Huawei AR150&200 Series Enterprise Routers V200R002C00. Configuration Guide - IP Service. Issue 02 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 V200R002C00 Issue 02 Date HUAWEI TECHNOLOGIES CO., LTD.

2 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China i

3 About This Document About This Document Intended Audience This document provides the basic concepts, configuration procedures, and configuration examples in different application scenarios of the IP service feature supported by the AR150/200. This document describes how to configure the IP service feature. This document is intended for: Data configuration engineers Commissioning engineers Network monitoring engineers System maintenance engineers Symbol Conventions The symbols that may be found in this document are defined as follows. Symbol Description DANGER WARNING CAUTION Indicates a hazard with a high level of risk, which if not avoided, will result in death or serious injury. Indicates a hazard with a medium or low level of risk, which if not avoided, could result in minor or moderate injury. Indicates a potentially hazardous situation, which if not avoided, could result in equipment damage, data loss, performance degradation, or unexpected results. TIP NOTE Indicates a tip that may help you solve a problem or save time. Provides additional information to emphasize or supplement important points of the main text. ii

4 About This Document Command Conventions The command conventions that may be found in this document are defined as follows. Convention Boldface Italic Description The keywords of a command line are in boldface. Command arguments are in italics. [ ] Items (keywords or arguments) in brackets [ ] are optional. { x y... } Optional items are grouped in braces and separated by vertical bars. One item is selected. [ x y... ] Optional items are grouped in brackets and separated by vertical bars. One item is selected or no item is selected. { x y... } * Optional items are grouped in braces and separated by vertical bars. A minimum of one item or a maximum of all items can be selected. [ x y... ] * Optional items are grouped in brackets and separated by vertical bars. Several items or no item can be selected. &<1-n> The parameter before the & sign can be repeated 1 to n times. A line starting with the sign is comments. Interface Numbering Conventions Interface numbers used in this manual are examples. In device configuration, use the existing interface numbers on devices. Change History Updates between document issues are cumulative. Therefore, the latest document issue contains all updates made in previous issues. Changes in Based on issue 01 ( ), the document is updated as follows: The following information is added: Disabling the Routing and Forwarding Function on High-end LAN Cards The following information is modified: Enabling the DHCP/BOOTP Client iii

5 About This Document Changes in Issue 01 ( ) Initial commercial release. iv

6 Contents Contents About This Document...ii 1 ARP Configuration ARP Overview ARP Features Supported by the AR150/ Configuring Static ARP Establishing the Configuration Task Configuring a Static ARP Entry Configuring a Static ARP Entry in a VLAN Configuring a Static ARP Entry in a VPN Instance Checking the Configuration Optimizing Dynamic ARP Establishing the Configuration Task Adjusting Parameters of Dynamic ARP Entries Enabling ARP Suppression Enabling Layer 2 Topology Detection Checking the Configuration Configuring Routed Proxy ARP Establishing the Configuration Task Configuring an IP Addresses for an Interface Configuring Routed Proxy ARP Checking the Configuration Configuring Intra-VLAN Proxy ARP Establishing the Configuration Task Configuring an IP Address for an Interface (Optional) Configuring the VLAN ID of a Sub-interface Enabling Intra-VLAN Proxy ARP Checking the Configuration Configuring Inter-VLAN Proxy ARP Establishing the Configuration Task Configuring an IP Addresses for an Interface (Optional) Configuring the VLAN ID of the Sub-interface Enabling Inter-VLAN Proxy ARP Checking the Configuration...19 v

7 Contents 1.8 Configuring ARP-Ping IP Establishing the Configuration Task Checking an IP Address by Using ARP-Ping IP Configuring ARP-Ping MAC Establishing the Configuration Task Checking a MAC Address by Using ARP-Ping MAC Maintaining ARP Deleting ARP Entries Monitoring the ARP Running Status Configuration Examples Example for Configuring Static ARP Example for Configuring Routed Proxy ARP Example for Configuring Intra-VLAN Proxy ARP Example for Configuring Inter-VLAN Proxy ARP Example for Configuring Layer 2 Topology Detection IP Address Configuration IP Address Overview IP Addresses Supported by the AR150/ Configuring IP Addresses for an Interface Establishing the Configuration Task Configuring a Primary IP Address for an Interface (Optional) Configuring a Secondary IP Address for an Interface Checking the Configuration Configuring IP Address Unnumbered on an Interface Establishing the Configuration Task Configuring a Primary IP Address for the Interface from Which an IP Address Will Be Borrowed Configuring IP Address Unnumbered on an Interface Checking the Configuration Configuration Examples Example for Configuring Primary and Secondary IP Addresses for an Interface Example for Configuring IP Address Unnumbered on an Interface Basic IPv6 Configuration Introduction to IPv IPv6 Supported by the AR150/ Configuring an IPv6 Address for an Interface Establishing the Configuration Task Enabling IPv6 Packet Forwarding Capability Configuring an IPv6 Link-Local Address for an Interface Configuring an IPv6 Global Unicast Address for an Interface Configuring an IPv6 Anycast Address for an Interface Checking the Configuration...58 vi

8 Contents 3.4 Configuring IPv6 Neighbor Discovery Establishing the Configuration Task Configuring Static Neighbors Enabling RA Message Advertising Setting the Interval for Advertising RA Messages Configuring the Address Prefixes to Be Advertised Configuring Other Information to Be Advertised Configuring the Default Router Priority and Route Information Checking the Configuration Configuring IPv4/IPv6 Dual Stacks Establishing the Configuration Task Enabling IPv6 Packet Forwarding Configuring IPv4 and IPv6 Addresses for the Interface Checking the Configuration Configuring PMTU Establishing the Configuration Task Creating Static PMTU Entries Configuring PMTU Aging Time Checking the Configuration Configuring TCP Establishing the Configuration Task Configuring TCP6 Timers Configuring the Size of the TCP6 Sliding Window Checking the Configuration Maintaining IPv Resetting IPv Configuration Examples Example for Configuring an IPv6 Address for an Interface Example for Configuring IPv6 Neighbor Discovery DNS Configuration DNS Overview DNS Features Supported by the AR150/ Configuring a DNS Client Establishing the Configuration Task Configuring Static DNS Configuring Dynamic DNS Checking the Configuration Configuring DNS Proxy or Relay Establishing the Configuration Task Configuring a DNS Server (Optional) Configuring DNS Spoofing (Optional) Setting the Aging Time of DNS Entries...89 vii

9 Contents Checking the Configuration Configuring a DDNS Client Establishing the Configuration Task Creating a DDNS Policy Configuring a DDNS Policy Binding a DDNS Policy to an Interface Checking the Configuration Maintaining DNS Deleting Dynamic DNS Entries of DNS Clients Deleting DNS Entries of the DNS Proxy or Relay Manually Updating a DDNS Policy Configuration Examples Example for Configuring a DNS Client Example for Configuring DNS Proxy Example for Configuring a DDNS Client NAT Configuration NAT Overview NAT Features Supported by the AR150/ Configuring NAT Establishing the Configuration Task Configuring an Address Pool Associating an ACL with an Address Pool Configuring Easy IP Configuring an Internal Server Configuring Static NAT Enabling NAT ALG Configuring NAT Filtering Configuring NAT Mapping Configuring DNS Mapping Configuring Twice NAT Checking the Configuration Configuration Examples Example for Configuring the NAT Server Example for Configuring Outbound NAT Example for Configuring Twice NAT DHCP Configuration DHCP Overview DHCP Features Supported by the AR150/ Configuring a DHCP Server Based on a Global Address Pool Establishing the Configuration Task Configuring an Interface to Select a Global Address Pool for IP Address Allocation Configuring Global Address Pool Attributes viii

10 Contents (Optional) Configuring the DNS Service and NetBIOS Service Dynamically on the DHCP Client (Optional) Configuring the Static DNS Service on a DHCP Client (Optional) Configuring the Static NetBIOS Service on a DHCP Client (Optional) Configuring User-Defined DHCP Options of the Global Address Pool (Optional) Configuring the Function That Prevents Identical IP Addresses Checking the Configuration Configuring a DHCP Server Based on an Interface Address Pool Establishing the Configuration Task Configuring Interface Address Pool Attributes (Optional) Configuring the DNS Service and NetBIOS Service Dynamically on the DHCP Client (Optional) Configuring the Static DNS Service on a DHCP Client (Optional) Configuring the Static NetBIOS Service on a DHCP Client (Optional) Configuring User-Defined DHCP Options of the Interface Address Pool (Optional) Configuring the Function That Prevents Identical IP Addresses Checking the Configuration Configuring a DHCP Relay Agent Establishing the Configuration Task Configuring an Interface to Function as a DHCP Relay Agent Specifying a Server Group on the DHCP Relay Agent Binding a DHCP Server Group to a DHCP Relay Interface (Optional) Configuring the DHCP Relay Agent to Instruct the DHCP Server to Reclaim the Client IP address Checking the Configuration Configuring a DHCP/BOOTP Client Establishing the Configuration Task (Optional) Configuring the DHCP/BOOTP Client Attributes Enabling the DHCP/BOOTP Client Checking the Configuration Configuring the DHCP Rate Limit Function Maintaining DHCP Clearing DHCP Statistics Monitoring the Operating Status of DHCP Configuration Examples Example for Configuring a DHCP Server Based on a Global Address Pool in the Scenario Where DHCP Clients and the DHCP Server Are on the Same Network Segment Example for Configuring a DHCP Server Based on an Interface Address Pool in the Scenario Where DHCP Clients and the Server Are on the Same Network Segment Example for Configuring a DHCP Server and a DHCP Relay Agent When the DHCP Server and Clients Are on Different Network Segments Example for Configuring the DHCP and BOOTP Clients Example for Configuring DHCP Rate Limit IP Performance Configuration ix

11 Contents 7.1 IP Performance Overview IP Performance Features Supported by the AR150/ Optimizing IP Performance Establishing the Configuration Task Checking Validity of Source IP Addresses of Received Packets Controlling IP packets with Source Route Options Configuring an Interface to Forward Broadcast Packets Configuring an Outbound Interface to Fragment IP Packets Configuring an Interface to Send ICMP Redirection Packets Setting the Mode in Which Protocol Packets Are Sent Checking the Configuration Configuring Load Balancing for IP Packet Forwarding Establishing the Configuration Task Configuring the Unequal-Cost Multiple Path During IP Packet Forwarding Checking the Configuration Configuring TCP Attributes Establishing the Configuration Task Setting Values of TCP Timers Setting the Aging Time of the PMTU Setting the Size of the TCP Sliding Window Setting the MSS of TCP Packets on an Interface Checking the Configuration Maintaining IP Performance Clearing IP Performance Statistics Monitoring the IP Running Status Configuration Examples Example for Disabling the Sending of ICMP Redirection Packets IP Unicast PBR Configuration PBR Overview PBR Supported by the AR150/ Configuring IP Policy-based Routing Establishing the Configuration Task Defining the Matching Rule of PBR Defining Actions of PBR Applying PBR Checking the Configuration Configuration Examples Example for Configuring IP Unicast PBR UDP Helper Configuration UDP Helper Overview UDP Helper Features Supported by the AR150/ Configuring UDP Helper x

12 Contents Establishing the Configuration Task Enabling UDP Helper (Optional) Configuring a UDP Port for Packets to Be Relayed Configuring a Destination Server Checking the Configuration Maintaining UDP Helper Clearing the UDP Helper Statistics Configuration Examples Example for Configuring UDP Helper xi

13 1 ARP Configuration 1 ARP Configuration About This Chapter ARP can map an IP address to a MAC address and implements transmission of Ethernet frames. 1.1 ARP Overview ARP dynamically maps Layer 3 IP addresses to Layer 2 MAC addresses. An Ethernet device must support ARP. 1.2 ARP Features Supported by the AR150/200 This section describes ARP Features supported by the AR150/ Configuring Static ARP Static ARP entries record fixed mappings between IP addresses and MAC addresses. They are configured manually by network administrators. 1.4 Optimizing Dynamic ARP If dynamic ARP is configured, the system resolves an IP address into an Ethernet MAC address. Dynamic ARP entries are maintained dynamically by the ARP protocol. You can adjust parameters of dynamic ARP entries such as the number of ARP probes and the aging time of dynamic ARP entries to optimize forwarding performance of the AR150/ Configuring Routed Proxy ARP Routed proxy ARP implements communication between devices on the same network segment but on different physical networks. 1.6 Configuring Intra-VLAN Proxy ARP Intra-VLAN proxy ARP enables hosts that are isolated at Layer 2 in a VLAN to communicate with each other. 1.7 Configuring Inter-VLAN Proxy ARP Inter-VLAN proxy ARP enables hosts in different sub-vlans of a super-vlan to communicate with each other. 1.8 Configuring ARP-Ping IP ARP-Ping IP checks whether an IP address on a LAN is in use by sending ARP packets. 1.9 Configuring ARP-Ping MAC ARP-Ping MAC checks whether a MAC address on a LAN is in use by sending Internet Control Management Protocol (ICMP) packets. 1

14 1 ARP Configuration 1.10 Maintaining ARP This section describes how to maintain ARP Configuration Examples 2

15 1 ARP Configuration 1.1 ARP Overview ARP dynamically maps Layer 3 IP addresses to Layer 2 MAC addresses. An Ethernet device must support ARP. On a LAN, a host or a network device must know the IP address of another host or network device to send data to it. In addition, the physical address of the destination device must also be known because IP packets are encapsulated in frames for transmission across a physical network. Therefore, the mapping from an IP address to a physical address is required. ARP maps IP addresses to physical addresses. 1.2 ARP Features Supported by the AR150/200 ARP Proxy ARP This section describes ARP Features supported by the AR150/200. The AR150/200 supports dynamic ARP, static ARP, proxy ARP, and ARPing. ARP is classified into the following types: Static ARP: Mappings between IP addresses and MAC addresses are configured manually. Dynamic ARP: Dynamic ARP entries are maintained by the ARP protocol. The AR150/200 supports the following types of proxy ARP: Routed proxy ARP Routed proxy ARP implements communication between devices on the same network segment but on different physical networks. If a device connected to the AR150/200 is not configured with a default gateway address (that is, the device does not know how to reach the intermediate system of the network), the device cannot forward data packets. Routed proxy ARP solves this problem. A device sends an ARP Request packet to request the MAC address of the destination host. After receiving the packet, the AR150/200 enabled with proxy ARP replies with its own MAC address. The AR150/200 then functions as the gateway to route packets to the actual destination. Proxy ARP can also shield topologies of physical networks so that internal hosts of Ethernet A and Ethernet B on different physical networks but on the same network segment can communicate. Intra-VLAN proxy ARP If two users belong to the same VLAN but port isolation is configured in the VLAN, to enable the two users to communicate, you must enable intra-vlan proxy ARP on an interface associated with the VLAN. If an interface on the AR150/200 is enabled with intra-vlan proxy ARP, it does not discard the ARP request packet that is destined for another interface. Instead, it searches for the corresponding ARP entry of the interface. If the ARP entry is found, the interface sends the MAC address of the AR150/200 to the sender of the ARP request. 3

16 1 ARP Configuration Proxy ARP within a VLAN implements the interworking between isolated users in the same VLAN. Inter-VLAN proxy ARP If two users belong to different VLANs, to implement communication between the two users, you must enable inter-vlan proxy ARP on an interface associated with the VLANs. If an interface on the AR150/200 is enabled with inter-vlan proxy ARP, it does not discard the ARP request packet that is destined for another interface. Instead, it searches for the corresponding ARP entry of the interface. If the ARP entry is found, the interface sends the MAC address of the AR150/200 to the sender of the ARP request. Inter-VLAN proxy ARP implements the following functions: Layer 3 communication between users in different VLANs Communication between users in sub-vlans (you must enable inter-vlan proxy ARP on the VLANIF interface corresponding to the super-vlan) ARPing ARPing is classified into ARP-Ping IP and ARP-Ping MAC. ARPing facilitates maintenance of deployed Layer 2 features. ARP-Ping IP checks whether an IP address on a LAN is in use by sending ARP packets. ARP-Ping MAC checks whether a MAC address on a LAN is in use by sending Internet Control Management Protocol (ICMP) packets. 1.3 Configuring Static ARP Static ARP entries record fixed mappings between IP addresses and MAC addresses. They are configured manually by network administrators Establishing the Configuration Task Applicable Environment Pre-configuration Tasks Before configuring static ARP, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. Static ARP entries ensure communication between the local device and another specified device. They use the specified MAC address to keep attackers from modifying mappings between IP addresses and MAC addresses in static ARP entries. When static ARP and the Virtual Router Redundancy Protocol (VRRP) are configured on the router, the IP address in a static ARP entry cannot be set to the VRRP virtual IP address on a sub-interface for dot1q VLAN tag termination, a sub-interface for VLAN tag termination, or a VLANIF interface. Otherwise, an incorrect host route is generated, causing forwarding errors. Before configuring static ARP, complete the following tasks: 4

17 1 ARP Configuration Data Preparation Connecting interfaces and setting physical parameters for the interfaces to ensure that the physical layer status of the interfaces is Up Setting link layer protocol parameters for interfaces to ensure that the link layer protocol status on the interfaces is Up Setting network layer protocol parameters for the interfaces to ensure that the routing protocol status on the interfaces is Up To configure static ARP, you need the following data. No. Data 1 IP address and MAC address in a static ARP entry 2 Name of the VPN instance and ID of the VLAN that a static ARP entry belongs to 3 Outbound interface of ARP packets Configuring a Static ARP Entry Static ARP entries are valid as long as the AR150/200 works properly. Context NOTE To configure static ARP entries for double-tagged packets, run the arp static cevid command. system-view The system view is displayed. Step 2 arp static ip-address mac-address A static ARP entry is configured Configuring a Static ARP Entry in a VLAN This section describes how to configure a static ARP entry in a VLAN. Context NOTE To configure static ARP entries for double-tagged packets, run the arp static cevid command. 5

18 1 ARP Configuration system-view The system view is displayed. Step 2 arp static ip-address mac-address vid vlan-id interface interface-type interfacenumber A static ARP entry is configured in a VLAN. When configuring a static ARP entry in a VLAN, you must specify the outbound interface so that the packets are sent out from the specified outbound interface Configuring a Static ARP Entry in a VPN Instance Context To implement Layer 2 communication between devices in a VPN instance, you can configure static ARP entries in the VPN instance. NOTE To configure static ARP entries for double-tagged packets, run the arp static cevid command. system-view The system view is displayed. Step 2 arp static ip-address mac-address vpn-instance vpn-instance-name A static ARP entry is configured for a VPN instance Checking the Configuration Run the display arp [ all ] command to check all ARP entries, including static ARP entries and dynamic ARP entries. Run the display arp network net-number net-mask [ dynamic static ] command to check ARP entries on the specified network segment. Run the display arp static command to check static ARP entries. Run the display arp statistics { all interface interface-type interface-number } command to check statistics on ARP entries on the AR150/200 or the specified interface. 6

19 1 ARP Configuration Example Display all the static ARP entries. <Huawei> display arp static IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC efc e3 S-- 10/ e00-fc S aa00-fcc S-- 3/ Total:3 Dynamic:0 Static:3 Interface:0 Display all the ARP entries. <Huawei> display arp all IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC e0-fc S I - Vlanif11 vpna I - Vlanif I - Eth c D-0 Eth ecb7-a D-0 Eth Total:6 Dynamic:2 Static:1 Interface:3 1.4 Optimizing Dynamic ARP If dynamic ARP is configured, the system resolves an IP address into an Ethernet MAC address. Dynamic ARP entries are maintained dynamically by the ARP protocol. You can adjust parameters of dynamic ARP entries such as the number of ARP probes and the aging time of dynamic ARP entries to optimize forwarding performance of the AR150/ Establishing the Configuration Task Applicable Environment Pre-configuration Tasks Before optimizing Dynamic ARP, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. Dynamic ARP entries are maintained dynamically by the ARP protocol. They can be aged out, updated, or overridden by static ARP entries. When the aging time is reached or the interface is Down, corresponding dynamic ARP entries are deleted. The AR150/200 can dynamically create dynamic ARP entries. You can adjust parameters of dynamic ARP entries to optimize forwarding performance of the AR150/200. Before optimizing Dynamic ARP, complete the following tasks: Connecting interfaces and setting physical parameters for the interfaces to ensure that the physical layer status of the interfaces is Up 7

20 1 ARP Configuration Data Preparation Setting link layer protocol parameters for interfaces to ensure that the link layer protocol status on the interfaces is Up Configuring the network layer protocol on the interfaces To optimize Dynamic ARP, you need the following data. No. Data 1 Number of the interface where dynamic ARP entries are created 2 Maximum number of ARP probes 3 Aging time of dynamic ARP entries Adjusting Parameters of Dynamic ARP Entries When the AR150/200 frequently updates ARP entries, you can shorten the aging time of dynamic ARP entries and the interval for ARP probes and increase the number of ARP probes. system-view The system view is displayed. Step 2 interface interface-type interface-number The interface view is displayed. On the AR150/200, you can adjust the parameters of parameters of dynamic ARP entries on Ethernet interfaces, Eth-Trunk interfaces, VLANIF interfaces, and VE interfaces. Step 3 arp expire-time expire-time The aging time of dynamic ARP entries is set. By default, the aging time is 1200s. Step 4 arp detect-times detect-times The number of ARP probes is set. By default, the maximum number of ARP probes is 3. When the aging time of a dynamic ARP entry is reached, the AR150/200 sends an ARP probe packet to the peer device periodically. If the AR150/200 does not receive an ARP Reply packet from the peer device after the specified number of ARP probes, it deletes the ARP entry. Step 5 (Optional) arp detect-mode unicast 8

21 1 ARP Configuration An interface is configured to send ARP probe packets in unicast mode. By default, an interface broadcasts ARP probe packets Enabling ARP Suppression If the system receives a great number of ARP packets from the same source at a time, it has to update ARP entries repeatedly, causing performance deterioration. To ensure system performance, you can enable ARP suppression. The system then only responds to the ARP packets but does not update ARP entries. system-view The system view is displayed. Step 2 arp-suppress enable ARP suppression is enabled. By default, ARP suppression is disabled in the system but is enabled on VLANIF interfaces. After ARP suppression is enabled, it takes effect for only Eth-Trunk interfaces and VLANIF interfaces Enabling Layer 2 Topology Detection Layer 2 topology detection enables the system to update all the ARP entries in the VLAN that a Layer 2 interface belongs to when the Layer 2 interface status changes from Down to Up. system-view The system view is displayed. Step 2 l2-topology detect enable Layer 2 topology detection is enabled. By default, Layer 2 topology detection is disabled Checking the Configuration You can view the dynamic ARP configuration. 9

22 1 ARP Configuration Run the display arp [ all ] command to check all ARP entries, including static ARP entries and dynamic ARP entries. Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP entries on the specified interface. Run the display arp network net-number net-mask [ dynamic static ] command to check ARP entries on the specified network segment. Run the display arp dynamic command to check dynamic ARP entries. Run the display arp statistics { all interface interface-type interface-number } command to check statistics on ARP entries on the AR150/200 or the specified interface. Example Run the display arp interface command, and you can view ARP entries on Eth1/0/0. <Huawei> display arp interface ethernet 1/0/0 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC a I - Eth1/0/0 r a D-6 Eth1/0/0 r Total:2 Dynamic:1 Static:0 Interface:1 Display all the dynamic ARP entries. <Huawei> display arp dynamic IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC e0-fc I - Eth1/0/ e38-a09e 20 D-0 Eth1/0/ e0-fc D-0 Eth1/0/ e0-fc I - Eth-Trunk e0-fc I - Eth2/0/ e0-fc I - Vlanif e0-fc I - Vlanif Total:7 Dynamic:2 Static:0 Interface:5 1.5 Configuring Routed Proxy ARP Routed proxy ARP implements communication between devices on the same network segment but on different physical networks Establishing the Configuration Task Before configuring routed proxy ARP, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. 10

23 1 ARP Configuration Applicable Environment Pre-configuration Tasks Data Preparation If two hosts on different network segments are not configured with the default gateways, you can enable routed proxy ARP to on a routing device connecting the two hosts to resolve IP addresses between the two hosts. Before configuring routed proxy ARP, complete the following tasks: Connecting interfaces and setting physical parameters for the interfaces to ensure that the physical layer status of the interfaces is Up Setting link layer protocol parameters for interfaces to ensure that the link layer protocol status on the interfaces is Up To configure routed proxy ARP, you need the following data. No. Data 1 Number of the interface where routed proxy ARP is to be enabled 2 IP address of the interface where routed proxy ARP is to be enabled Configuring an IP Addresses for an Interface The IP address of the interface enabled with routed proxy ARP must be on the same network segment as the IP address of the connected host on a LAN. system-view The system view is displayed. Step 2 interface interface-type interface-number [.subinterface-number ] The interface view is displayed. Routed proxy ARP can be enabled on Ethernet interfaces, Ethernet sub-interfaces, VE interfaces, Eth-Trunk interfaces, Eth-Trunk sub-interfaces, and VLANIF interfaces. The preceding interfaces and sub-interfaces are Layer 3 interfaces and sub-interfaces. Step 3 ip address ip-address { mask mask-length } An IP address is configured for the interface. The IP address of the interface enabled with routed proxy ARP must be on the same network segment as the IP address of the connected host on a LAN. 11

24 1 ARP Configuration Configuring Routed Proxy ARP Routed proxy ARP implements communication between devices on different subnets. system-view The system view is displayed. Step 2 interface interface-type interface-number The interface view is displayed. Routed proxy ARP can be enabled on Ethernet interfaces, Ethernet sub-interfaces, VE interfaces, Eth-Trunk interfaces, Eth-Trunk sub-interfaces, and VLANIF interfaces. The preceding interfaces and sub-interfaces are Layer 3 interfaces and sub-interfaces. Step 3 arp-proxy enable Routed proxy ARP is enabled on the interface. By default, routed proxy ARP is disabled on an interface Checking the Configuration After configuring routed proxy ARP, you can view the configuration. Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP entries on the specified interface. Run the display arp vpn-instance vpn-instance-name [ dynamic static ] command to check ARP entries in the specified VPN instance. Run the display arp dynamic command to check dynamic ARP entries. Run the display arp statistics { all interface interface-type interface-number } command to check statistics on ARP entries on the AR150/200 or the specified interface. Example Run the display arp interface command, and you can view ARP entries on Eth1/0/0. <Huawei> display arp interface ethernet 1/0/0 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC a I - Eth1/0/0 r a D-6 Eth1/0/0 r Total:2 Dynamic:1 Static:0 Interface:1 12

25 1 ARP Configuration Run the display arp vpn-instance command, and you can view all the ARP entries in the VPN instance r1. <Huawei> display arp vpn-instance r1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC I - Vlanif I - Vlanif Total:2 Dynamic:0 Static:0 Interface:2 Run the display arp statistics command, and you can view the statistics on ARP entries. <Huawei> display arp statistics all Dynamic:1 Static:0 1.6 Configuring Intra-VLAN Proxy ARP Intra-VLAN proxy ARP enables hosts that are isolated at Layer 2 in a VLAN to communicate with each other Establishing the Configuration Task Applicable Environment Pre-configuration Tasks Data Preparation Before configuring intra-vlan proxy ARP, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the required data. This will help you complete the configuration task quickly and accurately. If two users are connected to Layer 2 isolated interfaces in the same VLAN, you can enable intra-vlan proxy ARP to implement Layer 3 communication between the two users. Before configuring intra-vlan proxy ARP, complete the following tasks: Connecting interfaces and setting physical parameters for the interfaces to ensure that the physical layer status of the interfaces is Up Configuring a VLAN Configuring port isolation in a VLAN To configure intra-vlan proxy ARP, you need the following data. No. Data 1 Number of the interface where intra-vlan proxy ARP is to be enabled 2 IP address of the interface where intra-vlan proxy ARP is to be enabled 3 VLAN ID associated with the interface to be enabled with proxy ARP in a VLAN 13

26 1 ARP Configuration Configuring an IP Address for an Interface The IP address of the interface must be on the same network segment as the IP addresses in the associated VLAN. system-view The system view is displayed. Step 2 interface { ethernet eth-trunk } interface-number.sub-interface-number The sub-interface view is displayed. Or, run: interface vlanif vlan-id The VLANIF interface view is displayed. Intra-VLAN proxy ARP can be enabled on VLANIF interfaces, Ethernet sub-interfaces, and Eth-Trunk sub-interfaces. Step 3 ip address ip-address { mask mask-length } An IP address is configured for the interface. The IP address of the interface must be on the same network segment as the IP addresses in the associated VLAN (Optional) Configuring the VLAN ID of a Sub-interface Context This section describes how to configure the VLAN ID of a sub-interface. NOTE You must complete this task before you enable intra-vlan proxy ARP on Ethernet sub-interfaces, or Eth- Trunk sub-interfaces. You can skip step when you are enabling intra-vlan proxy ARP on the VLANIF interface. system-view The system view is displayed. Step 2 interface { ethernet eth-trunk } interface-number.sub-interface-number The sub-interface view is displayed. 14

27 1 ARP Configuration Step 3 control-vid vid dot1q-termination The control VLAN and encapsulation mode of the sub-interface are configured. Step 4 dot1q termination vid vid The single VLAN ID for dot1q encapsulation on a sub-interface is configured Enabling Intra-VLAN Proxy ARP Intra-VLAN proxy ARP implements Layer 3 communication between isolated users in a VLAN. system-view The system view is displayed. Step 2 interface { ethernet eth-trunk } interface-number.sub-interface-number The sub-interface view is displayed. Or, run: interface vlanif vlan-id The VLANIF interface view is displayed. Step 3 arp-proxy inner-sub-vlan-proxy enable Intra-VLAN proxy ARP is enabled. By default, intra-vlan proxy ARP is disabled Checking the Configuration After configuring intra-vlan proxy ARP, you can view the intra-vlan proxy ARP configuration. Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP entries on the specified interface. Run the display arp vpn-instance vpn-instance-name [ dynamic static ] command to check ARP entries in the specified VPN instance. Run the display arp dynamic command to check dynamic ARP entries. Run the display arp statistics { all interface interface-type interface-number } command to check statistics on ARP entries on the AR150/200 or the specified interface. 15

28 1 ARP Configuration Example Run the display arp interface command, and you can view ARP entries on Eth1/0/0. <Huawei> display arp interface ethernet 1/0/0 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC a I - Eth1/0/0 r a D-6 Eth1/0/0 r Total:2 Dynamic:1 Static:0 Interface:1 Run the display arp vpn-instance command, and you can view all the ARP entries in the VPN instance r1. <Huawei> display arp vpn-instance r1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC I - Vlanif I - Vlanif Total:2 Dynamic:0 Static:0 Interface:2 Run the display arp statistics command, and you can view the statistics on ARP entries. <Huawei> display arp statistics all Dynamic:1 Static:0 1.7 Configuring Inter-VLAN Proxy ARP Inter-VLAN proxy ARP enables hosts in different sub-vlans of a super-vlan to communicate with each other Establishing the Configuration Task Applicable Environment Before configuring inter-vlan proxy ARP, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. The VLAN aggregation technology isolates broadcast domain by using multiple VLANs on a physical network so that different VLANs belong to the same subnet. This technology introduces the super-vlan and sub-vlan. A super-vlan contains one or more sub-vlans in different broadcast domains. A sub-vlan does not occupy an independent subnet segment. In a super- VLAN, IP addresses of hosts in different sub-vlans are on the subnet segment corresponding to the super-vlan. Sub-VLANs use the same Layer 3 interface to communicate. This reduces subnet IDs and subnet default gateway addresses. The VLAN aggregation function allows different broadcast domains to use the same subnet address, implements flexible addressing, and saves IP addresses. Hosts in different sub-vlans of a super-vlan cannot communicate with each other. To enable these hosts to communicate with each other, you can enable inter-vlan proxy ARP on the subinterface or VLANIF interface corresponding to the super-vlan. 16

29 1 ARP Configuration Pre-configuration Tasks Data Preparation Before configuring inter-vlan proxy ARP, complete the following tasks: Connecting interfaces and setting physical parameters for the interfaces to ensure that the physical layer status of the interfaces is Up Configuring VLAN aggregation To configure inter-vlan proxy ARP, you need the following data. No. Data 1 Number of the interface where inter-vlan proxy ARP is to be enabled 2 IP address of the interface where inter-vlan proxy ARP is to be enabled 3 VLAN ID associated with the interface to be enabled with proxy ARP between VLANs Configuring an IP Addresses for an Interface The IP address of the interface must be on the same network segment as the IP address of the user in a VLAN that the interface belongs to. system-view The system view is displayed. Step 2 interface { ethernet eth-trunk } interface-number.sub-interface-number The sub-interface view is displayed. Or, run: interface vlanif vlan-id The VLANIF interface view is displayed. Inter-VLAN proxy ARP can be enabled on VLANIF interfaces, Ethernet sub-interfaces, and Eth-Trunk sub-interfaces. Step 3 ip address ip-address { mask mask-length } An IP address is configured for the interface. The IP address of the interface must be on the same network segment as the IP address of the user in a VLAN that the interface belongs to. 17

30 1 ARP Configuration (Optional) Configuring the VLAN ID of the Sub-interface Context This section describes how to configure the VLAN ID of the sub-interface. NOTE You must complete this task before you enable inter-vlan proxy ARP on Ethernet sub-interfaces, or Eth- Trunk sub-interfaces. You can skip this task if you are enabling inter-vlan proxy ARP on the VLANIF interface. system-view The system view is displayed. Step 2 interface { ethernet eth-trunk } interface-number.sub-interface-number The sub-interface view is displayed. Step 3 control-vid vid dot1q-termination The control VLAN and encapsulation mode of the sub-interface are configured. Step 4 dot1q termination vid vid The single VLAN ID for dot1q encapsulation on a sub-interface is configured Enabling Inter-VLAN Proxy ARP To implement communication between users in different sub-vlans, enable inter-vlan proxy ARP on the sub-interface corresponding to the super-vlan. system-view The system view is displayed. Step 2 interface { ethernet eth-trunk } interface-number.sub-interface-number The sub-interface view is displayed. Or, run: interface vlanif vlan-id The VLANIF interface view is displayed. 18

31 1 ARP Configuration Step 3 arp-proxy inter-sub-vlan-proxy enable Inter-VLAN proxy ARP is enabled. By default, inter-vlan proxy ARP is disabled Checking the Configuration After configuring inter-vlan proxy ARP, you can view the inter-vlan proxy ARP configuration. Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlanid ] ] command to check ARP entries on the specified interface. Run the display arp vpn-instance vpn-instance-name [ dynamic static ] command to check ARP entries in the specified VPN instance. Run the display arp dynamic command to check dynamic ARP entries. Run the display arp statistics { all interface interface-type interface-number } command to check statistics on ARP entries on the AR150/200 or the specified interface. Example Run the display arp interface command, and you can view ARP entries on Eth1/0/0. <Huawei> display arp interface ethernet 1/0/0 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC a I - Eth1/0/0 r a D-6 Eth1/0/0 r Total:2 Dynamic:1 Static:0 Interface:1 Run the display arp vpn-instance command, and you can view all the ARP entries in the VPN instance r1. <Huawei> display arp vpn-instance r1 IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE VLAN/CEVLAN PVC I - Vlanif I - Vlanif Total:2 Dynamic:0 Static:0 Interface:2 Run the display arp statistics command, and you can view the statistics on ARP entries. <Huawei> display arp statistics all Dynamic:1 Static:0 1.8 Configuring ARP-Ping IP ARP-Ping IP checks whether an IP address on a LAN is in use by sending ARP packets. 19

32 1 ARP Configuration Establishing the Configuration Task Applicable Environment Pre-configuration Tasks Data Preparation Before configuring ARP-Ping IP, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. ARP-Ping IP checks whether an IP address on a LAN is in use by sending ARP packets. Before configuring an IP address for a device, ensure that this IP address is not in use by sending ARP packets. You can configure ARP-Ping IP on the device. Before configuring ARP-Ping IP, complete the following task: Setting link layer protocol parameters for interfaces to ensure that the link layer protocol status on the interfaces is Up To configure ARP-Ping IP, you need the following data. No. Data 1 IP address to be checked Checking an IP Address by Using ARP-Ping IP Context ARP-Ping IP checks whether an IP address on a LAN is in use by sending ARP Request packets. ARP-Ping IP checks whether an IP address on a LAN is in use by sending ARP packets. You can also use the ping command to check whether an IP address is in use, but the result of this method may be inaccurate. The ping command uses Layer 3 packets as ICMP Echo Request packets. If the destination host or the routing device enabled with the firewall function is configured not to respond to the ICMP Echo Request packets, the destination host or the routing device does not send ICMP Reply packets. Consequently, the IP address is considered unused. ARP packets, which are Layer 2 protocol packets, can pass through the firewall that is configured not to reply to ICMP Echo Request packets; therefore, the result of ARP-Ping IP is accurate. arp-ping ip ip-address [ interface interface-type interface-number [ vlan-id vlanid ] ] The AR150/200 is configured to check whether the IP address is in use on a LAN. 20

33 1 ARP Configuration Example If the following information is displayed, the IP address is not used. [Huawei] arp-ping ip ARP-Pinging : Error: Request timed out. Error: Request timed out. Error: Request timed out. Info: The IP address is not used by anyone! If the following information is displayed, the IP address is used. [Huawei] arp-ping ip ARP-Pinging : is used by 00e0-517d-f Configuring ARP-Ping MAC ARP-Ping MAC checks whether a MAC address on a LAN is in use by sending Internet Control Management Protocol (ICMP) packets Establishing the Configuration Task Applicable Environment Pre-configuration Tasks Data Preparation Before configuring ARP-Ping MAC, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration. This will help you complete the configuration task quickly and accurately. If you know the specific MAC address but not the corresponding IP address on a network segment, you can obtain the corresponding IP address by using ARP-Ping MAC to broadcast ICMP packets. In this way, you can obtain the IP address mapping the MAC address on the network segment. Before configuring ARP-Ping MAC, complete the following task: Setting link layer protocol parameters for interfaces to ensure that the link layer protocol status on the interfaces is Up To configure ARP-Ping MAC, you need the following data. No. Data 1 MAC address to be checked 21