:
tunnel ipv4-ipv6 hop-limit hop-limit
The hop limit is set. By default, the hop limit is set to 64. Step 5 Run:
tunnel ipv4-ipv6 traffic-class { original | class-value }
The traffic level is set. By default, the traffic level is 0. ----End

You can view the configuration of an IPv4 over IPv6 tunnel.
Prerequisite
The configurations of the IPv4 over IPv6 Tunnel function are complete.
Procedure
l l l Run the display device slot-id command to check whether the service mode of the SPUC is Tunnel. Run the display interface tunnel [ interface-number ] command to check the working status of the tunnel interface. Run the display ip routing-table command to check the routing table.
----End
Example
If the service mode of the SPUC is Tunnel, run the display device 3 command, and you can view that the type of the SPUC on the CX device is displayed as General.
<HUAWEI> display device 3
12-6
Issue 01 (2011-05-30)

SPU3's detail information: - - - - - - - - - - - - - - - - - - - - Description: Board status: Register: Uptime: CPU Utilization(%): Mem Usage(%): Clock information: State item Current syn-clock: Current line-clock: Syn-clock state: Syn-clock 17 state: Syn-clock 18 state: Line-clock 23 state: Line-clock 24 state: Statistic information: Statistic item SERDES interface link lost: Mpu switchs: Syn-clock switchs: - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - Line Processing Unit - General Normal Registered 2009/02/26 18:33:23 3% 19% State 17 23 Locked Actived Inactived Inactived Inactived
VCXO_OK
REF_OK
Statistic number 0 0 0 - - - - - - - - - - - - - - - - -
Run the display interface tunnel command. If the status of the tunnel interface is Up, it means that the configuration succeeds. For example:
<HUAWEI> display interface tunnel 2/0/0 Tunnel2/0/0 current state : UP Line protocol current state : UP Last line protocol up time : 2010-06-22, 19:33:19 Description : Tunnel2/0/0 Interface, Route Port Route Port,The Maximum Transmit Unit is 1452 bytes Internet Address is 10.1.1.1/30 Encapsulation is TUNNEL6, loopback not set Tunnel protocol/transport (IPv6 or IPV4) over IPv6 Tunnel Source 2001::1 (Pos2/0/0) Tunnel Destination 2002::2 Tunnel Encapsulation limit 4 Tunnel Traffic class not set Tunnel Flow label not set Tunnel Hop limit 64 Current system time: 2010-06-29 20:26:18 5 minutes input rate 10 bits/sec, 0 packets/sec 5 minutes output rate 14 bits/sec, 0 packets/sec 493 packets input, 38480 bytes 0 input error 447 packets output, 53144 bytes 0 output error
Run the display ip routing-table command. If the route with the outgoing interface as the tunnel interface is displayed in the IPv4 routing table, it means that the configuration succeeds. For example:
<HUAWEI> display ip routing-table Routing Tables: Public Destinations : 11 Routes : 11 Destination/Mask Proto Pre Cost NextHop 10.1.1.0/24 Direct 0 0 10.1.1.2 10.1.1.2/32 Direct 0 0 127.0.0.1 10.2.1.0/24 Static 60 0 40.1.1.1 20.1.1.0/24 Direct 0 0 20.1.1.1 20.1.1.1/32 Direct 0 0 127.0.0.1 20.1.1.2/32 Direct 0 0 20.1.1.2 30.1.1.0/24 OSPF 10 3124 20.1.1.2 40.1.1.0/24 Direct 0 0 40.1.1.1 40.1.1.1/32 Direct 0 0 127.0.0.1 127.0.0.0/8 Direct 0 0 127.0.0.1 127.0.0.1/32 Direct 0 0 127.0.0.1
Interface GigabitEthernet2/0/0 InLoopBack0 Tunnel2/0/0 Pos2/0/0 InLoopBack0 Pos1/0/0 Pos1/0/0 Tunnel2/0/0 InLoopBack0 InLoopBack0 InLoopBack0
Issue 01 (2011-05-30)
12-7
Run the ping -a source-ipv4-address dest-ipv4-address command. The local tunnel interface can ping through the destination tunnel interface.
12.3 Maintaining IPv4 over IPv6 Tunnels

This section describes how to maintain an IPv4 over IPv6 tunnel, including how to monitor an IPv4 over IPv6 tunnel. 12.3.1 Monitoring the Operation Status of IPv4 over IPv6 Tunnel This section describes how to monitor an IPv4 over IPv6 tunnel.
12.3.1 Monitoring the Operation Status of IPv4 over IPv6 Tunnel

This section describes how to monitor an IPv4 over IPv6 tunnel.
Context
In routine maintenance, you can run the following command in any view to check the operation of IPv4 over IPv6 tunnel.
Procedure
l l Run the display interface tunnel [ interface-number ] command in any view to check the operation status of the tunnel interface. Run the display interface tunnel interface-number command in any view to check the IPv4 attributes of the tunnel interface.
----End

This section includes the networking requirements, configuration notes, and configuration roadmap. 12.4.1 Example for Configuring an IPv4 over IPv6 Tunnel
12.4.1 Example for Configuring an IPv4 over IPv6 Tunnel
12-8
Issue 01 (2011-05-30)
Figure 12-2 Networking diagram of an IPv4 over IPv6 tunnel
IPv4 network
IPv6 network
CX-2 POS1/0/0 CX-3 POS1/0/0 2001::2/64 2002::2/64 POS2/0/0 2001::1/64 POS2/0/0 2002::1/64 CX-4
POS1/0/0 10.1.2.1/30 POS1/0/0 10.1.2.2/30 CX-1
POS2/0/0 10.1.3.1/30 POS1/0/0 10.1.3.2/30
CX-5
IPv4 network
As shown in Figure 12-2, two IPv4 networks are connected to an IPv6 network through CX-1 and CX-5, respectively. Border devices CX-2 and CX-4 of the IPv6 network support IPv4 and IPv6 dual stacks. To enable communications between the two IPv4 networks, configure an IPv4 over IPv6 tunnel between CX-2 and CX-4.
NOTE
l An IPv4 over IPv6 tunnel does not support IS-IS. l When configuring an IPv4 over IPv6 tunnel, you must set the service mode of the SPUC to Tunnel. In addition, you must bind the SPUC to the tunnel.
The configuration roadmap is as follows: 1. 2. Configure an IPv4 over IPv6 tunnel on the border devices at both ends of the IPv6 network. Use a dynamic routing protocol to configure the route with the outgoing interface as the tunnel interface.
Data Preparation
To complete the configuration, you need the following data: l l l
Issue 01 (2011-05-30)
Routing protocols applied to the IPv6 and IPv4 networks Source and destination IPv6 addresses of the tunnel IPv4 address of the tunnel interface
Procedure
Step 1 Configure the IPv6 address of the physical interface and IS-ISv6 of the IPv6 network to implement the connectivity of the IPv6 network. # Configure CX-2.
<HUAWEI> system-view [HUAWEI] sysname CX-2 [CX-2] ipv6 [CX-2] interface pos 2/0/0 [CX-2-Pos2/0/0] ipv6 enable [CX-2-Pos2/0/0] ipv6 address 2001::1 64 [CX-2-Pos2/0/0] undo shutdown [CX-2-Pos2/0/0] quit [CX-2] isis 1 [CX-2-isis-1] network-entity 10.0000.0000.0001.00 [CX-2-isis-1] ipv6 enable topology standard [CX-2-isis-1] quit [CX-2] interface pos 2/0/0 [CX-2-Pos2/0/0] isis ipv6 enable 1 [CX-2-Pos2/0/0] quit
# Create a loopback interface, assign an IPv6 address to it, and enable IS-ISv6.
[CX-2] interface [CX-2-LoopBack1] [CX-2-LoopBack1] [CX-2-LoopBack1] [CX-2-LoopBack1] Loopback 1 ipv6 enable ipv6 address 2::2 64 isis ipv6 enable 1 quit
# Configure CX-3.
<HUAWEI> system-view [HUAWEI] sysname CX-3 [CX-3] ipv6 [CX-3] interface pos 1/0/0 [CX-3-Pos1/0/0] ipv6 enable [CX-3-Pos1/0/0] ipv6 address 2001::2 64 [CX-3-Pos1/0/0] undo shutdown [CX-3-Pos1/0/0] quit [CX-3] interface pos 2/0/0 [CX-3-Pos2/0/0] ipv6 enable [CX-3-Pos2/0/0] ipv6 address 2002::1 64 [CX-3-Pos2/0/0] undo shutdown [CX-3-Pos2/0/0] quit [CX-3] isis 1 [CX-3-isis-1] network-entity 10.0000.0000.0002.00 [CX-3-isis-1] ipv6 enable topology standard [CX-3-isis-1] quit [CX-3] interface pos 1/0/0 [CX-3-Pos1/0/0] isis ipv6 enable 1 [CX-3-Pos1/0/0] quit [CX-3] interface pos 2/0/0 [CX-3-Pos2/0/0] isis ipv6 enable 1 [CX-3-Pos2/0/0] quit
# Configure CX-4.
<HUAWEI> system-view [HUAWEI] sysname CX-4 [CX-4] ipv6 [CX-4] interface pos 1/0/0 [CX-4-Pos1/0/0] ipv6 enable [CX-4-Pos1/0/0] ipv6 address 2002::2 64 [CX-4-Pos1/0/0] undo shutdown [CX-4-Pos1/0/0] quit [CX-4] isis 1 [CX-4-isis-1] network-entity 10.0000.0000.0003.00
12-10
Issue 01 (2011-05-30)

[CX-4-isis-1] ipv6 enable topology standard [CX-4-isis-1] quit [CX-4] interface pos 1/0/0 [CX-4-Pos1/0/0] isis ipv6 enable 1 [CX-4-Pos1/0/0] quit
# Create a loopback interface, assign an IPv6 address to it, and enable IS-ISv6.
[CX-4] interface [CX-4-LoopBack1] [CX-4-LoopBack1] [CX-4-LoopBack1] [CX-4-LoopBack1] Loopback 1 ipv6 enable ipv6 address 4::4 64 isis ipv6 enable 1 quit
Step 2 Configure the IPv4 address and OSPF of the physical interfaces for the IPv4 networks to implement the connectivity of the IPv4 networks. # Configure CX-1.
<HUAWEI> system-view [HUAWEI] sysname CX-1 [CX-1] interface pos 1/0/0 [CX-1-Pos1/0/0] ip address 10.1.2.2 30 [CX-1-Pos1/0/0] undo shutdown [CX-1-Pos1/0/0] quit [CX-1] ospf 1 [CX-1-ospf-1] area 0 [CX-1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.3
# Configure CX-2.
<CX-2> system-view [CX-2] interface pos 1/0/0 [CX-2-Pos1/0/0] ip address 10.1.2.1 30 [CX-2-Pos1/0/0] undo shutdown [CX-2-Pos1/0/0] quit [CX-2] ospf 1 [CX-2-ospf-1] area 0 [CX-2-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.3
# Configure CX-4.
<CX-4> system-view [CX-4] interface pos 1/0/0 [CX-4-Pos1/0/0] ip address 10.1.3.1 30 [CX-4-Pos1/0/0] quit [CX-4] ospf 1 [CX-4-ospf-1] area 0 [CX-4-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.3
# Configure CX-5.
<HUAWEI> system-view [HUAWEI] sysname CX-5 [CX-5] interface pos 1/0/0 [CX-5-Pos1/0/0] ip address 10.1.3.2 30 [CX-5-Pos1/0/0] undo shutdown [CX-5-Pos1/0/0] quit [CX-5] ospf 1 [CX-5-ospf-1] area 0 [CX-5-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.3
Step 3 Configure the tunnel interface. # Create a tunnel interface and configure the IPv4 address, source IPv6 address (or source interface), and destination IPv6 address of the tunnel interface. Bind the SPUC to the tunnel.

NOTE
# Configure CX-2.
<CX-2> set board-type slot 6 tunnel <CX-2> system-view [CX-2] interface Loopback 1 [CX-2-LoopBack1] target-board 6 [CX-2-LoopBack1] binding tunnel ipv4-ipv6 [CX-2-LoopBack1] quit [CX-2] interface tunnel 6/0/0 [CX-2-Tunnel6/0/0] tunnel-protocol ipv4-ipv6 [CX-2-Tunnel6/0/0] ip address 10.1.1.1 30 [CX-2-Tunnel6/0/0] source loopback1 [CX-2-Tunnel6/0/0] destination 4::4
# Configure CX-4.
<CX-4> set board-type slot 6 tunnel <CX-4> system-view [CX-4] interface Loopback 1 [CX-4-LoopBack1] target-board 6 [CX-4-LoopBack1] binding tunnel ipv4-ipv6 [CX-4-LoopBack1] quit [CX-4] interface tunnel 6/0/0 [CX-4-Tunnel6/0/0] tunnel-protocol ipv4-ipv6 [CX-4-Tunnel6/0/0] ip address 10.1.1.2 30 [CX-4-Tunnel6/0/0] source loopback1 [CX-4-Tunnel6/0/0] destination 2::2
Step 4 Configure the route with the outgoing interface as the tunnel interface. # Configure CX-2.
<CX-2> system-view [CX-2] ospf 1 [CX-2-ospf-1] area 0 [CX-2-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.3 [CX-2-ospf-1-area-0.0.0.0] quit [CX-2-ospf-1] quit
# Configure CX-4.
<CX-4> system-view [CX-4] ospf 1 [CX-4-ospf-1] area 0 [CX-4-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.3
Step 5 Verify the configuration. After the configuration is completed, view the tunnel interface on CX-2 and CX-4. You can view that the protocol status of the tunnel interface is Up.
[CX-2] display interface tunnel 6/0/0 Tunnel6/0/0 current state : UP Line protocol current state : UP Last up time: 2007-11-16, 12:26:17 Description : Tunnel2/0/0 Interface, Route Port The Maximum Transmit Unit is 1452 bytes Internet Address is 10.1.1.1/30 Encapsulation is TUNNEL6, loopback not set Tunnel protocol/transport (IPv6 or IPV4) over IPv6 Tunnel Source 2001::1 (Pos2/0/0) Tunnel Destination 2002::2 Tunnel Encapsulation limit 4 Tunnel Traffic class not set
12-12
Issue 01 (2011-05-30)
Tunnel Flow label not set Tunnel Hop limit 64 5 minutes input rate 10 bits/sec, 0 packets/sec 5 minutes output rate 14 bits/sec, 0 packets/sec 493 packets input, 38480 bytes 0 input error 447 packets output, 53144 bytes 0 output error
On CX-2 and CX-4, view the IPv4 routing table. You can view that the outgoing interfaces to the remote IPv4 network are tunnel interfaces.
[CX-2] display ip routing-table Routing Tables: Public Destinations : 9 Destination/Mask Proto Pre 1.1.1.1/32 Direct 0 10.1.1.0/30 Direct 0 10.1.1.1/32 Direct 0 10.1.2.0/30 Direct 0 10.1.2.1/32 Direct 0 10.1.2.2/32 Direct 0 10.1.3.0/24 OSPF 10 127.0.0.0/8 Direct 0 127.0.0.1/32 Direct 0
Routes : 9 Cost NextHop 0 127.0.0.1 0 10.1.1.1 0 127.0.0.1 0 10.1.2.1 0 127.0.0.1 0 10.1.2.2 2 10.1.1.2 0 127.0.0.1 0 127.0.0.1
Interface InLoopBack0 Tunnel2/0/0 InLoopBack0 Pos1/0/0 InLoopBack0 Pos1/0/0 Tunnel2/0/0 InLoopBack0 InLoopBack0
CX-1 and CX-5 can ping through each other. ----End
Configuration Files
l Configuration file of CX-1
# sysname CX-1 # interface Pos1/0/0 link-protocol ppp undo shutdown ip address 10.1.2.2 255.255.255.252 # ospf 1 area 0.0.0.0 network 10.1.2.0 0.0.0.3 # return
Configuration file of CX-2

# sysname CX-2 # ipv6 # isis 1 network-entity 10.0000.0000.0001.00 # ipv6 enable topology standard # interface Pos1/0/0 link-protocol ppp ip address 10.1.2.1 255.255.255.252 # interface Pos2/0/0 link-protocol ppp ipv6 enable ipv6 address 2001::1/64 isis ipv6 enable 1 #
Issue 01 (2011-05-30)
12-13

interface LoopBack1 ipv6 enable ipv6 address 2::2 64 isis ipv6 enable 1 target-board 6 binding tunnel ipv4-ipv6 # interface Tunnel6/0/0 ip address 10.1.1.1 255.255.255.252 tunnel-protocol ipv4-ipv6 source loopback 1 destination 4::4 # ospf 1 area 0.0.0.0 network 10.1.2.0 0.0.0.3 network 10.1.1.0 0.0.0.3 # return

# sysname CX-3 # ipv6 # isis 1 network-entity 10.0000.0000.0002.00 # ipv6 enable topology standard # interface Pos1/0/0 link-protocol ppp undo shutdown ivp6 enable ipv6 address 2001::2/64 isis ipv6 enable 1 # interface Pos2/0/0 link-protocol ppp undo shutdown ipv6 enable ipv6 address 2002::1/64 isis ipv6 enable 1 # return

# sysname CX-4 # ipv6 # isis 1 network-entity 10.0000.0000.0003.00 # ipv6 enable topology standard # # interface Pos1/0/0 link-protocol ppp ipv6 enable ipv6 address 2002::2/64 isis ipv6 enable 1 # interface Pos2/0/0 link-protocol ppp ip address 10.1.3.1 255.255.255.252 # interface LoopBack1
12-14
Issue 01 (2011-05-30)

ipv6 enable ipv6 address 4::4 64 isis ipv6 enable 1 target-board 6 binding tunnel ipv4-ipv6 # interface Tunnel6/0/0 ip address 10.1.1.2 255.255.255.252 tunnel-protocol ipv4-ipv6 source loopback 1 destination 2::2 # ospf 1 area 0.0.0.0 network 10.1.1.0 0.0.0.3 network 10.1.3.0 0.0.0.3 # return

# sysname CX-1 # interface Pos1/0/0 link-protocol ppp undo shutdown ip address 10.1.3.2 255.255.255.252 # ospf 1 area 0.0.0.0 network 10.1.3.0 0.0.0.3 # return
Issue 01 (2011-05-30)
12-15
A Glossary
A
This appendix collates frequently used glossaries in this document. A Access Control List Acknowledge Address Resolution Protocol ATM
Glossary
A list composed of multiple sequential permit/deny statements. In firewall, after ACL is applied to an interface on the device, the device decides which packet can be forwarded and which packet should be denied. In QoS, ACL is used to classify traffic. To confirm an action. The acknowledgement (ACK) message is sent from one device to another. A protocol used to map an IP Address to a MAC address, as defined in RFC 826. An asynchronous Transfer Mode. It is a data transmission technology in which data (files, voice and video) is transferred in cells with a fixed length (53 Bytes). The fixed length makes the cell be processed by the hardware. The object of ATM is to make good use of high-speed transmission medium such as E3, SONET and T3.
B Broadcast To send packets to all ports of the nodes in the network.
D Domain name Dotted decimal notation A name composed of numbers or characters. Each domain name corresponds to an IP address. A format of IP address. IP addresses in this format are separated into four parts by a dot "." with each part is in the decimal numeral.
Issue 01 (2011-05-30)
A-1
A Glossary
Ethernet
A technology complemented in LAN. It adopts Carrier Sense Multiple Access/Collision Detection. The speed of an Ethernet interface can be 10 Mbit/s, 100 Mbit/s, 1000 Mbit/s or 10000 Mbit/s. The Ethernet network features high reliability and easy maintaining..
F File Transfer Protocol An application layer protocol based on TCP/IP. It is used to transfer large amounts of data reliably between the user and the remote host. FTP is implemented based on corresponding file system.
I IPv6 A update version of IPv4. It is also called IP Next Generation (IPng). The specifications and standardizations provided by it are consistent with the Internet Engineering Task Force (IETF).Internet Protocol Version 6 (IPv6) is also called. It is a new version of the Internet Protocol, designed as the successor to IPv4. The specifications and standardizations provided by it are consistent with the Internet Engineering Task Force (IETF).The difference between IPv6 and IPv4 is that an IPv4 address has 32 bits while an IPv6 address has 128 bits.
L Local Area Network A network intended to serve a small geographic area, (few square kilometers or less), a single office or building, or a small defined group of users. It features high speed and little errors. Ethernet, FDDI and Toke Ring are three technologies implemented in LAN.
M MAC address MTU A link layer address or physical address. It is six bytes long. A maximum size of packets that an interface can process. It is in bytes
N Neighbor Discovery A process to discover neighboring modes.
P Ping To test the reachablitly of a device in the network through ICMP Echo message.
A-2
Issue 01 (2011-05-30)
A Glossary
Policy-based Routing PPP
A routing mechanism based on user-defined policies. It can implement secure communication and load balancing. A serial point to point link used for special transmission between two devices.
R Router A device running on the network layer. After receiving a packet, the device searches the routing table for a proper route and sends the packet to the next hop. The last hop device sends the packet to the host directly.
T Telnet Time Range Traffic Tunnel An application layer protocol based on TCP/IP. It implements remote login and virtual terminal. It A special time period. A group of packets sent from the source to the destination and matching certain classification. In VPN, it is a transport tunnel set up between two entities to prevent interior users from interrupting and ensure security.
U Unicast To send packets to one destination network.
V VPN Virtual Private Network (VPN). It implements an apparent single private network (as seen by the user), over a number of separate public and private networks. Virtual indicates that this kind of network is a logical network. Versatile Routing Platform. It is a versatile operating system platform developed by Huawei.
VRP
W Wide Area Network A network that covers a large geographic area, such as a country or a state. Devices in this network are connected through certain protocol or physical links.
Issue 01 (2011-05-30)
A-3
A Glossary
X.25
A data link layer protocol. It defines the communication in the Public Data Network (PDN) between a host and a remote terminal.
A-4
Issue 01 (2011-05-30)
B Acronyms and Abbreviations
B
A AAA ACK ASCII ATM
Acronyms and Abbreviations
This appendix collates frequently used acronyms and abbreviations in this document.
Authentication, Authorization and Accounting Acknowledgement American Standard Code for Information Interchange Asynchronous Transfer Mode
B BGP Border Gateway Protocol
C CIDR Classless Inter-Domain Routing
D DHCP DLCI DNS DOS DAD Dynamic Host Configuration Protocol Data Link Control Identifier Domain Name System Denial of Service Duplicate Address Detect
E EBGP External BGP
Issue 01 (2011-05-30)
B-1
F FEC FIB G GRE Generic Routing Encapsulation Forward Error Correction Forward Information Base
H HDLC HTTP High level Data Link Control Hyper Text Transport Protocol
I IBGP ICMP IEEE IETF IGP IP IPoEoA IPSec IS-IS ISP Internal BGP Internet Control Message Protocol Institute of Electrical and Electronics Engineers Internet Engineering Task Force Interior Gateway Protocol Internet Protocol IP over Ethernet over AAL5 Internet Protocol SECurity extensions Intermediate System-Intermediate System Internet Service Provider
L LDP LSP Label Distribution Protocol Label Switch Path
M MAC MED MPLS Medium Access Control Multi-Exit discrimination Multi-Protocol Label Switching
B-2
Issue 01 (2011-05-30)
NAT NAT-PT NIC
Network Address Translation Network Address Translation - Protocol Translation Network Information Center
O OSPF Open Shortest Path First
P PC PE POS PPP PVC Personal Computer Provider Edge Packet Over SDH/SONET Point-to-Point Protocol Permanent Virtual Circuit
Q QoS Quality of Service
R RIP RPR Routing Information Protocol Resilient Packet Ring
S SLIP SNMP SVC Serial Line Internet Protocol Simple Network Management Protocol Switched Virtual Channel
T TCP TFTP TOS TTL Transmission Control Protocol Trivial File Transfer Protocol Type of Service Time To Live
Issue 01 (2011-05-30)
B-3
U UDP URPF User Datagram Protocol Unicast Reverse Path Forwarding
V VLAN VPN VRP VRRP VT Virtual Local Area Network Virtual Private Network Versatile Routing Platform Virtual Router Redundancy Protocol Virtual-Template
W WINS WWW Windows Internet Name Service World Wide Web
B-4
Issue 01 (2011-05-30)

Configuration Guide - IP Services (V600R003C00 - 01)

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Configuration Guide - IP Services (V600R003C00 - 01)

Uploaded by

Copyright:

Available Formats

HUAWEI CX600 Metro Services Platform V600R003C00

Configuration Guide - IP Services

HUAWEI TECHNOLOGIES CO., LTD.

Trademarks and Permissions

Huawei Technologies Co., Ltd.

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

About This Document

About This Document

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

About This Document

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

Changes in Issue 01 (2011-05-16)

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

8 Basic IPv6 Configuration..........................................................................................................8-1

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

9 IPv6 DNS Configuration..........................................................................................................9-1

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

10 ACL6 Configuration.............................................................................................................. 10-1

11 IPv6 over IPv4 Tunnel Configuration................................................................................11-1

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

12 IPv4 over IPv6 Tunnel Configuration................................................................................12-1

A Glossary.....................................................................................................................................A-1 B Acronyms and Abbreviations.................................................................................................B-1

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

1.1 IP Addresses Overview

1.1.1 Introduction to IP Addresses

1.1.2 Features of IP Addresses Supported by the CX600

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

1.2 Configuring IP Addresses for Interfaces

1.2.1 Establishing the Configuration Task

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

1.2.2 Configuring a Primary IP Address for an Interface

The system view is displayed. Step 2 Run:

The interface view is displayed. Step 3 Run:

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

1.2.3 (Optional) Configuring a Secondary IP Address for an Interface

The system view is displayed. Step 2 Run:

The interface view is displayed. Step 3 Run:

1.2.4 Checking the Configuration

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

1.3 Configuring IP Address Negotiation on Interfaces

1.3.1 Establishing the Configuration Task

Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd.

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

1.3.2 Configuring a Server to Assign an IP Address for a Client Through Negotiation

The system view is displayed.

Step 2 (Optional) Run:

HUAWEI CX600 Metro Services Platform Configuration Guide - IP Services

The AAA view is displayed. Step 3 (Optional) Run:

The local IP address pool is configured. Step 4 (Optional) Run:

Quit the AAA view. Step 5 Run: