Quidway S2700 Series Ethernet Switches V100R006C00. Configuration Guide - IP Service. Issue 01 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 V100R006C00 Issue 01 Date HUAWEI TECHNOLOGIES CO., LTD.

2 2011. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China i

3 About This Document About This Document Intended Audience This document describes the configurations of the IP services of the S2700, including the basic knowledge and configurations of secondary IP addresses, DNS, IP performance, basic IPv6 functions. By reading this document, you can learn the concepts and configuration procedures of IP services. This document is intended for: Policy planning engineers Installation and commissioning engineers NM configuration engineers Technical support engineers Symbol Conventions The symbols that may be found in this document are defined as follows. Symbol Description DANGER WARNING CAUTION Indicates a hazard with a high level of risk, which if not avoided, will result in death or serious injury. Indicates a hazard with a medium or low level of risk, which if not avoided, could result in minor or moderate injury. Indicates a potentially hazardous situation, which if not avoided, could result in equipment damage, data loss, performance degradation, or unexpected results. TIP NOTE Indicates a tip that may help you solve a problem or save time. Provides additional information to emphasize or supplement important points of the main text. ii

4 About This Document Command Conventions The command conventions that may be found in this document are defined as follows. Convention Boldface Italic Description The keywords of a command line are in boldface. Command arguments are in italics. [ ] Items (keywords or arguments) in brackets [ ] are optional. { x y... } Optional items are grouped in braces and separated by vertical bars. One item is selected. [ x y... ] Optional items are grouped in brackets and separated by vertical bars. One item is selected or no item is selected. { x y... } * Optional items are grouped in braces and separated by vertical bars. A minimum of one item or a maximum of all items can be selected. [ x y... ] * Optional items are grouped in brackets and separated by vertical bars. Several items or no item can be selected. &<1-n> The parameter before the & sign can be repeated 1 to n times. A line starting with the sign is comments. Change History Updates between document issues are cumulative. Therefore, the latest document issue contains all changes made in previous issues. Changes in Initial commercial release. iii

5 Contents Contents About This Document...ii 1 IP Addresses Configuration Introduction to IP Addresses Features of IP Addresses Supported by the S Configuring IP Addresses for Interfaces Establishing the Configuration Task Configuring a Primary IP Address for an Interface (Optional) Configuring a Secondary IP Address for an Interface Checking the Configuration Configuration Examples Example for Setting Primary and Secondary IP Addresses ARP Configuration Overview of ARP ARP Features Supported by the S Configuring Static ARP Establishing the Configuration Task Configuring Common Static ARP Entries Configuring Static ARP Entries in a VLAN Checking the Configuration Optimizing Dynamic ARP Establishing the Configuration Task Modify the aging parameters of dynamic ARP Enabling ARP Suppression Function Enabling Layer 2 Topology Detection Function Checking the Configuration Configuring Routed Proxy ARP Establishing the Configuration Task Configure an IP Addresses for the Interface Enabling the Routed Proxy ARP Function Checking the Configuration Configuring Proxy ARP Within a VLAN Establishing the Configuration Task...17 iv

6 Contents Configure an IP Addresses for the Interface Enabling Proxy ARP Within a VLAN Checking the Configuration Configuring Proxy ARP Between VLANs Establishing the Configuration Task Configuring an IP Addresses for the Interface Enabling Proxy ARP Between VLANs Checking the Configuration Maintaining ARP Clearing ARP Entries Monitoring Network Operation Status of ARP Debugging ARP Configuration Examples Example for Configuring ARP Example for Configuring Routed Proxy ARP Example for Configuring Intra-VLAN Proxy ARP Example for Configuring Inter-VLAN Proxy ARP Example for Configuring Layer 2 Topology Detection IP Performance Configuration Introduction to IP Performance IP Performance Supported by the S Optimizing IP Performance Establishing the Configuration Task Enabling an Interface to Check the Source IP Addresses of Packets Configuring ICMP Attributes Setting TCP Parameters Checking the Configuration Maintaining IP Performance Clearing IP Performance Statistics Monitoring the Running Status of IP Performance Debugging IP Performance Configuration Examples Example for Disabling the Sending of ICMP Host Unreachable Packets DNS Configuration Introduction to DNS DNS Supported by the S Configuring DNS Establishing the Configuration Task Configuring Static DNS Entries Configuring Dynamic DNS Checking the Configuration Maintaining DNS...50 v

7 Contents Clearing DNS Entries Monitoring Network Operation Status of DNS Debugging DNS Configuration Examples Example for Configuring DNS Basic Configurations of IPv Introduction to IPv IPv6 Features Supported by the S Configuring an IPv6 Address for an Interface Establishing the Configuration Task Enabling IPv6 Packet Forwarding Capability Configuring an IPv6 Link-Local Address for an Interface Configuring an IPv6 Global Unicast Address for an Interface Checking the Configuration Configuring IPv6 Neighbor Discovery Establishing the Configuration Task Configuring Static Neighbors Enabling RA Message Advertising Setting the Interval for Advertising RA Messages Enabling Stateful Auto Configuration Configuring the Address Prefixes to Be Advertised Configuring Other Information to Be Advertised Checking the Configuration Maintaining IPv Clearing IPv6 Statistics Monitoring the Running Status of IPv Debugging IPv Configuration Examples Example for Setting an IPv6 Address for an Interface IPv6 DNS Configuration Introduction to IPv6 DNS IPv6 DNS Supported by the S Configuring IPv6 DNS Establishing the Configuration Task Configuring a Static IPv6 DNS Entry Configuring the Dynamic IPv6 DNS Services Checking the Configuration Maintaining IPv6 DNS Clearing IPv6 DNS Entries Monitoring Network Operation Status of IPv6 DNS Configuration Examples...79 vi

8 Contents Example for Configuring IPv6 DNS...79 vii

9 1 IP Addresses Configuration 1 IP Addresses Configuration About This Chapter By assigning IP addresses to network devices, you can enable data communications between the network devices. 1.1 Introduction to IP Addresses IP is the core of the TCP/IP protocol suite. The packets of the Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), and Internet Group Membership Protocol (IGMP) are all transmitted in the format of IP datagrams. Devices on different networks communicate with each other using their network layer addresses, namely IP addresses. 1.2 Features of IP Addresses Supported by the S2700 IP addresses can be obtained through static manual configuration or DHCP. 1.3 Configuring IP Addresses for Interfaces Assigning an IP address to a device on a network enables the device to communicate with the other devices on the network. 1.4 Configuration Examples This section provides several examples of IP address configuration. 1

10 1 IP Addresses Configuration 1.1 Introduction to IP Addresses IP is the core of the TCP/IP protocol suite. The packets of the Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), and Internet Group Membership Protocol (IGMP) are all transmitted in the format of IP datagrams. Devices on different networks communicate with each other using their network layer addresses, namely IP addresses. To communicate with each other on Internet Protocol (IP) networks, each host must be assigned an IP address. An IP address is a 32-bit number that is composed of two parts, namely, the network ID and host ID. The network ID identifies a network and the host ID identifies a host on the network. If the network IDs of hosts are the same, it indicates that the hosts are on the same network regardless of their physical locations. 1.2 Features of IP Addresses Supported by the S2700 IP addresses can be obtained through static manual configuration or DHCP. The S2700 supports IP address configuration through the following methods: Manually configuring an IP address for an interface Obtaining an IP address by DHCP The S2700 supports the space overlapping of network segment addresses to save the address space. Different IP addresses in the overlapped network segments but not same can be configured on different interfaces of the same device. For example, after an interface on a device is configured with the IP address /16, if another interface is configured with the IP address /24, the system prompts a message. However, the configuration is still successful; if another interface is configured with the IP address /16, the system prompts an IP address conflict. The configuration fails. The primary IP address and the secondary IP address in the overlapped network segments but not same can be configured on the same interface. For example, after the interface is configured with a primary IP address /24, if the secondary IP address is /16 sub, the system prompts a message. However, the configuration is still successful. The primary IP address and the secondary IP address in the overlapped network segments but not same can be configured on different interfaces of the same device. However, the primary IP address and the secondary IP address cannot be the same. For example, after an interface on a device is configured with the IP address /16, if another interface is configured with the IP address /24 sub, the system prompts a message. However, the configuration is still successful. The S2700 supports 31-bit IP address masks. Therefore, there are only two IP addresses in a network segment, that is, the network address and broadcast address. The two IP addresses can be used as host addresses. 2

11 1 IP Addresses Configuration 1.3 Configuring IP Addresses for Interfaces Assigning an IP address to a device on a network enables the device to communicate with the other devices on the network Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for assigning an IP address to an interface. Applicable Environment To start IP services on an interface, configure the IP address for the interface. You can assign several IP addresses to each interface. Among them, one is the primary IP address and the others are secondary IP addresses. Generally, you need to configure only a primary IP address for an interface. Secondary IP addresses, however, are required in some cases. For instance, when a device connects to a physical network through an interface, and computers on this network belong to two Class C networks, you need to configure a primary IP address and a secondary IP address for this interface to ensure that the device can communication with all computers on this network. Pre-configuration Tasks Data Preparation Before configuring an IP addresses for an interface, complete the following tasks: Configuring the physical parameters for the interface and ensuring that the physical layer status of the interface is Up Configuring the link layer parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up To configure IP addresses for an interface, you need the following data. No. Data 1 Interface number 2 Primary IP address and subnet mask of the interface 3 (Optional) Secondary IP address and subnet mask of the interface Configuring a Primary IP Address for an Interface An interface can have only one primary IP address. 3

12 1 IP Addresses Configuration Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Step 3 ip address ip-address { mask mask-length } A primary IP address is configured. An interface has only one primary IP address. If the interface already has a primary IP address, the newly configured primary IP address replaces the original one (Optional) Configuring a Secondary IP Address for an Interface To enable an interface to communicate with several networks with different network IDs, you need to assign a secondary IP address to this interface. Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Step 3 ip address ip-address { mask mask-length } sub A secondary IP address is configured. You can configure a maximum of 8 secondary IP addresses on an interface Checking the Configuration You can view the configuration of the IP address for an interface. Prerequisite The configurations of the IP addresses for the interface are complete. 4

13 1 IP Addresses Configuration Run the display ip interface [ brief ] [ interface-type [ interface-number ] ] command to check the IP configuration on the interface. Run the display interface [ interface-type [ interface-number ] ] command to check interface information. 1.4 Configuration Examples This section provides several examples of IP address configuration Example for Setting Primary and Secondary IP Addresses This section provides a configuration example of setting primary and secondary IP addresses. Networking Requirements As shown in Figure 1-1, Ethernet 0/0/1 of the Switch is connected to a LAN, in which hosts belong to two different network segments, that is /24 and /24. It is required that the Switch can access the two network segments but the host in /24 cannot interconnect with the host in /24. Figure 1-1 Networking diagram for setting IP addresses /24 Switch Ethernet 0/0/1 VLANIF / /24 sub /24 Configuration Roadmap The configuration roadmap is as follows: 1. Analyze the address of the network segment to which each interface is connected. 2. Set the secondary IP addresses for an interface. 5

14 1 IP Addresses Configuration Data Preparation To complete the configuration, you need the following data. Primary IP address and subnet mask of the VLANIF interface Secondary IP address and subnet mask of the VLANIF interface Step 1 Step 2 Set the IP address for VLANIF 100 where Ethernet 0/0/1 of the Switch belongs. <Quidway> system-view [Quidway] vlan 100 [Quidway-Vlan100] quit [Quidway] interface ethernet 0/0/1 [Quidway-Ethernet0/0/1] port hybrid pvid vlan 100 [Quidway-Ethernet0/0/1] port hybrid untagged vlan 100 [Quidway-Ethernet0/0/1] quit [Quidway] interface vlanif 100 [Quidway-Vlanif100] ip address [Quidway-Vlanif100] ip address sub Verify the configuration. Ping a host on network segment from Switch. The ping succeeds. <Quidway> ping PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=128 time=25 ms Reply from : bytes=56 Sequence=2 ttl=128 time=27 ms Reply from : bytes=56 Sequence=3 ttl=128 time=26 ms Reply from : bytes=56 Sequence=4 ttl=128 time=26 ms Reply from : bytes=56 Sequence=5 ttl=128 time=26 ms ping statistics packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/26/27 ms Ping a host on network segment from the Switch. The ping succeeds. <Quidway> ping PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=128 time=25 ms Reply from : bytes=56 Sequence=2 ttl=128 time=26 ms Reply from : bytes=56 Sequence=3 ttl=128 time=26 ms Reply from : bytes=56 Sequence=4 ttl=128 time=26 ms Reply from : bytes=56 Sequence=5 ttl=128 time=26 ms ping statistics packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/25/26 ms Configuration Files Configuration file of the Switch sysname Quidway vlan 100 interface Vlanif100 6

15 1 IP Addresses Configuration ip address ip address sub interface Ethernet0/0/1 port hybrid pvid vlan 100 port hybrid untagged vlan 100 return 7

16 2 ARP Configuration 2 ARP Configuration About This Chapter ARP can map an IP address to a MAC address and implements transmission of Ethernet frames. 2.1 Overview of ARP An Ethernet device must support ARP. ARP implements dynamic mapping between Layer 3 IP addresses and Layer 2 MAC addresses. 2.2 ARP Features Supported by the S2700 This section describes the ARP features supported by the S Configuring Static ARP Static ARP indicates that there is a fixed mapping between an IP address and a MAC address. Static ARP needs to be configured by an administrator. 2.4 Optimizing Dynamic ARP If dynamic ARP is configured, the system automatically resolutes an IP address into an Ethernet MAC address. 2.5 Configuring Routed Proxy ARP Proxy ARP enables devices whose IP addresses belong to the same network segment but different physical networks to communicate with each other. 2.6 Configuring Proxy ARP Within a VLAN By configuring proxy ARP on a VLAN, you can interconnect isolated hosts on a VLAN. 2.7 Configuring Proxy ARP Between VLANs By configuring inter-vlan proxy ARP, you can interconnect hosts on different VLANs. 2.8 Maintaining ARP The operations of ARP maintenance include clearing ARP statistics and monitoring ARP operating status. 2.9 Configuration Examples This section provides several configuration examples of ARP. 8

17 2 ARP Configuration 2.1 Overview of ARP An Ethernet device must support ARP. ARP implements dynamic mapping between Layer 3 IP addresses and Layer 2 MAC addresses. Each host or device on the Local Area Network (LAN) can be configured a 32-bit IP address to communicate with others. The assigned IP address is independent of the hardware address. On the Ethernet, a host or a device transmits and receives Ethernet frames according to a 48-bit Medium Access Control (MAC) address. The MAC address is also called the physical address or the hardware address, which is assigned to an Ethernet interface when equipment is produced. Therefore, on an interconnected network, an address resolution mechanism is required to provide the mapping between MAC addresses and IP addresses. The Address Resolution Protocol (ARP) maps an IP address to the corresponding MAC address. 2.2 ARP Features Supported by the S2700 This section describes the ARP features supported by the S2700. The S2700 supports dynamic ARP, static ARP, proxy ARP, and Layer 2 topology detection. ARP proxy ARP ARP is classified into the following types: dynamic ARP and static ARP. Static ARP means the mapping between manually configured IP addresses and MAC addresses. Dynamic ARP means that the ARP mapping table is dynamically maintained by the ARP protocol. The S2700 supports the following types of proxy ARP: NOTE The S2700SI does not support Intra-VLAN proxy ARP and Inter-VLAN proxy ARP. Routed proxy ARP Proxy ARP lets the PCs or switchs on the same network segment but in different physical networks communicate. In actual applications, if the current host connected with a switch is not configured with a default gateway address (that is, the host does not know how to reach the intermediate system of the network), the host cannot forward data packets. Routed proxy ARP is introduced to solve this problem. The host sends an ARP Request message, requesting the MAC address of the destination host. After receiving such a request, the switch enabled with proxy ARP answers with its own MAC address. By "faking" its identity, the switch accepts responsibility for routing messages to the "real" destination. 9

18 2 ARP Configuration The switch enabled with proxy ARP can also hide the details of the physical networks and implement the communication between hosts that are in different physical networks but on the same network segment. Intra-VLAN proxy ARP In the scenario where two users belong to the same VLAN but user isolation is configured in the VLAN, to implement communication between the two users, you need to enable proxy ARP with a VLAN on the member interface of the VLAN. The interface enabled with proxy ARP within a VLAN does not directly discard the ARP Request messages that are not for themselves. Instead, it searches the ARP mappings table for the corresponding ARP entries. In this case, if the switch is qualified to serve as a proxy, the interface sends the MAC address of the switch to the sender of the ARP Request message. Proxy ARP within a VLAN implements the interworking between isolated users in the same VLAN. Inter-VLAN proxy ARP In the scenario where two users belong to different VLANs, to implement communication between the two users, you need to enable proxy ARP between VLANs on the member interfaces of the VLANs. The interfaces enabled with proxy ARP between VLANs do not directly discard the ARP Request messages that are not for themselves. Instead, they search the ARP mappings tables on themselves for the corresponding ARP entries. If the conditions for being a proxy are met, the interface sends the MAC address of the switch to the sender of the ARP Request message. Proxy ARP between VLANs is mainly applied to the following situations: Implementing Layer 3 interworking between users in different VLANs Implementing interworking between sub-vlans by enabling proxy ARP between VLANs on the VLANIF interface of the super VLAN 2.3 Configuring Static ARP Static ARP indicates that there is a fixed mapping between an IP address and a MAC address. Static ARP needs to be configured by an administrator Establishing the Configuration Task Applicable Environment This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring static ARP. Static ARP is used in the following situations: For the packets whose destination IP address is on another network segment, static ARP can help these packets traverse a gateway of the local network segment so that the gateway can forward the packets to their destination. When you need to filter out some packets with illegitimate destination IP addresses, static ARP can bind these illegitimate addresses to a nonexistent MAC address. 10

19 2 ARP Configuration Pre-configuration Tasks Data Preparation Before configuring ARP, complete the following tasks: Configuring physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring link layer protocol parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up Configuring the network layer protocol for the interface To configure ARP, you need the following data. No. Data 1 IP address and MAC address of the static ARP entry 2 VPN instance name and VLAN ID to which the static ARP entry belongs Configuring Common Static ARP Entries Context Static ARP entries are required for the communication between common interfaces. If static ARP and the Virtual Router Redundancy Protocol (VRRP) are enabled on a device simultaneously, the virtual IP address of the VRRP backup group configured on the VLANIF interface cannot be the IP address contained in the static ARP entries; otherwise, incorrect host routes are generated and thus packets cannot be normally forwarded. Step 1 system-view The system view is displayed. Step 2 arp static ip-address mac-address Configure common static ARP entries. NOTE Static ARP entries keep valid when a device works normally Configuring Static ARP Entries in a VLAN In the scenario where two users belong to the same VLAN but user isolation is configured in the VLAN, to implement communications between the two users, you need to enable static ARP within the VLAN on the member interface of the VLAN. 11

20 2 ARP Configuration Context If static ARP and the Virtual Router Redundancy Protocol (VRRP) are enabled on a device simultaneously, the virtual IP address of the VRRP backup group configured on the VLAN interface cannot be the IP address contained in the static ARP entries; otherwise, incorrect host routes are generated and thus packets cannot be normally forwarded. Step 1 system-view The system view is displayed. Step 2 Configure static ARP entries in a Virtual Local Area Network (VLAN). To configure static ARP entries in a VLAN, do as follows: Run the arp static ip-address mac-address [ vid vlan-id interface interface-type interfacenumber ] command. To configure static ARP entries for VLANIF interfaces, if an ARP entry contains only the IP address and MAC address, and the VLAN ID and outbound interface of the ARP packet are not specified, the system selects the outbound interface automatically. If the VLAN ID and outbound interface are specified, the system forwards the packet from the specified outbound interface. If the interface corresponding to the VLAN is bound to a Virtual Private Network (VPN), the device can automatically associate the configured static ARP entry with the VPN. This command is applicable to port-based VLANs. NOTE Static ARP entries keep valid when a device works normally Checking the Configuration You can view the configuration of static ARP. Prerequisite The configurations of the ARP function are complete. Run the display arp statistics { all } command to check the statistics for ARP entries. 2.4 Optimizing Dynamic ARP If dynamic ARP is configured, the system automatically resolutes an IP address into an Ethernet MAC address. 12

21 2 ARP Configuration Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for optimizing dynamic ARP. Applicable Environment Dynamic ARP is one of functions owned by a device or host. You do not need to run a command to enable dynamic ARP but you can modify some parameters of dynamic ARP. Pre-configuration Tasks None Data Preparation Optimizing dynamic ARP, you need the following data. No. Data 1 Aging detection times of the dynamic ARP entry 2 Aging time of the dynamic ARP entry Modify the aging parameters of dynamic ARP If the device needs to update ARP entries frequently, you can reduce the aging timeout period of ARP entries, increase the number of aging detections for ARP entries, and reduce the aging detection intervals of ARP entries. Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Step 3 arp detect-times detect-times The number of aging detection times of the dynamic ARP entries is configured. Step 4 arp expire-time expire-times The timeout period for aging dynamic ARP entries is configured. 13

22 2 ARP Configuration By default, the aging detection times of the dynamic ARP entries is three, and the aging timeout period is 1200 seconds. Step 5 arp detect-mode unicast The interface is configured to send ARP Aging Detection packets in unicast mode. By default, an interface sends ARP Aging Detection packets in broadcast mode Enabling ARP Suppression Function If the system receives a great number of ARP packets from the same source at a time, the system needs to update ARP entries repeatedly. To ensure the performance of the system, you can enable ARP suppression. In this manner, the system only responds to the ARP packets but does not update ARP entries. Step 1 system-view The system view is displayed. Step 2 arp-suppress enable ARP suppression is enabled on the current device Enabling Layer 2 Topology Detection Function After Layer 2 topology detection is enabled, the system updates all the ARP entries corresponding to the VLANs to which a Layer 2 interface belongs, if this Layer 2 interface goes Up. Step 1 system-view The system view is displayed. Step 2 l2-topology detect enable The Layer 2 topology detection function is enabled. By default, this function is not enabled Checking the Configuration You can view the configuration of dynamic ARP. 14

23 2 ARP Configuration Prerequisite The configurations of the ARP function are complete. Run the display arp interface interface-type interface-number command to check information about ARP mapping tables based on interfaces. Run the display arp statistics { all } command to check the statistics for ARP entries. 2.5 Configuring Routed Proxy ARP Proxy ARP enables devices whose IP addresses belong to the same network segment but different physical networks to communicate with each other Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring routed proxy ARP. Applicable Environment The two physical networks of an enterprise are in different subnets of the same IP network, and are separated by a device. You need to enable the proxy ARP on the device interface connected to the physical networks. This enables communication between the two networks. Network IDs of subnet hosts must be the same. You need not configure default gateways for hosts. Pre-configuration Tasks Data Preparation Before configuring routed proxy ARP, complete the following tasks: Configuring the physical parameters for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the link layer parameters for the interface and ensuring that the status of the link layer protocol on the interface is Up To configure routed proxy ARP, you need the following data. No. Data 1 Number of the interface to be enabled with routed proxy ARP 2 IP address of the interface to be enabled with routed proxy ARP 15

24 2 ARP Configuration Configure an IP Addresses for the Interface The IP address assigned to a routed proxy ARP-enabled interface must be on the same network segment with the IP address of the host on the LAN to which this interface connects. Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Routed proxy ARP can be enabled only on the VLANIF interface of the S2700. Step 3 ip address ip-address { mask mask-length } The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the LAN connected with this interface Enabling the Routed Proxy ARP Function To interconnect the subnets in the same IP network, you need to enable routed proxy ARP. Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Step 3 arp-proxy enable By default, the routed proxy ARP function is disabled on the interface. After routed proxy ARP is enabled, you must reduce the aging time of ARP entries in the deviece so that the number of packets received but cannot be forwarded by the device is decreased. To configure the aging time of ARP entries Checking the Configuration You can view the configuration of routed proxy ARP. 16

25 2 ARP Configuration Prerequisite The configurations of the routed proxy ARP function are complete. Run the display arp interface interface-type interface-number command to check information about ARP mapping tables based on interfaces. Run the display arp statistics command to check statistics about ARP entries. 2.6 Configuring Proxy ARP Within a VLAN By configuring proxy ARP on a VLAN, you can interconnect isolated hosts on a VLAN Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring proxy ARP on a VLAN. Applicable Environment If two users are in the same VLAN but they are isolated from each other, to ensure the two users can communicate, you need to enable proxy ARP within the VLAN on the interface associated with the VLAN. Pre-configuration Tasks Data Preparation Before configuring proxy ARP within a VLAN, complete the following tasks: Configuring physical attributes for the interface and ensuring that the status of the physical layer of the interface is Up Configuring the VLAN Configuring user isolation in the VLAN To configure proxy ARP within a VLAN, you need the following data. No. Data 1 Number of the interface to be enabled with proxy ARP in a VLAN 2 IP address of the interface to be enabled with proxy ARP in a VLAN 3 VLAN ID associated with the interface to be enabled with proxy ARP in a VLAN 17

26 2 ARP Configuration Configure an IP Addresses for the Interface The IP address assigned to an interface needs to be in the same network segment with the IP addresses of the users of the VLANs associated to this interface. Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Intra-VLAN proxy ARP can be enabled on only the VLANIF interface of the S2700. Step 3 ip address ip-address { mask mask-length } The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the VLAN associated with this interface Enabling Proxy ARP Within a VLAN To interconnect isolated users on a VLAN, you need to enable intra-vlan proxy ARP on the interface associated to the VLAN. Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Step 3 arp-proxy inner-sub-vlan-proxy enable Proxy ARP within a VLAN is enabled Checking the Configuration You can view the configuration of intra-vlan proxy ARP. 18

27 2 ARP Configuration Prerequisite The configurations of the proxy ARP within a VLAN function are complete. Run the display arp interface interface-type interface-number command to check information about ARP mapping tables based on interfaces. Run the display arp statistics command to check statistics about ARP entries. 2.7 Configuring Proxy ARP Between VLANs By configuring inter-vlan proxy ARP, you can interconnect hosts on different VLANs Establishing the Configuration Task This section describes the applicable environment, pre-configuration tasks, data preparation, and configuration procedure for configuring inter-vlan proxy ARP. Applicable Environment If two users belong to different VLANs and they need to communicate, you need to enable proxy ARP between VLANs on the sub-interface associated with the VLAN. IP addresses of hosts in a VLAN must be in the same network segment. Pre-configuration Tasks Data Preparation Before configuring proxy ARP between VLANs, complete the following tasks: Configuring physical attributes for the interface and ensuring that the status of the physical layer of the interface is Up Configuring VLAN aggregation To configure proxy ARP between VLANs, you need the following data. No. Data 1 Number of the interface to be enabled with proxy ARP between VLANs 2 IP address of the interface to be enabled with proxy ARP between VLANs 3 VLAN ID associated with the interface to be enabled with proxy ARP between VLANs 19

28 2 ARP Configuration Configuring an IP Addresses for the Interface The IP address assigned to an interface needs to be in the same network segment with the IP addresses of the users of all the VLANs associated to this interface. Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Inter-VLAN proxy ARP can be enabled only on the VLANIF interface of the S2700. Step 3 ip address ip-address { mask mask-length } The interface is configured with an IP address. The IP address configured for the interface must be in the same network segment with that of hosts in the VLAN associated with this interface Enabling Proxy ARP Between VLANs To interconnect users on different VLANs, you need to enable inter-vlan proxy ARP on the VLANIF interfaces. Step 1 system-view The system view is displayed. Step 2 interface vlanif vlan-id The VLANIF interface view is displayed. Step 3 arp-proxy inter-sub-vlan-proxy enable Proxy ARP between VLANs is enabled Checking the Configuration You can view the configuration of inter-vlan proxy ARP. 20

29 2 ARP Configuration Prerequisite The configurations of Proxy ARP Between VLANs are complete. Run the display arp interface interface-type interface-number command to check information about ARP mapping tables based on interfaces. Run the display arp statistics command to check statistics about ARP entries. 2.8 Maintaining ARP The operations of ARP maintenance include clearing ARP statistics and monitoring ARP operating status Clearing ARP Entries This section describes ARP entries clearance through the reset command. Context CAUTION The mapping between the IP and MAC addresses is deleted after you clear ARP entries. So, confirm the action before you use the command. The static ARP entries cannot restore after you clear it. So, confirm the action before you use the command. Step 1 Run the reset arp { all dynamic interface interface-type interface-number static } command in the user view to clear the ARP entries in the ARP mapping table Monitoring Network Operation Status of ARP This section describes ARP operation monitoring through the display command. Context In routine maintenance, you can run the following command in any view to check the operation of ARP. 21

30 2 ARP Configuration Run the display arp interface interface-type interface-number command in any view to check the information about the ARP mapping table based on interfaces Debugging ARP Context This section describes ARP debugging through the debugging command. CAUTION Debugging affects the performance of the system. Thus, after debugging, run the undo debugging all command to disable debugging immediately. When the CPU usage is close to 100%, debugging ARP may cause the board resetting. So, confirm the action before you use the command. When faults occur during ARP operation, run the following debugging command in the user view to debug ARP and locate the fault. For more information, see chapter "Information Center Configuration" in the Quidway S2700 Series Ethernet Switches Configuration Guide-System Management. For descriptions about the debugging commands, see the Quidway S2700 Series Ethernet Switches Debugging Reference. Run the debugging arp packet [ interface interface-type interface-number ] command in the user view to debug ARP. Run the debugging arp-proxy [ inner-sub-vlan-proxy inter-sub-vlan-proxy ] [ interface interface-type interface-number ] command in the user view to debug proxy ARP. Run the debugging arp process [ interface interface-type interface-number ] command in the user view to debug the processing of ARP packets. 2.9 Configuration Examples This section provides several configuration examples of ARP Example for Configuring ARP Networking Requirements As shown in Figure 2-1, GE 0/0/1 of the Switch is connected to the host through the LAN switch (LSW); GE 0/0/2 is connected to the server through the router. It is required that: 22

31 2 ARP Configuration GE 0/0/1 should be added to VLAN 2, and GE 0/0/2 should be added to VLAN 3. To adapt to fast changes of the network and ensure correct forwarding of packets, dynamic ARP parameters should be set on VLANIF 2 of the Switch. To ensure the security of the server and prevent invalid ARP packets, a static ARP entry should be created on GE 0/0/2 of the Switch, with the IP address of the router being and the MAC address being 00e0-fc Figure 2-1 Networking diagram for configuring ARP Server Internet Router GE0/0/2 Switch GE0/0/1 LSW PC1 PC2 PC2 Configuration Roadmap Data Preparation The configuration roadmap is as follows: 1. Create a VLAN and add an interface to the VLAN. 2. Set dynamic ARP parameters on a VLANIF interface at the user side. 3. Create a static ARP entry. To complete the configuration, you need the following data: GE 0/0/1 added to VLAN 2 and GE 0/0/2 added to VLAN 3 VLANIF 2 with the IP address being and subnet mask being , aging time of ARP entries being 60s, and number of detection times being 2 VLANIF 3 with the IP address being and subnet mask being

32 2 ARP Configuration Interface connecting the router and the Switch, with the IP address being , subnet mask being , and MAC address being 00e0-fc Step 1 Create a VLAN and add an interface to the VLAN. Create VLAN 2 and VLAN 3. <Quidway> system-view [Quidway] vlan batch 2 3 Add GE 0/0/1 to VLAN 2 and add GE 0/0/2 to VLAN 3. [Quidway] interface gigabitethernet 0/0/1 [Quidway-GigabitEthernet0/0/1] port hybrid tagged vlan 2 [Quidway-GigabitEthernet0/0/1] quit [Quidway] interface gigabitethernet 0/0/2 [Quidway-GigabitEthernet0/0/2] port hybrid tagged vlan 3 [Quidway-GigabitEthernet0/0/2] quit Step 2 Set dynamic ARP parameters on a VLANIF interface. Create VLANIF2. [Quidway] interface vlanif 2 Assign an IP address to VLANIF 2. [Quidway-Vlanif2] ip address Set the aging time of ARP entries to 60s. [Quidway-Vlanif2] arp expire-time 60 Set the number of detection times before deleting ARP entries to 2. [Quidway-Vlanif2] arp detect-times 2 [Quidway-Vlanif2] quit Create VLANIF 3. [Quidway] interface vlanif 3 Assign an IP address to VLANIF 3. [Quidway-Vlanif3] ip address [Quidway-Vlanif3] quit Step 3 Create a static ARP entry. Create a static ARP entry with IP address , MAC address 00e0-fc , VLAN ID 3, and outgoing interface GE 0/0/2. [Quidway] arp static e0-fc vid 3 interface gigabitethernet 0/0/2 [Quidway] quit Step 4 Verify the configuration. Run the display current-configuration command. You can view the aging time of ARP entries, the number of detection times before deleting ARP entries, and the ARP mapping table. <Quidway> display current-configuration include arp arp expire-time 60 arp detect-times 2 arp static e0-fc vid 3 interface GigabitEthernet0/0/2 24

33 2 ARP Configuration Configuration Files The following is the configuration file of the Switch. sysname Quidway vlan batch 2 to 3 interface Vlanif2 ip address arp expire-time 60 arp detect-times 2 interface Vlanif3 ip address interface GigabitEthernet0/0/1 port hybrid tagged vlan 2 interface GigabitEthernet0/0/2 port hybrid tagged vlan 3 arp static e0-fc vid 3 interface GigabitEthernet0/0/2 return Example for Configuring Routed Proxy ARP Networking Requirements As shown in Figure 2-2, GE 0/0/1 and GE 0/0/2 of the Switch are connected to a LAN respectively, and the network IDs of the two LANs are /16. Host A and Host B are not configured with the default gateway. It is required that routed proxy ARP should be enabled on the Switch so that hosts in the two LANs can communicate. Figure 2-2 Networking diagram for configuring routed proxy ARP Host A / e33-ee20 Host B / e33-ee10 GE0/0/1 GE0/0/ / /24 VLAN 2 VLAN 3 Switch Ethernet A Ethernet B Configuration Roadmap The configuration roadmap is as follows: 1. Assign an IP Address to an interface. 25

34 2 ARP Configuration Data Preparation 2. Enable routed proxy ARP on the interface. To complete the configuration, you need the following data: IP addresses of the interfaces IP addresses of the hosts Step 1 Create VLAN 2 and add GE 0/0/1 to VLAN 2. <Quidway> system-view [Quidway] vlan 2 [Quidway-vlan2] quit [Quidway] interface gigabitethernet 0/0/1 [Quidway-GigabitEthernet0/0/1] port link-type access [Quidway-GigabitEthernet0/0/1] port default vlan 2 [Quidway-GigabitEthernet0/0/1] quit Step 2 Create and configure VLANIF 2. [Quidway] interface vlanif 2 [Quidway-Vlanif2] ip address Step 3 Enable routed proxy ARP on VLANIF 2. [Quidway-Vlanif2] arp-proxy enable [Quidway-Vlanif2] quit Step 4 Create VLAN 3 and add GE 0/0/2 to VLAN 3. [Quidway] vlan 3 [Quidway-vlan3] quit [Quidway] interface gigabitethernet 0/0/2 [Quidway-GigabitEthernet0/0/2] port link-type access [Quidway-GigabitEthernet0/0/2] port default vlan 3 [Quidway-GigabitEthernet0/0/2] quit Step 5 Create and configure VLANIF 3. [Quidway] interface vlanif 3 [Quidway-Vlanif3] ip address Step 6 Enable routed proxy ARP on VLANIF 3. [Quidway-Vlanif3] arp-proxy enable [Quidway-Vlanif3] quit Step 7 Configure the hosts. Assign IP address /16 to Host A. Assign IP address /16 to Host B. Step 8 Verify the configuration. Ping Host B from Host A. The ping operation is successful. Configuration Files Configuration file of the Switch sysname Quidway 26

35 2 ARP Configuration vlan batch 2 to 3 interface Vlanif2 ip address arp-proxy enable interface Vlanif3 ip address arp-proxy enable interface GigabitEthernet0/0/1 port link-type access port default vlan 2 interface GigabitEthernet0/0/2 port link-type access port default vlan 3 return Example for Configuring Intra-VLAN Proxy ARP Networking Requirements As shown in Figure 2-3, GE 0/0/2 and GE 0/0/1 of the Switch belong to Sub-VLAN 2. Sub- VLAN 2 belong to Super-VLAN 3. It is required that: Host A and host B in VLAN 2 should be isolated at Layer 2. Host A should communicate with host B at Layer 3 through intra-vlan proxy ARP. The IP address and subnet mask of the VLANIF interface in Super-VLAN 3 should be and Figure 2-3 Networking diagram for configuring intra-vlan proxy ARP Internet Switch GE0/0/2 GE0/0/1 hostb /24 00-e0-fc sub-vlan2 hosta /24 00-e0-fc Configuration Roadmap The configuration roadmap is as follows: 27

36 2 ARP Configuration Data Preparation 1. Create and configure a Super-VLAN and a Sub-VLAN. 2. Add an interface to the Sub-VLAN. 3. Create a VLANIF interface of the Super-VLAN and assign an IP address to the VLANIF interface. 4. Enable intra-vlan proxy ARP on the VLANIF interface of the Super-VLAN. To complete the configuration, you need the following data: VLAN IDs of the Super-VLAN and Sub-VLAN GE 0/0/2 and GE 0/0/1 belonging to Sub-VLAN 2 IP address and subnet mask of VLANIF 3 of Super-VLAN 3 being and Step 1 Configure the Super-VLAN and Sub-VLAN. Configure Sub-VLAN 2. <Quidway> system-view [Quidway] vlan 2 [Quidway-vlan2] quit Enable port isolation on GE 0/0/1 and GE 0/0/2. [Quidway] port-isolate mode l2 [Quidway] interface gigabitethernet 0/0/1 [Quidway-GigabitEthernet0/0/1] port-isolate enable [Quidway-GigabitEthernet0/0/1] quit [Quidway] interface gigabitethernet 0/0/2 [Quidway-GigabitEthernet0/0/2] port-isolate enable [Quidway-GigabitEthernet0/0/2] quit Add GE 0/0/1 and GE 0/0/2 to Sub-VLAN 2. [Quidway] interface gigabitethernet 0/0/1 [Quidway-GigabitEthernet0/0/1] port link-type access [Quidway-GigabitEthernet0/0/1] port default vlan 2 [Quidway-GigabitEthernet0/0/1] quit [Quidway] interface gigabitethernet 0/0/2 [Quidway-GigabitEthernet0/0/2] port link-type access [Quidway-GigabitEthernet0/0/2] port default vlan 2 [Quidway-GigabitEthernet0/0/2] quit Configure Super-VLAN 3 and add Sub-VLAN 2 to Super-VLAN 3. [Quidway] vlan 3 [Quidway-vlan3] aggregate-vlan [Quidway-vlan3] access-vlan 2 [Quidway-vlan3] quit Step 2 Create and configure VLANIF 3. Create VLANIF 3. [Quidway] interface vlanif 3 Assign an IP address to VLANIF 3. [Quidway-Vlanif3] ip address Step 3 Enable intra-vlan proxy ARP on VLANIF 3. 28