RG-HS2310 Series Switches
Configuration Guide, Release 11.4(1)B90

·Copyright Statement
Ruijie Networks©2023
Ruijie Networks reserves all copyrights of this document. Any reproduction, excerption, backup, modification,transmission, translation or commercial use of this document or any portion of this document, in any form or by any means,
without the prior written consent of Ruijie Networks is prohibited.

Exemption Statement
This document is provided “as is”. The contents of this document are subject to change without any notice. Please obtainthe latest information through the Ruijie Networks website. Ruijie Networks endeavors to ensure content accuracy and will
not shoulder any responsibility for losses and damages caused due to content omissions, inaccuracies or errors.

·PrefaceThank you for using our products. This manual matches the RGOS Release 11.9(6)B13P4.

Audience
This manual is intended for:

Network engineersTechnical support and servicing engineersNetwork administrators

Obtaining Technical Assistance

Ruijie Networks Website: https://ruijie.co.jp/Technical Support Website: https://www.ruijie.co.jp/service

Inquiry & Repair: https://www.ruijie.co.jp/service/post-salesTechnical Support Email: support_jp@ruijienetworks.com

Related Documents
Documents
Configuration Guide

Hardware Installation and Reference
Guide

Description
Describes network protocols and related mechanisms that supported by the
product, with configuration examples.
Describes the functional and physical features and provides the device
installation steps, hardware troubleshooting, module technical specifications,and specifications and usage guidelines for cables and connectors.

Conventions
This manual uses the following conventions:
Convention

Description

boldface font

Commands, command options, and keywords are in boldface.

italic font

Arguments for which you supply values are in italics.

[]

Elements in square brackets are optional.

{x|y|z}Alternative keywords are grouped in braces and separated by vertical bars.

·[x|y|z]

Optional alternative keywords are grouped in brackets and separated byvertical bars.

Symbols
Means reader take note. Notes contain helpful suggestions or references.

Means reader be careful. In this situation, you might do something that could result in equipment damage or loss ofdata.

ACL & QoS Configuration
1. Configuring Access Control List
2. Configuring QoSConfiguration Guide

Configuring the ACL

1 Configuring the ACL
1.1 Overview
Access control list (ACL) is also called access list or firewall. It is even called packet filtering in some documents. The
ACL defines rules to determine whether to forward or drop data packets arriving at a network interface.
ACLs are classified by function into two types:



Security ACLs: Used to control data flows that are allowed to pass through a network device.

Quality of service (QoS) ACLs: Used to classify and process data flows by priority.

ACLs are configured for a lot of reasons. Major reasons include:Network access control: To ensure network security, rules are defined to limit access of users to some services(for example, only access to the WWW and email services is permitted, and access to other services such as
Telnet is prohibited), or to allow users to access services in a specified period of time, or to allow only specified
hosts to access the network.



QoS: QoS ACLs are used to preferentially classify and process important data flows. For details about the use of
QoS ALCs, see the configuration manual related to QoS.

1.2 Applications
Application

Description

Access Control of an Enterprise

On an enterprise network, the network access rights of each department, for

Network

example, access rights of servers and use permissions of chatting tools (such as
QQ and MSN), must be controlled according to requirements.

1.2.1 Access Control of an Enterprise Network
ScenarioInternet viruses can be found everywhere. Therefore, it is necessary to block ports that are often used by viruses toensure security of an enterprise network as follows:Allow only internal PCs to access the server.

Prohibit PCs of a non-financial department from accessing PCs of the financial department, and prohibit PCs of a
non-R&D department from accessing PCs of the R&D department.

Prohibit the staff of the R&D department from using chatting tools (such as QQ and MSN) during working hours
from 09:00 to 18:00.

1-1

Configuration Guide

Configuring the ACL

Figure 1-1

Remarks

Switch C at the access layer:It is connected to PCs of each department and to Switch B at the aggregation
layer through the gigabit optical fiber (trunk mode).
Switch B at the aggregation layer:Multiple virtual local area networks (VLANs) are divided. One VLAN is
defined for one department. These VLANs are connected to Switch A at the core layer through the 10-gigabit
optical fiber (trunk mode).
Switch A at the core layer:It is connected to various servers, such as the File Transfer Protocol (FTP) serverand Hypertext Transfer Protocol (HTTP) server, and to the Internet through firewalls.

Deployment
Configure an extended ACL on the port G2/1 to filter data packets, thus protecting the network against the viruses.
This port is located on a core-layer device (Switch A) and used to connect Switch A to the uplink port G2/1 of arouter.



Allow only internal PCs to access servers, and prohibit external PCs from accessing servers. Define and apply theextended IP ACLs on G2/2 or switch virtual interface (SVI) 2 that is used to connect Switch A to an aggregation
layer device or server.

Prohibit mutual access between specified departments. Define and apply the extended IP ACLs on G0/17 andG0/18 of Switch B.

Configure and apply the time-based extended IP ACLs on SVI 2 of Switch B to prohibit the R&D department fromusing chatting tools (such as QQ and MSN) in a specified period of time.

1-2

Configuration Guide

Configuring the ACL

1.3 Features
Basic Concepts

ACL

ACLs include basic ACLs and dynamic ACLs.
You can select basic or dynamic ACLs as required. Generally, basic ACLs can meet the security requirements.
However, experienced hackers may use certain software to access the network by means of IP address spoofing. If
dynamic ACLs are used, users are requested to pass identify authentication before accessing the network, which
prevents hackers from intruding the network. Therefore, you can use dynamic ACLs in some sensitive areas toguarantee network security.
IP address spoofing is an inherent problem of all ACLs, including dynamic ACLs. Hackers may use forged IP
addresses to access the network during the validity period of authenticated user identities. Two methods areavailable to resolve this problem. One is to set the idle time of user access to a smaller value, which increases thedifficulty in intruding networks. The other is to encrypt network data using the IPSec protocol, which ensures thatall data is encrypted when arriving at a device.
ACLs are generally configured on the following network devices:

Devices between the internal network and the external network (such as the Internet)



Devices on the border of two network segments



Devices connected to controlled ports

ACL statements must be executed in strict compliance with their sequence in the ACL. Comparison starts from the firststatement. Once the header of a data packet matches a statement in the ACL, the subsequent statements are ignored
and no longer checked.



Input ACLs, Filtering Field Template, and Rules

When receiving a packet on an interface, the device checks whether the packet matches any access control entry (ACE)in the input ACL of this interface.
When different filtering rules are defined, all or only some rules may be applied simultaneously. If a packet matches an
ACE, this packet is processed according to the action policy (permit or deny) defined in this ACE. ACEs in an ACL
identify Ethernet packets based on the following fields in the Ethernet packets:
Layer 2 (L2) fields:

48-bit source MAC address (containing all 48 bits)



48-bit destination MAC address (containing all 48 bits)



16-bit L2 type field

Layer 3 (L3) fields:



Source IP address field (All source IP address values can be specified, or the subnet can be used to define a typeof data flows.)

Destination IP address field (All destination IP address values can be specified, or the subnet can be used todefine a type of data flows.)

1-3Configuration GuideConfiguring the ACL

Protocol type field

Layer 4 (L4) fields:Either a TCP source or destination port is specified, or both are specified, or the range of the source or destination
port is specified.

Either a UDP source or destination port is specified, or both are specified, or the range of the source or destination
port is specified.

Filtering fields refer to the fields in packets that can be used to identify or classify packets when an ACE is generated. A
filtering field template is a combination of these fields. For example, when an ACE is generated, packets are identified
and classified based on the destination IP address field in each packet; when another ACE is generated, packets are
identified and classified based on the source IP address field and UDP source port field in each packet. The two ACEs
use different filtering field templates.
Rules refer to values of fields in the filtering field template of an ACE.For example, the content of an ACE is as follows:
permit tcp host 192.168.12.2 any eq telnet
In this ACE, the filtering field template is a combination of the following fields:source IP address field, IP protocol field,
and TCP destination port field. The corresponding values (rules) are as follows:source IP address = Host 192.168.12.2;
IP protocol = TCP; TCP destination port = Telnet.
Figure 1-2 Analysis of the ACE: permit tcp host 192.168.12.2 any eq telnet

A filtering field template can be a combination of L3 and L4 fields, or a combination of multiple L2 fields. The
filtering field template of a standard or an extended ACL, however, cannot be a combination of L2 and L3 fields, acombination of L2 and L4 fields, or a combination of L2, L3, and L4 fields. To use a combination of L2,L3, and L4
fields, you can use the expert ACLs.
If an IP extended or expert ACL is configured to match the destination IP address, but the destination IP address is
not in the subnet IP address range of the associated SVI, the configured ACL cannot take effect. For example,
assume that the address of VLAN 1 is 192.168.64.1 255.255.255.0, an IP extended ACL is created, and the ACE
is deny udp any 192.168.65.1 0.0.0.255 eq 255. If this ACL is applied to interface of VLAN 1, the ACL cannot
take effect because the destination IP address is not in the subnet IP address range of VLAN 1. If the ACE is deny
udp any 192.168.64.1 0.0.0.255 eq 255, the ACL can take effect because the destination IP address is in thesubnet IP address range of VLAN 1.

1-4

Configuration Guide

Configuring the ACL

On a switch, if the input ACL and DOT1X, global IP+MAC binding, port security, and IP source guard are shared
among all ports, the permit and default deny ACEs do not take effect, but other deny ACEs take effect.
On a switch, if the input ACL and QoS are shared, the permit ACEs do not take effect, other deny ACEs take effect,
and the default deny ACE takes effect after the QoS ACE takes effect.
On a switch, you can run the norgos-security compatible command to make the permit and deny ACEs takeeffect at the same time when the port-based input ACL and DOT1X, global IP+MAC binding, port security, and IP
source guard are shared.
If ACEs are added to an ACL and then the switch is restarted after an ACL is applied to the incoming direction ofmultiple SVIs, the ACL may fail to be configured on some SVIs due to the limited hardware capacity.
If ACEs of an ACL (IP ACL or expert extended ACL) are configured to match non-L2 fields (such as SIP and DIP),
the ACL does not take effect on tagged MPLS packets.



ACL Logging

To allow users better learn the running status of ACLs on a device, you can determine whether to specify the ACL
logging option as required when adding ACEs. If this option is specified, logs are output when packets matching ACEs
are found. ACL logs are displayed based on ACEs. That is, the device periodically displays ACEs with matched packets
and the number of matched packets. An example of the log is as follows:*Sep

9 16:23:06: %ACL-6-MATCH: ACL 100 ACE 10 permit icmp any any, match 78 packets.

To control the amount of logs and output frequency, you can configure the log update interval respectively for the IPv4
ACL and the IPv6 ACL.
An ACE containing the ACL logging option consumes more hardware resources. If all configured ACEs containthis option, the ACE capacity of a device will be reduced by half.
By default, the log update interval is 0, that is, no log is output. After the ACL logging option is specified in an ACE,
you need to configure the log update interval to output related logs.
For an ACE containing the ACL logging option, if no packet is matched in the specified interval, no packet
matching log related to this ACE will be output. If matched packets are found in the specified interval, packet
matching logs related to this ACE will be output when the interval expires. The number of matched packets is thetotal number of packets that match the ACE during the specified interval, that is, the period from the previous log
output to the current log output.
Only switches support the ACL logging function.



ACL Packet Matching Counters

To implement network management, users may want to know whether an ACE has any matched packets and how
many packets are matched. ACLs provide the ACE-based packet matching counters. You can enable or disable packet
matching counters for all ACEs in an ACL, which can be an IP ACL, MAC ACL, expert ACL, or IPv6 ACL. In addition,
you can run the clear counters access-list [ acl-id | acl-name ] command to reset ACL counters for a new round of
statistics.
Enabling ACL counters requires more hardware entries. In an extreme case, this will reduce by half the number of
ACEs that can be configured on a device.
Only switches support the ACL packet matching counters.

1-5

Configuration Guide

Configuring the ACL

Overview
FeatureDescription

IP ACL

Control incoming IPv4 packets of a device based on the L3 or L4 information in the IPv4 packet
header.

MAC Extended ACL

Control incoming L2 packets of a device based on the L2 information in the Ethernet packet
header.

Expert Extended

Combine the IP ACL and MAC extended ACL into an expert extended ACL, which controls

ACL(permits or denies) incoming packets of a device using the same rule based on the L2, L3, and L4
information in the packet header.

IPv6 ACL

Control incoming IPv6 packets of a device based on the L3 or L4 information in the IPv6 packet
header.

ACL80

Customize the matching fields and mask for scenarios where fixed matching fields cannot meetthe requirements.

ACL Redirection

Redirect incoming packets of a device that match ACEs to a specified outgoing interface.

Global Security ACL

Make an ACL take effect in the incoming direction of all interfaces, instead of applying the ACL on
every interface.

ACL Logging

Output ACL packet matching logs at a specified interval according to requirements. The logs help
users learn the packet matching result of a specified ACE.

Packet Matching

Outpu ACL packet matching statistics according to requirements. The statistics help users learn

Counters

the packet matching result of a specified ACE.

Fragmented Packet

Help ACL to better control fragmented packet.

Matching Mode

1.3.1 IP ACL
The IP ACL implements refined control on incoming IPv4 packets of a device. You can permit or deny the entry of
specific IPv4 packets to a network according to actual requirements to control access of IP users to network resources.

Working Principle
Define a series of IP access rules in the IP ACL, and then apply the IP ACL either in the incoming direction of aninterface or globally. The device checks whether the incoming IPv4 packets match the rules and accordingly forwards orblocks these packets.
To configure an IP ACL, you must specify a unique name or ID for the ACL of a protocol so that the protocol canuniquely identify each ACL. The following table lists the protocols that can use IDs to identify ACLs and the range of
IDs.
ProtocolID Range

Standard IP

1–99, 1300–1999

Extended IP

100–199, 2000–2699

Basic ACLs include the standard IP ACLs and extended IP ACLs. Typical rules defined in an ACL contain the following
matching fields:



Source IP addressDestination IP address

1-6

Configuration GuideIP protocol number

L4 source port ID or ICMP typeL4 destination port ID or ICMP code

Configuring the ACL

The standard IP ACL (ID range: 1–99, 1300–1999) is used to forward or block packets based on the source IP address,
whereas the extended IP ACL (ID range: 100–199, 2000–2699) is used to forward or block packets based on a
combination of the preceding matching fields.
For an individual ACL, multiple independent ACL statements can be used to define multiple rules. All statements
reference the same ID or name so that these statements are bound with the same ACL. However, more statements
mean that it is increasingly difficult to read and understand the ACL.
For routing products, the ICMP code matching field in an ACL rule is ineffective for ICPM packets whose ICPM
type is 3. If the ICPM code of ICMP packets to be matched is configured in an ACL rule, the ACL matching resultof incoming ICMP packets of a device whose ICPM type is 3 may be different from the expected result.

Implicit "Deny All Traffic" Rule Statement

At the end of every IP ACL is an implicit "deny all traffic" rule statement. Therefore, if a packet does not match any rule,
the packet will be denied.
For example:
access-list 1 permit host 192.168.4.12
This ACL permits only packets sent from the source host 192.168.4.12, and denies packets sent from all other hosts.
This is because the following statement exists at the end of this ACL: access-list 1 deny any.
If the ACL contains only the following statement:
access-list 1 deny host 192.168.4.12
Packets sent from any host will be denied when passing through this port.
When defining an ACL, you must consider the routing update packets. As the implicit "deny all traffic" statement
exists at the end of an ACL, all routing update packets may be blocked.



Input Sequence of Rule Statements

Every new rule is added to the end of an ACL and in front of the default rule statement. The input sequence ofstatements in an ACL is very important. It determines the priority of each statement in the ACL. When determining
whether to forward or block packets, a device compares packets with rule statements based on the sequence that rulestatements are created. After locating a matched rule statement, the device does not check any other rule statement.
If a rule statement is created and denies all traffic, all subsequent statements will not be checked.
For example:
access-list 101 deny ip any any
access-list 101 permit tcp 192.168.12.0 0.0.0.255 eq telnet any
The first rule statement denies all IP packets. Therefore, Telnet packets from the host on the network 192.168.12.0/24
will be denied. After the device finds that packets match the first rule statement, it does not check the subsequent rulestatements any more.

1-7

Configuration Guide

Configuring the ACL

RelatedConfiguration

Configuring an IP ACL

By default, no IP ACL is configured on a device.
Run the ip access-list { extended | standard } { acl-id | acl-name } command in global configuration mode to create astandard or an extended IP ACL and enter standard or extended IP ACL mode.

Adding ACEs to an IP ACL

By default, a newly created IP ACL contains an implicit ACE that denies all IPv4 packets. This ACE is hidden from users,
but takes effect when the ACL is applied to an interface. That is, all IPv4 packets will be discarded. Therefore, if you
want the device to receive or send some specific IPv4 packets, add some ACEs to the ACL.
For a standard IP ACL, add ACEs as follows:No matter whether the standard IP ACL is a named or number ACL, you can run the following command in
standard IP ACL mode to add an ACE:
[ sn ] { deny | permit } { source-ipv4-address source-ipv4-wildcard | any | host source-ipv4-address } [ time-range
time-range-name ] [ log ]For a numbered standard IP ACL, you can also run the following command in global configuration mode to add an
ACE:access-list acl-id { deny | permit } { source-ipv4-address source-ipv4-wildcard | any | host source-ipv4-address }[ time-range time-range-name ] [ log ]For an extended IP ACL, you can add ACEs as follows:No matter whether the extended IP ACL is a named or numbered ACL, you can run the following command inextended IP ACL mode to add an ACE:
[ sn ] { deny | permit } protocol { source-ipv4-address source-ipv4-wildcard | any | host source-ipv4-address } [ eqport | gt port | lt port | neq port | range lower upper ] { destination-ipv4-address destination-ipv4-wildcard | any |host destination-ipv4-address } [ dscp dscp ] [ fragment ] [ precedence precedence ] [ tos tos ] [ eq port | gt port
| lt port | neq port | range lower upper ] [ match-all tcp-flag | established ] [ time-range time-range-name ] [ log ]For a numbered extended IP ACL, you can also run the following command in global configuration mode to add an
ACE:access-list acl-id { deny | permit } protocol { source-ipv4-address source-ipv4-wildcard | any | hostsource-ipv4-address } [ eq port | gt port | lt port | neq port | range lower upper ] { destination-ipv4-address
destination-ipv4-wildcard | any | host destination-ipv4-address } [ dscp dscp ] [ fragment ] [ precedence
precedence ] [ tos tos ] [ eq port | gt port | lt port | neq port | range lower upper ] [ match-all tcp-flag |established ] [ time-range time-range-name ] [ log ]Applying an IP ACL

By default, the IP ACL is not applied to any interface, that is, the IP ACL does not filter incoming IP packets of thedevice.
Run the ip access-group { acl-id | acl-name } in command in interface configuration mode to apply a standard or an
extended IP ACL to a specified interface.

1-8

Configuration Guide

Configuring the ACL

1.3.2 MAC Extended ACL
The MAC extended ACL implements refined control on incoming packets based on the L2 header of packets. You canpermit or deny the entry of specific L2 packets to a network, thus protecting network resources against attacks orcontrol users' access to network resources.

Working Principle
Define a series of MAC access rules in the MAC extended ACL, and then apply the ACL to the incoming direction of aninterface. The device checks whether the incoming packets match the rules and accordingly forwards or blocks thesepackets.
To configure an MAC extended ACL, you must specify a unique name or ID for this ACL to uniquely identify the ACL.
The following table lists the range of IDs that identify MAC extended ACLs.
ProtocolID Range

MAC extended ACL

700–799

Typical rules defined in an MAC extended ACL include:Source MAC addressDestination MAC address

Ethernet protocol type

The MAC extended ACL (ID range: 700–799) is used to filter packets based on the source or destination MAC address
and the Ethernet type in the packets.
For an individual MAC extended ACL, multiple independent ACL statements can be used to define multiple rules. All
statements reference the same ID or name so that these statements are bound with the same ACL. However, morestatements mean that it is increasingly difficult to read and understand the ACL.
If ACEs in an MAC extended ACL are not defined specifically for IPv6 packets, that is, the Ethernet type is not
specified or the value of the Ethernet type field is not 0x86dd, the MAC extended ACL does not filter IPv6 packets.
If you want to filter IPv6 packets, use the IPv6 extended ACL.



Implicit "Deny All Traffic" Rule Statement

At the end of every MAC extended ACL is an implicit "deny all traffic" rule statement. Therefore, if a packet does notmatch any rule, the packet will be denied.
For example:
access-list 700 permit host 00d0.f800.0001 any
This ACL permits only packets from the host with the MAC address 00d0.f800.0001, and denies packets from all otherhosts. This is because the following statement exists at the end of this ACL: access-list 700 deny any any.

RelatedConfiguration

Configuring an MAC Extended ACL

By default, no MAC extended ACL is configured on a device.

1-9Configuration Guide

Configuring the ACL

Run the mac access-list extended { acl-id | acl-name } command in global configuration mode to create an MAC
extended ACL and enter MAC extended ACL mode.

Adding ACEs to an MAC Extended ACL

By default, a newly created MAC extended ACL contains an implicit ACE that denies all L2 packets. This ACE is hiddenfrom users, but takes effect when the ACL is applied to an interface. That is, all L2 packets will be discarded. Therefore,
if you want the device to receive or send some specific L2 packets, add some ACEs to the ACL.
You can add ACEs to an MAC extended ACL as follows:No matter whether the MAC extended ACL is a named or numbered ACL, you can run the following command in
MAC extended ACL mode to add an ACE:
[ sn ] { deny | permit } { source-mac-address mask | any | host source-mac-address } { destination-mac-address
mask | any | host destination-mac-address } [ ethernet-type ] [ cos [ cos ] [ inner cos ] ] [ time-range
time-range-name ]For a numbered MAC extended ACL, you can also run the following command in global configuration mode to add
an ACE:
access-list acl-id { deny | permit } { source-mac-address mask | any | host source-mac-address }{ destination-mac-address mask | any | host destination-mac-address } [ ethernet-type ] [ cos [ cos ] [ inner cos ] ][ time-range time-range-name ]Applying an MAC Extended ACL

By default, the MAC extended ACL is not applied to any interface, that is, the created MAC extended ACL does not filter
incoming L2 packets of a device.
Run the mac access-group { acl-id | acl-name } in command in interface configuration mode to apply an MAC
extended ACL to a specified interface

1.3.3 Expert Extended ACL
You can create an expert extended ACL to match the L2 and L3 information in packets using the same rule. The expert
extended ACL can be treated as a combination and enhancement of the IP ACL and the MAC extended ACL because
the expert extended ACL can contain ACEs in both the IP ACL and the MAC extended ACL. In addition, the VLAN ID
can be specified in the expert extended ACL to filter packets.

Working Principle
Define a series of access rules in the expert extended ACL, and then apply the ACL in the incoming direction of aninterface. The device checks whether incoming packets match the rules and accordingly forwards or blocks thesepackets.
To configure an expert extended ACL, you must specify a unique name or ID for this ACL so that the protocol canuniquely identify each ACL. The following table lists the ID range of the expert extended ACL.
ProtocolID Range

Expert extended ACL

2700–2899

When an expert extended ACL is created, defined rules can be applied to all packets. The device determines whether
to forward or block packets by checking whether packets match these rules.

1-10

Configuration Guide

Configuring the ACL

Typical rules defined in an expert extended ACL include:All information in the basic ACL and MAC extended ACL

VLAN ID

The expert extended ACL (ID range: 2700–2899) is a combination of the basic ACL and MAC extended ACL, and canfilter packets based on the VLAN ID.
For an individual expert extended ACL, multiple independent statements can be used to define multiple rules. All
statements reference the same ID or name so that these statements are bound with the same ACL.
If rules in an expert extended ACL are not defined specifically for IPv6 packets, that is, the Ethernet type is not
specified or the value of the Ethernet type field is not 0x86dd, the expert extended ACL does not filter IPv6 packets.
If you want to filter IPv6 packets, use the IPv6 extended ACL.



Implicit "Deny All Traffic" Rule Statement

At the end of every expert extended ACL is an implicit "deny all traffic" rule statement. Therefore, if a packet does notmatch any rule, the packet will be denied.
For example:
access-list 2700permit 0x0806 any any any any any
This ACL permits only ARP packets whose Ethernet type is 0x0806, and denies all other types of packets. This isbecause the following statement exists at the end of this ACL: access-list 2700 deny any any any any.

RelatedConfiguration

Configuring an Expert Extended ACL

By default, no expert extended ACL is configured on a device.
Run the expert access-list extended { acl-id | acl-name } command in global configuration mode to create an expert
extended ACL and enter expert extended ACL mode.

Adding ACEs to an Expert Extended ACL

By default, a newly created expert extended ACL contains an implicit ACE that denies all packets. This ACE is hiddenfrom users, but takes effect when the ACL is applied to an interface. That is, all L2 packets will be discarded. Therefore,
if you want the device to receive or send some specific L2 packets, add some ACEs to the ACL.
You can add ACEs to an expert extended ACL as follows:No matter whether the expert extended ACL is a named or numbered ACL, you can run the following command inexpert extended ACL mode to add an ACE:
[ sn ] { deny | permit } [ protocol | [ ethernet-type ] [ cos [ cos ] [ inner cos ] ] ] [ VID [ vid ] [ inner vid ] ]{ source-ipv4-address source-ipv4-wildcard | any | host source-ipv4-address } { source-mac-address mask | any |host source-mac-address } [ eq port | gt port | lt port | neq port | range lower upper ] { destination-ipv4-address
destination-ipv4-wildcard | any | host destination-ipv4-address } { any | host destination-mac-address } [ eq port |gt port | lt port | neq port | range lower upper ] [ dscp dscp ] [ precedence precedence ] [ tos tos ] [ fragment ][ match-all tcp-flag | established ] [ time-range time-range-name ]1-11

Configuration GuideConfiguring the ACL

For a numbered expert extended ACL, you can also run the following command in expert extended ACL mode to
add an ACE:
access-list acl-id { deny | permit } [ protocol | [ ethernet-type ] [ cos [ cos ] [ inner cos ] ] ] [ VID [ vid ] [ inner vid ] ]{ source-ipv4-address source-ipv4-wildcard | any | host source-ipv4-address } { source-mac-address mask | any |host source-mac-address } [ eq port | gt port | lt port | neq port | range lower upper ] { destination-ipv4-address
destination-ipv4-wildcard | any | host destination-ipv4-address } { any | host destination-mac-address } [ eq port |gt port | lt port | neq port | range lower upper ] [ dscp dscp ] [ precedence precedence ] [ tos tos ] [ fragment ][ match-all tcp-flag | established ] [ time-range time-range-name ]Applying an Expert Extended ACL

By default, the expert extended ACL is not applied to any interface, that is, the created expert extended ACL does notfilter incoming L2 or L3 packets of a device.
Run the expert access-group { acl-id | acl-name } in command in interface configuration mode to apply an expert
extended ACL to a specified interface.

1.3.4 IPv6 ACL
The IPv6 ACL implements refined control on incoming IPv6 packets of a device. You can permit or deny the entry of
specific IPv6 packets to a network according to actual requirements to control access of IPv6 users to network
resources.

Working Principle
Define a series of IPv6 access rules in the IPv6 ACL, and then apply the ACL in the incoming direction of an interface.
The device checks whether the incoming IPv6 packets match the rules and accordingly forwards or blocks thesepackets.
To configure an IPv6 ACL, you must specify a unique name for this ACL.
Unlike the IP ACL, MAC extended ACL, and expert extended ACL, you can specify only a name but not an ID for
the IPv6 ACL created.
Only one IP ACL, or one MAC extended ACL, or one expert extended ACL can be applied to the incoming
direction of an interface. Besides, one more IPv6 ACL can be applied.

Implicit "Deny All Traffic" Rule Statement

At the end of every IPv6 ACL is an implicit "deny all IPv6 traffic" rule statement. Therefore, if a packet does not match
any rule, the packet will be denied.
For example:
ipv6 access-list ipv6_acl
10 permit ipv6 host 200::1 any
This ACL permits only IPv6 packets from the source host 200::1, and denies IPv6 packets from all other hosts. This isbecause the following statement exists at the end of this ACL: deny ipv6 any any.
Although the IPv6 ACL contains the implicit "deny all IPv6 traffic" rule statement by default, it does not filter ND
packets.

1-12

Configuration GuideConfiguring the ACL

Input Sequence of Rule Statements

Every new rule is added to the end of an ACL and in front of the default rule statement. The input sequence ofstatements in an ACL is very important. It determines the priority of each statement in the ACL. When determining
whether to forward or block packets, a device compares packets with rule statements based on the sequence that rulestatements are created. After locating a matched rule statement, the device does not check any other rule statement.
If a rule statement is created and permits all IPv6 traffic, all subsequent statements will not be checked.
For example:
ipv6 access-list ipv6_acl
10 permit ipv6 any any
20 deny ipv6 host 200::1 any
As the first rule statement permits all IPv6 packets, all IPv6 packets sent from the host 200::1 does not match thesubsequent deny rule with the serial number of 20, and therefore will not be denied. After the device finds that packets
match the first rule statement, it does not check the subsequent rule statements any more.

RelatedConfiguration

Configuring an IPv6 ACL

By default, no IPv6 ACL is configured on a device.
Run the ipv6 access-list acl-name command in global configuration mode to create an IPv6 ACL and enter IPv6 ACL
mode.



Adding ACEs to an IPv6 ACL

By default, a newly created IPv6 ACL contains an implicit ACE that denies all IPv6 packets. This ACE is hidden fromusers, but takes effect when the ACL is applied to an interface. That is, all IPv6 packets will be discarded. Therefore, if
you want the device to receive or send some specific IPv6 packets, add some ACEs to the ACL.
Run the following command in IPv6 ACL mode to add an ACE:
[ sn ] { deny | permit } ipv6-protocol { any | host source-ipv6-address } [ eq port | gt port | lt port | neq port | range
lower upper ] { any | host destination-ipv6-address } [ eq port | gt port | lt port | neq port | range lower upper ] [ dscp
dscp ] [ flow-label flow-label ] [ fragment ] [ match-all tcp-flag | established ] [ time-range time-range-name ] [ log ]Applying an IPv6 ACL

By default, the IPv6 ACL is not applied to any interface, that is, the IPv6 ACL does not filter incoming IPv6 packets of adevice.
Run the ipv6 traffic-filter acl-name in command in interface configuration mode to apply an IPv6 ACL to a specified
interface.

1.3.5 ACL80
ACL80 refers to the expert advanced ACL, and is also called custom ACL. It filters packets based on the first 80 bytes
of every packet. Among these 80 bytes, the SMAC, DMAC, SIP, DIP, and ETYPE fields in a packet are mandatory, andyou can specify the remaining 16 bytes.

1-13Configuration Guide

Configuring the ACL

Working Principle
A packet consists of a number of bytes. ACL80 allows you to match the specified 16 bytes by bit in the first 80 bytes of apacket. Any bit of a 16-byte field can be set to a value (0 or 1), indicating whether the bit is compared. When any byte isfiltered, three factors are considered: content of the matching field, mask of the matching field, and the start position formatching. Bits of the matching field content are in one-to-one mapping relationship with bits of the matching field mask.
The filtering rule specifies the value of the field to be filtered. The filtering field template specifies whether thecorresponding field in the filtering rule should be filtered. (1 indicates that the bit specified in the filtering rule should bematched; 0 indicates that the bit specified in the filtering rule is not matched.) Therefore, when it is required to match a
specific bit, you must set the corresponding bit to 1 in the filtering field template. For example, if the bit is set to 0 in thefiltering field template, no bit is matched no matter which bit is specified in the filtering rule.
For example,
Ruijie(config)#expert access-list advanced name
Ruijie(config-exp-dacl)#permit 00d0f8123456 ffffffffffff 0
Ruijie(config-exp-dacl)#deny 00d0f8654321 ffffffffffff 6
The custom ACL matches any byte of the first 80 bytes in a L2 data frame according to user' definition, and filters
packets accordingly. To properly use a custom ACL, you must have an in-depth understanding about the structure of aL2 data frame. The following shows the first 64 bytes of a L3 data frame (every letter represents a hexadecimal number,and every two letters represent one byte):
AA AA AA AA AA AA BB BB BB BB BB BB CC CC DD DD
DD DD EE FF GG HH HH HH II II JJ KK LL LL MM MM
NN NN OO PP QQ QQ RR RR RR RR SS SS SS SS TT TTUU UU VV VV VV VV WW WW WW WW XY ZZ aa aa bb bb
The following table describes the meaning and offset of each letter:
LetterMeaning

OffsetLetterMeaning

OffsetA

Destination MAC address

0OTime To Live (TTL) field

34

B

Source MAC address

6

P

Protocol number

35

C

VLAN tag field

12

Q

IP checksum

36

D

Data frame length

16

R

Source IP address

38

18

S

Destination IP address

42

19

T

TCP source port

46

E

F

Destination service access point(DSAP) field
Source service access point (SSAP)
field

G

Cntl field

20

U

TCP destination port

48

H

Org Code field

21

V

Serial number

50

I

Encapsulated data type24

W

Acknowledgment field

54

J

IP version number

26

XY

IP header length and reserved bit

58

K

TOS field

27

Z

Reserved bit and flags bit

59

L

IP packet length28aWindows size field

60

M

ID

30

b

Miscellaneous

62

N

Flags field

32

1-14

Configuration Guide

Configuring the ACL

In the above table, the offset of each field is the offset of this field in the tagged 802.3 SNAP packet. In a custom ACL,
you can use the rule mask and offset jointly to extract any byte from the first 80 bytes of a data frame, compare the byte
with the rule customized in the ACL, and then filter matched data frames for further processing. Customized rules may
be some fixed attributes of data. For example, to obtain all TCP packets, you can define the rule as "06", rule mask as"FF", and offset as "35". Then, the device can use the rule mask and offset jointly to extract the content of TCP protocol
number field in a received data frame, and compare the extracted content with the rule to obtain all TCP packets.
Only switches support the ACL80.
The ACL80 supports filtering of the Ethernet, 803.3 SNAP, and 802.3 LLC packets. If the values of the fields fromDSAP to cntl are set to AAAA03, the ACL is used to filter the 803.3 SNAP packets. If the values of the fields fromDSAP to cntl are set to E0E003, the ACL is used to filter the 803.3 LLC packets. The value of the cntl field cannot
be configured to filter Ethernet packets.
The ACL80 can be configured to compare packets with any of the 16 bytes. If the 16 bytes are already used, no
ACE can be configured to compare packets with fields in any other bytes.

RelatedConfiguration

Configuring an Expert Advanced ACL

By default, no expert advanced ACL is configured on a device.
Run the expert access-list advanced acl-name command in global configuration mode to create an expert advanced
ACL and enter expert advanced ACL mode.

Adding ACEs to an Expert Advanced ACL

By default, a newly created expert advanced ACL contains an implicit ACE that denies all packets. This ACE is hiddenfrom users, but takes effect when the ACL is applied to an interface. That is, all L2 packets will be discarded. Therefore,
if you want the device to receive or send some specific L2 packets, add some ACEs to the ACL.



Run the [ sn ] { deny | permit } hex hex-mask offset command in expert advanced ACL mode to add an ACE to

the expert advanced ACL.



Applying an Expert Advanced ACL

By default, the expert advanced ACL is not applied to any interface, that is, the created expert advanced ACL does notfilter incoming packets of a device.
Run the expert access-group { acl-id | acl-name } in command in interface configuration mode to apply an expert
advanced ACL to a specified interface.

1.3.6 ACL Redirection
ACL redirection allows a device to analyze received packets and redirect the packets to a specified port for forwarding.
To analyze specific incoming packets of a device, you can configure the ACL redirection function to redirect packets
meeting rules to a specified port and capture packets on this port for analysis.

1-15

Configuration Guide

Configuring the ACL

Working Principle
Bind different ACL policy to an interface and specify an output destination interface for each policy. When receiving
packets on this interface, the device searches ACL policies bound to this interface one by one. If packets match criteria
described in a certain policy, the device forwards packets on the destination interface specified by the policy, thus
redirecting packets based on traffic.
Only switches support the ACL redirection function.
ACL redirection takes effect only in the incoming direction of an interface.

RelatedConfiguration

Configuring an ACL

Before configuring ACL redirection, configure an ACL. For details about how to configure an ACL, see the earlier
descriptions about ACL configuration.

Adding ACEs to an ACL

For details about how to add ACEs to an ACL, see the earlier descriptions about the IP ACL, MAC extended ACL,
expert extended ACL, or IPv6 ACL.



Configuring ACL Redirection

By default, ACL redirection is not configured on a device.
Run the redirect destination interface interface-name acl { acl-id | acl-name } in command in interface configuration
mode to configure ACL redirection.
You can configure the ACL redirection function only on an Ethernet interface, AP, or SVI.

1.3.7 Global Security ACL
To meet the requirements of security deployment, the port-based ACL is often configured to filter out virus packets andobtain packets with certain characteristics, for example, packets that attack the TCP port. Various virus packets exist ina global network environment, and the identification features of virus packets under each port are identical or similar.
Therefore, an ACL is generally created. After the deny ACE for matching virus signatures is added to the ACL, theport-based ACL is applied to each port on the switch to filter out virus packets.
For two reasons, it is not convenient to use the port-based ACLs in antivirus scenarios such as virus filtering. The firstreason is that the port-based ACL must be configured on every port, which results in repeated configuration, poor
operation performance, and over-consumption of ACL resources. The second reason is that the access control functionof the ACL is weakened. As the port-based ACL is used for virus filtering, basic functions of the ACL, such as route
update restriction and network access restriction, cannot be used properly. The global security ACL can be used for
global antivirus deployment and defense without affecting the port-based ACL. By running only one command, you canmake the global security ACL takes effect on all L2 interfaces. In contrast, the port-based ACL must be configured on
every interface.

1-16

Configuration Guide

Configuring the ACL

Working Principle
The global security ACL takes effect on all L2 interfaces. When both the global security ACL and the port-based ACL
are configured, both take effect. Packets that match the global security ACL are directly filtered out as virus packets.
Packets that do not match the global security ACL are still controlled by the port-based ACL. You can disable the global
security ACL on some ports so that these ports are not controlled by the global security ACL.
The global security ACL is mainly used for virus filtering. Therefore, in an ACL associated with the global security
ACL, only the deny ACEs take effect, and the permit ACEs do not take effect.
Unlike the secure ACL applied to a port, the global security ACL does not contain the default "deny all traffic" ACE,
that is, all packets that do not match the ACL are permitted.
A global secure ACL can take effect either on a L2 port or a routed port. That is, it takes effect on all the following
types of ports: access port, trunk port, hibird port, routed port, and AP (L2 or L3). The global secure ACL does nottake effect on an SVI.
You can disable the global security ACL on an individual physical port or AP, but not on a member port of an AP.
The global secure ACL supports only the associated IP standard ACL, IP extended ACL, MAC extended ACL andExpert extended ACL.

RelatedConfiguration

Configuring an ACL

Before configuring the global security ACL, configure an ACL. For details about how to configure an ACL, see theearlier descriptions about ACL configuration.

Adding ACEs to an ACL

For details about how to add ACEs to an ACL, see the earlier descriptions about the IP ACL.



Configuring a Global Security ACL

By default, no global security ACL is configured on a device.
Run the { mac | expert | ip } access-group acl-id in command in global configuration mode to enable the global
security ACL.



Configuring an Exclusive Interface of the Global Security ACL

By default, no exclusive interface is configured for the global security ACL on a device.
Run the no global access-group command in interface configuration to disable the global security ACL on a specified
interface.

1.3.8 ACL Logging
ACL logging is used to monitor the running status of ACEs in an ACL and provide essential information for routine
network maintenance and optimization.

1-17

Configuration Guide

Configuring the ACL

Working Principle
To better learn the running status of ACLs on a device, you can determine whether to specify the ACL logging option as
required when adding ACEs. If this option is specified, logs are output when packets matching ACEs are found. ACL
logs are displayed based on ACEs. That is, the device periodically displays ACEs with matched packets and thenumber of matched packets. An example of the log is as follows:*Sep

9 16:23:06: %ACL-6-MATCH: ACL 100 ACE 10 permit icmp any any, match 78 packets.

To control the amount of logs and output frequency, you can configure the log update interval.
An ACE containing the ACL logging option consumes more hardware resources. If all configured ACEs containthis option, the ACE capacity of a device will be reduced by half.
By default, the log update interval is 0, that is, no log is output. After the ACL logging option is specified in an ACE,
you need to configure the log update interval to output related logs; otherwise, logs are not output.
For an ACE containing the ACL logging option, if no packet is matched in the specified interval, no packet
matching log related to this ACE will be output. If matched packets are found in the specified interval, packet
matching logs related to this ACE will be output when the interval expires. The number of matched packets is thetotal number of packets that match the ACE during the specified interval, that is, the period from the previous log
output to the current log output.
Only switches support the ACL logging function.
You can configure the ACL logging option only for an IP ACL or an IPv6 ACL.

RelatedConfiguration

Configuring an ACL

Configure an ACL before configuring ACEs containing the ACL logging option. For details about how to configure an
ACL, see the earlier descriptions about ACL configuration.

Adding ACEs to an ACL

For details about how to add ACEs to an ACL, see the earlier descriptions about the IP ACL and IPv6 ACL. Note that
the ACL logging option must be configured.

Configuring the Log Update Interval

Run the { ip | ipv6 } access-list log-update inerval time command in the configuration mode to configure the interval
at which the ACL logs are output.



Applying an ACL

For details about how to apply an ACL, see the earlier descriptions about the IP ACL and IPv6 ACL.

1.3.9 Packet Matching Counters
In addition to ACL logs, packet matching counters provide another choice for routine network maintenance andoptimization.

1-18

Configuration Guide

Configuring the ACL

Working Principle
To implement network management, users may want to know whether an ACE has any matched packets and how
many packets are matched.ACLs provide the ACE-based packet matching counters. You can enable or disable packet
matching counters for all ACEs in an ACL. When a packet matches the ACE, the corresponding counter increments by
1. You can run the clear counters access-list [ acl-id | acl-name ] command to reset counters of all ACEs in an ACL fora new round of statistics.
Enabling ACL counters requires more hardware entries. In an extreme case, this will reduce by half the number of
ACEs that can be configured on a device.
You can enable packet matching counters on an IP ACL, MAC ACL, expert ACL, or IPv6 ACL.
Only switches support the ACL packet matching counters.

RelatedConfiguration

Configuring an ACL

Configure an ACL before configuring ACEs containing the ACL logging option. For details about how to configure an
ACL, see the earlier descriptions about ACL configuration.

Adding ACEs to an ACL

For details about how to add ACEs to an ACL, see the earlier descriptions about the IP ACL and IPv6 ACL. Note that
the ACL logging option must be configured.

Enabling Packet Matching Counters

To enable packet matching counters on an IP ACL, MAC ACL, or expert ACL, run the { mac | expert | ip } access-list
counter { acl-id | acl-name } command in global configuration mode.
To enable packet matching counters on an IPv6 ACL, run the ipv6 access-list counter acl-name command in global
configuration mode.



Applying an ACL

For details about how to apply an ACL, see the earlier descriptions about the IP ACL, MAC extended ACL, expert
extended ACL, or IPv6 ACL.



Clearing Packet Matching Counters

Run the clear counters access-list [ acl-id | acl-name ] command in privileged EXEC mode to reset packet matching
counters.

1.3.10 Fragmented Packet Matching ModeIn fragmented packet matching mode, an ACL can implement more refined control on fragmented packets.

Working Principle
IP packets may be fragmented when transmitted on the network. When fragmentation occurs, only the first fragment of
the packet contains the L4 information, such as the TCP/UDP port number, ICMP type, and ICMP code, and otherfragmented packets do not contain the L4 information. By default, if an ACE contains the fragment flag, fragmented

1-19

Configuration Guide

Configuring the ACL

packets except the first fragments are filtered. If an ACE does not contain the fragment flag, all fragmented packets(including the first fragments) are filtered. In addition to this default fragmented packet matching mode, a new
fragmented packet matching mode is provided. You can switch between the two fragmented packet matching modes as
required on a specified ACL. In the new fragmented packet matching mode, if an ACE does not contain the fragment
flag and packets are fragmented, the first fragments are compared with all the matching fields (including L3 and L4
information) defined in the ACE, and other fragmented packets are compared with only the non-L4 information definedin the ACE.
In the new fragmented packet matching mode, if an ACE does not contain the fragment flag and the action is
Permit, this type of ACE occupies more hardware entries. In an extreme case, this will reduce by half the numberof hardware entries. If Established is configured for filter the TCP flag in an ACE, more hardware entries will beoccupied.
The ACL will be temporarily ineffective during switchover of the fragmented packet matching mode.
In the new fragmented packet matching mode, if an ACE does not contain the fragment flag, the L4 information of
packets needs to be compared, and the action is Permit, the ACE checks the L3 and L4 information of the firstfragments of packets, and checks only the L3 information of other fragmented packets. If the action is Deny, theACE checks only the first fragments of packets, and ignores other fragmented packets.
In the new fragmented packet matching mode, if an ACE contains the fragment flag, the ACE checks only
fragmented packets but not the first fragments of packets no matter whether the action in the ACE is Permit or
Deny.
Only the IP extended ACL and the expert extended ACL support switching between the two fragmented packet
matching modes.
Only switches support filtering of fragmented packets.

RelatedConfiguration

Configuring an ACL

For details about how to configure an ACL, see the earlier descriptions about the IP ACL and expert extended ACL.



Adding ACEs to an ACL

For details about how to add ACEs to an ACL, see the earlier descriptions about the IP ACL and expert extended ACL.
Note that the fragment option must be added.



Switching the Fragmented Packet Matching Mode

Run the [ no ] { ip | expert } access-list new-fragment-mode { acl-id | acl-name } command in global configuration
mode to switch the fragmented packet matching mode.



Applying an ACL

For details about how to apply an ACL, see the earlier descriptions about the IP ACL and expert extended ACL.

1-20

Configuration Guide

Configuring the ACL

1.4 Configuration
Configuration Item

Description and Command(Optional) It is used to filter IPv4 packets.

Configuring an IP ACL

ip access-list standard

Configures a standard IP ACL.

ip access-list extended

Configures an extended IP ACL.

permit host any time-range log

Adds a permit ACE to a standard IP ACL.

deny host any time-range log

Adds a deny ACE to a standard IP ACL.

permit host any host any tos dscp
precedence fragment time-range log
deny host any host any tos dscp
precedence fragment time-range log

Adds a permit ACE to an extended IP ACL.

Adds a deny ACE to an extended IP ACL.
Applies a standard or an extended IP ACL.

ip access-group in
Configuring an MAC
Extended ACL(Optional) It is used to filter L2 packets.
mac access-list extended

Configures an MAC extended ACL.

permit any host any host cos inner

Adds a permit ACE to an MAC extended

time-range

ACL.

deny any host any host cos inner

Adds a deny ACE to an MAC extended

time-range

ACL.

mac access-group in

Applies an MAC extended ACL.

Configuring an Expert
Extended ACL(Optional) It is used to filter L2 and L3 packets.
expert access-list extended
permit cos inner VID inner host any hostany host any host any precedence tos
fragment range time-range
deny cos inner VID inner host any hostany host any host any precedence tos
fragment range time-range

Configures an expert extended ACL.
Adds a permit ACE to an expert extended
ACL.

Adds a deny ACE to an expert extended
ACL.
Applies an expert extended ACL.

expert access-group in
Configuring an IPv6
Extended ACL(Optional) It is used to filter IPv6 packets.
Configures an IPv6 ACL.

ipv6 access-list
permit host any host any range dscp
flow-label fragment time-range
deny host any host any range dscp
flow-label fragment time-range

Adds a deny ACE to an IPv6 ACL.
Applies an IPv6 ACL.

ipv6 traffic-filter in
Configuring an ACL80

Adds a permit ACE to an IPv6 ACL.

(Optional) It is used to customize the fields for filter L2 and L3 packets.
expert access-list advanced

1-21

Configures an expert advanced ACL.

Configuration Guide
Configuration Item

Configuring the ACL
Description and Command
Adds a permit ACE to an expert advanced

permitACL.
Adds a deny ACE to an expert advanced

deny

ACL.
Applies an expert advanced ACL

expert access-group in
Configuring ACL(Optional) It is used to redirect packets meeting the rules to a specified interface.

Redirection

redirect destination interface acl in

Configures ACL redirection.

Configuring a Global(Optional) It is used to make an ACL take effect globally.

Security ACL

Applies a global security ACL in global

ip access-group in

configuration mode.

Configuring the Time
(Optional) It is used to configure ACE based-on Time Range

Range-Based ACEs
Configuring Comments for(Optional) It is used to configure comments for an ACL or ACE so that users canACLseasily identify the functions of the ACL or ACE.
Configures a comment for an ACL in ACL

list-remark

configuration mode.
Configures a comment for an ACL in global

access-list list-remark

configuration mode.
Configures a comment for an ACE in ACL

remarkconfiguration mode.

1.4.1 Configuring an IP ACL
Configuration EffectConfigure and apply an IP ACL to an interface to control all incoming IPv4 packets of this interface. You can permit ordeny the entry of specific IPv4 packets to a network to control access of IP users to network resources.

Notes
N/A

Configuration Steps

Configuring an IP ACL(Mandatory) Configure an IP ACL if you want to control access of IPv4 users to network resources.



You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
IP ACL takes effect only on the local device, and does not affect other devices on the network.

Adding ACEs to an IP ACL

(Optional) An ACL may contain zero or multiple ACEs. If no ACE is configured, all incoming IPv4 packets of thedevice are denied by default.

1-22

Configuration Guide

Configuring the ACLResequencing an IP ACL

(Optional) Resequence a standard or extended IP access list.

Applying an IP ACL(Mandatory) Apply an IP ACL to a specified interface if you want this ACL take effect.

You can apply an IP ACL on a specified interface of an access, an aggregate, or a core device based on the
distribution of users.

Verification


Use the following methods to verify the configuration effects of the IP ACL:

Run the ping command to verify that the IP ACL takes effect on the specified interface. For example, if an IP ACL
is configured to prohibit a host with a specified IP address or hosts in a specified IP address range from accessing
the network, run the ping command to verify that the host(s) cannot be successfully pinged.

Access related network resources to verify that the IP ACL takes effect on the specified interface. For example,
access the Internet or access the FTP resources on the network through FTP.

Related Commands

Configuring an IP ACL

Commandip access-list { extended | standard } { acl-id | acl-name }Parameter

standard: Indicates that a standard IP ACL is created.

Description

extended: Indicates that an extended IP ACL is created.
acl-name: Indicates the name of a standard or an extended IP ACL. If this option is configured, a named
ACL is created. The name is a string of 1 to 99 characters. The ACL name cannot start with numbers(0–9), "in".
acl-id: Indicates the ID that uniquely identifies a standard or extended IP ACL. If this option is configured,a numbered ACL is created. If a standard IP ACL is created, the value range of acl-id is 1–99 and
1300–1999. If an extended IP ACL is created, the value range of acl-id is 100–199 and 2000–2699.

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure a standard or an extended IP ACL and enter standard or extended IP
ACL configuration mode. If you want to control access of users to network resources by checking thesource IP address of each packet, configure a standard IP ACL. If you want to control access of users to
network resources by checking the source or destination IP address, protocol number, and TCP/UDP
source or destination port, configure an extended IP ACL.



Adding ACEs to an IP ACL

Add ACEs to a standard IP ACL.

Use either of the following methods to add ACEs to a standard IP ACL:
Command[ sn ] { deny | permit } { source-ipv4-address source-ipv4-wildcard | any | host source-ipv4-address }[ time-range time-range-name ] [ log ]Parameter

sn: Indicates the sequence number of an ACE. The value ranges from 1 to 2,147,483,647. This

1-23

Configuration Guide
Description

Configuring the ACL

sequence number determines the priority of this ACE in the ACL. A smaller sequence number indicatesa higher priority. An ACE with a higher priority will be preferentially used to match packets. If you do not
specify the sequence number when adding an ACE, the system automatically allocates a sequencenumber, which is equal to an increment (10 by default) plus the sequence number of the last ACE in thecurrent ACL. For example, if the sequence number of the last ACE is 100, the sequence number of a
newly-added ACE will be 110 by default. You can adjust the increment using a command.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
host source-ipv4-address: Indicates that IP packets sent from a host with the specified source IP
address are filtered.
any: Indicates that IP packets sent from any host are filtered.
source-ipv4-address source-ipv4-wildcard: Indicates that IP packets sent from hosts in the specified IP
network segment are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of thetime range.
log: Indicates that logs will be periodically output if packets matching the ACEs are found. For details
about logs, see "ACL Logging" in this document.

CommandStandard IP ACL configuration mode

Mode
Usage Guide

Run this command to add ACEs in standard IP ACL configuration mode. The ACL can be a named or
numbered ACL.

Commandaccess-list acl-id { deny | permit } { source-ipv4-address source-ipv4-wildcard | any | hostsource-ipv4-address } [ time-range time-range-name ] [ log ]Parameteracl-id: Indicates the ID of a numbered ACL. It uniquely identifies an ACL. The value range of acl-id is

Description

100–199 and 1300–1999.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
host source-ipv4-address: Indicates that IP packets sent from a host with the specified source IP
address are filtered.
any: Indicates that IP packets sent from any host are filtered.
source-ipv4-address source-ipv4-wildcard: Indicates that IP packets sent from hosts in the specified IP
network segment are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of thetime range.
log: Indicates that logs will be periodically output if packets matching the ACEs are found. For details
about logs, see "ACL Logging" in this document.

CommandStandard IP ACL configuration mode

Mode
Usage Guide

Run this command to add ACEs to a numbered IP ACL in global configuration mode.It cannot be used to
add ACEs to a named IP ACL.

1-24

Configuration GuideConfiguring the ACL

Add ACEs to an extended IP ACL.

Use either of the following methods to add ACEs to an extended IP ACL:
Command[ sn ] { deny | permit } protocol { source-ipv4-address source-ipv4-wildcard | any | hostsource-ipv4-address } [ eq port | gt port | lt port | neq port | range lower upper ]{ destination-ipv4-address destination-ipv4-wildcard | any | host destination-ipv4-address } [ dscp dscp ][ fragment ] [ precedence precedence ] [ tos tos ] [ eq port | gt port | lt port | neq port | range lower
upper ] [ match-all tcp-flag | established ] [ time-range time-range-name ] [ log ]Parameter

sn: Indicates the sequence number of an ACE. The value ranges from 1 to 2,147,483,647. This

Description

sequence number determines the priority of this ACE in the ACL. A smaller sequence number indicatesa higher priority. An ACE with a higher priority will be preferentially used to match packets. If you do not
specify the sequence number when adding an ACE, the system automatically allocates a sequencenumber, which is equal to an increment (10 by default) plus the sequence number of the last ACE in thecurrent ACL. For example, if the sequence number of the last ACE is 100, the sequence number of a
newly-added ACE will be 110 by default. You can adjust the increment using a command.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
protocol: Indicates the IP protocol number. The value ranges from 0 to 255. To facilitate the use, thesystem provides frequently-used abbreviations to replace the specific IP protocol numbers, including
eigrp, gre, icmp, igmp, ip, ipinip, nos, ospf, tcp, and udp.
host source-ipv4-address: Indicates that IP packets sent from a host with the specified source IP
address are filtered.
source-ipv4-address source-ipv4-wildcard: Indicates that IP packets sent from hosts in the specified IP
network segment are filtered.
host destination-ipv4-address: Indicates that IP packets sent to a host with the specified destination IP
address are filtered. If the any keyword is configured, IP packets sent to any host are filtered.
destination-ipv4-address destination-ipv4-wildcard: Indicates that IP packets sent to hosts in a specified
IP network segment are filtered.
any: Indicates that IP packets sent to or from any host are filtered.
eq port | gt port | lt port | neq port: Indicates that TCP or UDP packets are filtered based on the L4
destination port number. The value of the op parameter can be eq (equal to), neq (not equal to), gt(greater than), or lt (smaller than).
range lower upper: Indicates that TCP or UDP packets with the L4 destination port number in thespecified range are filtered.
precedence precedence: Indicates that IP packets with the specified precedence field in the header are
filtered.
tos tos: Indicates that IP packets with the specified the type of service (TOS) field in the header are
filtered.
dscp dscp: Indicates that IP packets with the specified the dcsp field in the header are filtered.
fragment: Indicates that only fragmented IP packets except the first fragments are filtered.
match-all tcp-flag: Indicates that TCP packets with all the bits of the TCP flag are filtered.
established: Indicates that TCP packets with the RST or ACK bits of the TCP flag are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of thetime range.

1-25

Configuration Guide

Configuring the ACL

log: Indicates that logs will be periodically output if packets matching the ACEs are found. For details
about logs, see "ACL Logging" in this document.
Command

Extended IP ACL configuration mode

Mode
Usage Guide

Run this command to add ACEs in extended IP ACL configuration mode. The ACL can be a named or
numbered ACL.

Commandaccess-list acl-id { deny | permit } protocol { source-ipv4-address source-ipv4-wildcard | any | hostsource-ipv4-address } [ eq port | gt port | lt port | neq port | range lower upper ]{ destination-ipv4-address destination-ipv4-wildcard | any | host destination-ipv4-address } [ dscp dscp ][ fragment ] [ precedence precedence ] [ tos tos ] [ eq port | gt port | lt port | neq port | range lower
upper ] [ match-all tcp-flag | established ] [ time-range time-range-name ] [ log ]Parameteracl-id: Indicates the ID of a numbered ACL. It uniquely identifies an ACL. The value range of acl-id is

Description

100–199 and 2000–1999.
sn: Indicates the sequence number of an ACE. The value ranges from 1 to 2,147,483,647. Thissequence number determines the priority of this ACE in the ACL. A smaller sequence number indicatesa higher priority. An ACE with a higher priority will be preferentially used to match packets. If you do not
specify the sequence number when adding an ACE, the system automatically allocates a sequencenumber, which is equal to an increment (10 by default) plus the sequence number of the last ACE in thecurrent ACL. For example, if the sequence number of the last ACE is 100, the sequence number of a
newly-added ACE will be 110 by default. You can adjust the increment using a command.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
protocol:Indicates the IP protocol number. The value ranges from 0 to 255. To facilitate the use, thesystem provides frequently-used abbreviations to replace the specific IP protocol numbers, including
eigrp, gre, icmp, igmp, ip, ipinip, nos, ospf, tcp, and udp.
host source-ipv4-address: Indicates that IP packets sent from a host with the specified source IP
address are filtered.
source-ipv4-address source-ipv4-wildcard: Indicates that IP packets sent from hosts in the specified IP
network segment are filtered.
host destination: Indicates that IP packets sent to a host with the specified destination IP address arefiltered. If the any keyword is configured, IP packets sent to any host are filtered.
destination-ipv4-address destination-ipv4-wildcard: Indicates that IP packets sent to hosts in a specified
IP network segment are filtered.
any: Indicates that IP packets sent to or from any host are filtered.
eq port | gt port | lt port | neq port: Indicates that TCP or UDP packets are filtered based on the L4
destination port number. The value of the op parameter can be eq (equal to), neq (not equal to), gt(greater than), or lt (smaller than).
range lower upper: Indicates that TCP or UDP packets with the L4 destination port number in thespecified range are filtered.
precedence precedence: Indicates that IP packets with the specified precedence field in the header are
filtered.
tos tos: Indicates that IP packets with the specified the type of service (TOS) field in the header are
filtered.

1-26

Configuration Guide

Configuring the ACL

dscp dscp: Indicates that IP packets with the specified the dcsp field in the header are filtered.
fragment: Indicates that only fragmented IP packets except the first fragments are filtered.
match-all tcp-flag: Indicates that TCP packets with all the bits of the TCP flag are filtered.
established: Indicates that TCP packets with the RST or ACK bits of the TCP flag are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of thetime range.
log: Indicates that logs will be periodically output if packets matching the ACEs are found. For details
about logs, see "ACL Logging" in this document.
Command

Extended IP ACL configuration mode

Mode
Usage Guide

Run this command to add ACEs to a numbered IP ACL in extended IP ACL configuration mode.It cannot
be used to add ACEs to a named extended IP ACL.



Resequencing an IP ACL

Commandip access-list resequence { acl-id | acl-name } start-sn inc-sn

Parameteracl-id: Indicates the ID that uniquely identifies a standard or extended IP ACL. If this option is configured,

Description

a numbered ACL is created. If a standard IP ACL is created, the value range of acl-id is 1–99 and
1300–1999. If an extended IP ACL is created, the value range of acl-id is 100–199 and 2000–2699.
acl-name: Indicates the name of a standard or an extended IP ACL. If this option is configured, a named
ACL is created. The name is a string of 1 to 99 characters.
start-sn: Indicates the start sequence number. Range: 1 to 2147483647.
inc-sn: Indicates the Increment of the sequence number. Range: 1 to 2147483647.

Command

Global configuration mode

Mode
Usage GuideRun this command to change the order of the access entries configuration mode.

Applying an IP ACL

Commandip access-group { acl-id | acl-name } inParameteracl-id: Indicates that a numbered standard or extended IP ACL will be applied to the interface.

Description

acl-name: Indicates that a named standard or extended IP ACL will be applied to the interface.
in: Indicates that this ACL controls incoming IP packets of the interface.

Command

Interface configuration mode

Mode
Usage Guide

This command makes an IP ACL take effect on the incoming or outgoing packets of a specified
interface.

Configuration
ExampleThe following configuration example describes only ACL-related configurations.



Configuring an IP ACL to Prohibit Departments Except the Financial Department from Accessing the
Financial Data Server

1-27

Configuration Guide

Configuring the ACL

Scenario
Figure 1-3

Configuratio

Configure an IP ACL.

n Steps

Add ACEs to the IP ACL.



Apply the IP ACL to the incoming direction of the interface connecting the financial data server.

SW1

sw1(config)# ip access-list standard 1
sw1(config-std-nacl)# permit 10.1.1.0 0.0.0.255
sw1(config-std-nacl)# deny 11.1.1.1 0.0.0.255
sw1(config-std-nacl)# exit
sw1(config)# int gigabitEthernet 0/17
sw1(config-if-GigabitEthernet 0/17)# ip access-group 1 in

VerificationOn a PC of the R&D department, ping the financial data server. Verify that the ping operation fails.

On a PC of the financial department, ping the financial data server. Verify that the ping operation
succeeds.

SW1

sw1(config)# show access-lists

ip access-list standard 1
10 permit 10.1.1.0 0.0.0.255
20 deny 11.1.1.0 0.0.0.255

sw1(config)#show access-groupip access-group 1 inApplied On interface GigabitEthernet 0/17

1-28

Configuration Guide

Configuring the ACL

1.4.2 Configuring an MAC Extended ACL
Configuration EffectConfigure and apply an MAC extended ACL to an interface to control all incoming IPv4 packets of this interface. You
can permit or deny the entry of specific L2 packets to a network to control access of users to network resources basedon L2 packets.

Notes
N/A

Configuration Steps

Configuring an MAC Extended ACL(Mandatory) Configure an MAC extended ACL if you want to control users' access to network resources based on
the L2 packet header, for example, the MAC address of each user's PC.

You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
MAC extended ACL takes effect only on the local device, and does not affect other devices on the network.

Adding ACEs to an MAC Extended ACL

(Optional) An ACL may contain zero or multiple ACEs. If no ACE is configured, all incoming L2 Ethernet packets ofthe device are denied by default.



Resequencing an MAC Extended ACL

(Optional) Resequence an MAC extended access list.

Applying an MAC extended ACL(Mandatory) Apply an MAC extended ACL to a specified interface if you want this ACL take effect.

You can apply an MAC extended ACL on a specified interface of an access, an aggregate, or a core device basedon the distribution of users.

Verification


Use the following methods to verify the configuration effects of the MAC extended ACL:

If an MAC extended ACL is configured to permit or deny some IP packets, run the ping command to check
whether ACEs of this ACL takes effect on the specified interface. For example, an MAC extended ACL is
configured to prevent a device interface from receiving IP packets (Ethernet type is 0x0800), run the pingcommand for verification.



If an MAC extended ACL is configured to permit or deny some non-IP packets (e.g. ARP packets), also run theping command to check whether ACEs of this ACL takes effect on the specified interface. For example, to filter
out ARP packets, run the ping command for verification.

You can also construct L2 packets meeting some specified characteristics to check whether the MAC extended
ACL takes effect. Typically, prepare two PCs, construct and send L2 packets on one PC, enable packet capturing
on another PC, and check whether packets are forwarded as expected (forwarded or blocked) according to theaction specified in the ACEs.

1-29

Configuration Guide

Configuring the ACL

Related Commands

Configuring an MAC Extended ACL

Commandmac access-list extended { acl-id | acl-name }Parameter

acl-name: Indicates the name of an MAC extended ACL. If this option is configured, a named ACL is

Description

created. The name is a string of 1 to 99 characters. The ACL name cannot start with numbers (0–9).
acl-id: Indicates the ID that uniquely identifies an MAC extended ACL. If this option is configured, anumbered ACL is created. The value range of acl-id is 700–799.

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure an MAC extended ACL and enter MAC extended ACL configuration
mode. You can configure an MAC extended ACL to control users' access to network resources bychecking the L2 information of Ethernet packets.

Adding ACEs to an MAC Extended ACL

Use either of the following methods to add ACEs to an MAC extended ACL:

Add ACEs in MAC extended ACL configuration mode.

Command[ sn ] { deny | permit } { source-mac-address mask | any | host source-mac-address }{ destination-mac-address mask | any | host destination-mac-address } [ ethernet-type ] [ cos [ cos ][ inner cos ] ] [ time-range time-range-name ]Parameter

sn: Indicates the sequence number of an ACE. The value ranges from 1 to 2,147,483,647. This

Description

sequence number determines the priority of this ACE in the ACL. A smaller sequence number indicatesa higher priority. An ACE with a higher priority will be preferentially used to match packets. If you do not
specify the sequence number when adding an ACE, the system automatically allocates a sequencenumber, which is equal to an increment (10 by default) plus the sequence number of the last ACE in thecurrent ACL. For example, if the sequence number of the last ACE is 100, the sequence number of a
newly-added ACE will be 110 by default. You can adjust the increment using a command.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
any: Indicates that L2 packets sent from any host are filtered.
host source-mac-address: Indicates that IP packets sent from a host with the specified source MAC
address are filtered.
source-mac-address mask: Indicates that the source MAC address is reversed.
any: Indicates that L2 packets sent to any host are filtered.
host destination-mac-address: Indicates that IP packets sent to a host with the specified destination
MAC address are filtered.
destination-mac-address mask: Indicates that the destination MAC address is reversed.
ethernet-type: Indicates that L2 packets of the specified Ethernet type are filtered.
cos cos: Indicates that L2 packets with the specified class of service (cos) field in the outer tag arefiltered.
inner cos: Indicates that L2 packets with the specified cos field in the inner tag are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of the

1-30

Configuration Guide

Configuring the ACL

time range.
Command

MAC extended ACL configuration mode

Mode
Usage Guide

Run this command to add ACEs in MAC extended ACL configuration mode. The ACL can be a named or
numbered ACL.



Add ACEs to an MAC extended ACL in global configuration mode.

Commandaccess-list acl-id { deny | permit } { source-mac-address mask | any | host source-mac-address }{ destination-mac-address mask | any | host destination-mac-address } [ ethernet-type ] [ cos [ cos ][ inner cos ] ] [ time-range time-range-name ]Parameteracl-id: Indicates the ID of a numbered ACL. It uniquely identifies an ACL. The value range of acl-id is

Description

700–799.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
host source-mac-address: Indicates that IP packets sent from a host with the specified source MAC
address are filtered.
source-mac-address mask: Indicates that the source MAC address is reversed.
any: Indicates that L2 packets sent to any host are filtered.
host destination-mac-address: Indicates that IP packets sent to a host with the specified destination
MAC address are filtered.
destination-mac-address mask: Indicates that the destination MAC address is reversed.
ethernet-type: Indicates that L2 packets of the specified Ethernet type are filtered.
cos cos: Indicates that L2 packets with the specified cos field in the outer tag are filtered.
inner cos: Indicates that L2 packets with the specified cos field in the inner tag are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of thetime range.

Command

Global configuration mode

Mode
Usage Guide

Run this command to add ACEs to a numbered MAC extended ACL in global configuration mode. It
cannot be used to add ACEs to a named MAC extended ACL.



Resequencing an MAC Extended ACL

Commandmac access-list resequence { acl-id | acl-name } start-sn inc-sn

Parameteracl-id: Indicates the ID that uniquely identifies an MAC extended ACL. If this option is configured, aDescription

numbered ACL is created. The value range of acl-id is 700–799.
acl-name: Indicates the name of an MAC extended ACL. If this option is configured, a named ACL iscreated. The name is a string of 1 to 99 characters.
start-sn: Indicates the start sequence number. Range: 1 to 2147483647.
inc-sn: Indicates the Increment of the sequence number. Range: 1 to 2147483647.

Command

Global configuration mode

Mode
Usage GuideRun this command to change the order of the access entries configuration mode.

Applying an MAC Extended ACL

1-31

Configuration Guide

Configuring the ACL

Commandmac access-group { acl-id | acl-name } inParameteracl-id: Indicates that a numbered MAC extended IP ACL will be applied to the interface.

Description

acl-name: Indicates that a named MAC extended IP ACL will be applied to the interface.
in: Indicates that this ACL controls incoming L2 packets of the interface.

Command

Interface configuration mode

Mode
Usage Guide

This command makes an MAC extended ACL take effect on the incoming packets of a specified
interface.

Configuration
ExampleThe following configuration example describes only ACL-related configurations.



Configuring an MAC Extended ACL to Restrict Resources Accessible by Visitors

Scenario
Figure 1-4

Configuratio

Configure an MAC extended ACL.

n Steps

Add ACEs to the MAC extended ACL.



Apply the MAC extended ACL to the outgoing direction of the interface connected to the visitor area
so that visitors are allowed to access Internet and the public server of the company, but prohibitedfrom accessing the financial data server of the company. That is, visitors cannot access the serverwith the MAC address 00e0.f800.000d.

SW1

sw1(config)# mac access-list extended 700
sw1(config-mac-nacl)# deny any host 00e0.f800.000d
sw1(config-mac-nacl)# pemit any any
sw1(config-mac-nacl)# exit
sw1(config)# int gigabitEthernet 0/17
sw1(config-if-GigabitEthernet 0/17)# mac access-group 700 in

1-32

Configuration Guide
Verification

Configuring the ACLOn a visitor's PC, ping the financial data server. Verify that the ping operation fails.

On a visitor's PC, ping the public resource server. Verify that the ping operation succeeds.

On a visitor's PC, access the Internet, for example, visit the Baidu website. Verify that the webpage
can be opened.

SW1

sw1(config)# show access-lists
mac access-list extended 700
10 deny any host 00e0.f800.000d etype-any
20 permit any any etype-anysw1(config)# show access-group
mac access-group 700 in
Applied On interface GigabitEthernet 0/17

1.4.3 Configuring an Expert Extended ACL
Configuration EffectConfigure and apply an expert extended ACL to an interface to control incoming packets of the interface based on theL2 and L3 information, and allow or prohibit the entry of specific packets to the network. In addition, you can configure
an expert extended ACL to control all L2 packets based on the VLAN to permit or deny the access of users in some
network segments to network resources. Generally, you can use an expert extended ACL if you want to incorporate
ACEs of the IP ACL and MAC extended ACL into one ACL.

Configuration Steps

Configuring an Expert Extended ACL(Mandatory) Configure an expert extended ACL if you want to control users' access to network resources basedon the L2 packet header, for example, the VLAN ID.

You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
expert extended ACL takes effect only on the local device, and does not affect other devices on the network.

Adding ACEs to an Expert Extended ACL

(Optional) An ACL may contain zero or multiple ACEs. If no ACE is configured, all incoming packets of the device
are denied by default.



Resequencing an Expert Extended ACL

(Optional) Resequence an expert access list.

Applying an Expert Extended ACL(Mandatory) Apply an expert extended ACL to a specified interface if you want this ACL take effect.

You can apply an expert extended ACL in the incoming direction of a specified interface of an access, anaggregate, or a core device based on the distribution of users.

1-33

Configuration Guide

Configuring the ACL

Verification


Use the following methods to verify the configuration effects of the expert extended ACL:

If IP-based access rules are configured in an expert extended ACL to permit or deny some IP packets, run theping command to verify whether these rules take effect.



If MAC-based access rules are configured in an expert extended ACL to permit or deny some L2 packets (e.g.
ARP packets), also run the ping command to check whether ACEs of this ACL takes effect on the specified
interface. For example, to filter out ARP packets, run the ping command for verification.



If VLAN ID-based access rules are configured in an expert extended ACL to permit or deny some L2 packets insome network segments (e.g., to prevent communication between VLAN 1 users and VLAN 2 users), ping PCs of
VLAN 2 on a PC of VLAN 1. If the ping operation fails, the rules take effect.

Related Commands

Configuring an Expert Extended ACL

Commandexpert access-list extended { acl-id | acl-name }Parameter

acl-name: Indicates the name of an expert extended ACL. If this option is configured, a named ACL is

Description

created. The name is a string of 1 to 99 characters. The ACL name cannot start with numbers (0–9).
acl-id: Indicates the ID of an expert extended ACL. If this option is configured, a numbered ACL iscreated. The value range of acl-id is 2700-2899.

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure an expert extended ACL and enter expert extended ACL configuration
mode.



Adding ACEs to an Expert Extended ACL

Use either of the following methods to add ACEs to an expert extended ACL:

Add ACEs in expert extended ACL configuration mode.

Command[ sn ] { deny | permit } [ protocol | [ ethernet-type ] [ cos [ cos ] [ inner cos ] ] ] [ VID [ vid ] [ inner vid ] ]{ source-ipv4-address source-ipv4-wildcard | any | host source-ipv4-address } { source-mac-address
mask | any | host source-mac-address } [ eq port | gt port | lt port | neq port | range lower upper ]{ destination-ipv4-address destination-ipv4-wildcard | any | host destination-ipv4-address } { any | hostdestination-mac-address } [ eq port | gt port | lt port | neq port | range lower upper ] [ dscp dscp ][ precedence precedence ] [ tos tos ] [ fragment ] [ match-all tcp-flag | established ] [ time-range
time-range-name ]Parameter

sn: Indicates the sequence number of an ACE. The value ranges from 1 to 2,147,483,647. This

Description

sequence number determines the priority of this ACE in the ACL. A smaller sequence number indicatesa higher priority. An ACE with a higher priority will be preferentially used to match packets. If you do not
specify the sequence number when adding an ACE, the system automatically allocates a sequencenumber, which is equal to an increment (10 by default) plus the sequence number of the last ACE in thecurrent ACL. For example, if the sequence number of the last ACE is 100, the sequence number of a
newly-added ACE will be 110 by default. You can adjust the increment using a command.
permit: Indicates that the ACE is a permit ACE.

1-34

Configuration Guide

Configuring the ACL

deny: Indicates that the ACE is a deny ACE.
protocol: Indicates the IP protocol number. The value ranges from 0 to 255. To facilitate the use, thesystem provides frequently-used abbreviations to replace the specific IP protocol numbers, including
eigrp, gre, icmp, igmp, ip, ipinip, nos, ospf, tcp, and udp.
ethernet-type: Indicates that L2 packets of the specified Ethernet type are filtered.
cos cos: Indicates that L2 packets with the specified cos field in the outer tag are filtered.
inner cos: Indicates that L2 packets with the specified cos field in the inner tag are filtered.
VID vid: Indicates that L2 packets with the specified VLAN ID field in the outer tag are filtered.
inner vid: Indicates that L2 packets with the specified VLAN ID field in the inner tag are filtered.
source-ipv4-address source-ipv4-wildcard: Indicates that IP packets sent from hosts in the specified IP
network segment are filtered.
host source-ipv4-address: Indicates that IP packets sent from a host with the specified source IP
address are filtered.
any: Indicates that IP packets sent from any host are filtered.
host source-mac-address: Indicates that IP packets sent from a host with the specified source MAC
address are filtered.
any: Indicates that L2 packets sent to any host are filtered.
destination-ipv4-address destination-ipv4-wildcard: Indicates that IP packets sent to hosts in a specified
IP network segment are filtered.
host destination-ipv4-address: Indicates that IP packets sent to a host with the specified destination IP
address are filtered.
any: Indicates that IP packets sent to any host are filtered.
host destination-mac-address: Indicates that IP packets sent to a host with the specified destination
MAC address are filtered.
any: Indicates that L2 packets sent to any host are filtered.
eq port | gt port | lt port | neq port: Indicates that TCP or UDP packets are filtered based on the L4
destination port number. The value of the op parameter can be eq (equal to), neq (not equal to), gt(greater than), or lt (smaller than).
range lower upper: Indicates that TCP or UDP packets with the L4 destination port number in thespecified range are filtered.precedence precedence: Indicates that IP packets with the specified
precedence field in the header are filtered.
tos tos: Indicates that IP packets with the specified the TOS field in the header are filtered.
dscp dscp: Indicates that IP packets with the specified the dcsp field in the header are filtered.
fragment: Indicates that only fragmented IP packets except the first fragments are filtered.
match-all tcp-flag: Indicates that TCP packets with all the bits of the TCP flag are filtered.
established: Indicates that TCP packets with the RST or ACK bits of the TCP flag are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of thetime range.
CommandExpert extended ACL configuration mode

Mode
Usage Guide

Run this command to add ACEs in expert extended ACL configuration mode. The ACL can be a named
or numbered ACL.



Add ACEs to an expert extended ACL in global configuration mode.

1-35

Configuration Guide
Command

Configuring the ACL

access-list acl-id { deny | permit } [ protocol | [ ethernet-type ] [ cos [ cos ] [ inner cos ] ] ] [ VID [ vid ][ inner vid ] ] { source-ipv4-address source-ipv4-wildcard | any | host source-ipv4-address }{ source-mac-address mask | any | host source-mac-address } [ eq port | gt port | lt port | neq port |range lower upper ] { destination-ipv4-address destination-ipv4-wildcard | any | hostdestination-ipv4-address } { any | host destination-mac-address } [ eq port | gt port | lt port | neq port |range lower upper ] [ dscp dscp ] [ precedence precedence ] [ tos tos ] [ fragment ] [ match-all tcp-flag| established ] [ time-range time-range-name ]Parameteracl-id: Indicates the ID of a numbered ACL. It uniquely identifies an ACL. The value range of acl-id is

Description

2700-2899.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
protocol: Indicates the IP protocol number. The value ranges from 0 to 255. To facilitate the use, thesystem provides frequently-used abbreviations to replace the specific IP protocol numbers, including
eigrp, gre, icmp, igmp, ip, ipinip, nos, ospf, tcp, and udp.
ethernet-type: Indicates that L2 packets of the specified Ethernet type are filtered.
cos cos: Indicates that L2 packets with the specified cos field in the outer tag are filtered.
inner cos: Indicates that L2 packets with the specified cos field in the inner tag are filtered.
VID vid: Indicates that L2 packets with the specified VLAN ID field in the outer tag are filtered.
inner vid: Indicates that L2 packets with the specified VLAN ID field in the inner tag are filtered.
source-ipv4-address source-ipv4-wildcard: Indicates that IP packets sent from hosts in the specified IP
network segment are filtered.
host source-ipv4-address: Indicates that IP packets sent from a host with the specified source IP
address are filtered.
any: Indicates that IP packets sent from any host are filtered.
host source-mac-address: Indicates that IP packets sent from a host with the specified source MAC
address are filtered.
any: Indicates that L2 packets sent to any host are filtered.
destination-ipv4-address destination-ipv4-wildcard: Indicates that IP packets sent to hosts in a specified
IP network segment are filtered.
host destination-ipv4-address: Indicates that IP packets sent to a host with the specified destination IP
address are filtered.
any: Indicates that IP packets sent to any host are filtered.
host destination-mac-address: Indicates that IP packets sent to a host with the specified destination
MAC address are filtered.
any: Indicates that L2 packets sent to any host are filtered.
eq port | gt port | lt port | neq port: Indicates that TCP or UDP packets are filtered based on the L4
destination port number. The value of the op parameter can be eq (equal to), neq (not equal to), gt(greater than), or lt (smaller than).
range lower upper: Indicates that TCP or UDP packets with the L4 destination port number in thespecified range are filtered.
precedence precedence: Indicates that IP packets with the specified precedence field in the header are
filtered.
tos tos: Indicates that IP packets with the specified the TOS field in the header are filtered.
dscp dscp: Indicates that IP packets with the specified the dcsp field in the header are filtered.

1-36

Configuration Guide

Configuring the ACL

fragment: Indicates that only fragmented IP packets except the first fragments are filtered.
match-all tcp-flag: Indicates that TCP packets with all the bits of the TCP flag are filtered.
established: Indicates that TCP packets with the RST or ACK bits of the TCP flag are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of thetime range.
Command

Global configuration mode

Mode
Usage Guide

Run this command to add ACEs to a numbered expert extended ACL in global configuration mode. It
cannot be used to add ACEs to a named expert extended ACL.



Resequencing an Expert Extended ACL

Commandexpert access-list resequence { acl-id | acl-name } start-sn inc-sn

Parameteracl-id: Indicates the ID of an expert extended ACL. If this option is configured, a numbered ACL is

Description

created. The value range of acl-id is 2700-2899.
acl-name: Indicates the name of an expert extended ACL. If this option is configured, a named ACL iscreated. The name is a string of 1 to 99 characters.
start-sn: Indicates the start sequence number. Range: 1 to 2147483647.
inc-sn: Indicates the Increment of the sequence number. Range: 1 to 2147483647.

Command

Global configuration mode

Mode
Usage GuideRun this command to change the order of the access entries configuration mode.

Applying an Expert Extended ACL

Commandexpert access-group { acl-id | acl-name } inParameteracl-id: Indicates that a numbered expert extended ACL will be applied to the interface.

Description

acl-name: Indicates that a named expert extended ACL will be applied to the interface.
in: Indicates that this ACL controls incoming L2 packets of the interface.

Command

Interface configuration mode

Mode
Usage Guide

This command makes an expert extended ACL take effect on the incoming packets of a specified
interface.

Configuration
ExampleThe following configuration example describes only ACL-related configurations.



Configuring an Expert Extended ACL to Restrict Resources Accessible by Visitors (It is required that
visitors and employees cannot communicate with each other, visitors can access the public resource
server but not the financial data server of the company.)

1-37

Configuration Guide

Configuring the ACL

Scenario
Figure 1-5

Configuratio

Configure an expert extended ACL.

n Steps

Add an ACE to deny packets sent from PCs in the visitor area (VLAN 3) to employee PCs in VLAN
2.



Add an ACE to prevent visitors from accessing the financial data server of the company.



Add an ACE to permit all packets.



Apply the ACL to the incoming direction of the interface of the switch that connects to the visitor
area.

SW1

sw1(config)# expert access-list extended 2700
sw1(config-exp-nacl)# deny ip any any 192.168.1.0 0.0.0.255 anysw1(config-exp-nacl)# deny ip any any host 10.1.1.1 anysw1(config-exp-nacl)# pemit any any any any
sw1(config-exp-nacl)# exit
sw1(config)# int gigabitEthernet 0/17
sw1(config-if-GigabitEthernet 0/17)# expert access-group 2700 in

VerificationOn a visitor's PC, ping the financial data server. Verify that the ping operation fails.

On a visitor's PC, ping the public resource server. Verify that the ping operation succeeds.

On a visitor's PC, ping the gateway address 192.168.1.1 of an employee. Verify that the ping
operation fails.

On a visitor's PC, access the Internet, for example, visit the Baidu website. Verify that the webpage
can be opened.

SW1

sw1(config)# show access-lists
expert access-list extended 2700
10 deny ip any any 192.168.1.0 0.0.0.255 any

1-38

Configuration Guide

Configuring the ACL

20 deny ip any any host 10.1.1.1 any
30 permit ip any any any any

sw1(config)# show access-groupexpert access-group 2700 in
Applied On interface GigabitEthernet 0/17

1.4.4 Configuring an IPv6 Extended ACL
Configuration EffectConfigure and apply an IPv6 ACL to an interface to control all incoming IPv6 packets of this interface. You can permit ordeny the entry of specific IPv6 packets to a network to control access of IPv6 users to network resources.

Configuration Steps

Configuring an IPv6 ACL(Mandatory) Configure an IP ACL if you want to access of IPv4 users to network resources.



You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
IPv6 ACL takes effect only on the local device, and does not affect other devices on the network.

Adding ACEs to an IPv6 ACL

(Optional) An ACL may contain zero or multiple ACEs. If no ACE is configured, all incoming IPv6 packets of thedevice are denied by default.



Resequencing an IPv6 ACL

(Optional) Resequence an IPv6 access list.

Applying an IPv6 ACL(Mandatory) Apply an IPv6 ACL to a specified interface on a device if you want this ACL take effect.

You can apply an IPv6 ACL on a specified interface of an access, an aggregate, or a core device based on the
distribution of users.

Verification


Use the following methods to verify the configuration effects of the IPv6 ACL:

Run the ping command to verify that the IPv6 ACL takes effect on the specified interface. For example, if an IPv6
ACL is configured to prohibit a host with a specified IP address or hosts in a specified IPv6 address range fromaccessing the network, run the ping command to verify that the host(s) cannot be successfully pinged.

Access network resources, for example, visit an IPv6 website, to check whether the IPv6 ACL takes effect on thespecified interface.

Related Commands

Configuring an IPv6 ACL
1-39

Configuration Guide

Configuring the ACL

Commandipv6 access-list acl-nameParameter

acl-name: Indicates the name of a standard or an extended IP ACL. The name is a string of 1 to 99

Description

characters. The ACL name cannot start with numbers (0–9).

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure an IPv6 ACL and enter IPv6 configuration mode.

Adding ACEs to an IPv6 ACL



To filter TCP or UDP packets, add ACEs to an IPv6 ACL as follows:

Command[ sn ] { deny | permit } ipv6-protocol { any | host source-ipv6-address } [ eq port | gt port | lt port | neq
port | range lower upper ] { any | host destination-ipv6-address } [ eq port | gt port | lt port | neq port |range lower upper ] [ dscp dscp ] [ flow-label flow-label ] [ fragment ] [ match-all tcp-flag |established ] [ time-range time-range-name ] [ log ]Parameter

sn: Indicates the sequence number of an ACE. The value ranges from 1 to 2,147,483,647. This

Description

sequence number determines the priority of this ACE in the ACL. A smaller sequence number indicatesa higher priority. An ACE with a higher priority will be preferentially used to match packets. If you do not
specify the sequence number when adding an ACE, the system automatically allocates a sequencenumber, which is equal to an increment (10 by default) plus the sequence number of the last ACE in thecurrent ACL. For example, if the sequence number of the last ACE is 100, the sequence number of a
newly-added ACE will be 110 by default. You can adjust the increment using a command.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
ipv6-protocol: Indicates the IPv6 protocol number. The value ranges from 0 to 255. To facilitate the use,
the system provides frequently-used abbreviations of IPv6 protocol numbers to replace the specific IP
protocol numbers, including icmp, ipv6, tcp, and udp.
host source-ipv6-address Indicates that IPv6 packets sent from a host with the specified source IP
address are filtered.
any: Indicates that IPv6 packets sent from any host are filtered.
host destination-ipv6-address: Indicates that IPv6 packets sent to a host with the specified destination
IP address are filtered.
any: Indicates that IPv6 packets sent to any host are filtered.
eq port | gt port | lt port | neq port: Indicates that TCP or UDP packets are filtered based on the L4
destination port number. The value of the op parameter can be eq (equal to), neq (not equal to), gt(greater than), or lt (smaller than).
range lower upper: Indicates that TCP or UDP packets with the L4 destination port number in thespecified range are filtered.
dscp dscp: Indicates that IPv6 packets with the specified the dcsp field in the header are filtered.
flow-label flow-label: Indicates that IPv6 packets with the specified the flow label field in the header are
filtered.
fragment: Indicates that only fragmented IPv6 packets except the first fragments are filtered.
match-all tcp-flag: Indicates that TCP packets with all the bits of the TCP flag are filtered.
established: Indicates that TCP packets with the RST or ACK bits of the TCP flag are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of the

1-40

Configuration Guide

Configuring the ACL

time range.
log: Indicates that logs will be periodically output if packets matching the ACEs are found. For details
about logs, see "ACL Logging" in this document.
Command

IPv6 ACL configuration mode

Mode
Usage GuideRun this command to add ACEs in IPv6 ACL configuration mode.

To filter IPv6 packets except for the TCP or UDP packets, add ACEs to an IPv6 ACL as follows:

Command[ sn ] { deny | permit } ipv6-protocol { any | host source-ipv6-address } [ eq port | gt port | lt port | neq
port | range lower upper ] { any | host destination-ipv6-address } [ eq port | gt port | lt port | neq port |range lower upper ] [ dscp dscp ] [ flow-label flow-label ] [ fragment ] [ match-all tcp-flag |established ] [ time-range time-range-name ] [ log ]Parameter

sn: Indicates the sequence number of an ACE. The value ranges from 1 to 2,147,483,647. This

Description

sequence number determines the priority of this ACE in the ACL. A smaller sequence number indicatesa higher priority. An ACE with a higher priority will be preferentially used to match packets. If you do not
specify the sequence number when adding an ACE, the system automatically allocates a sequencenumber, which is equal to an increment (10 by default) plus the sequence number of the last ACE in thecurrent ACL. For example, if the sequence number of the last ACE is 100, the sequence number of a
newly-added ACE will be 110 by default. You can adjust the increment using a command.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
ipv6-protocol: Indicates the IPv6 protocol number. The value ranges from 0 to 255. To facilitate the use,
the system provides frequently-used abbreviations of IPv6 protocol numbers to replace the specific IP
protocol numbers, including icmp, ipv6, tcp, and udp.
host source-ipv6-address: Indicates that IPv6 packets sent from a host with the specified source IP
address are filtered.
any: Indicates that IPv6 packets sent from any host are filtered.
host destination-ipv6-addr: Indicates that IPv6 packets sent to a host with the specified destination IP
address are filtered.
any: Indicates that IPv6 packets sent to any host are filtered.
eq port | gt port | lt port | neq port: Indicates that TCP or UDP packets are filtered based on the L4
destination port number. The value of the op parameter can be eq (equal to), neq (not equal to), gt(greater than), or lt (smaller than).
range lower upper: Indicates that TCP or UDP packets with the L4 destination port number in thespecified range are filtered.
dscp dscp: Indicates that IPv6 packets with the specified the dcsp field in the header are filtered.
flow-label flow-label: Indicates that IPv6 packets with the specified the flow label field in the header are
filtered.
fragment: Indicates that only fragmented IPv6 packets except the first fragments are filtered.
match-all tcp-flag: Indicates that TCP packets with all the bits of the TCP flag are filtered.
established: Indicates that TCP packets with the RST or ACK bits of the TCP flag are filtered.
time-range time-range-name: Indicates that this ACE is associated with a time range. The ACE takes
effect only within this time range. For details about the time range, see the configuration manual of thetime range.
log: Indicates that logs will be periodically output if packets matching the ACEs are found. For details

1-41Configuration Guide

Configuring the ACL

about logs, see "ACL Logging" in this document.
Command

IPv6 ACL configuration mode

Mode
Usage GuideRun this command to add ACEs in IPv6 ACL configuration mode.

Resequencing an IPv6 ACL

Commandipv6 access-list resequence acl-name start-sn inc-sn

Parameter

acl-name: Indicates the name of an IPv6 extended ACL. The name is a string of 1 to 99 characters. The

Description

ACL name cannot start with numbers (0–9).
start-sn: Indicates the start sequence number. Range: 1 to 2147483647.
inc-sn: Indicates the Increment of the sequence number. Range: 1 to 2147483647.

Command

Global configuration mode

Mode
Usage GuideRun this command to change the order of the access entries configuration mode.

Applying an IPv6 ACL

Commandipv6 traffic-filter acl-name in

Parameter

acl-name: Indicates the name of an IPv6 ACL.

Description

in: Indicates that this ACL controls incoming IPv6 packets of the interface.

Command

Interface configuration mode

Mode
Usage Guide

This command makes an IPv6 ACL take effect on the incoming packets of the specified interface.

Configuration
Example

Configuring an IPv6 ACL to Prohibit the R&D Department from Accessing the Video Server

Scenario
Figure 1-6

Configuratio

Configure an IPv6 ACL.

1-42

Configuration Guiden Steps

SW1

Configuring the ACL

Add an ACE to the IPv6 ACL to prevent access to the video server.



Add an ACE to the IPv6 ACL to permit all IPv6 packets.



Apply the IPv6 ACL to the incoming direction of the interface connected to the R&D department.

sw1(config)# ipv6 access-list dev_deny_ipv6video
sw1(config-ipv6-nacl)# deny ipv6 any host 200::1
sw1(config-ipv6-nacl)# permit ipv6 any any
sw1(config-ipv6-nacl)# exit
sw1(config)# int gigabitEthernet 0/17
sw1(config-if-GigabitEthernet 0/17)# ipv6 traffic-filter dev_deny_ipv6video in

Verification
SW1

On a PC of the R&D department, ping the video server. Verify that the ping operation fails.

sw1(config)# show access-lists
ipv6 access-list dev_deny_ipv6video
10 deny ipv6 any host 200::1
20 permit ipv6 any any
sw1(config)# show access-groupipv6 traffic-filter dev_deny_ipv6video in
Applied On interface GigabitEthernet 0/17

1.4.5 Configuring an ACL80
Configuration Effect
When the IP ACL, MAC extended ACL, expert extended ACL, and IPv6 ACL with fixed matching fields cannot meetrequirements, configure the ACL80 to customize the packet fields that need to be matched.

Configuration Steps

Configuring an Expert Advanced ACL(Mandatory) Configure an expert advanced ACL if you want to implement the ACL80 function. For details about
how to configure the expert advanced ACL, see the related descriptions.



You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
expert advanced ACL takes effect only on the local device, and does not affect other devices on the network.

Adding ACEs to an Expert Advanced ACL(Mandatory) Add ACEs to an expert advanced ACL to customize matching fields. If no ACE is added to the expert
advanced ACL, the deny ACEs will drop all packets by default. For details about how to add an ACE to an expert
advanced ACL, see the related descriptions.



Applying an Expert Advanced ACL

1-43

Configuration Guide

Configuring the ACL(Mandatory) Apply an expert advanced ACL to a specified interface if you want this ACL take effect.

You can apply an expert advanced ACL on a specified interface of an access, an aggregate, or a core device
based on the distribution of users.

Verification


Use the following methods to verify the configuration effects of the expert advanced ACL:

Run the ping command to check whether the configurations take effect.

Construct packets matching the ACEs to check whether ACEs take effect.

Related Commands

Configuring an Expert Advanced ACL

Commandexpert access-list advanced acl-nameParameter

acl-name: Indicates the name of an expert advanced ACL. The name is a string of 1 to 99 characters.

Description

The ACL name cannot start with numbers (0–9).

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure an expert advanced ACL and enter expert advanced ACL configuration
mode.



Adding ACEs to an Expert Advanced ACL

Command[ sn ] { permit | deny } hex hex-mask offset

Parameter

sn: Indicates the sequence number of an ACE. The value ranges from 1 to 2,147,483,647. This

Description

sequence number determines the priority of this ACE in the ACL. A smaller sequence number indicatesa higher priority. An ACE with a higher priority will be preferentially used to match packets. If you do not
specify the sequence number when adding an ACE, the system automatically allocates a sequencenumber, which is equal to an increment (10 by default) plus the sequence number of the last ACE in thecurrent ACL. For example, if the sequence number of the last ACE is 100, the sequence number of a
newly-added ACE will be 110 by default. You can adjust the increment using a command.
permit: Indicates that the ACE is a permit ACE.
deny: Indicates that the ACE is a deny ACE.
hex: Indicates the customized matching rule expressed in hexadecimal format, for example, 00d0f800.
hex-mask: Indicates the matching mask.
offset: Indicates the start position of matching. For example, if the matching content is 00d0f800, thematching mask is 00ff0000, and start position is 6, the destination MAC address of each packet iscompared. All packets whose second byte of the destination MAC address is d0 match this ACE.

CommandExpert advanced ACL configuration mode

Mode
Usage GuideRun this command to add ACEs in expert advanced ACL configuration mode.

Applying an Expert Advanced ACL

Commandexpert access-group acl-name in

Parameter

acl-name: Indicates that a named expert advanced ACL will be applied to the interface.

1-44

Configuration Guide

Configuring the ACL

Description

in: Indicates that this ACL controls incoming L2 packets of the interface.

Command

Interface configuration mode

Mode
Usage Guide

This command makes an expert advanced ACL take effect on the incoming packets of a specified
interface.

Configuration
ExampleThe following configuration example describes only ACL-related configurations.



Configuring an ACL80 to Restrict Resources Accessible by Visitors (It is required that visitors andemployees cannot communicate with each other, visitors can access the public resource server but not
the financial data server of the company.)

Scenario
Figure 1-7

Configuratio

Configure an expert advanced ACL.

n Steps

Add an ACE to deny packets sent from PCs in the visitor area (VLAN 3) to employee PCs in VLAN
2.



Add an ACE to prevent visitors from accessing the financial data server of the company.



Add an ACE to permit all packets.



Apply the ACL to the incoming direction of the interface of the switch that connects to the visitor
area.

SW1

sw1(config)# expert access-list advanced acl80-guestsw1(config-exp-dacl)# deny C0A801 FFFFFF 42
sw1(config-exp-dacl)# deny 0A010101 FFFFFFFF 42

1-45

Configuration Guide

Configuring the ACL

sw1(config-exp-dacl)# permit 0806 FFFF 24
sw1(config-exp-dacl)# permit 0800 FFFF 24
sw1(config-exp-dacl)# exit
sw1(config)# int gigabitEthernet 0/17
sw1(config-if-GigabitEthernet 0/17)# expert access-group acl80-guest in

VerificationOn a visitor's PC, ping the financial data server. Verify that the ping operation fails.

On a visitor's PC, ping the public resource server. Verify that the ping operation succeeds.

On a visitor's PC, ping the gateway address 192.168.1.1 of an employee. Verify that the ping
operation fails.

On a visitor's PC, access the Internet, for example, visit the Baidu website. Verify that the webpage
can be opened.

SW1

sw1(config)# show access-lists
expert access-list advanced sss
10 deny C0A801 FFFFFF 42
20 deny 0A010101 FFFFFFFF 42
30 permit 0806 FFFF 24
40 permit 0800 FFFF 24
expert access-group acl80-guest in
Applied On interface GigabitEthernet 0/17

1.4.6 Configuring ACL Redirection
Configuration EffectConfigure the ACL redirection function on a specified interface to directly redirect specified packets on the interface to a
specified port for further forwarding.

Configuration Steps

Configuring an ACL(Mandatory) To implement ACL redirection, you must first configure an ACL, for example, an IP, MAC extended,or expert extended ACL. For details about how to configure an ACL, see the related descriptions.



You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
IPv6 ACL takes effect only on the local device, and does not affect other devices on the network.

Adding ACEs to an ACL

(Optional) An ACL may contain zero or multiple ACEs. If no ACE is configured, the ACL redirection function is notavailable. For details about how to add an ACE to an ACL, see the related descriptions.



Configuring ACL Redirection

1-46Configuration Guide

Configuring the ACL(Mandatory) Enable ACL redirection on a specified interface if you want to implement ACL redirection.

You can configure the ACL redirection function on a specified interface of an access, an aggregate, or a coredevice based on the distribution of users.

Verification
Send packets matching ACEs on the port where ACL redirection is enabled, and then use the packet capturing softwareon the destination port to check whether the ACL redirection function takes effect.

Related Commands

Configuring an ACL

For details about how to configure an ACL, see the earlier descriptions about the IP ACL, MAC extended ACL, expert
extended ACL, or IPv6 ACL.



Adding ACEs to an ACL

For details about how to add ACEs to an ACL, see the earlier descriptions about the IP ACL, MAC extended ACL,
expert extended ACL, or IPv6 ACL.



Configuring ACL Redirection

Commandredirect destination interface interface-name acl { acl-id | acl-name } inParameterinterface interface-name: Indicates the name of the destination port for redirection.

Description

acl-id: Indicates the ID of an ACL.
acl-name: Indicates the name of an ACL.
in: Indicates that incoming packets of the interface are redirected.

Command

Interface configuration mode

Mode
Usage Guide

Run this command to redirect incoming packets of the interface that match ACEs to the destination port
for further forwarding.

Configuration
ExampleThe following configuration example describes only ACL-related configurations.



Enabling ACL Redirection to Redirect Packets Sent from the Host 10.1.1.1 to the Packet Capturing Device
for Analysis

1-47Configuration Guide

Configuring the ACL

Scenario
Figure 1-8

Configuratio

Configures an IP ACL.

n Steps

Add an ACE to the IP ACL to permit packets sent from the host 10.1.1.1.

Enable ACL redirection on the port GI 0/17, and set the destination port to Gi 0/18.

SW1

sw1(config)# ip access-list standard 1
sw1 (config-std-nacl)# permit host 10.1.1.1
sw1(config-std-nacl)# exit
sw1(config)# int gigabitEthernet 0/17
sw1(config-if-GigabitEthernet 0/17)# redirect destination interface gigabitEthernet 0/18 acl 1 in

VerificationCapture packets on PC 2. Ping the video server on PC 1. Verify that ICMP requests sent from PC 1
are captured on PC 2.

SW1

sw1# show access-lists
ip access-list standard 1
10 permit host 10.1.1.1
sw1# show redirect interface gigabitEthernet 0/17
acl redirect configuration on interface gigabitEthernet 0/17
redirect destination interface gigabitEthernet 0/18 acl 1 in

1.4.7 Configuring a Global Security ACL
Configuration EffectConfigure a global security ACL to prevent internal PCs of a company from accessing illegal websites or prevent virus
from attacking the company's internal network. You can also configure exclusive interfaces to allow specified
departments of the company to access external websites.

1-48

Configuration Guide

Configuring the ACL

Configuration Steps

Configuring an ACL(Mandatory) Configure an ACL if you want to protect the internal network globally. For details about theconfiguration method, see the earlier descriptions about the ACL.

You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
configurations take effect only on the local device, and do not affect other devices on the network.

Adding ACEs to an ACL

(Optional) An ACL may contain zero or multiple ACEs. If no ACE is configured, it is equivalent that the global
security ACL does not exist. For details about how to add an ACE to an ACL, see the related descriptions.



Configuring a Global Security ACL(Mandatory) Enable the global security function if you want to make the global security ACL take effect.

You can configure a global security ACL on an access, an aggregate, or a core device based on the distribution ofusers.

Verification
On the internal network protected by the global security ACL, ping the website or device that are denied by ACEs tocheck whether the global security ACL takes effect.

Related Commands

Configuring an ACL

For details about the configuration method, see the earlier descriptions about the ACL.



Adding ACEs to an ACL

For details about the configuration method, see the earlier descriptions about the ACL.



Configuring a Global Security ACL

Command{ mac | expert | ip } access-group acl-id in

Parameteracl-id: Indicates the ID of an ACL.

Description

in: Filters the incoming packets of the device.

Command

Global configuration mode

Mode
Usage Guide

Run this command to enable the global security ACL so that the ACL takes effect on all L2 interfaces ofthe device.

Configuring an Exclusive Interface of the Global Security ACL

Commandno global access-group

Parameter

N/A

Description

1-49

Configuration Guide
Command

Configuring the ACL

Interface configuration mode

Mode
Usage Guide

Run this command to invalidate a global security ACL on a specified interface.

Configuration
ExampleThe following configuration example describes only ACL-related configurations.



Configuring a Global Security ACL to Prevent the R&D Department From Accessing the Server of theSales Department but Allow the Sales Department to Access This Server

Scenario
Figure 1-9

Configuratio

Configure an extended IP ACL "ip_ext_deny_dst_sale_server".

n Steps

Add the ACE that prevents the device to forward packets to the destination host 10.1.1.3/24.

Configure the ACL "ip_ext_deny_dst_sale_server" as a global security ACL.



Configure the interface directly connected to the sales department as the exclusive interface of the
global security ACL.

SW1

sw1(config)# ip access-list extended ip_ext_deny_dst_sale_serversw1(config-ext-nacl)# deny ip any host 10.1.1.3
sw1(config-ext-nacl)# exit
sw1(config)# ip access-group ip_ext_deny_dst_sale_server insw1(config)# int gigabitEthernet 0/17
sw1(config-if-GigabitEthernet 0/17)# no global access-group

VerificationOn a PC of the sales department, ping the server of the sales department. Verify that the ping

1-50

Configuration Guide

Configuring the ACL
operation succeeds.

On the PCs of R&D department 1 and R&D department 2, ping the server of the sales department.
Verify that the ping operations fail.

sw1# show access-lists
ip access-list extended ip_ext_deny_dst_sale_server
10 deny ip any host 10.1.1.3
sw1#show running……
!
ip access-group ip_ext_deny_dst_sale_server in
!
!
!
!
!
!
!
!
interface GigabitEthernet 0/17
no global access-group!
……

1.4.8 Configuring the Time Range-Based ACEs
Configuration EffectConfigure the time range-based ACEs if you want some ACEs to take effect or to become invalid in a specified period oftime, for example, in some time ranges during a week.

Configuration Steps

Configuring an ACL(Mandatory) Configure an ACL if you want ACEs to take effect in the specified time range. For details about theconfiguration method, see the earlier descriptions.



You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
configurations take effect only on the local device, and do not affect other devices on the network.

Adding an ACE with the Time Range Specified

1-51

Configuration GuideConfiguring the ACL(Mandatory) Specify the time range when adding an ACE. For details about how to configure the time range, see
the configuration manual related to the time range.



Applying an ACL(Mandatory) Apply the ACL to a specified interface if you want to make ACEs take effect in the specified time
range.

You can apply an IP ACL on a specified interface of an access, an aggregate, or a core device based on the
distribution of users.

Verification
In the time range that the configured ACE takes effect or becomes invalid, run the ping command or construct packets
matching the ACE to check whether the ACE takes effect or becomes invalid.

Related Commands

Configuring an ACL

For details about the ACL configuration commands, see the earlier descriptions about the IP ACL, MAC extended ACL,
expert extended ACL, or IPv6 ACL.



Adding an ACE with the Time Range Specified

For details about the ACE configuration commands, see the earlier descriptions about the IP ACL, MAC extended ACL,
expert extended ACL, or IPv6 ACL.



Applying an ACL

For details about the command for applying an ACL, see the earlier descriptions about the IP ACL, MAC extended ACL,
expert extended ACL, or IPv6 ACL.

Configuration
ExampleThe following configuration example describes only ACL-related configurations.



Adding an ACE With the Time Range Specified to Allow the R&D Department to Access the Internet
Between 12:00 and 13:30 Every Day

1-52

Configuration Guide

Configuring the ACL

Scenario
Figure 1-10

Configuratio

Configure a time range named "access-internet", and add an entry of the time range between 12:00
and 13:30 every day.

n StepsConfigure an IP ACL "ip_std_internet_acl".



Add an ACE to allow packets with the source IP address in the network segment 10.1.1.0/24, andassociate this ACE with the time zone "access-internet".



Add an ACE to deny packets with the source IP address the network segment 10.1.1.0/24. Accessto the Internet is not allowed except in the specified time range.

SW1

Add an ACE to permit all packets.



Apply the ACL to the incoming direction of the interface connected to the breakout gateway.

Ruijie(config)# time-range access-internet
Ruijie(config-time-range)# periodic daily 12:00 to 13:30
Ruijie(config-time-range)# exit
sw1(config)# ip access-list standard ip_std_internet_acl
sw1(config-std-nacl)# permit 10.1.1.0 0.0.0.255 time-range access-internet
sw1(config-std-nacl)# deny 10.1.1.0 0.0.0.255
sw1(config-std-nacl)# permit any
sw1(config-std-nacl)# exit
sw1(config)# int gigabitEthernet 0/17
sw1(config-if-GigabitEthernet 0/17)# ip access-group ip_std_internet_acl in

Verification

Within the time range between 12:00 and 13:30, visit the Baidu website on a PC of the R&D
department. Verify that the website can be opened normally.



Beyond the time range between 12:00 and 13:30, visit the Baidu website on a PC of the R&D
department. Verify that the website cannot be opened.

1-53

Configuration Guide
SW1

Configuring the ACL

sw1# show time-range

time-range entry: access-internet (inactive)
periodic Daily 12:00 to 13:30

sw1# show access-lists

ip access-list standard ip_std_internet_acl
10 permit 10.1.1.0 0.0.0.255 time-range access-internet (inactive)
20 deny 10.1.1.0 0.0.0.255
30 permit any

sw1# show access-groupip access-group ip_std_internet_acl in
Applied On interface GigabitEthernet 0/17

1.4.9 Configuring Comments for ACLs
Configuration EffectDuring network maintenance, if a lot of ACLs are configured without any comments, it is difficult to distinguish these
ACLs later on. You can configure comments for ACLs to better understand the intended use of ACLs.

Configuration Steps

Configuring an ACL(Mandatory) Configure an ACL before configuring the security channel. For details about the configuration method,
see the earlier descriptions.



You can configure this ACL on an access, an aggregate, or a core device based on the distribution of users. The
configurations take effect only on the local device, and do not affect other devices on the network.

Configuring Comments for ACLs



(Optional) Configure comments for ACLs so that it is easy to manage and understand the configured ACLs.



Adding ACEs to an ACL

(Optional) An ACL may contain zero or multiple ACEs. If no ACE is configured, it is equivalent that the security
channel does not take effect. For details about how to add an ACE to an ACL, see the related descriptions.



Configuring Comments for ACEs



(Optional) To facilitate understanding of a configured ACL, you can configure comments for ACEs in addition tocomments for the ACL.

1-54

Configuration Guide

Configuring the ACL

Verification
Run the show access-lists command on the device to display the comments configured for ACLs.

Related Commands

Configuring an ACL

For details about how to configure an ACL, see the earlier descriptions about the IP ACL, MAC extended ACL, expert
extended ACL, or IPv6 ACL.



Configuring a Comment for an ACL

Use either of the following two methods to configure a comment for an ACL:
Commandlist-remark comment

Parameter

comment: Indicates the comment. The value is a string of 1 to 100 characters. A comment longer than

Description

100 characters will be truncated to 100 characters.

Command

ACL configuration mode

Mode
Usage Guide

Run this command to configure the comment for a specified ACL.

Commandaccess-list acl-id list-remark comment

Parameteracl-id: Indicates the ID of an ACL.

Descriptioncomment: Indicates the comment. The value is a string of 1 to 100 characters. A comment longer than
100 characters will be truncated to 100 characters.

Command

Configuration mode

Mode
Usage GuideRun this command to configure the comment for a specified ACL.

Adding ACEs to an ACL

For details about how to add ACEs to an ACL, see the earlier descriptions about the IP ACL, MAC extended ACL,
expert extended ACL, or IPv6 ACL.



Configuring Comments for ACEs

Use either of the following two methods to configure a comment for an ACE:
Commandremark comment

Parameter

comment: Indicates the comment. The value is a string of 1 to 100 characters. A comment longer than

Description

100 characters will be truncated to 100 characters.

Command

ACL configuration mode

Mode
Usage Guide

Run this command to configure the comment for a specified ACE.

Commandaccess-list acl-id remark comment

Parameteracl-id: Indicates the ID of an ACL.

1-55

Configuration Guide
Description

Configuring the ACL

comment: Indicates the comment. The value is a string of 1 to 100 characters. A comment longer than
100 characters will be truncated to 100 characters.

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure the comment for a specified ACE.

1.5 Monitoring
Clearing
Description
Clears the ACL packet matching
counters.
Clears the counters of packets
matching the deny ACEs.

Commandclear counters access-list [ acl-id | acl-name ]clear access-list counters [ acl-id | acl-name ]Displaying
Description

Command

Displays the basic ACLs.

show access-lists [ acl-id | acl-name ] [ summary ]Displays the redirection ACEs bound to a specified
interface. If the interface is not specified, redirection

show redirect [ interface interface-name ]ACEs bound to all interfaces are displayed.
Displays the ACL configurations applied to an interface.
Displays the IP ACL configurations applied to aninterface.
Displays the MAC extended ACL configurations applied
to an interface.
Displays the expert extended ACL configurations applied
to an interface.
Displays the IPv6 ACL configurations applied to aninterface.

show access-group [ interface interface-name ]show ip access-group [ interface interface-name ]show mac access-group [ interface interface-name ]show expert access-group [ interface interface-name ]show ipv6 traffic-filter [ interface interface-name ]Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs the ACL running process.

debug acl acld event

Debugs the ACL clients.

debug acl acld client-show

Debugs the ACLs created by all
ACL clients.

debug acl acld acl-show

1-56

Configuration Guide

Configuring QoS

2 Configuring QoS
2.1 Overview
Quality of Service (QoS) indicates that a network can provide a good service capability for specified network
communication by using various infrastructure technologies.
When the network bandwidth is sufficient, all data streams can be properly processed; when network congestion occurs,
all data streams may be discarded. To meet users' requirements for different applications and different levels of service
quality, a network must be able to allocate and schedule resources based on users' requirements and provide different
levels of service quality for different data streams.

To be specific, the network can process real-time and importantdata packets in higher priorities, and process non-real-time and common data packets in lower priorities and evendiscard the data packets upon network congestion.
The "doing the best" forwarding mechanism used by traditional networks cannot meet the requirements any longer andthen QoS comes into being. QoS-enabled devices provide transmission QoS quality service. A transmission priority canbe assigned to data streams of a type to identify the importance of the data streams. Then, the devices provide
forwarding policies for different priorities, congestion mitigation and other mechanisms to provide special transmission
services for these data streams. A network environment configured with QoS can provide predictability for network

performance, effectively allocate network bandwidth, and reasonably utilize network resources.

2.2 Applications
Application

Description

Interface Rate Limit + Priority

Based on different service requirements for a campus network, provide rate control

Relabelingand priority-based processing for outgoing traffic of the teaching building,laboratories and dormitory building.

Priority Relabeling + Queue
Scheduling

Provide priority-based processing and bandwidth control for traffic of internal
access to servers of an enterprise.

2.2.1 Interface Rate Limit + Priority Relabeling
Scenario
To meet the service requirements of normal teaching, a school puts forwards the following requirements:

Control the Internet access traffic under 100M and discard packets out of control.

Control the outgoing traffic of the dormitory building under 50M and discard packets out of control.

Control the rate of packets with DSCP priority 7 sent from laboratories under 20M, and change the DSCP prioritiesof these packets whose rates exceed 20M to 16.

Control the outgoing traffic of the teaching building under 30M and discard packets out of control.

2-1Configuration Guide

Configuring QoSFigure 2-1

RemarkA school connects GigabitEthernet 0/17 of Switch A to the Internet in the uplink and connects Ghn 0/1, Ghns

0/2 and Ghn 0/3 of Switch A to the teaching building, laboratory and dormitory building in the downlink
respectively.

Deployment
Configure the QoS interface rate limit for the interface G0/17 of Switch A for connecting the Internet.

Configure the QoS rate limit for packets sent from the dormitory building on Switch A.



Set the rate limit for packets with the DSCP priority 7 sent from the laboratory to 20M and relabel the DSCP priorityof packets out of the rate limit to 16.

Configure the QoS rate limit for packets sent from the teaching building on Switch A.

2.2.2 Priority Relabeling + Queue Scheduling
Scenario
Configure priority relabeling and queue scheduling to meet the following requirements:

When the R&D department and market department access servers, the priorities of the server packets are as
follows: mail server > file server > salary query server.

No matter when the HR management department accesses the Internet or servers, the switch processes thecorresponding packets in the highest priority.



Since network congestion often occurs in switch running, in order to ensure smooth business operation, WRR
queue scheduling must be used to schedule IP packets for the R&D and market departments to access the maildatabase, file database, and salary query database based on the ratio of 6:2:1.

2-2

Configuration Guide

Configuring QoSFigure 2-2

RemarkThe R&D, market and HR management departments access the interfaces Ghn 0/1, Ghn 0/2 and Ghn 0/3 ofs

Switch A respectively. The salary query server, mail server and file server are connected to GigabitEthernet
0/17 of Switch A.

Deployment
Configure the CoS values of data streams for accessing different servers to ensure that the switch processes
packets for different servers in different priorities.



Set the default CoS value of the interface to a specific value to ensure that the switch processes packets sent by
the HR management department in the highest priority.

Configure WRR queue scheduling to ensure that data packets are transmitted in a specific quantity ratio.

2.3 Features
Basic Concept

DiffServ

The Differentiated Services (DiffServ) Mode is an IETF system based on which QoS is implemented in Ruijie products.
The DiffServ system classifies all packets transmitted in a network into different types. The classification information is
included in layer-2/3 packet headers, including 802.1P, IP and IP DSCP priorities.
In a DiffServ-compliant network, all devices apply the same transmission service policy to packets containing the sameclassification information and apply different transmission service policies to packets containing different classification
information. Classification information of packets is either assigned by hosts or other devices in the network or assigned
based on different application policies or different packet contents. Based on the classification information carried by

2-3

Configuration Guide

Configuring QoS

packets, a device may provide different transmission priorities for different packet streams, reserve bandwidth for a kindof packet streams, discard certain packets with lower priorities, or take some other actions.



802.1P(PRI) priority

The 802.1 P priority is located at the header of a layer-2 packet with the 802.1Q header, and is used in scenarios wherelayer-3 headers do not need to be analyzed and QoS needs to be implemented at layer 2. Figure 2-3 shows the
structure of a layer-2 packet.
Figure 2-3

As shown in Figure 2-3, the 4-byte 802.1Q header contains 2-byte Tag ProtocolIdentifier (TPID) whose value is 0x8100
and 2-byte Tag ControlInformation (TCI). The first three bits of the TCI indicate the 802.1P priority.

IP priority (IP PRE) and DSCP priority

The priorities of IP packets are identified by the IP PRE and DSCP priority. The Type Of Service (ToS) field of the IPv4
header comprises 8 bits; where the first three bits indicate the IP precedence (IP PRE), ranging from 0 to 7. RFC 2474
redefines the ToS field of the IPv4 header, which is called the Differentiated Services (DS) field. The DifferentiatedServices Code Point (DSCP) priority is identified by the first 6 bits (bits 0 to 5) of the DS field, and by the first 6 bits of
the Traffic Class field in the IPv6 header. Figure 2-4 shows the locations of the IP PRE and DSCP priorities in IPv4/IPv6
packets.
Figure 2-4



CoSClass of Service (COS). Ruijie products convert packet priorities into CoS values to identity the local priorities of thepackets and determine the input queue ID when packets are sent from the output interface.

Overview
FeatureDescription

2-4Configuration Guide

Configuring QoSStreamStream classification uses certain rules to identify packets with same characteristics and is theClassification

prerequisite and basis for distinguishing network services.

Priority Labeling andLabel packet priorities with specified values and map the values to corresponding CoS values.

MappingTraffic Supervision

Supervise the specification of traffic flowing into a network, limit the traffic within a reasonable
range, and discard the traffic out of the limit or modify the priority of the traffic.

Congestion

Determine the sequence of data packets sent from an interface based on the priorities of the data

Management

packets and ensure that key services can be processed in time when congestion occurs.

2.3.1 Stream Classification
Stream classification uses certain rules to identify packets with same characteristics and is the prerequisite and basis
for distinguishing network services. Stream classification rules are used to distinguish different packets in the networkand specify different QoS parameters for packets at different service levels.

Working Principle
Stream classification rules can be matching the PRE or DSCP priorities of IP packets or classifying packets byidentifying packet content through an ACL. You can define the binding between multiple streams and stream behaviors
by using commands to form policies which can be applied to interfaces for stream classification and processing.



QoS policy

A QoS policy comprises three elements: class, stream behavior and policy.



Class
A class identifies streams and comprises the class name and class rules. You can define the class rules by usingcommands to classify packets.

Stream behavior
Stream behaviors define the QoS actions taken for packets, including priority labeling and traffic supervision forpackets.



PolicyA policy binds a specific class and specific stream behaviors and comprises the policy name, names of theclasses bound, and stream behaviors. You can bind a specified class and stream behaviors by using a QoS policy
and apply the policy to one or more interfaces.



QoS logical interface group

You can specify a series of interfaces as a QoS logical interface group (including both APs and Ethernet interfaces) andassociate polices with the logical interface group for QoS processing. Take rate limit for stream behaviors for example.
For packets that meet the rate limit conditions, all interfaces in the same logical interface group share the bandwidth
specified by the policy.

2-5Configuration Guide

Configuring QoS

RelatedConfigurationCreating a class

No class is defined by default.
You can run the class-map command to create a class and enter the class configuration mode.

Matching an ACL

No rules are defined for a class by default.
In the class configuration mode, you can run the match acess-group command to define a class rule as matching an
ACL. You need to create ACL rules first.

Matching PRE priorities of IP packets

No rules are defined for a class by default.
In the class configuration mode, you can run the match ip precedence command to define a class rule as matching
PRE priorities of IP packets. The value range of IP PRE is 0 to 7.

Matching DSCP priorities of IP packets

No rules are defined for a class by default.
In the class configuration mode, you can run the match ip dscp command to define a class rule as matching DSCP
priorities of IP packets. The value range of DHCP priorities is 0 to 63.

Creating a policy

No policy is defined by default.
You can run the policy-map command to create a policy and enter the policy configuration mode.

Associating a class

A policy is not associated with any class by default.
In the policy configuration mode, you can run the class command to associate a class and enter the policy-classconfiguration mode.

Binding a stream behavior

A class is not bound to any stream behavior by default.
In the policy-class configuration mode, you can run the set command to modify the CoS, DSCP or VID values of a
specified stream; where, the CoS value ranges from 0 to 7, the DSCP value ranges from 0 to 63 and the VID value
ranges from 1 to 4094. You can run the police command to limit the bandwidth and process streams out of the limit for
specified streams. The bandwidth limit ranges are determined by products.

Configuring a logical interface group

No logical interface group is defined and an interface is not added to any logical interface group by default.
In the global configuration mode, you can run the virtual-group command to create a logical interface group. In theinterface configuration mode, you can run the virtual-group command to add an interface to a logical interface group. If

2-6

Configuration Guide

Configuring QoS

this logical interface group is not created, you can create the logical interface group and add the interface to the group.
You can create 128 logical interface groups, ranging from 1 to 128.

Applying a policy to an interface

No policy is applied to an interface by default.
In the interface configuration mode, you can run the service-policy command to apply a policy in the input/output
directions of the interface. In the global configuration mode, you can run the service-policy command to apply a policyin the input/output directions of all interfaces.

2.3.2 Priority Labeling and Mapping
Priorities are used to label the scheduling weights of packets or the priorities of the packets in forwarding. Different
packet types have different priority types including 802.1P(PRI), IP PRE and DSCP priorities. Priority labeling andmapping refer to labeling packet priorities with specified values and mapping the values to corresponding CoS values.

Working Principle
After data streams of packets enter a device interface, the device assigns priorities to the packets based on the trust
mode configured for the interface. The following describes several trust modes:When the interface trust mode is untrust, which means not trusting the priority information carried in packets:
Modify the CoS value according to the default CoS value (0, which is configurable), COS-DSCP mapping table
and DSCP-COS mapping table of the interface and put the packets into queues based on the final CoS value. For
output packets carrying the 802.1Q tag, the packet priority will be modified to the corresponding CoS value.

When the interface trust mode is trusting CoS:
For packets carrying the 802.1Q tag, modify the CoS value according to the PRI value, CoS-DSCP mapping table,
and DSCP-CO mapping table, and put the packets into queues based on the final CoS value. For output packets
carrying the 802.1Q tag, the packet priority will be modified to the corresponding CoS value.
For packets not carrying the 802.1Q tag, modify the CoS value according to the default CoS value (0, which is
configurable), COS-DSCP mapping table and DSCP-COS mapping table of the interface, and put the packets intoqueues based on the final CoS value. For output packets carrying the 802.1Q tag, the packet priority will be
modified to the corresponding CoS value.

When the interface trust mode is trusting DSCP:For non-IP packets, the processing is the same as that for trusting CoS.
For IP packets, modify the CoS value according to the DSCP value of the packets and the DSCP-CoS mappingtable and put the packets into queues based on the final CoS value.

When the interface trust mode is trusting IP PRE:For non-IPv4 packets, the processing is the same as that for trusting CoS.
For IPv4 packets, obtain and modify the DSCP priority of the packets according to the IP PRE value of the packets
and the IP-PRE-DSCP mapping table, obtain the CoS value according to the DSCP-CoS mapping table, and thenput the packets into queues based on the final CoS value.

When the trust mode and the applied policy of an interface work together:

2-7

Configuration Guide

Configuring QoSWhen the trust mode and the applied policy of an interface work together, the trust mode has a lower priority thanthe policy and the CoS priority can be obtained according to the DSCP-CoS mapping table.
If a policy is applied to the interface but the policy does not has a configuration for modifying the DSCP and CoS
values, the processing will be performed based on the trust mode of the interface.

RelatedConfiguration

Configuring the trust mode of an interface

The default trust mode of an interface is untrust.
In the interface configuration mode, run the mls qos trust command to modify the trust mode. The trust mode can betrusting CoS, trusting DSCP or trusting IP PRE.



Configuring the default CoS value of an interface

The default CoS value of an interface is 0.
In the interface configuration mode, run the mls qos cos command to modify the default CoS value of the interface,which ranges from 0 to 7.

Labeling the priority of streams

The priorities of streams are not relabeled by default.
In the policy-class configuration mode, run the set command to modify the CoS, DSCP and VID values of streams. The
CoS value ranges from 0 to 7; the DSCP value ranges from 0 to 63; the VID value ranges from 1 to 4094.

Configuring CoS-to-DSCP Map

By default, the CoS values 0, 1, 2, 3, 4, 5, 6 and 7 are mapped to the DSCP values 0, 8, 16, 24, 32, 40, 48 and 56
respectively.
Run the mls qos map cos-dscp command to configure the COS-DSCP mapping. The DSCP value ranges from 0 to
63.

Configuring DSCP-to-CoS Map

By default, DSCP 0 to 7 are mapped to CoS 0, DSCP 8 to 15 mapped to CoS 1, DSCP 16 to 23 mapped to CoS2,
DSCP 24 to 31 mapped to CoS 3, DSCP 32 to 39 mapped to CoS 4, DSCP 40 to 47 mapped to CoS 5, DSCP 48 to 55
mapped to CoS 6, and DSCP 56 to 63 mapped to CoS 7.
Run the mls qos map dscp-cos command to configure the DSCP-CoS mapping. The CoS value ranges from 0 to 7
and the DSCP value ranges from 0 to 63.

Configuring IP-PRE-to-DSCP Map

By default, the IP PRE values 0, 1, 2, 3, 4, 5, 6 and 7 are mapped to the DSCP values 0, 8, 16, 24, 32, 40, 48 and 56
respectively.
Run the mls qos map ip-precedence-dscp command to configure the IP PRE-DSCP mapping. The DSCP value
ranges from 0 to 63.

2-8Configuration Guide

Configuring QoS

2.3.3 Traffic Supervision
Supervise the specification of traffic flowing into a network, limit the traffic within a reasonable range, and discard thetraffic out of the limit or modify the priority of packets. In addition, the total traffic of an interface can be monitored andthe traffic out of the limit will be discarded.

Working Principle
Traffic supervision is used to monitor the specification of traffic flowing into a network and conduct preset supervisionactions based on different assessment results. These actions can be:Forwarding:Discarding: discard packets out of the traffic limit.

Changing the priority and forwarding: modify the priorities of packets out of the traffic limit and then forward theNormally forward packets within the traffic limit.

packets.
Directly discard packets out of the total traffic limit of an interface.

RelatedConfiguration

Configuring the action to be conducted for traffic out of limit

No action to be conducted for traffic out of limit is configured by default.
In the policy-class configuration mode, run the police command to configure the action to be conducted for traffic out oflimit to discarding traffic out of limit, or modifying the CoS value or DSCP value. The traffic limit range is determined byproducts. When the traffic is out of the limit, you can modify the CoS value in the range of 0 to 7 and the DSCP value inthe range of 0 to 63.

Configuring the total traffic limit for an interface

The total traffic limit for an interface is not configured by default.
In the interface configuration mode, run the rate-limit command to configure the total traffic limit for an interface in the
input and output directions. The traffic limit range is determined by products.

2.3.4 Congestion Management
When the receiving rate of packets exceeds the sending rate of packets, congestion will occur on the sending interface.
If no sufficient buffer is provided to store these packets, the packets may be lost. The congestion management
mechanism determines the sequence of data packets to be sent from an interface based on the priorities of the data
packets. The congestion management function allows for congestion control by increasing the priorities of importantdata packets. When congestion occurs, the important data packets are sent in higher priorities to ensure that key
services are implemented in time.

Working Principle
A queue scheduling mechanism is used for congestion management and the process is as follows:

After each packet passes all QoS processing in a switch, the packet will obtain a CoS value finally.

2-9

Configuration GuideConfiguring QoS

At the output interface, the device classifies the packets into corresponding sending queues based on the CoS
values.

The output interface selects packets in a queue for sending based on various scheduling policies (SP, WRR, DRR,
WFQ, SP+WRR, SP+DRR and SP+WFQ).



Scheduling policy

The queue scheduling policies include SP, WRR, DRR, WFQ, SP+WRR, SP+DRR, and SP+WFQ.



Strict-Priority (SP) scheduling means scheduling packets strictly following queue IDs. Before sending packets
each time, check whether a queue with the first priority has packets to be sent. If yes, the packets in this queue aresent first. If not, check whether a queue with the second priority has packets. Follow the same rules for packets inother queues.



Weighted Round Robin (WRR) scheduling means scheduling queues in turn to ensure that all queues havecertain service time. For example, a 1000 Mbps interface has 8 output queues. The WRR configures a weighted
value (5, 5, 10, 20, 20, 10, 20 and 10, which indicate the proportions of obtained resources) for each queue. This
scheduling method ensures that a queue with the lowest priority is assigned with at least 50 Mbps bandwidth,
which avoids that packets in the queue with the lowest priority are not served for long time when the SP
scheduling method is used.



Deficit Round Robin (DRR) scheduling is similar to the WRR, but applies weight values based on bytes, but notbased on time slices.



Weighted Fair Queueing (WFQ) scheduling provides dynamic and fair queuing and applies weighted values basedon bytes, similar to the DRR. When encountering an empty queue, the DRR will shift to the next queue fortransmission immediately. If a queue misses its transmission time, the queue must wait for the next time, which isthe difference between the WFQ and DRR; therefore, the WFQ is more suitable for processing data packets withvariable lengths than the DRR.



SP+WRR scheduling means configuring the SP scheduling for one or more sending queues and configuring the
WRR scheduling for the other queues. Among SP queues, only after all packets in the SP queue with the firstpriority are sent, the packets in the SP queue with the second priority can be sent. Among SP and WRR queues,
only after the packets in all SP queues are sent, the packets in WRR queues can be sent.



SP+DRR scheduling means configuring the SP scheduling for one or more sending queues and configuring the
DRR scheduling for the other queues. Among SP queues, only after all packets in the SP queue with the firstpriority are sent, the packets in the SP queue with the second priority can be sent. Among SP and DRR queues,
only after the packets in all SP queues are sent, the packets in DRR queues are sent.



SP+WFQ scheduling means configuring the SP scheduling for one or more sending queues and configuring the
WFQ scheduling for the other queues. Among SP queues, only after all packets in the SP queue with the firstpriority are sent, the packets in the SP queue with the second priority can be sent. Among SP and WFQ queues,
only after the packets in all SP queues are sent, the packets in WFQ queues can be sent.



Scheduling policy and round robin weight for output queues on an interface

The scheduling policies and round robin weight for output queues are based on global configurations. Some products
support both global configurations and interface-based configurations. Interface-based configurations have higher
priorities than global configurations. The global scheduling policy works with the corresponding global round robinweight whereas the interface scheduling policy works with the interface round robin weight. If only the global scheduling

2-10

Configuration Guide

Configuring QoS

policy or interface scheduling policy is configured but no corresponding round robin weights are configured, the default
round robin weights will work with the scheduling policy.

Queue bandwidth

Some products allow for configuring the guaranteed minimum bandwidth and the limited maximum bandwidth for aqueue. A queue configured with the guaranteed minimum bandwidth ensures that the bandwidth for this queue is not
smaller than the configured value. A queue configured with the limited maximum bandwidth ensures that the bandwidth
for this queue is not greater than the configured value and packets out of the bandwidth limit will be discarded. The
bandwidth limits for unicast and multicast queues are configured together on some products whereas configured
separately on some other products. In addition, some products allow for configuring bandwidth only for unicast queues.

RelatedConfiguration

Configuring CoS-to-Queue Map

By default, the CoS values 0, 1, 2, 3, 4, 5, 6 and 7 are mapped to the queues 1, 2, 3, 4, 5, 6, 7 and 8 respectively.
Run the priority-queue cos-map command to configure the CoS-to-queue mapping. The CoS value ranges from 0 to 7
and the queue value ranges from 1 to 8.

Configuring the scheduling policy for an output queue

By default, the scheduling policy for a global output queue is WRR and no scheduling policy is configured for aninterface.
Run the mls qos scheduler command to configure the output scheduling policy for a queue. Configurable schedulingpolicies include SP, WRR and WFQ. You can also run the priority-queue command to configure the scheduling policy
as SP.

Configuring the round robin weight corresponding to the WRR scheduling policy for an output queue

By default, the weight of a global or interface-based queue is 1:1:1:1:1:1:1:1.
Run the wrr-queue bandwidth command to configure the round robin weight corresponding to the WRR schedulingpolicy for an output queue. The configurable weight range is determined by products.
A higher weight means longer output time.

Configuring the round robin weight corresponding to the WFQ scheduling policy for an output queue

By default, the weight of a global or interface-based queue is 1:1:1:1:1:1:1:1.
Run the wfq-queue bandwidth command to configure the round robin weight corresponding to the WFQ schedulingpolicy for an output queue. The configurable weight range is determined by products.
A higher weight means more packet bytes that can be sent.



Configuring the bandwidth for a queue

Run the qos queue command to configure the guaranteed minimum bandwidth and the limited maximum bandwidth foreach queue. The queue value ranges from 1 to 8 and the guaranteed minimum bandwidth and limited maximum
bandwidth value ranges are determined by products. Supported queue types (unicast, multicast, or both unicast andmulticast) are determined by products.

2-11

Configuration Guide

Configuring QoS

2.4 Configuration
Configuration

Description and Command(Optional) It is used to create stream classification information.

Configuring Stream

class-map

Creates a class.

match access-group

Matches ACL rules.

match ip precedence

Matches the PRE priorities of IP packets.

match ip dscp

Matches the DSCP priorities of IP packets.

policy-map

Creates a policy.

class

Associates a class.

Classification
Binds the bandwidth limit for streams andthe action for processing packets out of thepolicelimit.
Binds the behaviors for modifying the CoS,

set

DSCP and VID values of streams.
Creates a logical interface group and adds

virtual-groupinterfaces to the logical interface group.
Applies a policy to an interface.

service-policy(Optional) It is used to configure the trust mode, default CoS value and various
mappings for an interface.
Modifies the trust mode of an interface.

mls qos trust
Configuring Priority
Labeling and Mapping for

Modifies the default CoS value of themls qos cos

interface.

Packets

Configuring Interface Rate
Limit

mls qos map cos-dscp

Configures the CoS-to-DSCP mapping.

mls qos map dscp-cos

Configures the DSCP-to-CoS mapping.

mls qos map ip-precedence-dscp

Configures the IP PRE-to-DSCP mapping.

(Optional) It is used to configure the rate limit for an interface.
Configures the traffic limit for an interface.

rate-limit

Configuring Congestion(Optional) It is used to configure the CoS-to-queue mapping, queue schedulingManagement

policies and round robin weight.

2-12Configuration Guide

Configuration

Configuring QoS

Description and Command
Configures the CoS-to-queue mapping.

priority-queue cos-map

Configures the output scheduling policy forpriority-queue

a queue to SP.
Configures the output scheduling policy for

mls qos scheduler

a queue.
Configures the round robin weightcorresponding to the WRR schedulingwrr-queue bandwidth

policy for an output queue.
Configures the round robin weightcorresponding to the WFQ schedulingwfq-queue bandwidth

policy for an output queue.
Configures the guaranteed minimum
bandwidth and limited maximum

qos queue bandwith

bandwidth for a queue.

2.4.1 Configuring Stream Classification
Configuration EffectCreate a class and match classification rules.

Create a policy, bind a class and stream behaviors, and associate with an interface.

Notes


The class and policy names cannot comprise more than 31 characters.

Interface configurations allow for only AP and Ethernet interface configurations. Certain products support policies
applied to SVI interfaces through the service-policy command. When both physical interfaces and SVI interfaces
are configured with policies, the priority of the physical interfaces is higher than that of the SVI interfaces.



If run the service-policy command in global configuration mode, policies will be applied to all interfaces which canbe configured with policies.

Configuration Steps

Creating a class and matching ACL rules

Optional.

Create a class. In the class configuration mode, match ACL, IP PRE or DSCP.

Creating a policyOptional.

2-13Configuration Guide

Configuring QoSCreate a policy. In the policy configuration mode, bind the class and stream behaviors.



Creating a logical interface group and adding interfaces to the logical interface group

Optional.

Create a logical interface group and add interfaces to the logical interface group.



Applying a policy to an interface

Optional.



Associate a configured policy with a specified interface or logical interface group.

Verification


Run the show class-map command to check whether the class is successfully created and whether rules are
successfully matched.

Run the show policy-map command to check whether the policy is successfully created and whether the classand stream behaviors are successfully bound.



Run the show mls qos interface command to check whether the interface is associated with the policy.

Run the show virtual-group command to check the interfaces in the logical interface group.

Run the show mls qos virtual-group command to check whether the logical interface group is associated withthe policy.

Related Commands



Creating a classCommandclass-map class-map-nameParameterclass-map-name: Indicates the name of a class to be created. The name cannot comprise more than 31

Description

characters.

Command

Global configuration mode

Mode
Usage Guide-Matching an ACL

Commandmatch access-group { acl-id | acl-name }Parameter

acl-name: Indicates the name of a standard or an extended IP ACL. If this option is configured, a named

Description

ACL is created. The name is a string of 1 to 99 characters. The ACL name cannot start with numbers(0–9), "in", or "out".
acl-id: Indicates the ID that uniquely identifies a standard or extended IP ACL. If this option is configured,a numbered ACL is created. If a standard IP ACL is created, the value range of acl-id is 1–99 and
1300–1999. If an extended IP ACL is created, the value range of acl-id is 100–199 and 2000–2699.

CommandClass configuration mode

Mode
Usage Guide-Matching PRE of IP packets

2-14

Configuration Guide

Configuring QoS

Commandmatch ip precedence pre-vlaue-list

Parameter

pre-vlaue-list: Indicates the IP PRE to be matched, ranging from 0 to 7.

Description
CommandClass configuration mode

Mode
Usage Guide-Matching DSCP of IP packets

Commandmatch ip dscp dscp-vlaue-list

Parameter

dscp-vlaue-list: Indicates the DSCP to be matched, ranging from 0 to 63.

Description
CommandClass configuration mode

Mode
Usage Guide-Creating a policy

Commandpolicy-map policy-map-nameParameter

policy-map-name: Indicates the name of a policy to be created. The name cannot comprise more than

Description

31 characters.

Command

Global configuration mode

Mode
Usage Guide-Associating a classCommandclass class-map-nameParameterclass-map-name: Indicates the name of a class to be associated.

Description
Command

Policy configuration mode

Mode
Usage Guide-

Binding the behaviors for modifying the CoS, DSCP and VID values of streams

Commandset { ip dscp new-dscp | cos new-cos | vid new-vid }Parameter

ip dscp new-dscp: Changes the DSCP value of streams to new-dscp, ranging from 0 to 63.

Description

cos new-cos: Changes the CoS value of streams to new-cos, ranging from 0 to 7.
vid new-vid: Changes the VLAN ID of streams to new-vid, ranging from 1 to 4094.

Command

Policy map class configuration mode

Mode
Usage Guide-

Binding the bandwidth limit for streams and the action for processing packets out of the limit

Commandpolice rate-bps burst-byte [ exceed-action { drop | dscp new-dscp | cos new-cos [ none-tos ] } ]Parameterrate-bps: Indicates the bandwidth limit per second (KBits). The value range is determined by products.

2-15

Configuration Guide
Description

Configuring QoS

burst-byte: Indicates the burst traffic limit (Kbytes). The value range is determined by products.
drop: Discards packets out of the bandwidth limit.
dscp new-dscp: Changes the DSCP value of packets out of the bandwidth limit to new-dscp, ranging
from 0 to 63.
cos new-cos: Changes the CoS value of packets out of the bandwidth limit to new-cos, ranging from 0 to
7.
none-tos: Does not change the DSCP value of packets when changing the CoS value of the packets.

Command

Policy map class configuration mode

Mode
Usage GuideCreating a logical interface group and adding interfaces to the logical interface group

Commandvirtual-group virtual-group-number

Parameter

virtual-group-number: Indicates the logical interface group number, ranging from 1 to 128.

Description
CommandCreate the logical interface group in the global configuration mode, add the interface to the logicalModeinterface group in the interface configuration mode. If no logical interface group exists, you need tocreate a logical interface group first and then add interfaces to the logical interface group.

Usage Guide-

Applying a policy to an interface

Commandservice-policy { input } policy-map-nameParameter

input: Indicates the input direction of the interface.

Description

policy-map-name: Indicates the name of the policy applied to the interface.

Command

Interface configuration mode/Global configuration mode

Mode
Usage Guide-

Configuration
Example

Creating four stream classes and matching ACL, IP PRE and DSCP

Configuratio

Create ACL rules.

Create four stream classes and match ACL, IP PRE and DSCP.

n StepsRuijie# configure terminal
Ruijie(config)# access-list 11 permit host 192.168.23.61
Ruijie(config)# class-map cmap1
Ruijie(config-cmap)# match access-group 11
Ruijie(config-cmap)# exit
Ruijie(config)# class-map cmap2

2-16

Configuration Guide

Configuring QoSRuijie(config-cmap)# match ip dscp 21
Ruijie(config-cmap)# exit
Ruijie(config)# class-map cmap3
Ruijie(config-cmap)# match ip precedence 5
Ruijie(config-cmap)# exit

Verification



Check whether the created ACL rules and stream class rules are successful.

Ruijie# show access-lists
ip access-list standard 11
10 permit host 192.168.23.61
Ruijie# show class-map
Class Map cmap1
Match access-group 11
Class Map cmap2
Match ip dscp 21
Class Map cmap3
Match ip precedence 5Creating a policy, binding a class and stream behaviors, and associating with an interface

Configuratio

n StepsCreate the stream class cmap1, and match packets whose DSCP value is 18. Create cmap2 andmatch packets whose IP PRE is 7.

Create the policy pmap1, associate the policy with cmap1, and bind the behavior of changing the
CoS value of the stream to 6. Associate the policy with cmap2, bind the behavior of changing the
DSCP value of the stream to 16, limiting the traffic per second within 10,000 Kbits and trigger traffic
within 1024 Kbits per second, and changing the DSCP value for traffic out of limit to 7.

Create virtual logical group 1, add the interfaces gigabitEthernet 0/17 and gigabitEthernet 0/18 to
the group, and apply the policy pmap1 to the input interface of the virtual logical group.

Ruijie# configure terminal
Ruijie(config)# class-map cmap1
Ruijie(config-cmap)# match ip dscp 18
Ruijie(config-cmap)# exit
Ruijie(config)# class-map cmap2
Ruijie(config-cmap)# match ip precedence 7

2-17

Configuration Guide

Configuring QoSRuijie(config-cmap)# exit
Ruijie(config)# policy-map pmap1
Ruijie(config-pmap)# class cmap1
Ruijie(config-pmap-c)# set cos 6
Ruijie(config-pmap-c)# exit
Ruijie(config-cmap)# class cmap2
Ruijie(config-pmap-c)# set ip dscp 15
Ruijie(config-pmap-c)# police 10000 1024 exceed-action dscp 7
Ruijie(config-pmap-c)# exit
Ruijie(config-pmap)# exit
Ruijie(config)# interface gigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# virtual-group 1
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# virtual-group 1
Ruijie(config-if-GigabitEthernet 0/18)# exit
Ruijie(config)# virtual-group 1
Ruijie(config-VirtualGroup)# service-policy input pmap1
Ruijie(config-VirtualGroup)# exit

Verification



Check whether the stream class rules are successfully created.



Check whether the policy is successfully created, and whether the stream and stream behaviors
are successfully bound.



Check whether the policy is applied to the interface.

Check whether the logical interface group is successfully created, whether interfaces are
successfully associated and whether the policy is successfully applied to the interface.

Ruijie# show class-map
Class Map cmap1
Match ip dscp 18
Class Map cmap2
Match ip precedence 7
Ruijie# show policy-map

2-18

Configuration Guide

Configuring QoS

Policy Map pmap1
Class cmap1
set cos 6
Class cmap2
set ip dscp 15
police 10000 1024 exceed-action dscp 7
Ruijie# show virtual-group 1
virtual-groupmember--------------------------------------

1

Gi0/17 Gi0/18

Ruijie# show mls qos virtual-group 1
Virtual-group: 1
Attached input policy-map: pmap1

2.4.2 Configuring Priority Labeling and Mapping for Packets
Configuration EffectConfigure the trust mode and default CoS value of an interface.

Configure the CoS-to-DSCP, DSCP-to-CoS, and IP-PRE-to-DSCP mappings.

Notes


Interface configurations allow for only AP and Ethernet interface configurations.

Configuration Steps

Configuring the trust mode and default CoS value of an interface

Optional.

In the interface configuration mode, configure the trust mode and default CoS value of an interface.

Configuring the CoS-to-DSCP, DSCP-to-CoS, and IP-PRE-to-DSCP mappings

Optional.

Configure various mappings.

Verification


Run the show mls qos interface command to display the trust mode and default CoS value of the interface.

Run the show mls qos maps command to display the CoS-to-DSCP, DSCP-to-CoS and IP-PRE-to-DSCP
mappings.

2-19

Configuration Guide

Configuring QoS

Related Commands

Configuring the trust mode of an interface

Commandmls qos trust { cos | dscp | ip-precedence }Parametercos: Configures the trust mode of an interface to CoS.

Description

ip-precedence: Configures the trust mode of an interface to IP PRE.
dscp: Configures the trust mode of an interface to DSCP.

Command

Interface configuration mode

Mode
Usage Guide-Configuring the default CoS value of an interface

Commandmls qos cos default-cos

Parameter

default-cos: Configures the default CoS value, ranging from 0 to 7. The default value is 0.

Description
Command

Interface configuration mode

Mode
Usage Guide-Configuring CoS-to-DSCP MAP

Commandmls qos map cos-dscp dscp1 … dscp8

Parameter

dscp1 … dscp8: Indicates the DSCP values mapped to the CoS values. The default CoS values 0~7 are

Description

mapped to DSCP 0, 8, 16, 24, 32, 40, 48 and 56 respectively. The DSCP value ranges from 0 to 63.

Command

Global configuration mode

Mode
Usage Guide-Configuring DSCP-to-CoS MAP

Commandmls qos map dscp-cos dscp-list to cos

Parameter

dscp-list: Indicates the DSCP list mapped to the CoS values. The default DSCP 0~7 are mapped to CoS

Description

0, DSCP 8~15 mapped to CoS 1, DSCP 16~23 mapped to CoS 2, DSCP 24~31 mapped to CoS 3,
DSCP 32~39 mapped to CoS 4, DSCP 40~47 mapped to CoS 5, DSCP 48~55 mapped to CoS 6, and
DSCP 56~63 mapped to CoS 7. The DSCP value ranges from 0 to 63.
cos: Indicates the CoS values mapped to the dscp-list, ranging from 0 to 7.

Command

Global configuration mode

Mode
Usage Guide-Configuring IP-PRE-to-DSCP MAP

Commandmls qos map ip-precedence-dscp dscp1 … dscp8

Parameter

dscp1 … dscp8: Indicates the DSCP values mapped to the IP PRE values. The default IP PRE 0~7 are

Description

mapped to DSCP 0, 8, 16, 24, 32, 40, 48 and 56 respectively. The DSCP value ranges from 0 to 63.

Command

Global configuration mode

Mode

2-20

Configuration Guide
Usage Guide

Configuring QoS-

Configuration
Example

Configuring the trust mode and default CoS value of an interface

Configuratio

Modify the trust mode of the interface gigabitEthernet 0/18 to DSCP.



Change the default CoS value of the interface gigabitEthernet 0/17 to 7.

n StepsRuijie# configure terminal
Ruijie(config)# interface gigabitEthernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# mls qos trust dscp
Ruijie(config-if-GigabitEthernet 0/18)# exit
Ruijie(config)# interface gigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# mls qos cos 7
Ruijie(config-if-GigabitEthernet 0/17)# exit

Verification



Check whether the trust mode and default CoS value are successfully configured for the interface.

Ruijie# show mls qos interface gigabitEthernet 0/18
Interface: GigabitEthernet 0/18
Ratelimit input:
Ratelimit output:
Attached input

policy-map:

Default trust: dscp
Default cos: 0
Ruijie# show mls qos interface gigabitEthernet 0/17
Interface: GigabitEthernet 0/17
Ratelimit input:
Ratelimit output:
Attached input

policy-map:

Default trust: none
Default cos: 7Configuring the CoS-to-DSCP, DSCP-to-CoS, and IP-PRE-to-DSCP mappings

Configuratio

Configure CoS-to-DSCP to map CoS 0, 1, 2, 3, 4, 5, 6, and 7 to DSCP 7, 14, 21, 28, 35, 42, 49,

2-21

Configuration Guide

Configuring QoS
and 56 respectively.

n StepsConfigure DSCP-to-CoS to map DSCP 0, 1, 2, 3, and 4 to CoS 4 and DSCP 11, 12, 13 and 14 to
CoS 7.

Configure IP-PRE-to-DSCP to map IP PRE 0, 1, 2, 3, 4, 5, 6, and 7 to DSCP 31, 26, 21, 15, 19, 45,
47, and 61 respectively.

Ruijie# configure terminal
Ruijie(config)# mls qos map cos-dscp 7 14 21 28 35 42 49 56
Ruijie(config)# mls qos map dscp-cos 0 1 2 3 4 to 4
Ruijie(config)# mls qos map dscp-cos 11 12 13 14 to 7
Ruijie(config)# mls qos map ip-precedence-dscp 31 26 21 15 19 45 47 61

Verification



Check whether all mappings are successfully configured.

Ruijie# show mls qos maps cos-dscp
cos dscp--- ---0

7

1

14

2

21

3

28

4

35

5

42

6

49

7

56

Ruijie# show mls qos maps dscp-cos
dscp cos

dscp cos

dscp cos

dscp cos---- ------- ------- ------- ---

0

4

1

4

2

4

3

4

4

4

5

0

6

0

7

0

8

1

9

1

10

1

11

7

12

7

13

7

14

7

15

1

16

2

17

2

18

2

19

2

20

2

21

2

22

2

23

2

2-22

Configuration Guide

Configuring QoS

24

3

25

3

26

3

27

3

28

3

29

3

30

3

31

3

32

4

33

4

34

4

35

4

36

4

37

4

38

4

39

4

40

5

41

5

42

5

43

5

44

5

45

5

46

5

47

5

48

6

49

6

50

6

51

6

52

6

53

6

54

6

55

6

56

7

57

7

58

7

59

7

60

7

61

7

62

7

63

7

Ruijie# show mls qos maps ip-precedence-dscp
ip-precedence dscp------------- ---0 31
1 26
2 21
3 15
4 19
5 45
6 47
7 61

2.4.3 Configuring Interface Rate Limit
Configuration EffectConfigure the traffic limit for an interface.

Notes


The configuration is supported only by Ethernet and aggregate interfaces.

Configuration Steps

Configuring the traffic limit for an interface

Optional.

Configure the limit on the traffic and burst traffic for an interface.

Verification


Run the show mls qos rate-limit command to display the rate limit information about the interface.

2-23

Configuration Guide

Configuring QoS

Related Commands

Configuring the traffic limit for an interface

Commandrate-limit { input | output } { bps | mbps } burst-size

Parameter

input: Indicates the input direction of the interface.

Description

output: Indicates the output direction of the interface.
bps: Indicates the bandwidth limit per second (Kbits). The value range is determined by products.
Mbps: Indicates the bandwidth limit per second (Mbits) for G.hn port. The value range is determined byproducts.
burst-size: Indicates the burst traffic limit (Kbytes). The value range is determined by products.

Command

Interface configuration mode

Mode
Usage Guide

Configuration
Example

Typical application – Interface rate limit + priority relabeling

Configuratio

n StepsFor Internet access by using the output interface, configure the output traffic limit on the interface
G0/17, and set the bandwidth limit to 102,400 Kbits per second and burst traffic limit to 32 Kbytes
per second.



For the dormitory building, configure the input traffic limit on the interface G0/17, and set the
bandwidth limit to 51,200 Kbits per second and burst traffic limit to 32 Kbytes per second.



For the teaching building, configure the input traffic limit on the interface G0/17, and set the
bandwidth limit to 30,720 Kbits per second and burst traffic limit to 32 Kbytes per second.



For the laboratory, create the class cmap_dscp7 to match DSCP priority 7, create the policy
pmap_shiyan to associate with cmap_dscp7, bind the stream behavior of changing the DSCP
value for packets whose rates exceed 20M to 16, apply pmap_shiyan to the interface G0/17, andconfigure the interface to trusting DSCP.

Ruijie# configure terminal
Ruijie(config)# interface gigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# rate-limit output 102400 32
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# rate-limit input 51200 32
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# rate-limit input 30720 32
Ruijie(config-if-GigabitEthernet 0/17)# exit

2-24Configuration Guide

Configuring QoSRuijie(config)# class-map cmap_dscp7
Ruijie(config-cmap)# match ip dscp 7
Ruijie(config-cmap)# exit
Ruijie(config)# policy-map pmap_shiyan
Ruijie(config-pmap)# class cmap_dscp7
Ruijie(config-pmap-c)# police 20480 128 exceed-action dscp 16
Ruijie(config-pmap-c)# exit
Ruijie(config-pmap)# exit
Ruijie(config)# interface gigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# service-policy input pmap_shiyan
Ruijie(config-if-GigabitEthernet 0/17)# mls qos trust dscp
Ruijie(config-if-GigabitEthernet 0/17)# exit

Verification



Check whether the interface rate limit is successfully configured.



Check whether the class and policy are successfully created and successfully applied to theinterface.

Ruijie# show mls qos rate-limit
Interface: GigabitEthernet 0/17
rate limit input Kbps = 30720 burst = 32
rate limit output Kbps = 102400 burst = 32
Ruijie# show class-map cmap_dscp7

Class Map cmap_dscp7
Match ip dscp 7
Ruijie# show policy-map pmap_shiyan

Policy Map pmap_shiyan
Class cmap_dscp7
police 20480 128 exceed-action dscp 16
Ruijie# show mls qos interface gigabitEthernet 0/17
Interface: GigabitEthernet 0/17
Ratelimit input: 30720 32
Ratelimit output: 102400 32

2-25

Configuration Guide
Attached input

Configuring QoS
policy-map: pmap_shiyan

Default trust: dscp
Default cos: 0

2.4.4 Configuring Congestion Management
Configuration EffectConfigure the CoS-to-queue mapping.

Configure the scheduling policy and round robin weight for an output queue.

Configure the guaranteed minimum bandwidth and limited maximum bandwidth for a queue.

Notes


Interface configurations allow for only AP and Ethernet interface configurations.

Configuration Steps

Configuring the CoS-to-unicast and CoS-to-multicast mappings

Optional.

Configure the CoS-to-queue mappings. On products supporting multicast queues, you can configure the
CoS-to-multicast queue mapping.

Configuring the scheduling policies and round robin weight for unicast and multicast output queues

Optional.

Configure the scheduling policy for an output queue and modify the round robin weight. On products supporting
multicast queues, you can configure the scheduling policies and round robin weights for multicast queues.

Configuring the guaranteed minimum bandwidth and limited maximum bandwidth for a queue

Optional.

Configure the guaranteed minimum bandwidth and limited maximum bandwidth for a queue.

Verification


Run the show mls qos queueing command to display the output queue information.

Run the show mls qos scheduler command to display the scheduling policy for the output queue.

Run the show qos bandwidth command to display the queue bandwidth.

Related Commands

Configuring CoS-to-Queue MAP

Commandpriority-queue cos-map qid cos0 [ cos1 [ cos2 [ cos3 [ cos4 [ cos5 [ cos6 [ cos7 ] ] ] ] ] ] ]Parameter

qid: Indicates the queue ID to be mapped, ranging from 1 to 8.

Description

cos0~cos7: Indicates the CoS values to be mapped to the qid. The default CoS values 0~7 are mapped
to queues 1~8. The value range is 0 to 7.

2-26

Configuration Guide
Command

Configuring QoSGlobal configuration mode

Mode
Usage Guide-Configuring the scheduling policy for an output queue to SP

Commandpriority-queue

Parameter-

Description
Command

Global configuration mode

Mode
Usage Guide-Configuring the scheduling policy for an output queue

Commandmls qos scheduler { sp | wrr | wfq }Parameter

sp: Sets the scheduling algorithm for an output queue to SP.

Description

wrr: Sets the scheduling algorithm for an output queue to WRR.
wfq: Sets the scheduling algorithm for an output queue to WFQ.

Command

Global/Interface configuration mode

Mode
Usage Guide-Configuring the scheduling policy and round robin weight for an output queue

Command{ wrr-queue | wfq-queue } bandwidth weight1 ... weight8

Parameter

wrr-queue: Configures the round robin weight corresponding to the WRR scheduling policy for an output

Description

queue.
wfq-queue: Configures the round robin weight corresponding to the WFQ scheduling policy for an
output queue.
weight1 ... weight8: Indicates the weight of queues 1 to 8. The value range is determined by products.
The value 0 indicates that the queue uses the SP scheduling algorithm. The default weight for
global/interface queues is 1:1.

Command

Global/Interface configuration mode

Mode
Usage Guide-Configuring the guaranteed minimum bandwidth and limited maximum bandwidth for a queue

Commandqos queue queue-id bandwidth { minimum | maximum } bandwidthParameter

queue [ ucast | mcast ]: queue ucast configures the guaranteed minimum bandwidth or limited

Description

maximum bandwidth for devices that allow for configuring the unicast queue bandwidth limit; queue
mcast configures the guaranteed minimum bandwidth or limited maximum bandwidth for devices thatallow for configuring the multicast queue bandwidth limit; queue configures the guaranteed minimum
bandwidth or limited maximum bandwidth for devices that allow for configuring both the unicast andmulticast queue bandwidth limits.
queue-id: Indicates the queue ID to be configured, ranging from 1 to 8.
minimum bandwidth: Indicates the guaranteed minimum bandwidth Kbps. The value range is

2-27

Configuration Guide

Configuring QoS

determined by products. It is not configured by default.
maximum bandwidth: Indicates the limited maximum bandwidth Kbps. The value range is determinedby products. It is not configured by default.
Command

Interface configuration mode

Mode
Usage Guide-

Configuration
Example

Configuring the CoS-to-queue mapping and modifying the scheduling policy and its round robin weight

Configuratio

n Steps

Configure the CoS-to-queue mapping to the mapping from the CoS values 0, 1, 2, 3, 4, 5, 6, and 7
to queues 1, 2, 5, 5, 5, 5, 7, and 8.

Configure the output scheduling policy for a queue to WRR and the round robin weight to2:1:1:1:6:6:6:8.

Ruijie# configure terminal
Ruijie(config)# priority-queue cos-map 5 2 3 4 5
Ruijie(config)# mls qos scheduler wrr
Ruijie(config)# wrr-queue bandwidth 2 1 1 1 6 6 6 8

Verification



Check whether the CoS-to-queue mapping is successfully created, and whether the output
scheduling policy and round robin weight are successfully configured for the queue.

Ruijie# show mls qos scheduler
Global Multi-Layer Switching scheduling
Weighted Round Robin
Ruijie# show mls qos queueing

Cos-queue map:cos qid--- --0

1

1

2

2

5

3

5

4

5

2-28

Configuration Guide

Configuring QoS

5

5

6

7

7

8

wrr bandwidth weights:
qid weights--- ------1

2

2

1

3

1

4

1

5

6

6

6

7

6

8

8

wfq bandwidth weights:
qid weights--- -------



1

1

2

1

3

1

4

1

5

1

6

1

7

1

8

1

Typical application – Priority relabeling + queue scheduling

Configuratio

Create ACLs for accessing various servers and create classes for matching these ACLs.



Create policies for associating with the classes and specify new CoS values for packets accessingn Stepsvarious servers. Associate the CoS values with the input interfaces for the R&D and market
departments and configure the interfaces to trusting CoS.


Configure the default CoS value for the HR management department interface to the highest
priority 7 to ensure that packets from the HR management department are sent in the highest

2-29

Configuration Guide

Configuring QoSpriority.

Configure the output scheduling policy to WR and the round robin weight to 1:1:1:2:6:1:1:0 for thequeues. This means that the SP scheduling algorithm is used for packets of the HR management
department, and the packets of the R&D and market departments for accessing the mail database,file database and salary query database are scheduled based on the ratio of 6:2:1.

Ruijie# configure terminal
Ruijie(config)# ip access-list extended salary
Ruijie(config-ext-nacl)# permit ip any host 192.168.10.1
Ruijie(config-ext-nacl)# exit
Ruijie(config)# ip access-list extended mailRuijie(config-ext-nacl)# permit ip any host 192.168.10.2
Ruijie(config-ext-nacl)# exit
Ruijie(config)# ip access-list extended file
Ruijie(config-ext-nacl)# permit ip any host 192.168.10.3
Ruijie(config-ext-nacl)# exit
Ruijie(config)# class-map salary
Ruijie(config-cmap)# match access-group salary
Ruijie(config-cmap)# exit
Ruijie(config)# class-map mailRuijie(config-cmap)# match access-group mailRuijie(config-cmap)# exit
Ruijie(config)# class-map file
Ruijie(config-cmap)# match access-group file
Ruijie(config)# policy-map toserver
Ruijie(config-pmap)# class mailRuijie(config-pmap-c)# set cos 4
Ruijie(config-pmap-c)# exit
Ruijie(config-pmap)# class file
Ruijie(config-pmap-c)# set cos 3
Ruijie(config-pmap-c)# exit
Ruijie(config-pmap)# class salary
Ruijie(config-pmap-c)# set cos 2
Ruijie(config-pmap-c)# end

2-30

Configuration Guide

Configuring QoSRuijie(config)# interface gigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# service-policy input toserver
Ruijie(config-if-GigabitEthernet 0/17)# mls qos trust cos
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# mls qos cos 7
Ruijie(config)#wrr-queue bandwidth 1 1 1 2 6 1 1 0
Ruijie(config)#mls qos scheduler wrr

Verification



Check whether the ACLs are successfully created and whether the classes are successfully
associated with the ACLs.



Check whether the policies are successfully created, whether the classes and stream behaviors
are successfully bound, and whether policies are successfully applied to the interfaces.

Check whether the default CoS value is successfully configured for the interface and whether thescheduling policy and the round robin weight are successfully configured.

Ruijie# show access-lists

ip access-list extended file
10 permit ip any host 192.168.10.3

ip access-list extended mail10 permit ip any host 192.168.10.2

ip access-list extended salary
10 permit ip any host 192.168.10.1
Ruijie# show class-map

Class Map salary
Match access-group salaryClass Map mailMatch access-group mailClass Map file2-31

Configuration Guide

Configuring QoSMatch access-group file

Ruijie# show policy-map

Policy Map toserver
Class mailset cos 4Class file
set cos 3Class salary
set cos 2
Ruijie# show mls qos interface gigabitEthernet 0/17
Interface: GigabitEthernet 0/17
Ratelimit input:
Ratelimit output:
Attached input

policy-map: toserver

Attached output policy-map:
Default trust: cos
Default cos: 0
Ruijie# show mls qos interface gigabitEthernet 0/18
Interface: GigabitEthernet 0/18
Ratelimit input:
Ratelimit output:
Attached input

policy-map:

Attached output policy-map:
Default trust: none
Default cos: 7
Ruijie# show mls qos scheduler
Global Multi-Layer Switching scheduling
Weighted Round Robin
Ruijie# Ruijie#show mls qos queueing
CoS-to-queue map:cos qid--- ---

2-32

Configuration Guide

Configuring QoS

0

1

1

2

2

3

3

4

4

5

5

6

6

7

7

8

wrr bandwidth weights:
qid weights--- ------1

1

2

1

3

1

4

2

5

6

6

1

7

1

8

0

wfq bandwidth weights:
qid weights--- ------1

1

2

1

3

1

4

1

5

1

6

1

7

1

8

1

2-33

Configuration Guide

Configuring QoS

2.5 Monitoring
Displaying
Description

Command

Displays stream classification

show class-map [ class-map-name ]information.
Displays QoS policy information.

show policy-map [ policy-map-name [ class class-map-name ] ]Displays the policy applied to anshow policy-map interface interface-nameinterface.
Displays logical interface groupshow virtual-group [ virtual-group-number | summary ]information.
Displays the policy applied to ashow mls qos virtual-group [ virtual-group-number | policers ]logical interface group.
Displays various mappings.

show mls qos maps [ cos-dscp | dscp-cos | ip-prec-dscp ]Displays interface rate limit

show mls qos rate-limit [ interface interface-name ]information.
Displays the QoS queue,

show mls qos queueing [ interface interface-name ]scheduling policy and round robinweight information.
Displays the scheduling information

show mls qos scheduler [ interface interface-name ]of an output queue.
Displays the QoS information of anshow mls qos interface [ interface-name | policers ]interface.
Displays the bandwidth information

show qos bandwidth [ interfaces interface-name ]of an interface.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs the QoS library.

debug qos lib [ event | message ]Debugs the QoS communication

debug qos server [ event | message ]server.

2-34

Configuration Guide

Debugs QoS user command

Configuring QoS

debug qos mls

processing.
Debugs VMSUP configurations.

debug qos vmsup

2-35

Ethernet Switching Configuration
1. Configuring Interface
2. Configuring MAC Address
3. Configuring Aggregate Port
4. Configuring VLAN
5. Configuring Protocol VLAN(beta)
6. Configuring Private VLAN(beta)
7. Configuring MSTP(beta)
8. Configuring GVRP(beta)
9. Configuring LLDP(beta)
10. Configuring ERPS(beta)Configuration Guide

Configuring Interfaces

1 Configuring Interfaces
1.1 Overview
Interfaces are important in implementing data switching on network devices. Ruijie devices support two types ofinterfaces: physical ports and logical interfaces. A physical port is a hardware port on a device, such as the 100M
Ethernet interface and gigabit Ethernet interface. A logical interface is not a hardware port on the device. A logicalinterface, such as the loopback interface and tunnel interface, can be associated with a physical port or independent ofany physical port. For network protocols, physical ports and logical interfaces serve the same function.

1.2 Applications
Application

Description

L2 Data Switching Through the

Implement Layer-2 (L2) data communication of network devices through the

Physical Ethernet Interface

physical L2 Ethernet interface.

1.2.1 L2 Data Switching Through the Physical Ethernet Interface
Scenario
Figure 1-1

As shown in Figure 1-1 , Switch A, Switch B, and Switch C form a simple L2 data switching network.

Deployment
Connect Switch A to Switch B through physical ports GigabitEthernet 0/17 and GigabitEthernet 0/17.

Connect Switch B to Switch C through physical ports GigabitEthernet 0/18 and GigabitEthernet 0/17.

Configure GigabitEthernet 0/17, GigabitEthernet 0/17, GigabitEthernet 0/18, and GigabitEthernet0/17 as Trunkports.



Create a switch virtual interface (SVI), SVI 1, on Switch A and Switch C respectively, and configure IP addresses
from a network segment for the two SVIs. The IP address of SVI 1 on Switch A is 192.168.1.1/24, and the IP
address of SVI 1 on Switch C is 192.168.1.2/24.



Run the ping 192.168.1.2 command on Switch A and the ping 192.168.1.1 command on Switch C to implement
data switching through Switch B.

1-1

Configuration Guide

Configuring Interfaces

1.3 Features
Basic Concepts

Interface Classification

Interfaces on Ruijie devices fall into three categories:L2 interface (Switch)1.

Common L2 interfaces are classified into the following types:



Switch port

L2 aggregate port (AP)

Switch PortA switch port is an individual physical port on the device, and implements only the L2 switching function. The switch port
is used to manage physical ports and L2 protocols related to physical ports.



L2 AP Port

An AP port is formed by aggregating multiple physical ports. Multiple physical links can be bound together to form asimple logical link. This logical link is called an AP port.
For L2 switching, an AP port is equivalent to a switch port that combines bandwidths of multiple ports, thus expanding
the link bandwidth. Frames sent over the L2 AP port are balanced among the L2 AP member ports. If one member link
fails, the L2 AP port automatically transfers the traffic on the faulty link to other member links, improving reliability ofconnections.

SVIThe SVI can be used as the management interface of the local device, through which the administrator can manage thedevice. You can also create an SVI as a gateway interface, which is mapped to the virtual interface of each VLAN to
implement routing across VLANs among L3 devices. You can run the interface vlan command to create an SVI andassign an IP address to this interface to set up a route between VLANs.
As shown in Figure 1-2, hosts in VLAN 20 can directly communicate with each other without participation of L3 devices.
If Host A in VLAN 20 wants to communicate with Host B in VLAN 30, SVI 1 of VLAN 20 and SVI 2 of VLAN 30 must be
used.
Figure 1-2

1-2

Configuration GuideConfiguring Interfaces

Loopback Interface

The loopback interface is a local L3 logical interface simulated by the software that is always UP. Packets sent to theloopback interface are processed on the device locally, including the route information. The IP address of the loopback
interface can be used as the source address used by Border Gateway Protocol (BGP) to set up a TCP connection. The
procedure for configuring a loopback interface is similar to that for configuring an Ethernet interface, and you can treat
the loopback interface as a virtual Ethernet interface.

Overview
FeatureDescription

Interface Configuration

You can configure interface-related attributes in interface configuration mode. If you

Commands

enter interface configuration mode of a non-existing logical interface, the interface will becreated.

Interface Description and

You can configure a name for an interface to identify the interface and help you

Administrative Statusremember the functions of the interface.
You can also configure the administrative status of the interface.

MTU

You can configure the maximum transmission unit (MTU) of a port to limit the length of aframe that can be received or sent over this port.

Bandwidth

You can configure the bandwidth of an interface.

Load Interval

You can specify the interval for load calculation of an interface.

Carrier Delay

You can configure the carrier delay of an interface to adjust the delay after which thestatus of an interface changes from Down to Up or from Up to Down.

Link Trap Policy

You can enable or disable the link trap function on an interface.

Interface Index Persistence

You can enable the interface index persistence function so that the interface index
remains unchanged after the device is restarted.

Interface Speed, Duplex

You can configure the speed, duplex mode, flow control mode, and auto negotiation

Mode, Flow Control Mode,

mode of an interface.

and Auto Negotiation Mode
Automatic Module Detection

If the interface speed is set to auto, the interface speed can be automatically adjusted
based on the type of the inserted module.

Protected PortYou can configure some ports as protected ports to disable communication between
these ports. You can also disable routing between protected ports.

Port Errdisable Recovery

After a port is shut down due to a violation, you can run the errdisable recovery
command in global configuration mode to recover all the ports in errdisable state andenable these ports.

EEE

You can configure the Energy Efficient Ethernet (EEE) function to enable the interface towork in low power consumption mode.

Port Flapping Protection

You can configure the port flapping protection function so that the system can
automatically shut down a port when flapping occurs on the port.

Syslog

You can enable the syslog function to check error messages and monitor interface
status change.

1-3Configuration Guide

Configuring Interfaces

1.3.1 Interface Configuration Commands
Run the interface command in global configuration mode to enter interface configuration mode. You can configure
interface-related attributes in interface configuration mode.

Working Principle
Run the interface command in global configuration mode to enter interface configuration mode. If you enter interface
configuration mode of a non-existing logical interface, the interface will be created. You can also run the interface range
or interface range macro command in global configuration mode to configure the range (IDs) of interfaces. Interfaces
defined in the same range must be of the same type and have the same features.
You can run the no interface command in global configuration mode to delete a specified logical interface.

Interface Numbering Rules

In stand-alone mode, the ID of a physical port consists of two parts: slot ID and port ID on the slot. For example, if theslot ID of the port is 2, and port ID on the slot is 3, the interface ID is 2/3. In VSU or stack mode, the ID of a physical port
consists of three parts: device ID, slot ID, and port ID on the slot. For example, if the device ID is 1, slot ID of the port is2, and port ID on the slot is 3, the interface ID is 1/2/3.
The device ID ranges from 1 to the maximum number of supported member devices.
The slot number rules are as follows: The static slot ID is 0, whereas the ID of a dynamic slot (pluggable module or linecard) ranges from 1 to the number of slots. Assume that you are facing the device panel. Dynamic slot are numberedfrom 1 sequentially from front to rear, from left to right, and from top to bottom.
The ID of a port on the slot ranges from 1 to the number of ports on the slot, and is numbered sequentially from left toright.
The ID of an AP port ranges from 1 to the number of AP ports supported by the device.
The ID of an SVI is the VID of the VLAN corresponding to this SVI.



Configuring Interfaces Within a Range

You can run the interface range command in global configuration mode to configure multiple interfaces at a time.
Attributes configured in interface configuration mode apply to all these interfaces.
The interface range command can be used to specify several interface ranges.
The macro parameter is used to configure the macro corresponding to a range. For details, see "Configuring Macros ofInterface Ranges."
Ranges can be separated by commas (,).
The types of interfaces within all ranges specified in a command must be the same.
Pay attention to the format of the range parameter when you run the interface range command.
The following interface range formats are valid:GigabitEthernet device/slot/{first port} - {last port};Ghn device/slot/{first port} - {last port};

AggregatePort Aggregate-port ID (The AP ID ranges from 1 to the maximum number of AP ports supported by
the device.)

1-4

Configuration Guide

Configuring Interfaces

vlan vlan-ID-vlan-ID (The VLAN ID ranges from 1 to 4,094.)



Loopback loopback-ID (The loopback ID ranges from 1 to 2,147,483,647.)Interfaces in an interface range must be of the same type, namely, FastEthernet, GigabitEthernet, AggregatePort, or
SVI.



Configuring Macros of Interface Ranges

You can define some macros to replace the interface ranges. Before using the macro parameter in the interface range
command, you must first run the define interface-range command in global configuration mode to define thesemacros.
Run the no define interface-range macro_name command in global configuration mode to delete the configured
macros.

1.3.2 Interface Description and Administrative Status
You can configure a name for an interface to identify the interface and help you remember the functions of the interface.
You can enter interface configuration mode to enable or disable an interface.

Working PrincipleInterface Description

You can configure the name of an interface based on the purpose of the interface. For example, if you want to assign
GigabitEthernet 1/1 for exclusive use by user A, you can describe the interface as "Port for User A."

Interface Administrative Status

You can configure the administrative status of an interface to disable the interface as required. If the interface isdisabled, no frame will be received or sent on this interface, and the interface will loss all its functions. You can enable adisabled interface by configuring the administrative status of the interface. Two types of interface administrative status
are defined: Up and Down. The administrative status of an interface is Down when the interface is disabled, and Up
when the interface is enabled. Please wait for 15 seconds after execution and wait for the chip to be ready.

1.3.3 MTU
You can configure the MTU of a port to limit the length of a frame that can be received or sent over this port.
The feature is not supported by G.hn ports.

Working Principle
When a large amount of data is exchanged over a port, frames greater than the standard Ethernet frame may exist.
This type of frame is called jumbo frame. The MTU is the length of the valid data segment in a frame. It does not include
the Ethernet encapsulation overhead.
If a port receives or sends a frame with a length greater than the MTU, this frame will be discarded.

1.3.4 Bandwidth
Working Principle

1-5Configuration Guide

Configuring Interfaces

The bandwidth command can be configured so that some routing protocols (for example, RIP) can calculate the route
metric and the Resource Reservation Protocol (RSVP) can calculate the reserved bandwidth. Modifying the interface
bandwidth will not affect the data transmission rate of the physical port.
The bandwidth command is a routing parameter, and does not affect the bandwidth of a physical link.

1.3.5 Load IntervalWorking Principle
You can run the load-interval command to specify the interval for load calculation of an interface. Generally, theinterval is 10s.

1.3.6 Carrier Delay
Working Principle
The carrier delay refers to the delay after which the data carrier detect (DCD) signal changes from Down to Up or fromUp to Down. If the DCD status changes during the delay, the system will ignore this change to avoid negotiation at theupper data link layer. If this parameter is set to a great value, nearly every DCD change is not detected. On the contrary,
if the parameter is set to 0, every DCD signal change will be detected, resulting in poor stability.
If the DCD carrier is interrupted for a long time, the carrier delay should be set to a smaller value to accelerate
convergence of the topology or route. On the contrary, if the DCD carrier interruption time is shorter than the
topology or route convergence time, the carrier delay should be set to a greater value to avoid topology or route
flapping.

1.3.7 Link Trap Policy
You can enable or disable the link trap function on an interface.

Working Principle
When the link trap function on an interface is enabled, the Simple Network Management Protocol (SNMP) sends linktraps when the link status changes on the interface.

1.3.8 Interface Index Persistence
Like the interface name, the interface index also identifies an interface. When an interface is created, the system
automatically assigns a unique index to the interface. The index of an interface may change after the device is restarted.
You can enable the interface index persistence function so that the interface index remains unchanged after the device
is restarted.

Working Principle
After interface index persistence is enabled, the interface index remains unchanged after the device is restarted.

Interface Speed, Duplex Mode, Flow Control Mode, and Auto Negotiation Mode

You can configure the interface speed, duplex mode, flow control mode, and auto negotiation mode of an Ethernet
physical port or AP port.

1-6

Configuration Guide

Configuring Interfaces

Working Principle



Speed

Generally, the speed of an Ethernet physical port is determined through negotiation with the peer device. The
negotiated speed can be any speed within the interface capability. You can also configure any speed within theinterface capability for the Ethernet physical port.
The feature is not supported by G.hn ports.
When you configure the speed of an AP port, the configuration takes effect on all of its member ports. (All thesemember ports are Ethernet physical ports.)



Duplex ModeThe duplex mode of an Ethernet physical port or AP port can be configured as follows:

Set the duplex mode of the interface to full-duplex so that the interface can receive packets while sending packets.

Set the duplex mode of the interface to half-duplex so that the interface can receive or send packets at a time.



Set the duplex mode of the interface to auto-negotiation so that the duplex mode of the interface is determinedthrough auto negotiation between the local interface and peer interface.

When you configure the duplex mode of an AP port, the configuration takes effect on all of its member ports. (Allthese member ports are Ethernet physical ports.)

The feature is not supported by G.hn ports.



Flow Control

Two flow control modes are defined for an interface:Symmetric flow control mode: Generally, after flow control is enabled on an interface, the interface processes thereceived flow control frames, and sends the flow control frames when congestion occurs on the interface. The
received and sent flow control frames are processed in the same way. This is called symmetric flow control mode.



Asymmetric flow control mode: In some cases, an interface on a device is expected to process the received flow
control frames to ensure that no packet is discarded due to congestion, and not to send the flow control frames toavoid decreasing the network speed. In this case, you need to configure asymmetric flow control mode to separate
the procedure for receiving flow control frames from the procedure for sending flow control frames.

When you configure the flow control mode of an AP port, the configuration takes effect on all of its member ports.
(All these member ports are Ethernet physical ports.)

The feature is not supported by G.hn ports.

As shown in Figure 1-3, Port A of the device is an uplink port, and Ports B, C and D are downlink ports. Assume that
Port A is enabled with the functions of sending and receiving flow control frames. Port B and Port C are connected todifferent slow networks. If a large amount of data is sent on Port B and Port C, Port B and Port C will be congested, andconsequently congestion occurs in the inbound direction of Port A. Therefore, Port A sends flow control frames. Whenthe uplink device responds to the flow control frames, it reduces the data flow sent to Port A, which indirectly slows
down the network speed on Port D. At this time, you can disable the function of sending flow control frames on Port A toensure the bandwidth usage of the entire network.

1-7

Configuration Guide

Configuring Interfaces

Figure 1-3

Auto Negotiation Mode

The auto negotiation mode of an interface can be On or Off. The auto negotiation state of an interface is not completely
equivalent to the auto negotiation mode. The auto negotiation state of an interface is jointly determined by the interface
speed, duplex mode, flow control mode, and auto negotiation mode.
When you configure the auto negotiation mode of an AP port, the configuration takes effect on all of its member ports.
(All these member ports are Ethernet physical ports.)
The feature is not supported by G.hn ports.
Generally, if one of the interface speed, duplex mode, and flow control mode is set to auto, or the auto negotiation
mode of an interface is On, the auto negotiation state of the interface is On, that is, the auto negotiation function of
the interface is enabled. If none of the interface speed, duplex mode, and flow control mode is set to auto, and theauto negotiation mode of an interface is Off, the auto negotiation state of the interface is Off, that is, the auto
negotiation function of the interface is disabled.

1.3.9 Automatic Module Detection
If the interface speed is set to auto, the interface speed can be automatically adjusted based on the type of the inserted
module.

Working Principle
Currently, the automatic module detection function can be used to detect only the SFP and SFP+ modules. The SFP isa Gigabit module, whereas SFP+ is a 10 Gigabit module. If the inserted module is SFP, the interface works in Gigabit
mode. If the inserted module is SFP+, the interface works in 10 Gigabit mode.
The automatic module detection function takes effect only when the interface speed is set to auto.

1.3.10 Protected Port
In some application environments, it is required that communication be disabled between some ports. For this purpose,
you can configure some ports as protected ports. You can also disable routing between protected ports.

Working PrincipleProtected Port

1-8

Configuration Guide

Configuring Interfaces

After ports are configured as protected ports, protected ports cannot communicate with each other, but cancommunicate with non-protected ports.
Protected ports work in either of the two modes. In the first mode, L2 switching is blocked but routing is allowed
between protected ports. In the second mode, both L2 switching and routing are blocked between protected ports. If a
protected port supports both modes, the first mode is used by default.
When two protected port are configured as a pair of mirroring ports, frames sent or received by the source port can be
mirrored to the destination port.
Currently, only an Ethernet physical port or AP port can be configured as a protected port. When an AP port isconfigured as a protected port, all of its member ports are configured as protected ports.



Blocking L3 Routing Between Protected Ports

By default, L3 routing between protected ports is not blocked. In this case, you can run the protected-portsroute-deny command to block routing between protected ports.

1.3.11 Port Errdisable Recovery
Some protocols support the port errdisable recovery function to ensure security and stability of the network. For
example, in the port security protocol, when you enable port security and configure the maximum number of security
addresses on the port, a port violation event is generated if the number of addresses learned on this port exceeds the
maximum number of security addresses. Other protocols, such as the Spanning Tree Protocol (STP), DOT1X, and
REUP, support the similar functions, and a violating port will be automatically shut down to ensure security.

Working Principle
After a port is shut down due to a violation, you can run the errdisable recovery command in global configuration mode
to recovery all the ports in errdisable state and enable these ports. You can manually recover a port, or automatically
recover a port at a scheduled time.

1.3.12 EEE
Energy Efficient Ethernet (EEE) is an energy efficient Ethernet solution. When EEE is enabled, the port enters low
power consumption mode when the Ethernet connection is idle, thus saving the energy.
Low Power Idle (LPI) is the low power consumption mode. After a port enters LPI mode, it reduces signals significantly,
and only sends signals that are sufficient to maintain the connection on the port to save the energy.

Working Principle
According to the Ethernet standards or specifications, interfaces with a bandwidth of 100M or above have the idle state.
An interface will consume much power if it maintains connection without being affected by data transmission. Therefore,
the power consumption is high no matter whether any data is transmitted on the link. Even if no data is transmitted, theport will always send the idle signals to retain the connection state of the link.
EEE enables a port to enter LPI mode for the purpose of saving energy. In LPI mode, the power consumption is low
when the link is idle. The EEE technology can also quickly change the LPI state of a port to the normal state, providing
high-performance data transmission.

1-9

Configuration Guide

Configuring Interfaces

After enabled with EEE, the port automatically enters LPI mode if the port is always Up without sending or receiving any
packet in a period of time. The port recovers the working mode when it needs to send or receive packets, thus saving
the energy. To make the EEE function take effect, the peer port must also support the EEE function.
Only a copper port working in 100M or 1000M speed mode supports the EEE function.
The EEE function takes effect only on the port enabled with auto negotiation.

1.3.13 Port Flapping Protection
When flapping occurs on a port, a lot of hardware interruptions occur, consuming a lot of CPU resources. On the other
hand, frequent port flapping damages the port. You can configure the flapping protection function to protect ports.

Working Principle
By default, the port flapping protection function is enabled. You can disable this function as required. When flapping
occurs on a port, the port detects flapping every 2s or 10s. If flapping occurs six times within 2s on a port, the device
displays a prompt. If 10 prompts are displayed continuously, that is, port flapping is detected continuously within 20s,
the port is disabled. If flapping occurs 10 times within 10s on a port, the device displays a prompt without disabling theport.

1.3.14 Syslog
You can enable or disable the syslog function to determine whether to display information about the interface changes
or exceptions.

Working Principle
You can enable or disable the syslog function as required. By default, this function is enabled. When an interface
becomes abnormal, for example, the interface status changes, or the interface receives error frames, or flapping occurs,
the system displays prompts to notify users.

1.4 Configuration
Configuration

Description and Command(Optional) It is used to manage interface configurations, for example,
creating/deleting an interface, or configuring the interface description.
Creates an interface and enters configuration mode of theinterface

Performing Basic
Configurations

created interface or a specified interface.
Enters an interface range, creates these interfaces (if notinterface range

created), and enters interface configuration mode.
Creates a macro to specify an interface range.

define interface-range

Enables the interface index persistence function so that

snmp-server if-index

the interface index remains unchanged after the device ispersistrestarted.
Configures the interface description of up to 80 characters

description

in interface configuration mode.

1-10

Configuration Guide
Configuration

Configuring Interfaces
Description and Command
snmp trap link-status

Configures whether to send the link traps of the interface.

shutdown

Shuts down an interface in interface configuration mode.

physical-port dither protect

Configures the port flapping protection function in global
configuration mode.

logging [ link-updown |Configures the syslog function on an interface in global

error-frame | link-dither ]configuration mode.

(Optional) It is used to configure interface attributes.
Configures the bandwidth of an interface in interface

bandwidth

configuration mode.
Configures the carrier delay of an interface in interface

carrier-delay

Configuring Interface
Attributes

configuration mode.

load-interval

Configures the interval for load calculation of an interface.

duplexConfigures the duplex mode of an interface.

flowcontrol

Enables or disables flow control of an interface.

mtu

Configures the MTU of an interface.

negotiation mode

Configures the auto negotiation mode of an interface.

speed

Configures the speed of an interface.
Configures an interface as a L2 interface in interface

switchportconfiguration mode. (Run the no switchport command to
configure an interface as a L3 interface.)
Configures a port as a protected port.

switchport protected
protected-ports route-deny

Blocks L3 routing between protected ports in global
configuration mode.
Recovers a port in errdisable state in global configuration

errdisable recovery

mode.
Enables EEE in interface configuration mode.

eee enable

1.4.1 Performing Basic Configurations
Configuration EffectCreate a specified logical interface and enter configuration mode of this interface, or enter configuration mode ofan existing physical or logical interface.

Create multiple specified logical interfaces and enter interface configuration mode, or enter configuration mode ofmultiple existing physical or logical interfaces.



The interface indexes remain unchanged after the device is restarted.

Configure the interface description so that users can directly learn information about the interface.

Enable or disable the link trap function of an interface.

Enable or disable an interface.

Notes

1-11

Configuration GuideConfiguring Interfaces

The no form of the command can be used to delete a specified logical interface or logical interfaces in a specified
range, but cannot be used to delete a physical port or physical ports in a specified range.

The default form of the command can be used in interface configuration mode to restore default settings of a
specified physical or logical interface, or interfaces in a specified range.

Configuration Steps

Configuring a Specified Interface

Optional.

Run this command to create a logical interface or enter configuration mode of a physical port or an existing logicalinterface.

Commandinterface interface-type interface-number

Parameterinterface-type interface-number: Indicates the type and number of the interface. The interface can be an

Description

Ethernet physical port, AP port, SVI, or loopback interface.

Defaults

N/A

Command

Global configuration mode

Mode
Usage Guide

If a logical interface is not created yet, run this command to create this interface and enter
configuration mode of this interface.

For a physical port or an existing logical interface, run this command to enter configuration mode ofthis interface.

Use the no form of the command to delete a specified logical interface.

Use the default form of the command to restore default settings of the interface in interface
configuration mode.

Configuring Interfaces Within a Range

Optional.

Run this command to create multiple logical interfaces or enter configuration mode of multiple physical port orexisting logical interfaces.

Commandinterface range { port-range | macro macro_name }Parameter

port-range: Indicates the type and ID range of interfaces. These interfaces can be Ethernet physicalDescription

ports, AP ports, SVIs, or loopback interfaces.
macro_name: Indicates the name of the interface range macro.

Defaults

N/A

Command

Global configuration mode

Mode
Usage GuideIf logical interfaces are not created yet, run this command to create these interfaces and enterinterface configuration mode.

For multiple physical ports or existing logical interfaces, run this command to enter interface
configuration mode.

Use the default form of the command to restore default settings of these interfaces in interface
configuration mode.



Before using a macro, run the define interface-range command to define the interface range as a

1-12

Configuration Guide

Configuring Interfaces
macro name in global configuration mode, and then run the interface range macro macro_namecommand to apply the macro.

Configuring Interface Index Persistence

Optional.

Run this command when the interface indexes must remain unchanged after the device is restarted.

Commandsnmp-server if-index persist

Parameter

N/A

Description
Defaults

By default, interface index persistence is disabled.

Command

Global configuration mode

Mode
Usage Guide

After this command is executed, current indexes of all interfaces will be saved, and the indexes remainunchanged after the device is restarted. You can use the no or default form of the command to disable
the interface index persistence function.

Configuring the Description of an Interface

Optional.

Run this command to configure the description of an interface.

Commanddescription string

Parameter

string: Indicates a string of up to 80 characters.

Description
Defaults

By default, no description is configured.

Command

Interface configuration mode

Mode
Usage Guide

This command is used to configure the description of an interface. You can use the no or default form of
the command to delete the description of an interface.-Configuring the Link Trap Function of an Interface

Optional.

Run this command to obtain the link traps through SNMP.

Commandsnmp trap link-status

Parameter

N/A

Description
Defaults

By default, the link trap function is enabled.

Command

Interface configuration mode

Mode
Usage Guide

This command is used to configure the link trap function on an interface. When this function is enabled,
the SNMP sends link traps when the link status changes on the interface. You can use the no or default
form of the command to disable the link trap function.

Configuring the Administrative Status of an Interface

1-13Configuration Guide

Configuring Interfaces

Optional.

Run this command to enable or disable an interface.

An interface cannot send or receive packets after it is disabled.

Commandshutdown

Parameter

N/A

Description
Defaults

By default, the administrative status of an interface is Up.

Command

Interface configuration mode

Mode
Usage Guide

You can run the shutdown command to disable an interface, or the no shutdown command to enable
an interface. In some cases, for example, when an interface is in errdisable state, you cannot run the no
shutdown command on an interface. You can use the no or default form of the command to enable theinterface.
Please wait for 15 seconds after execution and wait for the chip to be ready.

Configuring Port Flapping Protection



Optional.

Run this command to protect the port against flapping.

Commandphysical-port dither protect

Parameter

N/A

Description
Defaults

By default, port flapping protection is enabled.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring the Syslog Function



Optional.

Run this command to enable or disable the syslog function on an interface.

Command[no] logging [link-updown | error-frame | link-dither ]Parameter

N/A

Description
Defaults

By default, the syslog function is enabled on an interface.

Command

Global configuration mode

Mode
Usage Guide

N/A

Verification

Configuring a Specified Interface



Run the interface command. If you can enter interface configuration mode, the configuration is successful.

1-14

Configuration GuideConfiguring Interfaces

For a logical interface, after the no interface command is executed, run the show running or show interfacescommand to check whether the logical interface exists. If not, the logical interface is deleted.



After the default interface command is executed, run the show running command to check whether the default
settings of the corresponding interface are restored. If yes, the operation is successful.

Configuring Interfaces Within a RangeRun the interface range command. If you can enter interface configuration mode, the configuration is successful.

After the default interface range command is executed, run the show running command to check whether thedefault settings of the corresponding interfaces are restored. If yes, the operation is successful.

Configuring Interface Index Persistence

After the snmp-server if-index persist command is executed, run the write command to save the configuration,
restart the device, and run the show interface command to check the interface index. If the index of an interface
remains the same after the restart, interface index persistence is enabled.

Configuring the Link Trap Function of an Interface

Remove and then insert the network cable on a physical port, and enable the SNMP server. If the SNMP server
receives link traps, the link trap function is enabled.

Run the no form of the snmp trap link-status command. Remove and then insert the network cable on a physicalport. If the SNMP server does not receive link traps, the link trap function is disabled.

Configuring the Administrative Status of an Interface

Insert the network cable on a physical port, enable the port, and run the shutdown command on this port. If thesyslog is displayed on the Console indicating that the state of the port changes to Down, and the indicator on theport is off, the port is disabled. Run the show interfaces command, and verify that the interface state changes toAdministratively Down. Then, run the no shutdown command to enable the port. If the syslog is displayed on theConsole indicating that the state of the port changes to Up, and the indicator on the port is on, the port is enabled.

Configuring Port Flapping Protection

Run the physical-port dither protect command in global configuration mode. Frequently remove and insert the
network cable on a physical port to simulate port flapping. Verify that a syslog indicating port flapping is displayedon the Console. After such a syslog is displayed for several times, the system prompts that the port will be shut
down.



Configuring the Syslog Function

Run the logging link-updown command in global configuration mode to display the interface status information.
Remove and then insert the network cable on a physical port. The interface state will change twice. Verify that the
information is displayed on the Console, indicating that the interface state changes from Up to Down, and thenfrom Down to Up. Run the no logging link-updown command. Remove and then insert the network cable. Verify
that the related information is no longer displayed on the Console. This indicates that the syslog function is normal.

Configuration
Example1-15

Configuration GuideConfiguring Interfaces

Configuring Basic Attributes of Interfaces

Scenario
Figure 1-4

ConfiguratioConnect two devices through the switch ports.

n StepsConfigure an SVI respectively on two devices, and assign IP addresses from a network segment to
the two SVIs.

A

Enable interface index persistence on the two devices.



Enable the link trap function on the two devices.



Configure the interface administrative status on the two devices.

A# configure terminalA(config)# snmp-server if-index persist
A(config)# interface vlan 1A(config-if-VLAN 1)# ip address 192.168.1.1 255.255.255.0
A(config-if-VLAN 1)# exit
A(config)# interface gigabitethernet 0/17
A(config-if-GigabitEthernet 0/17)# snmp trap link-status
A(config-if-GigabitEthernet 0/17)# shutdown
A(config-if-GigabitEthernet 0/17)# end
A# writeB

B# configure terminal
B(config)# snmp-server if-index persist
B(config)# interface vlan 1
B(config-if-VLAN 1)# ip address 192.168.1.2 255.255.255.0
B(config-if-VLAN 1)# exit
B(config)# interface gigabitethernet 0/17
B(config-if-GigabitEthernet 0/17)# snmp trap link-status
B(config-if-GigabitEthernet 0/17)# shutdown
B(config-if-GigabitEthernet 0/17)# end
B# write

Verification

Perform verification on Switch A and Switch B as follows:Run the shutdown command on port GigabitEthern 0/17, and check whether GigabitEthern 0/17
and SVI 1 are Down.



Run the shutdown command on port GigabitEthern 0/17, and check whether a trap indicating that
this interface is Down is sent.

Restart the device, and check whether the index of GigabitEthern 0/17 is the same as that before
the restart.

1-16

Configuration Guide
A

Configuring Interfaces

A# show interfaces gigabitethernet 0/17
Index(dec):17 (hex):11
GigabitEthernet 0/17 is administratively down, line protocol is DOWN
Hardware is GigabitEthernet, address is 00d0.f865.de9b (bia 00d0.f865.de9b)
Interface address is: no ip address
MTU 1500 bytes, BW 1000000 Kbit
Encapsulation protocol is Bridge, loopback not set
Keepalive interval is 10 sec, set
Carrier delay is 2 sec
Rxload is 1/255, Txload is 1/255
Queue

Transmitted packets

Transmitted bytes

Dropped packets

0

0

0

0

1

0

0

0

2

0

0

0

3

0

0

0

4

0

0

0

5

0

0

0

6

0

0

0

7

4

440

0

Dropped

bytes
0
0
0
0
0
0
0
0
Switchport attributes:
interface's description:""lastchange time:0 Day:20 Hour:15 Minute:22 Second
Priority is 0
admin medium-type is Copper, oper medium-type is Copper

admin duplex mode is AUTO, oper

duplex is Unknown
admin speed is AUTO, oper speed is Unknown
flow control admin status is OFF, flow control oper status is Unknown
admin negotiation mode is OFF, oper negotiation state is ON
Storm Control: Broadcast is OFF, Multicast is OFF, Unicast is OFF
Port-type: access
Vlan id: 1
10 seconds input rate 0 bits/sec, 0 packets/sec
10 seconds output rate 0 bits/sec, 0 packets/sec
4 packets input, 408 bytes, 0 no buffer, 0 dropped
Received 0 broadcasts, 0 runts, 0 giants

1-17Configuration Guide

Configuring Interfaces
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort
4 packets output, 408 bytes, 0 underruns, 0 dropped

0 output errors, 0 collisions, 0 interface resets
A# show interfaces vlan 1
Index(dec):4097 (hex):1001
VLAN 1 is UP, line protocol is DOWN
Hardware is VLAN, address is 00d0.f822.33af (bia 00d0.f822.33af)
Interface address is: 192.168.1.1/24
ARP type: ARPA, ARP Timeout: 3600 seconds
MTU 1500 bytes, BW 1000000 Kbit
Encapsulation protocol is Ethernet-II, loopback not set
Keepalive interval is 10 sec, set
Carrier delay is 2 sec
Rxload is 0/255, Txload is 0/255
B

B# show interfaces gigabitethernet 0/17
Index(dec):17 (hex):11
GigabitEthernet 0/17 is administratively down, line protocol is DOWN
Hardware is GigabitEthernet
Interface address is: no ip address, address is 00d0.f865.de9b (bia 00d0.f865.de9b)
MTU 1500 bytes, BW 1000000 Kbit
Encapsulation protocol is Bridge, loopback not set
Keepalive interval is 10 sec, set
Carrier delay is 2 sec
Rxload is 1/255, Txload is 1/255
Queue

Transmitted packets

Transmitted bytes

Dropped packets

0

0

0

0

1

0

0

0

2

0

0

0

3

0

0

0

4

0

0

0

5

0

0

0

6

0

0

0

7

4

440

0

bytes
0
0
0
0
0
0
0
0
Switchport attributes:
interface's description:""

1-18

DroppedConfiguration Guide

Configuring Interfaces
lastchange time:0 Day:20 Hour:15 Minute:22 Second
Priority is 0
admin medium-type is Copper, oper medium-type is Copper
admin duplex mode is AUTO, oper duplex is Unknown
admin speed is AUTO, oper speed is Unknown
flow control admin status is OFF, flow control oper status is Unknown
admin negotiation mode is OFF, oper negotiation state is ON
Storm Control: Broadcast is OFF, Multicast is OFF, Unicast is OFF

Port-type: access
Vlan id: 1
10 seconds input rate 0 bits/sec, 0 packets/sec
10 seconds output rate 0 bits/sec, 0 packets/sec
4 packets input, 408 bytes, 0 no buffer, 0 dropped
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort
4 packets output, 408 bytes, 0 underruns, 0 dropped
0 output errors, 0 collisions, 0 interface resets
B# show interfaces vlan 1
Index(dec):4097 (hex):1001
VLAN 1 is UP, line protocol is DOWN
Hardware is VLAN, address is 00d0.f822.33af (bia 00d0.f822.33af)
Interface address is: 192.168.1.2/24
ARP type: ARPA, ARP Timeout: 3600 seconds
MTU 1500 bytes, BW 1000000 Kbit
Encapsulation protocol is Ethernet-II, loopback not set
Keepalive interval is 10 sec, set
Carrier delay is 2 sec
Rxload is 0/255, Txload is 0/255

1.4.2 Configuring Interface Attributes
Configuration EffectEnable the device to connect and communicate with other devices through the switch port.



Adjust various interface attributes on the device.

Configuration Steps

Configuring the Speed of an Interface

Optional.

Port flapping may occur if the configured speed of a port changes.

This command is applicable to an Ethernet physical port or AP port.

Commandspeed [ 10 | 100 | 1000 | auto ]1-19

Configuration Guide

Configuring Interfaces

Parameter

10: Indicates that the speed of the interface is 10 Mbps.

Description

100: Indicates that the speed of the interface is 100 Mbps.
1000: Indicates that the speed of the interface is 1000 Mbps.
auto: Indicates that the speed of the interface automatically adapts to the actual condition.

Defaults

By default, the speed of an interface is auto.

Command

Interface configuration mode

Mode
Usage Guide

If an interface is an AP member port, the speed of this interface is determined by the speed of the AP
port. When the interface exits the AP port, it uses its own speed configuration. You can run showinterfaces to display the speed configurations. The speed options available to an interface vary with thetype of the interface. For example, you cannot set the speed of an SFP interface to 10 Mbps.
The feature is not supported by G.hn ports.

Configuring the Duplex Mode of an Interface

Optional.

Port flapping may occur if the configured duplex mode of a port changes.

This command is applicable to an Ethernet physical port or AP port.

Commandduplex { auto | full | half }Parameter

auto: Indicates automatic switching between full duplex and half duplex.

Description

full: Indicates full duplex.
half: Indicates half duplex.

Defaults

By default, the duplex mode of an interface is auto.

Command

Interface configuration mode

Mode
Usage Guide

The duplex mode of an interface is related to the interface type. You can run show interfaces to display
the configurations of the duplex mode.
The feature is not supported by G.hn ports.

Configuring the Flow Control Mode of an Interface

Optional.



Generally, the flow control mode of an interface is off by default. For some products, the flow control mode is on bydefault.

After flow control is enabled on an interface, the flow control frames will be sent or received to adjust the data
volume when congestion occurs on the interface.

Port flapping may occur if the configured flow control mode of a port changes.

This command is applicable to an Ethernet physical port or AP port.

Commandflowcontrol { auto | off | on }Parameter

auto: Indicates automatic flow control.

Description

off: Indicates that flow control is disabled.
on: Indicates that flow control is enabled.

Defaults

By default, flow control is disabled on an interface.

1-20

Configuration Guide
Command

Configuring Interfaces

Interface configuration mode

Mode
Usage Guide

The feature is not supported by G.hn ports.

Configuring the Auto Negotiation Mode of an Interface

Optional.

Port flapping may occur if the configured auto negotiation mode of a port changes.

This command is applicable to an Ethernet physical port or AP port.

Commandnegotiation mode { on | off }Parameter

on: Indicates that the auto negotiation mode is on.

Description

off: Indicates that the auto negotiation mode is off.

Defaults

By default, the auto negotiation mode is off.

Command

Interface configuration mode

Mode
Usage Guide

The feature is not supported by G.hn ports.

Configuring the MTU of an Interface

Optional.

You can configure the MTU of a port to limit the length of a frame that can be received or sent over this port.

This command is applicable to an Ethernet physical port or SVI.

Command

mtu num

Parameternum: 64–9216

Description
Defaults

By default, the MTU of an interface is 1500 bytes.

Command

Interface configuration mode

Mode
Usage Guide

This command is used to configure the interface MTU, that is, the maximum length of a data frame at thelink layer. Currently, you can configure MTU for only a physical port or an AP port that contains one ormore member ports.
The feature is not supported by G.hn ports.

Configuring the Bandwidth of an Interface

Optional.



Generally, the bandwidth of an interface is the same as the speed of the interface.

Commandbandwidth kilobits

Parameterkilobits: The value ranges from 1 to 2,147,483,647. The unit is kilo bits.

Description
Defaults

Generally, the bandwidth of an interface matches the type of the interface. For example, the default
bandwidth of a gigabit Ethernet physical port is 1,000,000, and that of a 10G Ethernet physical port is
10,000,000.

Command

Interface configuration mode

1-21

Configuration Guide

Configuring Interfaces

Mode
Usage Guide

N/A

Configuring the Carrier Delay of an Interface

Optional.



If the configured carrier delay is long, it takes a long time to change the protocol status when the physical status of
an interface changes. If the carrier delay is set to 0, the protocol status changes immediately after the physicalstatus of an interface changes.

Commandcarrier-delay {[milliseconds] num | up [milliseconds] num down [milliseconds] num}

Parameternum: The value ranges from 0 to 60. The unit is second.

Description

milliseconds: Indicates the carrier delay. The value ranges from 0 to 60,000. The unit is millisecond.
Up: Indicates the delay after which the state of the DCD changes from Down to Up.
Down: Indicates the delay after which the state of the DCD changes from Up to Down.

Defaults

By default, the carrier delay of an interface is 2s.

Command

Interface configuration mode

Mode
Usage Guide

If millisecond is used as the unit, the configured carrier delay must be an integer multiple of 100
milliseconds.

Configuring the Load Interval of an Interface

Optional.



The configured load interval affects computation of the average packet rate on an interface. If the configured loadinterval is short, the average packet rate can accurately reflect the changes of the real-time traffic.

Commandload-interval seconds

Parameterseconds: The value ranges from 5 to 600. The unit is second.

Description
Defaults

By default, the load interval of an interface is 10s.

Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuring a Protected Port

Optional.

L2 packets cannot be forwarded between protected ports.

This command is applicable to an Ethernet physical port or AP port.

Commandswitchport protected

Parameter

N/A

Description
Defaults

By default, no protected port is configured.

Command

Interface configuration mode

Mode
Usage Guide

N/A

1-22

Configuration Guide

Configuring Interfaces



Blocking L3 Routing Between Protected Ports

Optional.

After this command is configured, L3 routing between protected ports are blocked.

Commandprotected-ports route-denyParameter

N/A

Description
Defaults

By default, the function of blocking L3 routing between protected ports is disabled.

Command

Global configuration mode

Mode
Usage Guide

By default, L3 routing between protected ports is not blocked. In this case, you can run this command toblock routing between protected ports.

Configuring Port Errdisable Recovery



Optional.



By default, a port will be disabled and will not be recovered after a violation occurs. After port errdisable recovery
is configured, a port in errdisable state will be recovered and enabled.

Commanderrdisable recovery [ interval time ]Parameter

time: Indicates the automatic recovery time. The value ranges from 30 to 86,400. The unit is second.

Description
Defaults

By default, port errdisable recovery is disabled.

Command

Global and Interface configuration mode.

Mode
Usage Guide

By default, a port in errdisable state is not recovered. You can recover the port manually or run thiscommand to automatically recover the port.



Configuring EEEOptional.



The EEE mode of a port is enabled after this command is configured.

Commandeee enable

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

By default, the EEE mode of a port is disabled. You can run this command to enable EEE, and use theno or default form of the command to disable EEE.

Verification


Run the show interfaces command to display the attribute configurations of interfaces.

Commandshow interfaces [ interface-type interface-number ] [ description | switchport | trunk ]Parameterinterface-type interface-number: Indicates the type and number of the interface.

1-23

Configuration Guide
Description

Configuring Interfaces

description: Indicates the interface description, including the link status.
switchport: Indicates the L2 interface information. This parameter is effective only for a L2 interface.
trunk: Indicates the Trunk port information. This parameter is effective for a physical port or an AP port.

CommandPrivileged EXEC mode

Mode
Usage Guide

Use this command without any parameter to display the basic interface information.
SwitchA#show interfaces GigabitEthernet 0/17
Index(dec):17 (hex):11
GigabitEthernet 0/17 is DOWN

, line protocol is DOWN

Hardware is Broadcom GigabitEthernet, address is 8080.8007.7026 (bia 8080.8007.7026)
Interface address is: no ip address
Interface IPv6 address is:
No IPv6 address
MTU 1500 bytes, BW 1000000 Kbit
Encapsulation protocol is Ethernet-II, loopback not set
Keepalive interval is 10 sec , set
Carrier delay is 2 sec
Ethernet attributes:
Last link state change time: 1970-01-01 00:00:56
Time duration since last link state change: 0 days, 11 hours, 18 minutes, 42 seconds
Priority is 0
Medium-type is Copper
Admin duplex mode is AUTO, oper duplex is Unknown
Admin speed is AUTO, oper speed is Unknown
Flow control admin status is OFF, flow control oper status is Unknown
Admin negotiation mode is OFF, oper negotiation state is ON
Storm Control: Broadcast is OFF, Multicast is OFF, Unicast is OFF
Bridge attributes:
Port-type: access
Vlan id: 1
Rxload is 1/255, Txload is 1/255
10 seconds input rate 0 bits/sec, 0 packets/sec
10 seconds output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer, 0 dropped
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort
0 packets output, 0 bytes, 0 underruns , 0 dropped
0 output errors, 0 collisions, 0 interface resets

Run the show eee interfaces status command to display the EEE status of an interface.

Commandshow eee interfaces { interface-type interface-number | status }Parameterinterface-type interface-number: Indicates the type and number of an interface.

Description

status: Indicates the EEE status of all interfaces.

CommandPrivileged EXEC mode

1-24

Configuration Guide

Configuring Interfaces

Mode
Usage Guide

If the interface is specified, the EEE status of the specified interface is displayed; otherwise, the EEE
status of all interfaces is displayed.
1. Display the EEE status of GigabitEthernet 0/17.
Ruijie#show eee interface gigabitethernet 0/1
Interface: Gi0/17

EEE Support: Yes

Admin Status: Disable

Oper Status: Disable

Remote Status: Unknown

Trouble Cause: NoneInterface

Indicates the interface information.

EEE Support

Indicates whether EEE is supported.

Admin Status

Indicates the administrative status.

Oper Status

Indicates the operational status.

Trouble Cause

Indicates the reason why the EEE status of aninterface is abnormal.

2. Display the EEE status of all interfaces.
Ruijie#show eee interface status
Interface

EEE

Admin

Oper

SupportStatusStatusRemoteStatusTroubleCause---------- -------- --------- --------- --------- ----------------------Ghn0/1

Yes

DisableDisableUnknown

None

Ghn0/2Yes

DisableDisableUnknown

None

Ghn0/3Yes

DisableDisableUnknown

None

Ghn0/4

Yes

DisableDisableUnknown

None

Ghn0/5

Yes

DisableDisableUnknown

None

Ghn0/6

Yes

DisableDisableUnknown

None

Ghn0/7

Yes

DisableDisableUnknown

None

Ghn0/8Yes

DisableDisableUnknown

None

Ghn0/9Yes

DisableDisableUnknown

None

Ghn0/10Yes

DisableDisableUnknown

None

Ghn0/11Yes

DisableDisableUnknown

None

Ghn0/12Yes

DisableDisableUnknown

None

Ghn0/13

Yes

DisableDisableUnknown

None

Ghn0/14

Yes

DisableDisableUnknown

None

1-25

Configuration Guide

Configuring Interfaces

Ghn0/15

Yes

DisableDisableUnknown

None

Ghn0/16

Yes

DisableDisableUnknown

None

Gi0/17

Yes

DisableDisableUnknown

None

Gi0/18Yes

DisableDisableUnknownNone

Te0/19

NO

-

-

-

-

Interface

Indicates the interface information.

EEE Support

Indicates whether EEE is supported.

Admin Status

Indicates the administrative status.

Oper Status

Indicates the operational status.

Trouble Cause

Indicates the reason why the EEE status of aninterface is abnormal.

Configuration
Example

Configuring Interface Attributes

Scenario
Figure 1-6

Configuratio

On Switch A, configure GigabitEthernet 0/17 as an access mode, and the default VLAN ID is 1.
Configure SVI 1, assign an IP address to SVI 1, and set up a route to Switch D.

n Steps

On Switch B, configure GigabitEthernet 0/17 and GigabitEthernet 0/18 as Trunk ports, and thedefault VLAN ID is 1. Configure SVI 1, and assign an IP address to SVI 1.



On Switch C, configure GigabitEthernet 0/17 as an Access port, and the default VLAN ID is 1.
Configure SVI 1, and assign an IP address to SVI 1.

A

A# configure terminalA(config)# interface GigabitEthernet 0/17
A(config-if-GigabitEthernet 0/17)# switchport mode accessA(config-if-GigabitEthernet 0/17)# switchport access vlan 1A(config-if-GigabitEthernet 0/17)# exit
A(config)# interface vlan 1A(config-if-VLAN 1)# ip address 192.168.1.1 255.255.255.0

1-26

Configuration Guide

Configuring Interfaces

A(config-if-VLAN 1)# exit
A(config)# ip route 192.168.2.0 255.255.255.0 VLAN 1 192.168.1.2
B

B# configure terminal
B(config)# interface GigabitEthernet 0/17
B(config-if-GigabitEthernet 0/17)# switchport mode trunk
B(config-if-GigabitEthernet 0/17)# exit
B(config)# interface GigabitEthernet 0/18
B(config-if-GigabitEthernet 0/18)# switchport mode trunk
B(config-if-GigabitEthernet 0/18)# exit
B(config)# interface vlan 1
B(config-if-VLAN 1)# ip address 192.168.1.2 255.255.255.0
B(config-if-VLAN 1)# exitC

C# configure terminalC(config)# interface GigabitEthernet 0/17
C(config-if-GigabitEthernet 0/17)# port-group 1C(config-if-GigabitEthernet 0/17)# exit
C(config)# interface aggregateport 1
C(config-if-AggregatePort 1)# switchport mode accessC(config-if-AggregatePort 1)# switchport access vlan 1C(config-if-AggregatePort 1)# exit
C(config)# interface vlan 1C(config-if-VLAN 1)# ip address 192.168.1.3 255.255.255.0
C(config-if-VLAN 1)# exit

Verification

Perform verification on Switch A, Switch B, Switch C, and Switch D as follows:

On Switch A, ping the IP addresses of interfaces of the other three switches. Verify that you canaccess the other three switches on Switch A.

AVerify that switch B and Switch D can be pinged mutually.



Verify that the interface status is correct.

A# show interfaces gigabitethernet 0/17
Index(dec):17 (hex):11
GigabitEthernet 0/17 is UP, line protocol is UP
Hardware is GigabitEthernet, address is 00d0.f865.de90 (bia 00d0.f865.de90)
Interface address is: no ip address
MTU 1500 bytes, BW 100000 Kbit
Encapsulation protocol is Ethernet-II, loopback not set
Keepalive interval is 10 sec, set
Carrier delay is 2 sec
Ethernet attributes:
Last link state change time: 2012-12-22 14:00:48
Time duration since last link state change: 3 days, 2 hours, 50 minutes, 50 seconds
Priority is 0
Admin medium-type is Copper, oper medium-type is Copper

1-27

Configuration Guide

Configuring Interfaces
Admin duplex mode is AUTO, oper duplex is Full
Admin speed is AUTO, oper speed is 100M
Flow control admin status is OFF, flow control oper status is OFF
Admin negotiation mode is OFF, oper negotiation state is ON
Storm Control: Broadcast is OFF, Multicast is OFF, Unicast is OFF

Bridge attributes:
Port-type: access
Vlan id: 1
Rxload is 1/255, Txload is 1/255
10 seconds input rate 0 bits/sec, 0 packets/sec
10 seconds output rate 67 bits/sec, 0 packets/sec
362 packets input, 87760 bytes, 0 no buffer, 0 dropped
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort
363 packets output, 82260 bytes, 0 underruns, 0 dropped
0 output errors, 0 collisions, 0 interface resets
B

B# show interfaces gigabitethernet 0/17
Index(dec):17 (hex):11
GigabitEthernet 0/17 is UP, line protocol is UP
Hardware is GigabitEthernet, address is 00d0.f865.de91 (bia 00d0.f865.de91)
Interface address is: no ip address
MTU 1500 bytes, BW 100000 Kbit
Encapsulation protocol is Ethernet-II, loopback not set
Keepalive interval is 10 sec, set
Carrier delay is 2 sec
Ethernet attributes:
Last link state change time: 2012-12-22 14:00:48
Time duration since last link state change: 3 days, 2 hours, 50 minutes, 50 seconds
Priority is 0
Admin medium-type is Copper, oper medium-type is Copper
Admin duplex mode is AUTO, oper duplex is Full
Admin speed is AUTO, oper speed is 100M
Flow control admin status is OFF, flow control oper status is OFF
Admin negotiation mode is OFF, oper negotiation state is ON
Storm Control: Broadcast is OFF, Multicast is OFF, Unicast is OFF
Bridge attributes:
Port-type: trunk
Native vlan: 1
Allowed vlan lists: 1-4094
Active vlan lists: 1
Rxload is 1/255, Txload is 1/255
10 seconds input rate 0 bits/sec, 0 packets/sec
10 seconds output rate 67 bits/sec, 0 packets/sec
362 packets input, 87760 bytes, 0 no buffer, 0 dropped

1-28

Configuration Guide

Configuring Interfaces
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort
363 packets output, 82260 bytes, 0 underruns, 0 dropped
0 output errors, 0 collisions, 0 interface resets

C# show interfaces gigabitethernet 0/17

C

Index(dec):17 (hex):11
GigabitEthernet 0/17 is UP, line protocol is UP
Hardware is GigabitEthernet, address is 00d0.f865.de92 (bia 00d0.f865.de92)
Interface address is: no ip address
MTU 1500 bytes, BW 100000 Kbit
Encapsulation protocol is Ethernet-II, loopback not set
Keepalive interval is 10 sec, set
Carrier delay is 2 sec
Ethernet attributes:
Last link state change time: 2012-12-22 14:00:48
Time duration since last link state change: 3 days, 2 hours, 50 minutes, 50 seconds
Priority is 0
Admin medium-type is Copper, oper medium-type is Copper
Admin duplex mode is AUTO, oper duplex is Full
Admin speed is AUTO, oper speed is 100M
Flow control admin status is OFF, flow control oper status is OFF
Admin negotiation mode is OFF, oper negotiation state is ON
Storm Control: Broadcast is OFF, Multicast is OFF, Unicast is OFF
Rxload is 1/255, Txload is 1/255
10 seconds input rate 0 bits/sec, 0 packets/sec
10 seconds output rate 67 bits/sec, 0 packets/sec
362 packets input, 87760 bytes, 0 no buffer, 0 dropped
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort
363 packets output, 82260 bytes, 0 underruns, 0 dropped
0 output errors, 0 collisions, 0 interface resets

1.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears the counters of a specified

clear counters [ interface-type interface-number ]interface.
Resets the interface hardware.

clear interface interface-type interface-number

DisplayingDisplaying Interface Configurations and Status
1-29

Configuration Guide

Configuring Interfaces

Description

Command

Displays all the status and configuration

show interfaces [ interface-type interface-number ]information of a specified interface.
Displays the interface status.

show interfaces [ interface-type interface-number ] status

Displays the interface errdisable status.

show interfaces [ interface-type interface-number ] status err-disable

Displays the link status change time andshow interfaces [ interface-type interface-number ] link-state-change

count of a specified port.

statistics

Displays the administrative and operational

show interfaces [ interface-type interface-number ] switchport

states of switch ports (non-routed ports).
Displays the description and status of ashow interfaces [ interface-type interface-number ] description

specified interface.
Displays the counters of a specified port,show interfaces [ interface-type interface-number ] countersamong which the displayed speed may havean error of ±0.5%.
Displays the number of packets increased inshow interfaces [ interface-type interface-number ] counters incrementa load interval.
Displays statistics about error packets.

show interfaces [ interface-type interface-number ] counters error

Displays the packet sending/receiving rate ofshow interfaces [ interface-type interface-number ] counters rate

an interface.
Displays a summary of interface information.

show interfaces [ interface-type interface-number ] counters summary

Displays the line detection status. When ashow interfaces [ interface-type interface-number ] line-detect

cable is short-circuited or disconnected, line
detection helps you correctly determine theworking status of the cable.
Displays the bandwidth usage of anshow interfaces [ interface-type interface-number ] usage

interface.
Displays the EEE status of an interface.

show eee interfaces { interface-type interface-number | status }Displaying Optical Module Information

Description

Command

Displays basic information about the opticalshow interfaces [ interface-type interface-number ] transceivermodule of a specified interface.
Displays the fault alarms of the opticalshow interfaces [ interface-type interface-number ] transceiver alarm

module on a specified interface. If no fault
occurs, "None" is displayed.
Displays the optical module diagnosis values

show interfaces [ interface-type interface-number ] transceiverof a specified interface.

diagnosis

Line Detection
The administrator can run the line-detect command to check the working status of a cable. When a cable isshort-circuited or disconnected, line detection helps you determine the working status of the cable.
Only a physical port using copper as the medium supports line detection. The AP port does not support line
detection.

1-30

Configuration Guide

Configuring Interfaces

When line detection is performed on an operational interface, the interface will be temporarily disconnected, andthen re-connected.
Description
Performs line detection in interface

Commandline-detect

configuration mode. When a cable isshort-circuited or disconnected, line detection
helps you determine the working status of thecable.

1-31

Configuration Guide

Configuring MAC Address

2 Configuring MAC Address
2.1 Overview
A MAC address table contains the MAC addresses, interface numbers and VLAN IDs of the devices connected to the
local device.
When a device forwards a packet, it finds an output port from its MAC address table according to the destination MAC
address and the VLAN ID of the packet.
After that, the packet is unicast, multicast or broadcast.
This document covers dynamic MAC addresses, static MAC addresses and filtered MAC addresses. For the
management of multicast MAC addresses, please see Configuring IGMP Snooping Configuration.

Protocols andStandards
IEEE 802.3: Carrier sense multiple access with collision detection (CSMA/CD) access method and physical layer
specifications

IEEE 802.1Q: Virtual Bridged Local Area Networks

2.2 Applications
Application

Description

MAC Address Learning

Forward unicast packets through MAC addresses learning.

MAC Address Change Notification

Monitor change of the devices connected to a network device through MAC
address change notification.

2.2.1 MAC Address Learning
Scenario
Usually a device maintains a MAC address table by learning MAC addresses dynamically. The operating principle isdescribed as follows:
As shown in the following figure, the MAC address table of the switch is empty. When User A communicates with User
B, it sends a packet to the port GigabitEthernet 0/18 of the switch, and the switch learns the MAC address of User A andstores it in the table.
As the table does not contain the MAC address of User B, the switch broadcasts the packet to the ports of all connected
devices except User A, including User B C.

2-1

Configuration Guide

Configuring MAC Address

Figure 2-1 Step 1 of MAC Address Learning

Figure 2-2 MAC Address Table 1
StatusVLAN

MAC address

Interface

Dynamic

100d0.f8a6.5af7

GigabitEthernet 0/18

When User B receives the packet, it sends a reply packet to User A through port GigabitEthernet 0/17 on the switch. As
the MAC address of User A is already in the MAC address table, the switch send the reply unicast packet to port
GigabitEthernet 0/18 port and learns the MAC address of User B.
Figure 2-3 Step 2 of MAC Address Learning

Figure 2-4 MAC Address Table 2
StatusVLAN

MAC address

Interface

Dynamic

100d0.f8a6.5af7

18

Dynamic

100d0.f8a4.e9b6

17

Through the interaction between User A and User B, the switch learns the MAC addresses of User A and User B. After
that, packets between User A and User B will be exchanged via unicast.

Deployment
With MAC address learning, a layer-2 switch forwards packets through unicast, reducing broadcast packets andnetwork load.

2.2.2 MAC Address Change Notification
MAC address change notification provides a mechanism for the network management system (NMS) to monitor thechange of devices connected to a network device.

Scenario

2-2

Configuration Guide

Configuring MAC Address

Figure 2-5 MAC Address Change Notification

After MAC address change notification is enabled on a device, the device generates a notification message when thedevice learns a new MAC address or finishes aging a learned MAC address, and sends the message in an SNMP Trap
message to a specified NMS.
A notification of adding a MAC address indicates that a new user accesses the network, and that of deleting a MAC
address indicates that a user sends no packets within an aging time and usually the user exits the network.
When a network device is connected to a number of devices, a lot of MAC address changes may occur in a short time,
resulting in an increase in traffic. To reduce traffic, you may configure an interval for sending MAC address change
notifications. When the interval expires, all notifications generated during the interval are encapsulated into a message.
±When a notification is generated, it is stored in the table of historical MAC address change notifications. The
administrator may know recent MAC address changes by checking the table of notification history even without NMS.
A MAC address change notification is generated only for a dynamic MAC address.

Deployment
Enable MAC address change notification on a layer-2 switch to monitor the change of devices connected to a
network device.

2.3 Features
Basic Concepts

Dynamic MAC Address

A dynamic MAC address is a MAC address entry generated through the process of MAC address learning by a device.

Address Aging

A device only learns a limited number of MAC addresses, and inactive entries are deleted through address aging.
A device starts aging a MAC address when it learns it. If the device receives no packet containing the source MAC
address, it will delete the MAC address from the MAC address table when the time expires.



Forwarding via Unicast

If a device finds in its MAC address table an entry containing the MAC address and the VLAN ID of a packet and theoutput port is unique, it will send the packet through the port directly.

Forwarding via Broadcast

2-3Configuration Guide

Configuring MAC Address

If a device receives a packet containing the destination address ffff.ffff.ffff or an unidentified destination address, it will
send the packet through all the ports in the VLAN where the packet is from, except the input port.

Overview
FeatureDescription

Dynamic Address Limit for VLAN

Limit the number of dynamic MAC addresses in a VLAN.

Dynamic Address Limit for Interface

Limit the number of dynamic MAC addresses on an interface.

2.3.1 Dynamic Address Limit for VLAN
Working Principle
The MAC address table with a limited capacity is shared by all VLANs. Configure the maximum number of dynamic
MAC addresses for each VLAN to prevent one single VLAN from exhausting the MAC address table space.
A VLAN can only learn a limited number of dynamic MAC addresses after the limit is configured. The packets exceeding
the limit are forwarded.User can configure the maximum MAC addresses learned by a VLAN. After the maximum
number exceeds the limit, the VLAN will stop learning MAC address, and packets will be discarded.
If the number of learned MAC addresses is greater than the limit, a device will stop learning the MAC addresses
from the VLAN and will not start learning again until the number drops below the limit after address aging.
The MAC addresses copied to a specific VLAN are not subject to the limit.

2.3.2 Dynamic Address Limit for Interface
Working Principle
An interface can only learn a limited number of dynamic MAC addresses after the limit is configured. The packets
exceeding the limit are forwarded.
User can configure the maximum MAC addresses learned by a VLAN. After the maximum number exceeds the limit,
the VLAN will stop learning MAC address, and packets will be discarded.
If the number of learned MAC addresses is greater than the limit, a device will stop learning the MAC addresses
from the interface and will not start learning again until the number drops below the limit after address aging.

2.4 Configuration
Configuration

Description and Command(Optional) It is used to enable MAC address learning.

Configuring Dynamic MAC

Configures MAC address learning globally

mac-address-learningor on an interface.

Address
mac-address-table aging-time
Configuring a Static MAC
Address

Configures an aging time for a dynamic
MAC address.

(Optional) It is used to bind the MAC address of a device with a port of a switch.
Configures a static MAC address.

mac-address-table static

2-4

Configuration Guide
Configuration

Configuring MAC Address
Description and Command

Configuring a MAC Addressfor Packet Filtering(Optional) It is used to filter packets.
mac-address-table filtering

Configures a MAC address for packet
filtering.

(Optional) It is used to monitor change of devices connected to a network device.
Configuring MAC Address

mac-address-table notification

Change Notification
snmp trap mac-notification

Configuring Maximum
Number of MAC Addresses
Learned by a VLAN

Configures MAC address change
notification globally.
Configures MAC address change
notification on an interface.

(Optional) It is used to configure the maximum number of MAC addresses learned bya port.
max-dynamic-mac-count countConfigures the maximum number of MAC
addresses learned by a VLAN/port.

2.4.1 Configuring Dynamic MAC Address
Configuration EffectLearn MAC addresses dynamically and forward packets via unicast.

Configuration Steps

Configuring Global MAC Address Learning

Optional.

You can perform this configuration to disable global MAC address learning.

Configuration:

Commandmac-address-learning { enable | disable }Parameter

enable: Enables global MAC address learning.

Description

disable: Disable global MAC address learning.

Defaults

Global MAC address learning is enabled by default.

Command

Global configuration mode

Mode
Usage Guide

N/A

By default, global MAC address learning is enabled. When global MAC address learning is enabled, the MAC
address learning configuration on an interface takes effect; when the function is disabled, MAC addresses cannot
be learned globally.

Configuring MAC Address Learning on Interface

Optional.

You can perform this configuration to disable MAC address learning on an interface.

Configuration:

2-5

Configuration Guide

Configuring MAC Address

Commandmac-address-learning

Parameter

N/A

Description
Defaults

MAC address learning is enabled by default.

Command

Interface configuration mode

Mode
Usage Guide

Perform this configuration on a layer-2 interface, for example, a switch port or an AP port.

By default, MAC address learning is enabled. If DOT1X, IP SOURCE GUARD, or a port security function is
configured on a port, MAC address learning cannot be enabled. Access control cannot be enabled on a port with
MAC address learning disabled.

Configuring an Aging Time for a Dynamic MAC AddressOptional.

Configure an aging time for dynamic MAC addresses.



Configuration:

Commandmac-address-table aging-time value

Parameter

value: Indicates the aging time. The value is either 0 or in the range from 10 to 630.

Description
Defaults

The default is 300s.

Command

Global configuration mode

Mode
Usage Guide

If the value is set to 0, MAC address aging is disabled and learned MAC addresses will not be aged.

The actual aging time may be different from the configured value, but it is not more than two times of theconfigured value.

Verification


Check whether a device learns dynamic MAC addresses.

Run the show mac-address-table dynamic command to display dynamic MAC addresses.

Run the show mac-address-table aging-time command to display the aging time for dynamic MAC addresses.

Commandshow mac-address-table dynamic [ address mac-address ] [ interface interface-type
interface-number ] [ vlan vlan-id ]Parameter

address mac-address: Displays the information of a specific dynamic MAC address.

Description

interface interface-type interface-number: Specifies a physical interface or an AP port.
vlan vlan-id: Displays the dynamic MAC addresses in a specific VLAN.

CommandPrivileged EXEC mode/Global configuration mode/Interface configuration mode

Mode
Usage Guide

N/A
Ruijie# show mac-address-table dynamic
Vlan

MAC Address

TypeInterface

Live Time------------------------- -------- ------------------10000.0000.0001

DYNAMIC gigabitethernet 0/17 1d 00:19:00

2-6

Configuration Guide

Configuring MAC Address

10001.960c.a740

DYNAMIC gigabitethernet 0/17 1d 00:28:00

10007.95c7.dff9

DYNAMIC gigabitethernet 0/17 1d 00:38:00

10007.95cf.eee0

DYNAMIC gigabitethernet 0/17 1d 00:42:00

10007.95cf.f41f

DYNAMIC gigabitethernet 0/17 1d 00:45:00

10009.b715.d400

DYNAMIC gigabitethernet 0/17 1d 00:58:00

Commandshow mac-address-table aging-timeParameter

N/A

Description
CommandPrivileged EXEC mode/Global configuration mode/Interface configuration mode

Mode
Usage Guide

N/A
Ruijie# show mac-address-table aging-timeAging time: 300

Configuration
Example

Configuring Dynamic MAC Address

Scenario
Figure 2-6

ConfiguratioEnable MAC address learning on an interface.

n StepsConfigure the aging time for dynamic MAC addresses to 180s.

Delete all dynamic MAC addresses in VLAN 1 on port GigabitEthernet 0/17.

Ruijie# configure terminal
Ruijie(config-if-GigabitEthernet 0/17)# mac-address-learning
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# mac aging-time 180
Ruijie# clear mac-address-table dynamic interface GigabitEthernet 0/17 vlan 1

Verification



Check MAC address learning on an interface.

Display the aging time for dynamic MAC addresses.



Display all dynamic MAC addresses in VLAN 1 on port GigabitEthernet 0/17.

Ruijie# show mac-address-learning
GigabitEthernet 0/17

learning ability: enable

Ruijie# show mac aging-timeAging time: 180 seconds

Ruijie# show mac-address-table dynamic interface GigabitEthernet 0/17 vlan 1
Vlan

MAC Address

Type

2-7

InterfaceConfiguration Guide

Configuring MAC Address------------------------------ -------- -------------------

100d0.f800.1001

STATIC

GigabitEthernet 0/17

Common Errors
Configure MAC address learning on an interface before configuring the interface as a layer-2 interface, for example, aswitch port or an AP port.

2.4.2 Configuring a Static MAC Address
Configuration EffectBind the MAC address of a network device with a port of a switch.

Configuration Steps

Configuring a Static MAC addressOptional.

Bind the MAC address of a network device with a port of a switch.

Configuration:

Commandmac-address-table static mac-address vlan vlan-id interface interface-type interface-number

Parameter

address mac-address: Specifies a MAC address.

Description

vlan vlan-id: Specifies a VLAN where the MAC address resides.
interface interface-type interface-number: Specifies a physical interface or an AP port.

Defaults

By default, no static MAC address is configured.

Command

Global configuration mode

Mode
Usage Guide

When the switch receives a packet containing the specified MAC address on the specified VLAN, thepacket is forwarded to the bound interface.

Verification


Run the show mac-address-table static command to check whether the configuration takes effect.

Commandshow mac-address-table static [ address mac-address ] [ interface interface-type interface-number ][ vlan vlan-id ]Parameter

address mac-address: Specifies a MAC address.

Description

interface interface-id: Specifies a physical interface or an AP port.
vlan vlan-id: Specifies a VLAN where the MAC address resides.

CommandPrivileged EXEC mode/Global configuration mode /Interface configuration mode

Mode
Usage Guide

N/A
Ruijie# show mac-address-table static
Vlan

MAC Address

TypeInterface

Live Time---------- -------------------- -------- ---- --1 00d0.f800.1001

STATIC gigabitethernet 0/17 -1 00d0.f800.1002

STATIC gigabitethernet 0/17 -2-8

Configuration Guide

Configuring MAC Address

1 00d0.f800.1003 STATIC gigabitethernet 0/17 -Configuration
Example

Configuring a Static MAC address

In the above example, the relationship of MAC addresses, VLAN and interfaces is shown in the following table.
Role

MAC Address

VLAN ID

Interface ID

Web Server

00d0.3232.0001

VLAN2

Gi0/18

Database Server

00d0.3232.0002

VLAN2

Te0/19Administrator

00d0.3232.1000

VLAN2

Gi0/17

Scenario
Figure 2-7

ConfiguratioSpecify destination MAC addresses (mac-address).

n StepsSpecify the VLAN (vlan-id) where the MAC addresses reside.

Specify interface IDs (interface-id).

A

A# configure terminalA(config)# mac-address-table static 00d0.f800.3232.0001 vlan 2 interface gigabitethernet 0/18
A(config)# mac-address-table static 00d0.f800.3232.0002 vlan 2 interface

TenGigabitEthernet

0/19
A(config)# mac-address-table static 00d0.f800.3232.1000 vlan 2 interface gigabitethernet 0/17

Verification

Display the static MAC address configuration on a switch.

A

A# show mac-address-table static
Vlan

MAC Address

TypeInterface------------------------------ -------- -------------------

Live Time---

200d0.f800.3232.1000 STATIC

GigabitEthernet 0/17 -200d0.f800.3232.0001

GigabitEthernet 0/18 -200d0.f800.3232.0002 STATICSTATIC

Common Errors

2-9

TenGigabitEthernet 0/19 -Configuration GuideConfiguring MAC Address

Configure a static MAC address before configuring the specific port as a layer-2 interface, for example, a switch
port or an AP port.

2.4.3 Configuring a MAC Address for Packet Filtering
Configuration Effect

If a device receives packets containing a source MAC address or destination MAC address specified as thefiltered MAC address, the packets are discarded.

Configuration Steps

Configuring a MAC Address for Packet FilteringOptional.

Perform this configuration to filter packets.

Configuration:

Commandmac-address-table filtering mac-address vlan vlan-id

Parameter

address mac-address: Specifies a MAC address.

Description

vlan vlan-id: Specifies a VLAN where the MAC address resides.

Defaults

By default, no filtered MAC address is configured.

Command

Global configuration mode

Mode
If a device receives packets containing a source MAC address or destination MAC address specified as

Usage Guide

the filtered MAC address, the packets are discarded.

Verification


Run the show mac-address-table filter command to display the filtered MAC address.

Commandshow mac-address-table filter [ address mac-address ] [ vlan vlan-id ]Parameter

address mac-address: Specifies a MAC address.

Description

vlan vlan-id: Specifies a VLAN where the MAC address resides.

CommandPrivileged EXEC mode/Global configuration mode /Interface configuration mode

Mode
Usage Guide

N/A
Ruijie# show mac-address-table filtering
Vlan

MAC Address

TypeInterface

Live Time------- ----------------- ------- ----------10000.2222.2222

FILTER Not available-

Configuration
Example

Configuring a MAC Address for Packet Filtering

ConfiguratioSpecify a destination MAC address (mac-address) for filtering.

n StepsSpecify a VLAN where the MAC addresses resides.

2-10Configuration Guide

Configuring MAC Address

Ruijie# configure terminal
Ruijie(config)# mac-address-table static 00d0.f800.3232.0001 vlan 1

Verification

Display the filtered MAC address configuration.
Ruijie# show mac-address-table filter
Vlan

MAC Address

TypeInterface

Live Time------- ----------------- ------- ----- -1

00d0.f800.3232.0001 FILTER-

2.4.4 Configuring MAC Address Change Notification
Configuration EffectMonitor change of devices connected to a network device.

Configuration Steps

Configuring NMSOptional.

Perform this configuration to enable an NMS to receive MAC address change notifications.



Configuration:

Commandsnmp-server host host-addr traps [ version { 1 | 2c | 3 [ auth | noauth | priv ] } ] community-string

Parameterhost host-addr: Specifies the IP address of a receiver.

Description

version { 1 | 2c | 3 [ auth | noauth | priv ] }: Specifies the version of SNMP TRAP messages. You canalso specify authentication and a security level for packets of Version 3.
community-string: Indicates an authentication name.

Defaults

By default, the function is disabled.

Command

Global configuration mode

Mode
Usage Guide

N/A

Enabling SNMP Trap



Optional.

Perform this configuration to send SNMP Trap messages.

Configuration:

Commandsnmp-server enable traps

Parameter

N/A

Description
Defaults

By default, the function is disabled.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring Global MAC Address Change Notification

2-11

Configuration Guide

Configuring MAC AddressOptional.



If MAC address change notification is disabled globally, it is disabled on all interfaces.

Configuration:

Commandmac-address-table notification

Parameter

mac-address-table notification [ interval value | history-size value ]Description
Defaults

By default, MAC address change notification is disabled globally.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring MAC Address Change Notification On Interface

Optional.

Perform this configuration to enable MAC address change notification on an interface.

Configuration:

CommandParametersnmp trap mac-notification { added | removed }added: Generates a notification when an MAC address is added.

Description
removed: Generates a notification when an MAC address is deleted.
Defaults
Command

By default, MAC address change notification is disabled on an interface.
Interface configuration mode

Mode
Usage Guide

N/A

Configuring Interval for Generating MAC Address Change Notifications and Volume of Notification History



Optional.

Perform this configuration to modify the interval for generating MAC address change notifications and the volume
of notification history.

Configuration:

Commandmac-address-table notification { interval value | history-size value }Parameterinterval value: (Optional) Indicates the interval for generating MAC address change notifications. The

Description

value ranges from 1 to 3600 seconds,.
history-size value: Indicates the maximum number of entries in the table of notification history. The
value ranges from 1 to 200.

Defaults

The default interval is 1 second. The default maximum amount of notifications is 50.

Command

Global configuration mode

Mode
Usage Guide

N/A

Verification

2-12

Configuration GuideConfiguring MAC Address

Run the show mac-address-table notification command to check whether the NMS receives MAC addresschange notifications.

Commandshow mac-address-table notification [ interface [ interface-id ] | history ]Parameter

Interface:Displays the configuration of MAC address change notification on all interfaces.

Description

interface-id: Displays the configuration of MAC address change notification on a specified interface.
history: Displays the history of MAC address change notifications.

CommandPrivileged EXEC mode/Global configuration mode /Interface configuration mode

Mode
Usage Guide

N/A

Usage Guide

Display the configuration of global MAC address change notification.
Ruijie#show mac-address-table notification
MAC Notification Feature : EnabledInterval(Sec): 300
Maximum History Size : 50
Current History Size : 0
Field

Description

Interval(Sec)Indicates the interval for generating MAC address change
notifications.

Maximum History Size

Indicates the maximum number of entries in the table ofnotification history.

Current History Size

Indicates the current notification entry number.

Configuration
ExampleScenario
Figure 2-8

The figure shows an intranet of an enterprise. Users are connected to A via port Gi0/18.
The Perform the configuration to achieve the following effects:When port Gi0/18 learns a new MAC address or finishes aging a learned MAC address, a MAC
address change notification is generated.



Meanwhile, A sends the MAC address change notification in an SNMP Trap message to a
specified NMS.

In a scenario where A is connected to a number of Users, the configuration can prevent MAC

2-13

Configuration Guide

Configuring MAC Address
address change notification burst in a short time so as to reduce the network flow.

ConfiguratioEnable global MAC address change notification on A, and configure MAC address change
notification on port Gi0/18.

n StepsConfigure the IP address of the NMS host, and enable A with SNMP Trap. A communicates with
the NMS via routing.

Configure the interval for sending MAC address change notifications to 300 seconds (1 second by
default).

A

Ruijie# configure terminal
Ruijie(config)# mac-address-table notification
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# snmp trap mac-notification added
Ruijie(config-if-GigabitEthernet 0/18)# snmp trap mac-notification removed
Ruijie(config-if-GigabitEthernet 0/18)# exit
Ruijie(config)# snmp-server host 192.168.1.10 traps version 2c comefrom2
Ruijie(config)# snmp-server enable traps
Ruijie(config)# mac-address-table notification interval 300

Verification



Check t whether MAC address change notification is enabled globally .

Check whether MAC address change notification is enabled on the interface.

Display the MAC addresses of interfaces, and run the clear mac-address-table dynamic
command to simulate aging dynamic MAC addresses.

A

Check whether global MAC address change notification is enabled globally.

Display the history of MAC address change notifications.

Ruijie# show mac-address-table notification
MAC Notification Feature : EnabledInterval(Sec): 300
Maximum History Size : 50
Current History Size : 0
Ruijie# show mac-address-table notification interface GigabitEthernet 0/18
Interface

MAC Added Trap

MAC Removed Trap---------------------------------------

GigabitEthernet 0/18

EnabledEnabledRuijie# show mac-address-table interface GigabitEthernet 0/18
Vlan

MAC Address------------------------------ -------- -------------------

100d0.3232.0001

TypeInterface

DYNAMIC GigabitEthernet 0/18

Ruijie# show mac-address-table notification
MAC Notification Feature : EnabledInterval(Sec): 300
Maximum History Size : 50
Current History Size : 1
Ruijie# show mac-address-table notification history
History Index : 0

2-14

Configuration Guide

Configuring MAC Address

Entry Timestamp: 221683
MAC Changed Message :Operation:DEL Vlan:1 MAC Addr: 00d0.3232.0003 GigabitEthernet 0/18

2.4.5 Configuring the Maximum Number of MAC Addresses Learned by a Port
Configuration EffectOnly a limited number of dynamic MAC addresses can be learned by a port.

Notes


None

Configuration Steps

Configuring the Maximum Number of MAC Addresses Learned by a Port

OptionalPerform this operation on the switch.

Commandmax-dynamic-mac-count countParametercount: Indicates the maximum number of MAC addresses learned by a port.

Description
Defaults

By default, the number of MAC addresses learned by a port is not limited. After the number of MAC
addresses learned by a port is limited and after the maximum number of MAC addresses exceeds thelimit, packets from source MAC addresses are forwarded by default.

Command

Interface configuration mode

Mode
Usage Guide

Verification
Run show run to query the configuration result.

Configuration
Example

Configuring the Maximum Number of MAC Addresses Learned by a Port

Configuratio

Configure the maximum number of MAC addresses learned by a port.

n StepsRuijie(config)# interface GigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# max-dynamic-mac-count 100
Verification

Run show running on the switch to query the configuration.

Common Errors
None

2-15

Configuration Guide

Configuring MAC Address

2.5 Monitoring
Clearing
Running the clear commands may lose vital information and interrupt services.
Description

CommandClears dynamic MAC addresses.

clear mac-address-table dynamic [ address mac-address ] [ interface
interface-id ] [ vlan vlan-id ]Displaying
Description

Command

Displays the MAC address table.

show mac-address-table { dynamic | static | filter } [ address mac-address ][ interface interface-id ] [ vlan vlan-id ]Displays the aging time for dynamic

show mac-address-table aging-time

MAC addresses.
Displays the number of address

show mac-address-table count [ interface interface-id | vlan vlan-id ]entries in the address table.
Displays all the MAC addresses onshow mac-address-table interface [ interface-id ] [ vlan vlan-id ]the specified interface including
static and dynamic MAC addresses.
Displays the MAC address learning.

show mac-address-learning

Displays the configuration andshow mac-address-table notification [ interface [ interface-id ] | history ]history of MAC address change
notifications.
Displays all addresses of theshow mac-address-table vlan [ vlan-id ]specified VLAN.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs MAC address operation.

debug bridge mac

2-16

Configuration Guide

Configuring Aggregated Port

3 Configuring Aggregated Port
3.1 Overview
An aggregated port (AP) is used to bundle multiple physical links into one logical link to increase the link bandwidth andimprove connection reliability.
An AP port supports load balancing, namely, distributes load evenly among member links. Besides, an AP port realizes
link backup. When a member link of the AP port is disconnected, the load carried by the link is automatically allocated toother functional member links. A member link does not forward broadcast or multicast packets to other member links.
For example, the link between two devices supports a maximum bandwidth of 1,000 Mbps. When the service trafficcarried by the link exceeds 1,000 Mbps, the traffic in excess will be discarded. Port aggregation can be used to solve
the problem. For example, you can connect the two devices with network cables and combine multiple links to form alogical link capable of multiples of 1,000 Mbps.
For example, there are two devices connected by a network cable. When the link between the two ports of the devices
is disconnected, the services carried by the link will be interrupted. After the connected ports are aggregated, theservices will not be affected as long as one link remains connected.

Protocols andStandards
IEEE 802.3ad

3.2 Applications
Applications

Description

AP Link Aggregation and Load

A large number of packets are transmitted between an aggregation device and a

Balancingcore device, which requires a greater bandwidth. To meet this requirement, you
can bundle the physical links between the devices into one logical link to increase
the link bandwidth, and configure a proper load balancing algorithm to distributethe work load evenly to each physical link, thus improving bandwidth utilization.

3.2.1 AP Link Aggregation and Load Balancing
Scenario
In Figure 3-1, the switch communicates with the router through an AP port. All the devices on the intranet (such as thetwo PCs on the left) use the router as a gateway. All the devices on the extranet (such as the two PCs on the right) send
packets to the internet devices through the router, with the gateway’s MAC address as its source MAC address. To
distribute the load between the router and other hosts to other links, configure destination MAC address-based loadbalancing. On the switch, configure source MAC address-based load balancing.
Figure 3-1 AP Link Aggregation and Load Balancing

3-1

Configuration Guide

Configuring Aggregated Port

Deployment
Configure the directly connected ports between the switch and router as a static AP port or a Link Aggregation
Control Protocol (LACP) AP port.

On the switch, configure a source MAC address-based load balancing algorithm.

On the router, configure a destination MAC address-based load balancing algorithm.

3.3 Features
Basic Concepts

Static AP

The static AP mode is an aggregation mode in which physical ports are directly added to an AP aggregation groupthrough manual configuration to allow the physical ports to forward packets when the ports are proper in link state andprotocol state.
An AP port in static AP mode is called a static AP, and its member ports are called static AP member ports.



LACP

LACP is a protocol about dynamic link aggregation. It exchanges information with the connected device through LACP
data units (LACPDUs).
An AP port in LACP mode is called an LACP AP port, and its member ports are called LACP AP member ports.

AP Member Port Mode

There are three aggregation modes available, namely, active, passive, and static.
AP member ports in active mode initiate LACP negotiation. AP member ports in passive mode only respond to received
LACPDUs. AP member ports in static mode do not send LACPDUs for negotiation. The following table lists therequirements for peer port mode.
Port Mode

Peer Port Mode

Active mode

Active or passive mode

Passive mode

Active mode

Static Mode

Static ModeAP Member Port State

There are two kinds of AP member port state available:

3-2

Configuration Guide

Configuring Aggregated PortWhen a member port is Down, the port cannot forward packets. The Down state is displayed.

When a member port is Up and the link protocol is ready, the port can forward packets. The Up state is displayed.

There are three kinds of LACP member port state:When the link of a port is Down, the port cannot forward packets. The Down state is displayed.

When the link of a port is Up and the port is added to an aggregation group, the bndl state is displayed.

When the link of a port is Up but the port is suspended because the peer end is not enabled with LACP or theattributes of the ports are inconsistent with those of the master port, the susp state is displayed. (The port in susp
state does not forward packets.)
Only full-duplex ports are capable of LACP aggregation.
The feature is not supported by G.hn ports.LACP aggregation can be implemented only when the rates, flow
control approaches, medium types, and Layer-2/3 attributes of member ports are consistent.
If you modify the preceding attributes of a member port in the aggregation group, LACP aggregation will fail.
The ports which are prohibited from joining or exiting an AP port cannot be added to or removed from a static AP
port or an LACP AP port.



LACP System ID

One device can be configured with only one LACP aggregation system. The system is identified by a system ID andeach system has a priority, which is a configurable value. The system ID consists of the LACP system priority and MAC
address of the device. A lower system priority indicates a higher priority of the system ID. If the system priorities are thesame, a smaller MAC address of the device indicates a higher priority of the system ID. The system with an ID of ahigher priority determines the port state. The port state of a system with an ID of a lower priority keeps consistent withthat of a higher priority.



LACP Port ID

Each port has an independent LACP port priority, which is a configurable value. The port ID consists of the LACP port
priority and port number. A smaller port priority indicates a higher priority of the port ID. If the port priorities are the same,a smaller port number indicates a higher priority of the port ID.



LACP Master Port

When dynamic member ports are Up, LACP selects one of those ports to be the master port based on the rates andduplex modes, ID priorities of the ports in the aggregation group, and the bundling state of the member ports in the Upstate. Only the ports that have the same attributes as the master port are in Bundle state and participate in data
forwarding. When the attributes of ports are changed, LACP reselects a master port. When the new master port is not in
Bundle state, LACP disaggregates the member ports and performs aggregation again.

Overview
Overview

Description

Link Aggregation

Aggregates physical links statically or dynamically to realize bandwidth extension and link backup.

Load Balancing

Balances the load within an aggregation group flexibly by using different load balancing methods.

3-3Configuration Guide

Configuring Aggregated Port

3.3.1 Link Aggregation
Working Principle
There are two kinds of AP link aggregation. One is static AP, and the other is dynamic aggregation through LACP.



Static AP

The static AP configuration is simple. Run a command to add the specified physical port to the AP port. After joining theaggregation group, a member port can receive and transmit data and participate in load balancing within the group.



Dynamic AP (LACP)An LACP-enabled port sends LACPDUs to advertise its system priority, system MAC address, port priority, port number,and operation key. When receiving the LACPDU from the peer end, the device compares the system priorities of bothends based on the system ID in the packet. The end with a higher system ID priority sets the ports in the aggregationgroup to Bundle state based on the port ID priorities in a descending order, and sends an updated LACPDU. When
receiving the LACPDU, the peer end sets corresponding ports to Bundle state so that both ends maintain consistency
when a port exits or joins the aggregation group. The physical link can forward packets only after the ports at both ends
are bundled dynamically.
After link aggregation, the LACP member ports periodically exchange LACPDUs. When a port does not receive an
LACPDU in the specified time, a timeout occurs and the links are unbundled. In this case, the member ports cannot
forward packets. There are two timeout modes: long timeout and short timeout. In long timeout mode, a port sends apacket every 30s. If it does not receive a packet from the peer end in 90s, a timeout occurs. In short timeout mode, aport sends a packet every 1s. If it does not receive a packet from the peer end in 3s, a timeout occurs.
Figure 3-2 LACP Negotiation

In Figure 3-2, Switch A is connected to Switch B through three ports. Set the system priorities of Switch A and Switch B
to 61440 and 4096 respectively. Enable LACP on the Ports 1–6, set the aggregation mode to the active mode, and set
the port priority to the default value 32768.
When receiving an LACPDU from Switch A, Switch B finds that it has a higher system ID priority than Switch A (thesystem priority of Switch B is higher than that of Switch A). Switch B sets Port 4, Port 5, and Port 6 to Bundle statebased on the order of port ID priorities (or in an ascending order of port numbers if the port priorities are the same).
When receiving an updated LACPDU from Switch B, Switch A finds that Switch B has a higher system ID priority andhas set Port 4, Port 5, and Port 6 to Bundle state. Then Switch A also sets Port 1, Port 2, and Port 3 to Bundle state.

3.3.2 Load Balancing
Working Principle
AP ports segregate packet flows by using load balancing algorithms based on packet features, such as the source anddestination MAC addresses, source and destination IP addresses, and Layer-4 source and destination port numbers.
3-4

Configuration Guide

Configuring Aggregated Port

The packet flow with the consistent feature is transmitted by one member link, and different packet flows are evenly
distributed to member links. For example, in source MAC address-based load balancing, packets are distributed to themember links based on the source MAC addresses of the packets. Packets with different source MAC addresses areevenly distributed to member links. Packets with the identical source MAC address are forwarded by one member link.
Currently, there are several AP load balancing modes as follows:

Source MAC address or destination MAC addressSource MAC address + destination MAC addressSource IP address or destination IP addressSource IP address + destination IP address

Layer-4 source port number or Layer-4 destination port number

Layer-4 source port number + Layer-4 destination port numberPanel port for incoming packets
Load balancing based on IP addresses or port numbers is applicable only to Layer-3 packets. When a device
enabled with this load balancing method receives Layer-2 packets, it automatically switches to the default loadbalancing method.
All the load balancing methods use a load algorithm to calculate the member links based on the input parametersof the methods. The input parameters include the source MAC address, destination MAC address, source MAC
address + destination MAC address, source IP address, destination IP address, source IP address + destination
IP addresses, source IP address + destination IP address + Layer-4 port number and so on. The algorithm
ensures that packets with different input parameters are evenly distributed to member links. It does not indicatethat these packets are always distributed to different member links. For example, in IP address-based loadbalancing, two packets with different source and destination IP addresses may be distributed to the same member
link through calculation.
Different products may support different load balancing algorithms.

3.4 Configuration
Configuration

Description and Command(Mandatory) It is used to configure link aggregation manually.

Configuring Static AP Ports

interface aggregateportCreates an Ethernet AP port.

port-group

Configures static AP member ports.

(Mandatory) It is used to configure link aggregation dynamically.
Configuring LACP AP Ports

Enabling LinkTrap

port-group mode

Configures LACP member ports.

lacp system-priority

Configures the LACP system priority.

lacp port-priority

Configures the port priority.

lacp short-timeout

Configures the short timeout mode on a port.

(Optional) It is used to enable LinkTrap.
Enables LinkTrap advertisement for an AP port.

snmp trap link-status

3-5

Configuration Guide
Configuration

Configuring Aggregated Port
Description and Commandaggregateport member linktrap

Enables LinkTrap t for AP member ports.

(Optional) It is used to configure a load balancing mode for an aggregated link.
Configuring a Load Balancing
Modeaggregateport load-balance

Configures a load balancing algorithm for an
AP port or AP member ports.

3.4.1 Configuring Static AP Ports
Configuration EffectConfigure multiple physical ports as AP member ports to realize link aggregation.

The bandwidth of the aggregation link is equal to the sum of the member link bandwidths.

When a member link of the AP port is disconnected, the load carried by the link is automatically allocated to otherfunctional member links.

Notes


Only physical ports can be added to an AP port.



The feature is not supported by G.hn ports.

The ports of different media types or port modes cannot be added to the same AP port.



Layer-2 ports can be added to only a Layer-2 AP port, and Layer-3 ports can be added to only a Layer-3 AP port.
The Layer-2/3 attributes of an AP port that contains member ports cannot be modified.

After a port is added to an AP port, the attributes of the port are replaced by those of the AP port.



After a port is removed from an AP port, the attributes of the port are restored.
After a port is added to an AP port, the attributes of the port are consistent with those of the AP port. Therefore, do
not perform configuration on the AP member ports or apply configuration to a specific AP member port. However,some configurations (the shutdown and no shutdown commands) can be configured on AP member ports.
When you use AP member ports, check whether the function that you want to configure can take effect on a
specific AP member port, and perform this configuration properly.

Configuration Steps

Creating an Ethernet AP Port

Mandatory.



Perform this configuration on an AP-enabled device.

Commandinterface aggregateport ap-number

Parameter

ap-number: Indicates the number of an AP port.

Description
Defaults

By default, no AP port is created.

Command

Global configuration mode

Mode

3-6

Configuration Guide
Usage Guide

Configuring Aggregated PortTo create an Ethernet AP port, run interface aggregateport in global configuration mode. To delete thespecified Ethernet AP port, run no interface aggregateport ap-number in global configuration mode.

Run port-group to add a physical port to a static AP port in interface configuration mode. If the AP port does notexist, it will be created automatically.
Run port-group mode to add a physical port to an LACP AP port in interface configuration mode. If the AP port
does not exist, it will be created automatically.
The AP feature must be configured on the devices at both ends of a link and the AP mode must be the same(static AP or LACP AP).



Configuring Static AP Member Ports

Mandatory.



Perform this configuration on AP-enabled devices.

Commandport-group ap-number

Parameter

port-group ap-number: Indicates the number of an AP port.

Description
Defaults

By default, no ports are added to any static AP port.

Command Mode

Interface configuration mode of the specified Ethernet port

Usage Guide

To add member ports to an AP port, run port-group in interface configuration mode. To remove
member ports from an AP port, run no port-group in interface configuration mode.
The feature is not supported by G.hn ports.

The static AP member ports configured on the devices at both ends of a link must be consistent.
After a member port exits the AP port, the default settings of the member port are restored. Different functions deal
with the default settings of the member ports differently. It is recommended that you check and confirm the portsettings after a member port exits an AP port.
After a member port exits an AP port, the port is disabled by using the shutdown command to avoid loops. Afteryou confirm that the topology is normal, run no shutdown in interface configuration mode to enable the port
again.

Converting Layer-2 APs to Layer-3 APs

Optional.

When you need to enable Layer-3 routing on an AP port, for example, to configure IP addresses or static route
entries, convert the Layer-2 AP port to a Layer-3 AP port and enable routing on the Layer-3 AP port.



Perform this configuration on AP-enabled devices that support Layer-2 features.
The AP port created on a Layer-3 device that does not support Layer-2 feature is a Layer-3 AP port. Otherwise,
the AP port is a Layer-2 AP port.

Verification
Run show running to display the configuration.

Run show aggregateport summary to display the AP configuration.

Commandshow aggregateport { [ aggregate-port-number ] summary | load-balance }3-7

Configuration Guide

Configuring Aggregated Port

Parameteraggregate-port-number: Indicates the number of an AP port.

Description

summary: Displays the summary of each link.
load-balance: Displays the load balancing algorithm.

Command ModeAny mode

Usage Guide

The information on all AP ports is displayed if you do not specify the AP port number.
Ruijie# show aggregateport 1 summary
AggregatePort MaxPorts SwitchPort Mode

Ports------------- -------- ---------- ------ ----------------------------------Ag1

8

EnabledACCESS Gi0/17

Configuration
Example

Configuring an Ethernet Static AP Port

Scenario
Figure 3-3

Configuratio

Add the GigabitEthernet 0/17 and GigabitEthernet 0/18 ports on Switch A to static AP port 3.

n Steps

Add the GigabitEthernet 0/17 and GigabitEthernet 0/18 ports on Switch B to static AP port 3.

Switch A

SwitchA# configure terminal
SwitchA(config)# interface range GigabitEthernet 0/17-18
SwitchA(config-if-range)# port-group 3

Switch B

SwitchB# configure terminal
SwitchB(config)# interface range GigabitEthernet 0/17-18
SwitchB(config-if-range)# port-group 3

Verification

Run show aggregateport summary to check whether AP port 3 contains member ports
GigabitEthernet 0/17 and GigabitEthernet 0/18.

Switch A

SwitchA# show aggregateport summary
AggregatePort MaxPorts SwitchPort Mode

Ports------------- -------- ---------- ------ ----------------------------------Ag1
Switch B

8

EnabledACCESS Gi0/17,Gi0/18

SwitchB# show aggregateport summary
AggregatePort MaxPorts SwitchPort Mode

Ports------------- -------- ---------- ------ ----------------------------------Ag1

8

EnabledACCESS Gi0/17,Gi0/18

3.4.2 Configuring LACP AP Ports
Configuration Effect

3-8

Configuration Guide

Configuring Aggregated Port

Connected devices perform auto negotiation through LACP to realize dynamic link aggregation.

The bandwidth of the aggregation link is equal to the sum of the member link bandwidths.

When a member link of the AP port is disconnected, the load carried by the link is automatically allocated to otherfunctional member links.

It takes LACP 90s to detect a link failure in long timeout mode and 3s in short timeout mode.

Notes


After a port exits an LACP AP port, the default settings of the port may be restored. Different functions deal withthe default settings of the member ports differently. It is recommended that you check and confirm the port settings
after a member port exits an LACP AP port.

Changing the LACP system priority may cause LACP member ports to be disaggregated and aggregated again.

Changing the priority of an LACP member port may cause the other member ports to be disaggregated andaggregated again.

Configuration Steps

Configuring LACP Member Ports

Mandatory.



Perform this configuration on LACP-enabled devices.

Commandport-group key-number mode { active | passive }Parameter

Key-number: Indicates the management key of an AP port. In other words, it is the LACP AP port

Description

number. The maximum value is subject to the number of AP ports supported by the device.
active: Indicates that ports are added to a dynamic AP port actively.
passive: Indicates that ports are added to a dynamic AP port passively.

Defaults

By default, no physical ports are added to any LACP AP port.

Command

Interface configuration mode of the specified physical port

Mode
Usage Guide

Use this command in interface configuration mode to add member ports to an LACP AP port.
The feature is not supported by G.hn ports.

The LACP member port configuration at both ends of a link must be consistent.

Configuring the LACP System Priority



Optional.

Perform this configuration when you need to adjust the system ID priority. A smaller value indicates a higher
system ID priority. The device with a higher system ID priority selects an AP port.



Perform this configuration on LACP-enabled devices.

Commandlacp system-priority system-priority

Parameter

system-priority: Indicates the LACP system priority. The value ranges from 0 to 65535.

Description
Defaults

By default, the LACP system priority is 32768.

Command

Global configuration mode

3-9Configuration Guide

Configuring Aggregated Port

Mode
Usage Guide

Use this command in global configuration mode to configure the LACP system priority. All the dynamic
member links share one LACP system priority. Changing the LACP system priority will affect all member
links. To restore the default settings, run no lacp system-priority in interface configuration mode.

Configuring the Priority of an LACP Member Port

Optional.

Perform this configuration when you need to specify the port ID priority. A smaller value indicates a higher port ID
priority. The port with the highest port ID priority will be selected as the master port.



Perform this configuration on LACP-enabled devices.

Commandlacp port-priority port-priority

Parameter

port-priority: Indicates the priority of an LACP member port. The value ranges from 0 to 65535.

Description
Defaults

By default, the priority of an LACP member port is 32768.

Command

Interface configuration mode of the specified physical port

Mode
Usage Guide

Use this command in global configuration mode to configure the priority of an LACP member port. To
restore the settings, run no lacp port-priority in interface configuration mode.

Configuring the Timeout Mode of LACP Member Ports

Optional.

When you need to implement real-time link failure detection, configure the short timeout mode. It takes LACP 90s
to detect a link failure in long timeout mode and 3s in short timeout mode.

Perform this configuration on LACP-enabled devices, such as switches.

Commandlacp short-timeout

Parameter

N/A

Description
Defaults

By default, the timeout mode of LACP member ports is long timeout.

Command

Interface configuration mode

Mode
Usage Guide

The timeout mode is supported only by physical ports.
To restore the default settings, run no lacp short-timeout in interface configuration mode.

Verification
Run show running to display the configuration.

Run show lacp summary to display LACP link state.

Commandshow lacp summary [ key-number ]Parameter

key-name: Indicates the number of an LACP AP port.

Description
CommandAny mode

Mode

3-10

Configuration Guide
Usage Guide

Configuring Aggregated Port

The information on all LACP AP ports is displayed if you do not specify key-name.
Ruijie(config)# show lacp summary 3
System Id:32768, 00d0.f8fb.0002
Flags:

S - Device is requesting Slow LACPDUs

F - Device is requesting Fast LACPDUs.
A - Device is in active mode.

P - Device is in passive mode.

Aggregated port 3:
Local information:
LACP port
Port

Flags

State

Oper

Priority

Port

Key

Port

Number State------------------------------------------------------------------Gi0/17

SA

bndl

4096

0x3

0x1

0x3d

Gi0/18

SA

bndl

4096

0x3

0x2

0x3d

Port

Port

Partner information:
LACP port
Port

Flags

PriorityOper
Dev ID

Key

NumberState-------------------------------------------------------------------Gi0/17

SA

61440

00d0.f800.0001

0x3

0x1

0x3d

Gi0/18SA

61440

00d0.f800.0001

0x3

0x2

0x3d

Configuration
Example

Configuring LACP

Scenario
Figure 3-4

Configuratio

On Switch A, set the LACP system priority to 4096.

n Steps

Enable dynamic link aggregation on the GigabitEthernet0/17 and GigabitEthernet0/18 ports on
Switch A and add the ports to LACP AP port 3.



On Switch B, set the LACP system priority to 61440.

Enable dynamic link aggregation on the GigabitEthernet0/17 and GigabitEthernet0/18 ports on
Switch B and add the ports to LACP AP port 3.

Switch A

SwitchA# configure terminal
SwitchA(config)# lacp system-priority 4096
SwitchA(config)# interface range GigabitEthernet 0/17-18
SwitchA(config-if-range)# port-group 3 mode active
SwitchA(config-if-range)# end

Switch B

SwitchB# configure terminal

3-11Configuration Guide

Configuring Aggregated Port

SwitchB(config)# lacp system-priority 61440
SwitchB(config)# interface range GigabitEthernet 0/17-18
SwitchB(config-if-range)# port-group 3 mode active
SwitchB(config-if-range)# end

Verification

Run show lacp summary 3 to check whether LACP AP port 3 contains member ports
GigabitEthernet0/17 and GigabitEthernet0/18.

Switch A

SwitchA# show LACP summary 3
System Id:32768, 00d0.f8fb.0001
Flags:

S - Device is requesting Slow LACPDUs

F - Device is requesting Fast LACPDUs.
A - Device is in active mode.

P - Device is in passive mode.

Aggregated port 3:
Local information:
LACP port
Port

Flags

State

Oper

Priority

Port

Key

Port

NumberState--------------------------------------------------------------------Gi0/17

SA

bndl

32768

0x3

0x1

0x3d

Gi0/18

SA

bndl

32768

0x3

0x2

0x3d

Partner information:
LACP port
Port

Flags

Oper

Priority

Dev ID

Key

Port

Port

NumberState--------------------------------------------------------------------

Switch B

Gi0/17

SA32768

00d0.f800.0002

0x3

0x1

0x3d

Gi0/18SA

32768

00d0.f800.0002

0x3

0x2

0x3d

SwitchB# show LACP summary 3
System Id:32768, 00d0.f8fb.0002
Flags:

S - Device is requesting Slow LACPDUs

F - Device is requesting Fast LACPDUs.
A - Device is in active mode.

P - Device is in passive mode.

Aggregated port 3:
Local information:
LACP port
Port

Oper

Flags

Port

State

Port
PriorityKey

NumberState--------------------------------------------------------------------Gi0/17

SA

bndl

32768

0x3

0x1

0x3d

Gi0/18

SA

bndl

32768

0x3

0x2

0x3d

Oper

Port

Port

Key

NumberState

Partner information:
LACP port
Port

Flags

Priority

Dev ID-------------------------------------------------------------------Gi0/17

SA

32768

00d0.f800.0001

0x3

0x1

0x3d

Gi0/18SA

32768

00d0.f800.0001

0x3

0x2

0x3d

3-12

Configuration Guide

Configuring Aggregated Port

3.4.3 Enabling LinkTrap
Configuration EffectEnable the system with LinkTrap to send LinkTrap messages when aggregation links are changed.

Configuration Steps

Enabling LinkTrap for an AP Port

Optional.

Enable LinkTrap in interface configuration mode. By default, LinkTrap is enabled. LinkTrap messages are sent
when the link state or protocol state of the AP port is changed.

Perform this configuration on AP-enabled devices.

Commandsnmp trap link-status

Parameter

N/A

Description
Defaults

By default, LinkTrap is enabled.

Command

Interface configuration mode of the specified AP port

Mode
Usage Guide

Use this command in interface configuration mode to enable LinkTrap for the specified AP port. After
LinkTrap is enabled, LinkTrap messages are sent when the link state of the AP port is changed.
Otherwise, LinkTrap messages are not sent. By default, LinkTrap is enabled. To disable LinkTrap for an
AP port, run no snmp trap link-status in interface configuration mode.
LinkTrap cannot be enabled for a specific AP member port. To enable LinkTrap for all AP member ports,
run aggregateport member linktrap in global configuration mode.

Enabling LinkTrap for AP Member Ports

Optional.



By default, LinkTrap is disabled for AP member ports.

Perform this configuration on AP-enabled devices.

Commandaggregateport member linktrap

Parameter

N/A

Description
Defaults

By default, LinkTrap is disabled for AP member ports.

Command

Global configuration mode

Mode
Usage Guide

Use this command in global configuration mode to enable LinkTrap for all AP member ports. By default,
LinkTrap messages are not sent when the link state of AP member ports is changed. To disable
LinkTrap for all AP member ports, run no aggregateport member linktrap in global configuration mode.

Verification
Run show running to display the configuration.

3-13

Configuration GuideConfiguring Aggregated Port

After LinkTrap is enabled, you can monitor this feature on AP ports or their member ports by using the MIB
software.

Configuration
Example

Enabling LinkTrap for AP Member Ports

Scenario
Figure 3-5

Configuratio

Add the GigabitEthernet 0/17 and GigabitEthernet 0/18 ports on Switch A to static AP port 3.

n Steps

Add the GigabitEthernet 0/17 and GigabitEthernet 0/18 ports on Switch B to static AP port 3.



On Switch A, disable LinkTrap for AP port 3 and enable LinkTrap for its member ports.

On Switch B, disable LinkTrap for AP port 3 and enable LinkTrap its AP member ports.

Switch A

SwitchA# configure terminal
SwitchA(config)# interface range GigabitEthernet 0/17-18
SwitchA(config-if-range)# port-group 3
SwitchA(config-if-range)# exit
SwitchA(config)# aggregateport member linktrap
SwitchA(config)# interface Aggregateport 3
SwitchA(config-if-AggregatePort 3)# no snmp trap link-status

Switch B

SwitchB# configure terminal
SwitchB(config)# interface range GigabitEthernet 0/17-18
SwitchB(config-if-range)# port-group 3
SwitchB(config-if-range)# exit
SwitchB(config)# aggregateport member linktrap
SwitchB(config)# interface Aggregateport 3
SwitchB(config-if-AggregatePort 3)# no snmp trap link-status

Verification

Switch A

SwitchA# show run interface AggregatePort 3

Run show running to check whether LinkTrap is enabled for AP port 3 and its member ports.

interface AggregatePort 3
no snmp trap link-status
SwitchA# show run | include AggregatePort
aggregateport member linktrap
Switch B

SwitchB# show run interface AggregatePort 3
interface AggregatePort 3

3-14

Configuration Guide

Configuring Aggregated Portno snmp trap link-status
SwitchB# show run | include AggregatePort
aggregateport member linktrap

3.4.4 Configuring a Load Balancing Mode
Configuration Effect
The system distributes incoming packets among member links by using the specified load balancing algorithm. The
packet flow with the consistent feature is transmitted by one member link, whereas different packet flows are evenly
distributed to various links. A device enabled with enhanced load balancing first determines the type of packets to betransmitted and performs load balancing based on the specified fields in the packets. For example, the AP port
performs source IP-based load balancing on the packets containing an ever-changing source IPv4 address.

Notes
N/A

Configuration Steps

Configuring the Global Load Balancing Algorithm of an AP port(Optional) Perform this configuration when you need to optimize load balancing.

Perform this configuration on AP-enabled devices.

Commandaggregateport load-balance { dst-mac | src-mac | src-dst-mac | dst-ip | src-ip | src-dst-ip |dst-l4port | src-dst-l4port | src-l4port | src-port }Parameter

dst-mac: Load balance based on the destination MAC addresses of incoming packets.

Description

src-mac: Load balance based on the source MAC addresses of incoming packets.
src-dst-ip: Load balance based on source and destination IP addresses of incoming packets.
dst-ip: Load balance based on the destination IP addresses of incoming packets.
src-ip: Load balance based on the source IP addresses of incoming packets.
src-dst-mac: Load balance based on source and destination MAC addresses of incoming packets.
dst-l4port: Load balance based on the L4 destination port number.
src-dst-l4port: Load balance based on Layer-4 source and destination port numbers.
src-l4port: Load balance based on the L4 source port number.
src-port: Load balance based on the source port.

Defaults

Load balancing can be based on source and destination MAC addresses, source and destination IP
addresses (applicable to gateways), or the profile of enhanced load balancing (applicable to switcheswith CB line cards).

Command

Global configuration mode

Mode
Usage Guide

To restore the default settings, run no aggregateport load-balance in global configuration mode.
The feature is not supported by G.hn ports.

Verification
Run show running to display the configuration.

3-15

Configuration GuideConfiguring Aggregated PortRun show aggregateport load-balance to display the load balancing configuration. If a device supports loadbalancing configuration on a specific AP port, run show aggregateport summary to display the configuration.

Commandshow aggregateport { [ aggregate-port-number ] summary | load-balance }Parameteraggregate-port-number: Indicates the number of an AP port.

Description

summary: Displays the summary of each link.
load-balance: Displays the load balancing algorithm.

CommandAny mode

Mode
Usage Guide

The information on All AP ports is displayed if you do not specify the AP port number.
Ruijie# show aggregateport 1 summary
AggregatePort MaxPorts SwitchPort Mode

Ports------------- -------- ---------- ------ ----------------------------------Ag1

8

EnabledACCESS Gi0/17

Configuration
Example

Configuring a Load Balancing Mode

Scenario
Figure 3-6

Configuratio

Add the GigabitEthernet 0/17 and GigabitEthernet 0/18 ports on Switch A to static AP port 3.

n Steps

Add the GigabitEthernet 0/17 and GigabitEthernet 0/18 ports on Switch B to static AP port 3.



On Switch A, configure source MAC address-based load balancing for AP port 3 in global
configuration mode.

On Switch B, configure destination MAC address-based load balancing for AP port 3 in global
configuration mode.

Switch A

SwitchA# configure terminal
SwitchA(config)# interface range GigabitEthernet 0/17-18
SwitchA(config-if-range)# port-group 3
SwitchA(config-if-range)# exit
SwitchA(config)# aggregateport load-balance src-mac

Switch B

SwitchB# configure terminal
SwitchB(config)# interface range GigabitEthernet 0/17-18
SwitchB(config-if-range)# port-group 3
SwitchB(config-if-range)# exit
SwitchB(config)# aggregateport load-balance dst-mac

3-16

Configuration Guide

Configuring Aggregated Port

Verification

Switch A

SwitchA# show aggregatePort load-balance

Run show aggregateport load-balance to check the load balancing algorithm configuration.

Load-balance
Switch B

SwitchB# show aggregatePort load-balance
Load-balance: Source MAC: Destination MAC

Configuring Hash Load Balancing Control

Common Errors

3.5 Monitoring
Displaying
Description

Command

Displays the LACP aggregation state. Youshow lacp summary [ key-numebr ]can display the information on a specified
LACP AP port by specifying key-number.
Displays the summary or load balancing

show aggregateport { [ aggregate-port-number ] summary |algorithm of an AP port.

load-balance }Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs an AP port.

debug lsm ap

Debugs LACP.

debug lacp { cli | packet | event | ha | realtime | stm | timer | all }3-17

Configuration Guide

Configuring VLAN

4 Configuring VLAN
4.1 Overview
A Virtual Local Area Network (VLAN) is a logical network created based on a physical network. A VLAN can be
categorized into Layer-2 networks of the OSI model.
A VLAN has the same properties as a common LAN, except for physical location limitation. Unicast, broadcast andmulticast frames of Layer 2 are forwarded and transmitted within a VLAN, keeping traffic segregated.
We may define a port as a member of a VLAN, and all terminals connected to this port are parts of a virtual network that
supports multiple VLANs. You do not need to adjust the network physically when adding, removing and modifying users.
Communication among VLANs is realized through Layer-3 devices, as shown in the following figure.
Figure 4-1

Protocols andStandards
IEEE 802.1Q: Virtual Bridged Local Area Networks and Standards

4.2 Applications
Application

Description

Isolating VLANs at Layer 2 andAn intranet is divided into multiple VLANs, realizing Layer-2 isolation and Layer-3

Interconnecting VLANs at Layer 3

interconnection with each other through IP forwarding by core switches.

4-1

Configuration Guide

Configuring VLAN

4.2.1 Isolating VLANs at Layer 2 and Interconnecting VLANs at Layer 3
Scenario
An intranet is divided into VLAN 10, VLAN 20 and VLAN 30, realizing Layer-2 isolation from each other. The three
VLANs correspond respectively to the IP sub-networks 192.168.10.0/24, 192.168.20.0/24, and 192.168.30.0/24,
realizing interconnection with each other through IP forwarding by Layer-3 core switches.
Figure 4-2

Remarks:

Switch A, Switch B are access switches.
Configure three VLANs on a core switch and the port connected to the access switches as a Trunk port, andspecify a list of allowed-VLANs to realize Layer-2 isolation;
Configure three SVIs on the core switch, which are the gateway interfaces of the IP sub-networks
corresponding to the three VLANs, and configure the IP addresses for these interfaces.
Create VLANs respectively on the three access switches, assign Access ports for the VLANs, and specify
Trunk ports of the core switch.

Deployment
Divide an intranet into multiple VLANs to realize Layer-2 isolation among them.

4-2

Configuration Guide

Configuring VLAN

4.3 Features
Basic Concepts



VLAN

A VLAN is a logical network created based on a physical network. A VLAN has the same properties as a common LAN,
except for physical location limitation. Unicast, broadcast and multicast frames of Layer 2 are forwarded and transmitted
within a VLAN, keeping traffic segregated.
The VLANs supported by Ruijie products comply with the IEEE802.1Q standard. A maximum of 4094 VLANs(VLAN ID 1-4094) are supported, among which VLAN 1 cannot be deleted.
The configurable VLAN IDs are from 1 to 4094.
In case of insufficient hardware resources, the system returns information on VLAN creation failure.

Port Mode

You can determine the frames allowed to pass a port and the VLANs which the port belongs to by configuring the port
mode. See the following table for details.
Port Mode

Description

Access port

An Access port belongs to only one VLAN, which is specified manually.
A Trunk port belongs to all the VLANs of an access switch by default, and it canTrunk port (802.1Q)

forward the frames of all the VLANs or the frames of allowed-VLANs.

Overview
FeatureDescription

VLAN

VLAN helps realize Layer-2 isolation.

4.3.1 VLAN
Every VLAN has an independent broadcast domain, and different VLANs are isolated on Layer 2.

Working Principle
Every VLAN has an independent broadcast domain, and different VLANs are isolated on Layer 2.
Layer-2 isolation: If no SVIs are configured for VLANs, VLANs are isolated on Layer 2. This means users in these
VLANs cannot communicate with each other.
Layer-3 interconnection: If SVIs are configured on a Layer-3 switch for VLANs, these VLANs can communicate witheach other on Layer 3.

4.4 Configuration
Configuration
Configuring Basic VLAN

Description and Command(Mandatory) It is used to create a VLAN.

4-3

Configuration Guide
Configuration

Configuring VLAN
Description and Command
vlan { vlan-id | range vlan-range }Enters a VLAN ID.

(Optional) It is used to rename a VLAN.
name vlan-name

Names a VLAN.

interface vlan vlan-id

Creates a SVI (Switch Virtual Interface)(Optional) It is used to configure an Access port to transmit the flows from a single
VLAN.
Configuring an Accessswitchport mode accessDefines a port as a Layer-2 Access port.

port

switchport access vlan vlan-id

Assigns a port to a VLAN.

add interface { interface-type
interface-number | range interface-type
interface-range }Adds one Access port or a group of such ports
to the current VLAN.

(Mandatory) It is used to configure the port as a Trunk port.
Defines a port as a Layer-2 Trunk port.

switchport mode trunk(Optional) It is used to configure Trunk ports to transmit flows from multiple VLANs.
Configuring a Trunk Portswitchport trunk native vlan vlan-id

Specifies a native VLAN for a Trunk port.

switchport trunk allowed vlan { all |add vlan-list | remove vlan-list | except

Configures allowed-VLANs for a Trunk port.

vlan-list | only vlan-list }switchport trunk accept-frame-type

Configuring tag-only, Only tagged packets are

tag-only

allowed4.4.1 Configuring Basic VLAN
Configuration Effect

A VLAN is identified by a VLAN ID. You may add, delete, modify VLANs 2 to 4094, but VLAN 1 is createdautomatically and cannot be deleted.

Configuration Steps

Creating and Modifying a VLAN



Mandatory.

In case of insufficient hardware resources, the system returns information on VLAN creation failure.



Use the vlan vlan-id command to create a VLAN or enter VLAN mode.

Configuration:

Commandvlan { vlan-id | range vlan-range }Parametervlan-id : Configures a VLAN ID ranging from 1 to 4094.

Description

range vlan-range: Configures the VLAN range.

Defaults

VLAN 1 is created automatically and is not deletable.

Command

Global configuration mode

4-4

Configuration Guide

Configuring VLAN

Mode
Usage Guide

If you enter a new VLAN ID, the corresponding VLAN will be created. If you enter an existing VLAN ID, thecorresponding VLAN will be modified. You may use the no vlan vlan-id command to delete a VLAN. The
undeletable VLANs include VLAN1, the VLANs configured with SVIs, and SubVLANs.



Renaming a VLAN



Optional.

You cannot rename a VLAN the same as the default name of another VLAN.



Configuration:

Commandname vlan-nameParametervlan-name: indicates a VLAN name.

Description
Defaults

By default, the name of a VLAN is its VLAN ID. For example, the default name of the VLAN 4 is VLAN 0004.

Command

VLAN configuration mode

Mode
Usage Guide

To restore the VLAN name to defaults, use the no name command.

Configuring a Virtual Interface for a VLAN



Optional.



Use this command to creat a SVI (Switch Virtual Interface) and enter the SVI configuration mode.

CommandParameterinterface vlan vlan-id
vlan-id: Configures a VLAN ID.

Description
Defaults
Command

By default, no SVI is configured.
Global configuration mode

Mode
Usage Guide-

Verification


Use the show vlan command to check whether the configuration takes effect.

Commandshow vlan [ id vlan-id ]Parametervlan-id: Configures a VLAN ID.

Description
CommandAny mode

Mode
Usage Guide

N/A

Command

Ruijie(config-vlan)#show vlan id 20

Display

VLAN Name

StatusPorts---- -------------------------------- --------- ----------------------------------20 VLAN0020

STATIC

4-5

Gi0/17

Configuration Guide

Configuring VLAN

Configuration
Example

Configuring Basic VLAN and Access Port

Configuratio

Create a VLAN and rename it.

n StepsRuijie# configure terminal
Ruijie(config)# vlan 888
Ruijie(config-vlan)# name test888
Verification

Check whether the configuration is correct.
Ruijie(config-vlan)#show vlan
VLAN Name

StatusPorts---- -------------------------------- --------- ----------------------------------1 VLAN0001

STATIC

888 test888

STATIC

4.4.2 Configuring an Access port
Configuration Effect

You may configure the port mode and add or remove a VLAN.

Configuration Steps

Configuring an Access Port

Mandatory.



Use the switchport mode access command to specify Layer-2 ports (switch ports) as Access ports.

Configuration:

Commandswitchport mode access

Parameter

N/A

Description
Defaults

A switch port is an Access port by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

Assigning Current Access port to a Specified VLAN



Mandatory.



Use the switchport access vlan vlan-id command to add an Access port to a specific VLAN so that the flows
from the VLAN can be transmitted through the port.



Configuration:

Commandswitchport access vlan vlan-id

Parametervlan-id: indicates a VLAN ID.

4-6

Configuration Guide

Configuring VLAN

Description
Defaults

An Access port is added to VLAN 1 by default.

Command

Interface configuration mode

Mode
If a port is assigned to a non-existent VLAN, the VLAN will be created automatically.

Usage Guide

Adding an Access Port to Current VLAN



Optional.

This command takes effect only on an Access port. After an Access port is added to a VLAN, the flows of the
VLAN can be transmitted through the port.



Configuration:

Command

add interface { interface-type interface-number | range interface-type interface-range }Parameterinterface-type interface-number: indicates a single port.

Description

interface-type interface-range : indicates multiple ports.

Defaults

By default, all Layer-2 Ethernet ports belong to VLAN 1.

Command

VLAN configuration modeMode
In VLAN configuration mode, add a specific Access port to a VLAN. This command takes the same effect as

Usage Guide

command switchport access vlan vlan-id.
For the two commands of adding a port to a VLAN, the command configured later will overwrite the other one.

Verification
Send untagged packets to an Access port, and they are broadcast within the VLAN.



Use the show vlan command and the show interface switchport command to check whether the configuration
takes effect.

Commandshow vlan [ id vlan-id ]Parametervlan-id : indicates a VLAN ID.

Description
CommandAny mode

Mode
Usage Guide

N/A

Command

Ruijie(config-vlan)#show vlan id 20

Display

VLAN Name

StatusPorts---- -------------------------------- --------- ----------------------------------20 VLAN0020

STATIC

Gi0/17

Configuration
Example

Configuring Basic VLAN and Access Port

Configuratio

Add an Access port to the VLAN. There are two approaches.

n Steps

4-7

Configuration Guide

Configuring VLAN

One is:Ruijie# configure terminal
Ruijie(config)# interface GigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport mode accessRuijie(config-if-GigabitEthernet 0/17)# switchport access vlan 20
The other approach is adding an Access port (GigabitEthernet 0/17) to VLAN20:
Ruijie# configure terminal
Ruijie(config)#vlan 20
Ruijie(config-vlan)#add interface GigabitEthernet 0/17
Verification

Check whether the configuration is correct.
Ruijie(config-vlan)#show vlan
VLAN Name

StatusPorts---- -------------------------------- --------- ----------------------------------1 VLAN0001

STATIC

20 VLAN0020

STATIC

Gi0/17

Ruijie(config-vlan)#
Ruijie# show interface GigabitEthernet 0/17 switchport
Interface

Switchport Mode

Access Native Protected VLAN lists-------------------------------- ---------- --------- ------ ------ --------- -------------GigabitEthernet 0/17

enabledACCESS

20

1

Disabled ALL

4.4.3 Configuring a Trunk Port
Configuration Effect
A Trunk is a point-to-point link connecting one Ethernet interface or multiple ones to other network devices (for example,
a router or switch) and it may transmit the flows from multiple VLANs.
The Trunk of Ruije devices adopts the 802.1Q encapsulation standard. The following figure displays a network adoptinga Trunk connection.
Figure 4-3

You may configure an Ethernet port or Aggregate Port (See Configuring Aggregate Port for details) as a Trunk port.

4-8

Configuration Guide

Configuring VLAN

You should specify a native VLAN for a Trunk port. The untagged packets received by and sent from the Trunk port areconsidered to belong to the native VLAN. The default VLAN ID (PVID in the IEEE 802.1Q) of this Trunk port is thenative VLAN ID. Meanwhile, frames of the native VLAN sent via the Trunk are untagged. The default native VLAN of a
Trunk port is VLAN 1.
When configuring a Trunk link, make sure the Trunk ports at the two ends of the link adopt the same native VLAN.

Configuration Steps

Configuring a Trunk Port

Mandatory.

Configure a Trunk port to transmit the flows from multiple VLANs.



Configuration:

Commandswitchport mode trunk

Parameter

N/A

Description
Defaults

The default mode is Access, which can be modified to Trunk.

Command

Interface configuration mode

Mode
Usage Guide

To restore all properties of a Trunk port to defaults, use the no switchport mode command.

Configuring a Native VLAN



Optional.

A Trunk port receives and sends tagged or untagged 802.1Q frames. Untagged frames transmit the flows from thenative VLAN. The default native VLAN is VLAN 1.



If a frame carries the VLAN ID of a native VLAN, its tag will be stripped automatically when it passes a Trunk port.



Configuration:

Commandswitchport trunk native vlan vlan-id

Parametervlan-id: indicates a VLAN ID.

Description
Defaults

The default VALN for a Trunk/Uplink port is VLAN 1.

Command

Interface configuration mode

Mode
Usage Guide

To restore the native VLAN of a Trunk port back to defaults, use the no switchport trunk native vlancommand.

When you set the native VLAN of a port to a non-existent VLAN, this VLAN will not be created automatically.
Besides, the native VLAN can be out of the list of allowed-VLANs for this port. In this case, the flows from thenative VLAN cannot pass through the port.



Defining Allowed-VLANs for a Trunk Port

4-9

Configuration Guide

Configuring VLAN



Optional.



By default, a trunk port transmits the flows from all the VLANs (1 to 4094). You may configure a list ofallowed-VLANs to prohibit flows of some VLANs from passing through a Trunk port.



Configuration:

Commandswitchport trunk allowed vlan { all | add vlan-list | remove vlan-list | except vlan-list | only vlan-list }Parameter

The parameter vlan-list can be a VLAN or some VLANs, and the VLAN IDs are connected by "-" in order. For

Description

example: 10–20.
all indicates allowed-VLANs include all VLANs;
add vlan-list :indicates adding a specific VLAN to the list of allowed-VLANs;
remove vlan-list :indicates removing a specific VLAN from the list of allowed-VLANs;
except vlan-list :indicates adding all VLANs except those in the listed VLAN to the list of allowed-VLANs.
only vlan-list :indicates adding the listed VLANs to the list of allowed-VLANs, and removing the other VLANs
from the list.

Defaults

The Trunk port and the Uplink port belong to all VLANs.

Command

Interface configuration mode

Mode
Usage Guide

To restore the configuration on a Trunk port to defaults (all), use the no switchport trunk allowed vlancommand.

Configuring tag-only

Optional.



By default, a trunk port transmits untagged flow. You may configure tag-only to prohibit flows of untag frompassing through a Trunk port.



Configuration:

Commandswitchport trunk accept-frame-type tag-only

Parameter

N/A

Description
Defaults

Default forward untag packets

Command

Interface configuration mode

Mode
Usage Guide

To restore the configuration on a Trunk port to defaults, use the no switchport trunk accept-frame-type
tag-only.

Verification
Send tag packets to a Trunk port, and they are broadcast within the specified VLANs.



Use commands show vlan and show interface switchport to check whether the configuration takes effect.

Commandshow vlan [ id vlan-id ]Parametervlan-id :indicates a VLAN ID.

Description
CommandAny mode

4-10Configuration Guide

Configuring VLAN

Mode
Usage Guide

N/A

Command

Ruijie(config-vlan)#show vlan id 20

Display

VLAN Name

StatusPorts---- -------------------------------- --------- ----------------------------------20 VLAN0020

STATIC

Gi0/17

Configuration
Example

Configuring Basic VLAN to Realize Layer-2 Isolation and Layer-3 Interconnection

Scenario
Figure 4-4

Configuration

Networking Requirements:

Steps

As shown in the figure above, an intranet is divided into VLAN 10, VLAN 20 and VLAN 30, realizing Layer-2
isolation from each other. The three VLANs correspond respectively to the IP sub-networks
192.168.10.0/24, 192.168.20.0/24, and 192.168.30.0/24, realizing interconnection with each other throughIP forwarding by Layer-3 core switches.
Key Points:
The following example describes the configuration steps on a core switch and an access switch.
Configure three VLANs on a core switch and the port connected to the access switches as a Trunkport, and specify a list of allowed-VLANs to realize Layer-2 isolation.

Configure three SVIs on the core switch, which are the gateway interfaces of the IP sub-networks
corresponding to the three VLANs, and configure the IP addresses for these interfaces.

Create VLANs respectively on the three access switches, assign Access ports for the VLANs, andspecify Trunk ports of the core switch. The following example describes the configuration steps on
Switch A.

D

D#configure terminal
D(config)#vlan 10
D(config-vlan)#vlan 20
D(config-vlan)#vlan 30

4-11

Configuration Guide

Configuring VLAN

D(config-vlan)#exit
D(config)#interface range GigabitEthernet 0/17-18
D(config-if-range)#switchport mode trunk
D(config-if-range)#exit
D(config)#interface GigabitEthernet 0/17
D(config-if-GigabitEthernet 0/17)#switchport trunk allowed vlan remove 1-4094
D(config-if-GigabitEthernet 0/17)#switchport trunk allowed vlan add 10,20
D(config-if-GigabitEthernet 0/17)#interface GigabitEthernet 0/18
D(config-if-GigabitEthernet 0/18)#switchport trunk allowed vlan remove 1-4094
D(config-if-GigabitEthernet 0/18)#switchport trunk allowed vlan add 10,20,30
D#configure terminal
D(config)#interface vlan 10
D(config-if-VLAN 10)#ip address 192.168.10.1 255.255.255.0
D(config-if-VLAN 10)#interface vlan 20
D(config-if-VLAN 20)#ip address 192.168.20.1 255.255.255.0
D(config-if-VLAN 20)#interface vlan 30
D(config-if-VLAN 30)#ip address 192.168.30.1 255.255.255.0
D(config-if-VLAN 30)#exit
A#configure terminalA

A(config)#vlan 10A(config-vlan)#vlan 20A(config-vlan)#exit
A(config)#interface range GigabitEthernet 0/2-12
A(config-if-range)#switchport mode accessA(config-if-range)#switchport access vlan 10A(config-if-range)#interface range GigabitEthernet 0/13-24
A(config-if-range)#switchport mode accessA(config-if-range)#switchport access vlan 20A(config-if-range)#exit
A(config)#interface GigabitEthernet 0/1
A(config-if-GigabitEthernet 0/1)#switchport mode trunk

Verification

Display the VLAN configuration on the core switch.


Display VLAN information including VLAN IDs, VLAN names, status and involved ports.

Display the status of ports Gi 0/17, Gi 0/18.

Common Errors


N/A

4.5 Monitoring
Displaying
Description

Command4-12

Configuration Guide

Configuring VLAN

Displays VLAN configuration.

show vlan [ id vlan-id ]Displays configuration of switch ports.

show interfaces [ interface-type interface-number ] switchport

Debugging
System resources are occupied when debugging information is output. Disable the debugging switch immediately
after use.
Description

CommandDebugs VLANs.

debug bridge vlan

4-13Configuration Guide

Configuring Protocol VLAN(beta)

5 Configuring Protocol VLAN(beta)
5.1 Overview
The protocol VLAN technology is a VLAN distribution technology based on the packet protocol type. It can distribute
packets of a certain protocol type with a null VLAN ID to the same VLAN. That is, the switch, based on the protocol typeand encapsulation format of packets received by ports, matches the received untagged packets with protocol profiles. If
the matching is successful, the switch automatically distributes the packets to a relevant VLAN for transmission. There
are two types of protocol VLANs: IP address-based protocol VLAN and protocol VLAN based on the packet type andEthernet type on ports. The protocol VLAN based on the packet type and Ethernet type on ports is called protocol VLAN
for short and the IP address-based protocol VLAN is called subnet VLAN for short.
The protocol VLAN is applicable only to Trunk ports and Hybrid ports.

Protocols andStandards
IEEE standard 802.1Q: Virtual Bridged Local Area Networks and Standards

5.2 Applications
Application

Description

Configuration and Application of

Implements Layer-2 communication isolation of user hosts that use different

Protocol VLAN

protocol packets for communication to reduce the network traffic.

Configuration and Application ofSpecifies the VLAN range based on the IP network segment to which user packets

Subnet VLAN

belong.

5.2.1 Configuration and Application of Protocol VLAN
Scenario
As shown in the following figure, the network architecture is composed of the interconnected Windows NT server andNovell Netware server and the office area is connected to the Layer-3 device Switch A through a hub. There aredifferent PCs in the office area. Some PCs use the Windows NT operating system (OS) and support the IP protocol,and some PCs use the Novell Netware OS and support the IPX protocol. PCs in the office area communicate with theexternal network and servers through the uplink port Gi 0/17.
The main requirements are as follows:

The Layer-2 communication of PCs using the Windows NT OS is isolated from that of PCs using the Novell
Netware OS, so as to reduce the network traffic.

Figure 6-1

5-1

Configuration Guide

Configuring Protocol VLAN(beta)

RemarkSwitch A is a switch and Port Gi 0/18 is a Hybrid port. Port Gi 0/17 is an Access port and belongs to VLAN 2.

sPort Te 0/19 is also an Access port and belongs to VLAN 3.

Deployment
Configure profiles of the packet type and Ethernet type (in this example, configure Profile 1 for IP protocol packets
and configure Profile 2 for IPX protocol packets).



Apply the profiles to the uplink port (Port Gi 0/18 in this example) and associate them with VLANs (in this example,
associate Profile 1 with VLAN 2 and associate Profile 2 with VLAN 3).
The configured protocol VLANs take effect only on the Trunk ports and Hybrid ports.

5.2.2 Configuration and Application of Subnet VLAN
Scenario
As shown in the following figure, PCs in Office A and Office B are connected to the Layer-3 device Switch A throughhubs. In Office A, the PCs belong to a fixed network segment and they are distributed to the same VLAN by port. In
Office B, the PCs belong to two network segments, but they cannot be distributed to VLANs by fixed port.
The main requirements are as follows:
For PCs in Office B, Switch A can determine the VLAN range of the PCs based on the IP network segment to which
their packets belong.
Figure 6-2

5-2

Configuration Guide

Configuring Protocol VLAN(beta)

RemarkSwitch A is a switch. Port G0/17 is an Access port and belongs to VLAN 2. Port Te0/19is also an Access portsand belongs to VLAN 3. Port G0/18 is a Hybrid port.

Deployment
Globally configure subnet VLANs (in this example, allocate the IP network segment 192.168.1.1/24 to VLAN 3 andthe IP network segment 192.168.2.1/24 to VLAN 2) and enable the subnet VLAN function on the uplink port (PortGi 0/18 in this example).
The configured subnet VLANs take effect only on the Trunk ports and Hybrid ports.

5.3 Features
Basic ConceptsProtocol VLAN

The protocol VLAN technology is a VLAN distribution technology based on the packet protocol type. It can distribute
packets of a certain protocol type with a null VLAN ID to the same VLAN.
VLANs need to be specified for packets received by device ports so that a packet belongs to a unique VLAN. There arethree possible cases:If a packet contains a null VLAN ID (untagged or priority packet) and the device supports only port-based VLAN
distribution, the VLAN ID in the tag added to the packet is the PVID of the input port.



If a packet contains a null VLAN ID (untagged or priority packet) and the device supports VLAN distribution basedon the packet protocol type, the VLAN ID in the tag added to the packet is selected from the VLAN IDs mapped tothe protocol suite configuration of the input port. If the protocol type of the packet does not match all protocol suite
configuration of the input port, a VLAN ID is allocated according to the port-based VLAN distribution.

5-3

Configuration GuideConfiguring Protocol VLAN(beta)

If a packet is a tagged packet, the VLAN to which the packet belongs is determined by the VLAN ID in the tag.

Subnet VLANs can be configured only globally that is, only the protocol VLAN function can be enabled or disabled on
ports. The matching configuration is globally performed for the protocol VLAN, the matching configuration is selected on
ports and the VLAN IDs are specified for packets that are matched successfully.



If an input packet contains a null VLAN ID and the IP address of the input packet matches an IP address, thepacket is distributed to the subnet VLAN.



If an input packet contains a null VLAN ID and the packet type and Ethernet type of the input packet match thepacket type and Ethernet type of an input port, the packet is allocated to the protocol VLAN.



Protocol VLAN Priority

The priority of a subnet VLAN is higher than that of a protocol VLAN. That is, if a subnet VLAN and protocol VLAN are
configured at the same time and an input packet conforms to both the subnet VLAN and protocol VLAN, the subnet
VLAN prevails.

Overview
FeatureDescription

Automatic VLAN Distribution

The service types supported on a network are bound with VLANs or packets from a

Based on Packet Typespecified IP network segment are transmitted in a specified VLAN to facilitate
management and maintenance.

5.3.1 Automatic VLAN Distribution Based on Packet Type
Working Principle
Set rules on the hardware and enable the rules on ports. The rules take effect only after they are enabled on ports. The
rules include the packet type and IP address of packets. When a port receives untagged data packets that meet therules, the port automatically distributes them to the VLAN specified in the rules for transmission. When the rules are
disabled on ports, untagged data packets are distributed to the Native VLAN according to the port configuration.

RelatedConfiguration

5.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enable the VLAN distribution function based on the packet type andEthernet type of the protocol VLAN.

Configuring theprotocol-vlan profile number frame-type

Protocol VLAN

{ EtherII ether-type type | SNAP ether-type type |Function

LLC dsap value ssap value }protocol-vlan profile number vlan vlan-id

5-4

Configures the profile of the packet type andEthernet type.
(Interface configuration mode) Applies the
protocol VLAN on a port.

Configuration Guide
Configuration

Configuring Protocol VLAN(beta)

Description and Command(Mandatory) It is used to enable IP address-based VLAN distribution function of the protocol
VLAN.

Configuring theSubnet VLAN
Function

protocol-vlan ipv4 address mask mask vlan

Configures an IP address, subnet mask, andvlan-id

VLAN distribution.
(Interface configuration mode) Enables the

protocol-vlan ipv4

subnet VLAN on a port.

5.4.1 Configuring the Protocol VLAN Function
Configuration EffectBind service types supported in a network with VLANs to facilitate management and maintenance.

Notes


It is recommended that the protocol VLAN be configured after VLANs, and the Trunk, Hybrid, Access, and AP
attributes of ports are configured.



If protocol VLAN is configured on a Trunk port or Hybrid port, all VLANs relevant to the protocol VLAN need to becontained in the permitted VLAN list of the Trunk port or Hybrid port.

Configuration Steps

Configuring the Protocol VLAN Globally

Mandatory.



The protocol VLAN can be applied on an interface only in global configuration mode.

Commandprotocol-vlan profile number frame-type { EtherII ether-type type | SNAP ether-type type | LLC dsap
value ssap value }Parameter

profile number : Indicates the profile index. The value ranges from 1 to 16.

Description

frame-type : Type of message, include EtherII, SNAP, LLC .
ether-type type : Indicates the type of Ethernet II or or SNAP. The value ranges from 1501 to 65535.
LLC dsap value ssap value : Service access point type. The value ranges from 0 to 255.

Defaults

The protocol VLAN is disabled by default.

Command

Global configuration mode

Mode
Usage Guide

The protocol VLAN can be configured on an interface only when the protocol VLAN is globallyconfigured. When the global configuration of a protocol VLAN profile is deleted, the protocol VLAN
configuration is deleted from all interfaces corresponding to the profile of the protocol VLAN.



Switching the Port Mode to Trunk/Hybrid Mode

Mandatory. The protocol VLAN function takes effect only on ports that are in Trunk/Hybrid mode.

Enabling the Protocol VLAN on a Port

5-5

Configuration Guide

Configuring Protocol VLAN(beta)

Mandatory. The protocol VLAN is disabled by default.



The protocol VLAN is truly enabled only when it is applied on interfaces.

Commandprotocol-vlan profile number vlan vlan-id

Parameter

profile number: Indicates the profile index. The value ranges from 1 to 16.

Description

vlan vlan-id: Indicates the VLAN ID. The value ranges from 1 to 4094.

Defaults

The protocol VLAN is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

An interface must work in Trunk/Hybrid mode.

Verification
Run the show protocol-vlan profile command to check the configuration.

Configuration
Example

Enabling the Protocol VLAN Function in the Topological Environment

Scenario
Figure 6-3

Configuratio

Configure VLAN 2 and VLAN 3 for user communication on Switch A.

n StepsConfigure the protocol VLAN globally on Switch A (in this example, assumeing that packets areencapsulated using Ethernet II, and the Ethernet types of IP protocol packets and IPX protocol
packets are 0X0800 and 0X8137 respectively, configure Profile 1 for IP protocol packets andconfigure Profile 2 for IPX protocol packets), ). enable the protocol VLAN function on the uplink port
(Port Gi 0/18 in this example), and complete the protocol-VLAN association (in this example,
associate Profile 1 with VLAN 2 and associate Profile 2 with VLAN 3).

Port Gi 0/17 is an Access port and belongs to VLAN 2. Port Te0/19 is also an Access port andbelongs to VLAN 3. Port Gi 0/18 is a Hybrid port. Ensure that the user communication VLANs are

5-6

Configuration Guide

Configuring Protocol VLAN(beta)
contained in the permitted untagged VLAN list of the Hybrid port.

Enable the protocol VLAN function on the uplink port (Port Gi 0/18 in this example), and complete
the protocol-VLAN association (in this example, associate Profile 1 with VLAN 2 and associate
Profile 2 with VLAN 3).

A

1. Create VLAN 2 and VLAN 3 for user network communication.
A# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
A(config)# vlan range 2-3
A(config-vlan-range)# exit
2. Configure the protocol VLAN globally.
Configure Profile 1 for IP protocol packets and Profile 2 for IPX protocol packets
A(config)#protocol-vlan profile 1 frame-type ETHERII ether-type 0x0800
A(config)#protocol-vlan profile 2 frame-type ETHERIIether-type 0x8137
23. Configure the port mode.
A(config)#interface gigabitEthernet gigabitethernet 0/17
A(config-if-GigabitEthernet 0/17)#switchport
A(config-if-GigabitEthernet 0/17)#switchport access vlan 2A(config-if-GigabitEthernet 0/17)#exit
A(config)#interface gigabitEthernet TenGigabitEthernet 0/19
A(config-if-TenGigabitEthernet 0/19)#switchport
A(config-if-TenGigabitEthernet 0/19)#switchport access vlan 3A(config-if-TenGigabitEthernet 0/19)#exit
A(config)# interface gigabitEthernet gigabitethernet 0/18
A(config-if-GigabitEthernet 0/18)#switchport
A(config-if-GigabitEthernet 0/18)# switchport mode hybridA(config-if-GigabitEthernet 0/18)# switchport hybrid allowed vlan untagged 2-3
A(config-if-GigabitEthernet 0/18)# exit
3. Configure the protocol VLAN globally.
Configure Profile 1 for IP protocol packets and Profile 2 for IPX protocol packets (in thisexample, assume that packets are encapsulated using Ethernet II and the Ethernet types of IP
protocol packets and IPX protocol packets are 0X0800 and 0X8137 respectively).
A(config)#protocol-vlan profile 1 frame-type ETHERII ether-type 0x0800
A(config)#protocol-vlan profile 2 frame-type ETHERIIether-type 0x8137

4. Apply Profile profile 1 and Profile 2 to Port Gi 0/18 and . Aallocate Profile 1 to VLAN 2 and Profile 2 to
VLAN 3.
A(config)# interface gigabitEthernet gigabitethernet 0/18
A(config-if-GigabitEthernet 0/18) # protocol-vlan profile 1 vlan 2A(config-if-GigabitEthernet 0/18) # protocol-vlan profile 2 vlan 3

Verification

Check whether the protocol VLAN configuration on the device is correct.

A

A(config)#show protocol-vlan profile

5-7

Configuration Guide

Configuring Protocol VLAN(beta)

profile frame-type

ether-type/DSAP+SSAP

interfacevlan------- ---------------- ---------------------- --------------- ---1

2

ETHERIIETHERII

0x0800Gi0/182

Gi0/1830x8137

Common Errors


A port connected to the device is not in Trunk/Hybrid mode.

The permitted VLAN list of the port connected to the device does not contain the user communication VLANs.



The protocol VLAN function is disabled on a port.

5.4.2 Configuring the Subnet VLAN Function
Configuration EffectDistribute packets from a specified network segment or IP address to a specified VLAN for transmission.

Notes


It is recommended that the protocol VLAN be configured after VLANs, and the Trunk, Hybrid, Access, and AP
attributes of ports are configured.



If protocol VLAN is configured on a Trunk port or Hybrid port, all VLANs relevant to the protocol VLAN need to becontained in the permitted VLAN list of the Trunk port or Hybrid port.

Configuration Steps

Configuring the Subnet VLAN Globally

Mandatory.

The subnet VLAN can be applied on an interface only in global configuration mode.

Commandprotocol-vlan ipv4 address mask address vlan vlan-id

Parameteripv4 address: Indicates the IP address in the A.B.C.D format.

Description

mask mask: Indicates the IP subnet mask in the A.B.C.D format.
vlan vlan-id: Indicates the VLAN ID. The value ranges from 1 to 4094.

Defaults

The subnet VLAN is disabled by default.

Command

Global configuration mode

Mode
Usage Guide

The subnet VLAN can be enabled on an interface even if the protocol VLAN is not enabled globally.
Nevertheless, the subnet VLAN takes effect only when the protocol VLAN is configured globally.



Switching the Port Mode to Trunk/Hybrid Mode

5-8

Configuration Guide

Configuring Protocol VLAN(beta)

Mandatory. The subnet VLAN function takes effect only on ports that are in Trunk/Hybrid mode.

Enabling the Subnet VLAN on a Port

Mandatory. The subnet VLAN is disabled by default.



The subnet VLAN is truly enabled only when it is applied on interfaces.

Commandprotocol-vlan ipv4

Parameter

N/A

Description
Defaults

The subnet VLAN is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

An interface must work in Trunk/Hybrid mode.

Verification
Run the show protocol-vlan ipv4 command to check the configuration.

Configuration
Example

Enabling the Subnet VLAN Function in the Topological Environment

Scenario
Figure 6-4

Configuratio

Configure VLAN 2 and VLAN 3 for user communication on Switch A.

n StepsGlobally configure subnet VLANs on Switch A (in this example, allocate the IP network segment

5-9

Configuration Guide

Configuring Protocol VLAN(beta)
192.168.1.1/24 to VLAN 3 and the IP network segment 192.168.2.1/24 to VLAN 2).and enable thesubnet VLAN function on the uplink port (Port Gi 0/18 in this example).

Port Gi 0/17 is an Access port and belongs to VLAN 2. Port Te 0/19 is also an Access port andbelongs to VLAN 3. Port Gi 0/18 is a Hybrid port. Ensure that the user communication VLANs arecontained in the permitted untagged VLAN list of the Hybrid port.

A

Enable the subnet VLAN function on the uplink port (Port Gi 0/18 in this example).

1. Create VLAN 2 and VLAN 3 for user network communication. Configure the subnet VLAN globally.
A# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
A(config)# vlan range 2-3
A(config-vlan-range)# exit
A(config)# protocol-vlan ipv4 192.168.1.0 mask 255.255.255.0 vlan 3A(config)# protocol-vlan ipv4 192.168.2.0 mask 255.255.255.0 vlan 2
2. Configure the port mode.
A(config)#interface gigabitethernet 0/17
A(config-if-GigabitEthernet 0/17)#switchport
A(config-if-GigabitEthernet 0/17)#switchport access vlan 2A(config-if-GigabitEthernet 0/17)#exit
A(config)#interface TenGigabitEthernet 0/19
A(config-if-TenGigabitEthernet 0/19)#switchport
A(config-if-TenGigabitEthernet 0/19)#switchport access vlan 3A(config-if-TenGigabitEthernet 0/19)#exit
A(config)# interface gigabitethernet 0/18
A(config-if-GigabitEthernet 0/18)# switchport
A(config-if-GigabitEthernet 0/18)# switchport mode hybridA(config-if-GigabitEthernet 0/18)# switchport hybrid allowed vlan untagged 2-3
3. Configure the subnet VLAN globally.
A(config)# protocol-vlan ipv4 192.168.1.0 mask 255.255.255.0 vlan 3A(config)# protocol-vlan ipv4 192.168.2.0 mask 255.255.255.0 vlan 2

34. Enable the subnet VLAN on interfaces. The subnet VLAN is disabled by default.
A(config-if-GigabitEthernet 0/18)# protocol-vlan ipv4

Verification

Check whether the subnet VLAN configuration on the device is correct.

A

A# show protocol-vlan ipv4
ip

mask

vlan

--------------- --------------- ---192.168.1.0

255.255.255.0

3

192.168.2.0

255.255.255.0

2

interface

ipv4 status-------------------- -----------

5-10

Configuration Guide
Gi0/18Configuring Protocol VLAN(beta)
enableCommon Errors


A port connected to the device is not in Trunk/Hybrid mode.

The permitted VLAN list of the port connected to the device does not contain the user communication VLANs.



The subnet VLAN is disabled on a port.

5.5 Monitoring
Displaying
Description

Command

Displays the protocol VLAN content.

show protocol-vlan [ profile [ number ] | ipv4 ]Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs the protocol VLAN.

debug bridge protvlan

5-11

Configuration Guide

Configuring Private VLAN(beta)

6 Configuring Private VLAN(beta)
6.1 Overview
Private VLAN divides the Layer-2 broadcast domain of a VLAN into multiple subdomains. Each subdomain iscomposed of one private VLAN pair: primary VLAN and secondary VLAN.
One private VLAN domain may consist of multiple private VLAN pairs and each private VLAN pair represents one
subdomain. In a private VLAN domain, all private VLAN pairs share the same primary VLAN. The secondary VLAN IDs
of subdomains are different.
If a service provider allocates one VLAN to each user, the number of users that can be supported by the service
provider is restricted because one device supports a maximum of 4,096 VLANs. On a Layer-3 device, one subnet
address or a series of addresses are allocated to each VLAN, which results in the waste of IP addresses. The private
VLAN technology properly solves the preceding two problems. Private VLAN is hereinafter called PVLAN for short.

6.2 Applications
Application

Description

Cross-Device Layer-2 Application ofUsers of an enterprise can communicate with each other but the user communication

PVLAN

between enterprises is isolated.

Layer-3 Application of PVLAN on a

All enterprise users share the same gateway address and can communicate with theSingle Device

external network.

6.2.1 Cross-Device Layer-2 Application of PVLAN
Scenario
As shown in the following figure, in the hosting service operation network, enterprise user hosts are connected to the
network through Switch A or Switch B. The main requirements are as follows:

Users of an enterprise can communicate with each other but the user communication between enterprises isisolated.

All enterprise users share the same gateway address and can communicate with the external network.

Figure 7-1

6-1

Configuration Guide

Configuring Private VLAN(beta)

RemarkSwitch A and Switch B are access switches.

s

PVLAN runs across devices. The ports for connecting the devices need to be configured as Trunk ports, that
is, Port Te 0/19 of Switch A and Port Te 0/19 of Switch B are configured as Trunk ports.
Port Te 0/19 for connecting Switch A to the gateway needs to be configured as a promiscuous port.
Port Te 0/19 of the gateway can be configured as a Trunk port or Hybrid port and the Native VLAN is theprimary VLAN of PVLAN.

Deployment
Configure all enterprises to be in the same PVLAN (primary VLAN 99 in this example). All enterprise users sharethe same Layer-3 interface through this VLAN to communicate with the external network.



If an enterprise has multiple user hosts, allocate the user hosts of different enterprises to different community
VLANs. That is, configure the ports connected to the enterprise user hosts as the host ports of a community VLAN,
so as to implement user communication inside an enterprise but isolate the user communication between
enterprises.



If an enterprise has only one user host, configure the ports connected to the user hosts of such enterprises as thehost ports of an isolated VLAN so as to implement isolation of user communication between the enterprises.

6.3 Features
Basic Concepts



PVLAN

6-2

Configuration Guide

Configuring Private VLAN(beta)

PVLAN supports three types of VLANs: primary VLANs, isolated VLANs, and community VLANs.
A PVLAN domain has only one primary VLAN. Secondary VLANs implement Layer-2 isolation in the same PVLAN
domain. There are two types of secondary VLANs.



Isolated VLAN

Ports in the same isolated VLAN cannot mutually make Layer-2 communication. A PVLAN domain has only one
isolated VLAN.

Community VLAN

Ports in the same community VLAN can make Layer-2 communication with each other but cannot make Layer-2
communication with ports in other community VLANs. A PVLAN domain can have multiple community VLANs.



Layer-2 Association of PVLAN

PVLAN pairs exist only after Layer-2 association is performed among the three types of VLANs of PVLAN. Then, a
primary VLAN has a specified secondary VLAN and a secondary VLAN has a specified primary VLAN. A primary VLAN
and secondary VLANs are in the one-to-many relationship.



Layer-3 Association of PVLANIn PVLAN, Layer-3 interfaces, that is, switched virtual interfaces (SVIs) can be created only in a primary VLAN. Users ina secondary VLAN can make Layer-3 communication only after Layer-3 association is performed between thesecondary VLAN and the primary VLAN. Otherwise, the users can make only Layer-2 communication.

Isolated Port

A port in an isolated VLAN can communicate only with a promiscuous port. An isolated port can forward the received
packets to a Trunk port but a Trunk port cannot forward the packets with the VID of an isolated VLAN to an isolated port.

Community Port

Community ports are ports in a community VLAN. Community ports in the same community VLAN can communicate
with each other and can communicate with promiscuous ports. They cannot communicate with community ports in othercommunity VLANs or isolated ports in an isolated VLAN.



Promiscuous Port

Promiscuous ports are ports in a primary VLAN. They can communicate with any ports, including isolated ports andcommunity ports in secondary VLANs of the same PVLAN domain.

Promiscuous Trunk Port

A promiscuous Trunk port is a member port that belongs to multiple common VLANs and multiple PVLANs at the sametime. It can communicate with any ports in the same VLAN.



In a common VLAN, packet forwarding complies with 802.1Q.

In PVLAN, for tagged packets to be forwarded by a promiscuous Trunk port, if the VID of the packets is asecondary VLAN ID, the VID is converted into the corresponding primary VLAN ID before packet forwarding.



Isolated Trunk Port

6-3

Configuration Guide

Configuring Private VLAN(beta)

An isolated Trunk port is a member port that belongs to multiple common VLANs and multiple PVLANs at the same
time.



In an isolated VLAN, an isolated Trunk port can communicate only with a promiscuous port.



In a community VLAN, an isolated Trunk port can communicate with community ports in the same community
VLAN and promiscuous ports.

In a common VLAN, packet forwarding complies with 802.1Q.



An isolated Trunk port can forward the received packets of an isolated VLAN ID to a Trunk port but a Trunk portcannot forward the packets with the VID of an isolated VLAN to an isolated port.



For tagged packets to be forwarded by an isolated Trunk port, if the VID of the packets is a primary VLAN ID, the
VID is converted into a secondary VLAN ID before packet forwarding.
In PVLAN, SVIs can be created only in a primary VLAN and SVIs cannot be created in secondary VLANs.
Ports in PVLAN can be used as mirroring source ports but cannot be used as mirroring destination ports.

Overview
FeatureDescription
Ports of different PVLAN types can be configured to implement interworking and isolation of VLAN

PVLAN Layer-2

intermediate user hosts.

Isolation and IP

After Layer-2 mapping is performed between a primary VLAN and secondary VLANs, only Layer-2

Address Saving

communication is supported. If Layer-3 communication is required, users in a secondary VLAN need
to use SVIs of the primary VLAN to make Layer-3 communication.

6.3.1 PVLAN Layer-2 Isolation
Add users to subdomains of PVLAN to isolate communication between enterprises and between enterprise users.

Working Principle
Configure PVLAN, configure Layer-2 association and Layer-3 association between a primary VLAN and SubVLANs of
PVLAN, and configure ports connected to user hosts, external network devices, and servers as different types of
PVLAN ports. In this way, subdomain division and communication of users in subdomains with the external network andservers can be implemented.

Packet Forwarding Relationship between Ports of Different Types

Output Port

Promiscuo

Isolated Portus PortCommunity

Isolated Trunk

Promiscuous

Trunk Port

Port

Port

Trunk Port(in the Same(in the Same(in the Same

VLAN)

VLAN)

VLAN)

Input Port
Promiscuous Port
Isolated Port
Community Port

Supported

Supported

Supported

Supported

Supported

Supported

Supported

Unsupported

Unsupported

Unsupported

Supported

Supported

Supported

Unsupported

Supported

Supported

Supported

Supported

6-4

Configuration Guide

Output Port

Configuring Private VLAN(beta)
Promiscuo

Isolated Portus PortCommunity

Isolated Trunk

Promiscuous

Trunk Port

Port

Port

Trunk Port(in the Same(in the Same(in the Same

VLAN)

VLAN)

VLAN)

Unsupported

Supported

Supported

Input Port
Isolated TrunkSupported

Unsupported

Supported(unsupported inPort

an isolated(in the SameVLAN but

VLAN)

supported in a
non-isolated
VLAN)
Promiscuous

Supported

Supported

Supported

Supported

Supported

Supported

Supported

Unsupported

Supported

Unsupported

Supported

Supported

Trunk Port(in the Same
VLAN)
Trunk Port(unsupported in(in the Samean isolated

VLAN)

VLAN but
supported in a
non-isolatedVLAN)
VLAN Tag Changes After Packet Forwarding Between Ports of Different Types

Output Port

Promiscuou

Isolated

Community

Isolated

Promiscuous

Trunk Ports PortPort

Port

Trunk Port

Trunk Port(in the Same(in the Same(in the Same

VLAN)

VLAN)

VLAN)

A secondary

A primary VLAN

A primary VLAN

VLAN ID is

ID tag is added

ID tag is added.

added.

and the VLAN tag

Input Port
Promiscuous

Unchanged

Unchanged

UnchangedPortkeeps unchangedin the non-PVLAN.
Isolated Port

Unchanged

NA

NA

NA

A primary VLAN

An isolated

ID tag is added

VLAN ID tag isand the VLAN tag

added.

keeps unchangedin the non-PVLAN.
Community Port

Unchanged

NA

Unchanged

A community

A primary VLAN

A community

VLAN ID tag is

ID tag is added

VLAN ID tag is

added.

and the VLAN tag

added.

keeps unchangedin the non-PVLAN.
Isolated Trunk

The VLANNA

The VLAN

6-5

The VLAN tag

A primary VLAN

Unchanged

Configuration Guide
Output Port

Configuring Private VLAN(beta)

Promiscuou

Isolated

Community

Isolated

Promiscuous

Trunk Ports PortPort

Port

Trunk Port

Trunk Port(in the Same(in the Same(in the Same

VLAN)

VLAN)

VLAN)

Input PortPort

tag istag iskeeps

ID tag is added(in the Sameremoved.

removed.

unchanged inand the VLAN tag

a non-isolated

keeps unchanged

VLAN.

in the non-PVLAN.

VLAN)

Promiscuous

The VLANA secondary

A primary VLAN

Trunk Port

tag isUnchanged

Unchanged

VLAN ID is

ID tag is added(in the Sameremoved.

added.

and the VLAN tag

VLAN)

Unchanged

keeps unchangedin the non-PVLAN.

Trunk Port

The VLAN(in the Same
VLAN)

NA

The VLANThe VLAN tag

A primary VLAN

tag istag isis converted

ID tag is added

removed.

removed.

into aand the VLAN tag

secondarykeeps unchanged

VLAN ID in a

in the non-PVLAN.

Unchanged

primary VLAN
and the VLAN
tag keeps
unchanged inothernon-isolated
VLANs.
Switch CPU

Untag

Untag

Untag

A secondary

A primary VLAN

A primary VLAN

VLAN ID tag is

ID tag is added

ID tag is added.

added.

and the VLAN tag
keeps unchangedin the non-PVLAN.

6.4 Configuration
Configuration

Description and Command(Mandatory) It is used to configure a primary VLAN and secondary VLANs.
private-vlan { community | isolated | primary }Configuring
Basic Functionsof PVLAN

Configures the PVLAN type.

(Mandatory) It is used to configure Layer-2 association between a primary VLAN and secondary
VLANs of PVLAN to form PVLAN pairs.
Creat the SVI (Switch Virtual Interface) of theinterface vlan vlan-id

primary VLAN

ip address { ipv4-address mask |Configures the IP address of the SVI

ipv4-address/mask-length }6-6

Configuration Guide
Configuration
ConfiguringConfiguring Private VLAN(beta)

Description and Command(Mandatory) It is used to allocate users to an isolated VLAN or community VLAN.

Isolated Ports

switchport mode private-vlan hostConfigures a PVLAN host port.

and Community

switchport private-vlan host-association

Associates Layer-2 ports with PVLAN and

Ports

primary-vlan-id secondary-vlan-id

allocates ports to subdomains.

Configuring a(Mandatory) It is used to configure a port as a promiscuous port.

Promiscuous
switchport mode private-vlan promiscuousPort

Configures a PVLAN promiscuous port.

(Optional) It is used to configuring an Isolated Trunk Port and Associating the Port with a PVLAN Pair
Configuring an
Isolated Trunkof a Layer-2 Interface.
Defines a port as a Layer-2 Trunk port.

switchport mode trunk

Port

Configuring an Isolated Trunk Port and Associating
the Port with a PVLAN Pair
(Optional) It is used to configuring a Promiscuous Trunk Port and Associating the Port with a PVLAN

Configuring a
Promiscuous
Trunk Port

Pair of a Layer-2 Interface.
switchport mode trunk

Defines a port as a Layer-2 Trunk port.

switchport private-vlan promiscuous trunk

Configuring a Promiscuous Trunk Port andprimary-vlan-id secondary-vlan-list

Associating the Port with a PVLAN Pair

6.4.1 Configuring Basic Functions of PVLAN
Configuration EffectEnable PVLAN subdomains to form to implement isolation between enterprises and between enterprise users.



Implement Layer-3 mapping between multiple secondary VLANs and the primary VLAN so that and multiple
VLANs uses the same IP gateway, thereby helping save IP addresses.

Notes


After a primary VLAN and a secondary VLAN are configured, a PVLAN subdomain exist only after Layer-2
association is performed between them.



A port connected to a use host must be configured as a specific PVLAN port so that the user host joins a
subdomain to implement the real user isolation.



The port connected to the external network and the port connected to a server must be configured as promiscuous
ports so that upstream and downstream packets are forwarded normally.

Users in a secondary VLAN can make Layer-3 communication through the SVI of the primary VLAN only after
Layer-3 mapping is performed between the secondary VLAN and the primary VLAN.

Configuration Steps

Configuring PVLAN



Mandatory.



A primary VLAN and a secondary VLAN must be configured. The two types of VLANs cannot exist independently.

6-7

Configuration GuideConfiguring Private VLAN(beta)

Run the private-vlan { community | isolated | primary } command to configure a VLAN as the primary VLAN of
PVLAN and other VLANs as secondary VLANs.

CommandParameter

private-vlan { community | isolated | primary }community: Specifies that the VLAN type is community VLAN.

Description
isolated: Specifies that the VLAN type is isolated VLAN.
primary: Specifies that the VLAN type is the primary VLAN of a PVLAN pair.
Defaults

VLANs are common VLANs and do not have the attributes of PVLAN.

Command

VLAN mode

Mode
Usage Guide

This command is used to specify the primary VLAN and secondary VLANs of PVLAN.



Configuring Layer-2 Association of PVLAN



Mandatory.



PVLAN subdomains form, and isolated ports, community ports, and Layer-3 association can be configured only
after Layer-2 association is performed between the primary VLAN and secondary VLANs of PVLAN.



By default, after various PVLANs are configured, the primary VLANs and secondary VLANs are independent ofeach other. A primary VLAN has a secondary VLAN and a secondary VLAN has a primary VLAN only after
Layer-2 association is performed.

Configuring Layer-3 Association of PVLAN

If users in a secondary VLAN domain need to make Layer-3 communication, configure a Layer-3 interface SVI for
the primary VLAN and then configure Layer-3 association between the primary VLAN and secondary VLANs on
the SVI.



By default, SVIs can be configured only in a primary VLAN. Secondary VLANs do not support Layer-3
communication.



If users in a secondary VLAN of PVLAN need to make Layer-3 communication, the SVI of the primary VLAN
needs to be used to transmit and receive packets.

CommandParameterinterface vlan vlan-id
vlan-id: Indicates the ID of the VLAN.

Description
Defaults
Command

By default, no SVI is configured.
Global configuration mode

Mode
Usage Guide-Configuring the IP Address of the SVI

CommandParameter
Description

ip address { ipv4-address mask | ipv4-address/mask-length }ipv4-address: 32-bit IP address, with 8 bits for each group. The IP address is expressed in decimal andgroups are separated by a full stop.

6-8

Configuration Guide

Configuring Private VLAN(beta)

mask: 32-bit network mask. Value 1 indicates the mask bit and 0 indicates the host bit. Every 8 bits form one
group. The network mask is expressed in decimal and groups are separated by a full stop.
mask-length: The length of the network mask.
Command

Interface configuration mode

Mode
Usage Guide

N/A

6.4.2 Configuring Isolated Ports and Community Ports
Configuration EffectAfter the primary VLAN and secondary VLANs of PVLAN as well as Layer-2 association are configured, allocate
the device ports connected to user hosts so as to specify the subdomains to which the user hosts belong.



If an enterprise has only one user host, set the port connected to the user host as an isolated port.



If an enterprise has multiple user hosts, set the ports connected to the user hosts as community ports.

Configuration Steps

Configuring Isolated Ports and Community Ports

Commandswitchport mode private-vlan hostswitchport private-vlan host-association primary-vlan-id secondary-vlan-id

Parameter

primary-vlan-id: Indicates the primary VLAN ID in a PVLAN pair.

Description
secondary-vlan-id: Indicates the secondary VLAN ID in a PVLAN pair. The port is an associated port if the
VLAN is an isolated VLAN and the port is a community port if the VLAN is a community VLAN.
Defaults

By default, the interface works in Access mode; no private VLAN pairs are associated.

CommandBoth commands run in interface configuration mode.

Mode
Usage Guide

Both the preceding commands need to be configured. Before a port is configured as an isolated port or
promiscuous port, and the port mode must be configured as the host port mode.
Whether a port is configured as an isolated port or community port depends on the secondary-vlan-id
parameter.
primary-vlan-id and secondary-vlan-id must be respectively the IDs of the primary VLAN and secondary
VLAN in a PVLAN pair, on which Layer-2 association is performed.
One host port can be associated with only one PVLAN pair.

6.4.3 Configuring a Promiscuous Port
Configuration Effect

According to the table listing port packet transmission and receiving rules in section "Features", the single port
type of PVLAN cannot ensure symmetric forwarding of upstream and downstream packets. Ports for connecting to
the external network or server need to be configured as promiscuous ports to ensure that users can successfully
access the external network or server.

6-9

Configuration Guide

Configuring Private VLAN(beta)

Configuration Steps

Configuring a Promiscuous Port

Commandswitchport mode private-vlan promiscuous

Parameter

primary-vlan-id: Indicates the primary VLAN ID in a PVLAN pair.

Description

secondary-vlan-list: Indicates the secondary VLAN associated with a promiscuous port. Layer-2 associationmust be performed between it and primary-vlan-id.
add secondary-vlan-list: Adds a secondary VLAN to be associated with a port.
remove secondary-vlan-list: Cancels the secondary VLAN associated with a port.

Defaults

By default, an interface works in Access mode; a promiscuous port is not associated with a secondary
VLAN.

Command

Interface configuration mode

Mode
Usage Guide

The port mode must be configured as the promiscuous mode.
If a port is configured as a promiscuous port, it must be associated with PVLN pairs. Otherwise, the portcannot bear or forward services.
One promiscuous port can be associated with multiple PVLAN pairs within one primary VLAN but cannot be
associated with multiple primary VLANs.

Verification
Make user hosts connected to PVLAN ports transmit and receive packets as per PVLAN port forwarding rules toimplement isolation. Configure Layer-3 association to make users in the primary VLAN and secondary VLANs of thesame PVLAN to share the same gateway IP address and make Layer-3 communication.

6.4.4 Configuring an Isolated Trunk Port
Configuration EffectWhen a downlink device of a device does not support PVLAN, if a port needs to isolate packets of some VLANs,
the port must be configured as an isolated Trunk port and the association between the port and a PVLAN pair of aLayer-2 interface must be configured.



After a port is configured as an isolated Trunk port, the port serves as a PVLAN uplink port. When the port
receives packets with the VLAN tag of a PVLAN, the port serves as the isolated port of the PVLAN. When the port
receives other packets, the port serves as a common Trunk port.

Configuration Steps

Configuring an Isolated Trunk Port and Associating the Port with a PVLAN Pair of a Layer-2 Interface

Commandswitchport mode trunk

Parameter

primary-vlan-id: Indicates the primary VLAN ID in a PVLAN pair.

Description

isolated-vlan-id: Indicates the associated isolated VLAN.
Layer-2 association must be performed between it and primary-vlan-id.

Command

Interface configuration mode

6-10

Configuration Guide

Configuring Private VLAN(beta)

Mode
Usage Guide

The associated PVLAN must be a VLAN pair on which Layer-2 association is performed.
The interface must work in Trunk port mode.
One Trunk port can be associated with multiple PVLAN pairs.

6.4.5 Configuring a Promiscuous Trunk Port
Configuration EffectWhen the management VLAN and the primary VLAN of a device are not the same, if a port needs to allow packetsof the management VLAN and primary VLAN at the same time, the port must be configured as a promiscuous
Trunk port and the association between the port and a PVLAN pair of a Layer-2 interface must be configured.



After a port is configured as a promiscuous Trunk port, the port serves as a PVLAN uplink port. When the port
receives packets with the VLAN tag of a PVLAN, the port serves as the promiscuous port of the PVLAN. When theport receives other packets, the port serves as a common Trunk port.

Configuration Steps

Configuring a Promiscuous Trunk Port and Associating the Port with a PVLAN Pair of a Layer-2 Interface

Commandswitchport mode trunkswitchport private-vlan promiscuous trunk primary-vlan-id secondary-vlan-list

Parameter

primary-vlan-id: Indicates the primary VLAN ID in a PVLAN pair.

Description

secondary-vlan-list: Indicates the secondary VLAN associated with a promiscuous port.
Layer-2 association must be performed between secondary-vlan-list and primary-vlan-id.

Command

Interface configuration mode

Mode
Usage Guide

The interface must work in Trunk port mode.
Layer-2 association must be performed on the associated primary VLAN and secondary VLANs.

6.5 Configuration Example
6.5.1 Cross-Device Layer-2 Application of PVLAN
Figure 7-2

6-11

Configuration Guide

Configuration



Steps

Configuring Private VLAN(beta)

Configure all enterprises to be in the same PVLAN (primary VLAN 99 in this example). All enterpriseusers share the same Layer-3 interface through this VLAN to communicate with the external network.



If an enterprise has multiple user hosts, allocate each enterprise to a different community VLAN (in thisexample, allocate Enterprise A to Community VLAN 100) to implement user communication inside anenterprise and isolate user communication between enterprises.



If an enterprise has only one user host, allocate such enterprises to the same isolated VLAN (in thisexample, allocate Enterprise B and Enterprise C to Isolated VLAN 101) to isolate user communication
between enterprises.

A

SwitchA#configure terminal
SwitchA(config)#vlan 99
SwitchA(config-vlan)#private-vlan primary
SwitchA(config-vlan)#exit
SwitchA(config)#vlan 100
SwitchA(config-vlan)#private-vlan community
SwitchA(config-vlan)#exit
SwitchA(config)#vlan 101
SwitchA(config-vlan)#private-vlan isolated
SwitchA(config-vlan)#exit
SwitchA(config)#vlan 99
SwitchA(config-vlan)#exit
SwitchA(config)#interface gigabitethernet 0/17
SwitchA(config-if-GigabitEthernet 0/17)#switchport mode private-vlan host
SwitchA(config-if-GigabitEthernet 0/17)#switchport private-vlan host-association 99 101
SwitchA(config)#interface TenGigabitEthernet 0/19
SwitchA(config-if-TenGigabitEthernet 0/19)#switchport mode trunk
SwitchA(config-if-TenGigabitEthernet 0/19)#exit

B

SwitchB#configure terminal

6-12Configuration Guide

Configuring Private VLAN(beta)

SwitchB(config)#vlan 99
SwitchB(config-vlan)#private-vlan primary
SwitchB(config-vlan)#exit
SwitchB(config)#vlan 100
SwitchB(config-vlan)#private-vlan community
SwitchB(config-vlan)#exit
SwitchB(config)#vlan 101
SwitchB(config-vlan)#private-vlan isolated
SwitchB(config-vlan)#exit
SwitchB(config)#vlan 99
SwitchB(config-vlan)#exit
SwitchB(config)#interface gigabitethernet 0/18
SwitchB(config-if-GigabitEthernet 0/18)#switchport mode private-vlan host
SwitchB(config-if-GigabitEthernet 0/18)# switchport private-vlan host-association 99 101
SwitchB(config-if-GigabitEthernet 0/18)#exit
SwitchB(config)#interface gigabitethernet 0/17
SwitchB(config-if-GigabitEthernet 0/17)#switchport mode private-vlan host
SwitchB(config-if-GigabitEthernet 0/17)# switchport private-vlan host-association 99 100
SwitchB(config-if-GigabitEthernet 0/17)#exit
SwitchB(config)#interface TenGigabitEthernet 0/19
SwitchB(config-if-TenGigabitEthernet 0/19)#switchport mode trunk
SwitchB(config-if-TenGigabitEthernet 0/19)#exit

Verification

Check whether VLANs and ports are correctly configured, and check whether packet forwarding is correct
according to packet forwarding rules in section "Features".

A

SwitchA#show running-config!
vlan 99
private-vlan primaryprivate-vlan association add 100-101!
vlan 100
private-vlan community!
vlan 101
private-vlan isolated!
interface GigabitEthernet 0/17
switchport mode private-vlan hostswitchport private-vlan host-association 99 101!
interface GigabitEthernet 0/18
switchport mode private-vlan promiscuous
switchport private-vlan mapping 99 add 100-101

6-13

Configuration Guide

Configuring Private VLAN(beta)!
interface TenGigabitEthernet 0/19
switchport mode trunk!
SwitchA# show vlan private-vlan
VLAN

Type

StatusRouted----- ---------- -------- ------active

Ports

99

primary100

community active

Disabled Te0/19

101

isolated

Disabled Gi0/17, Te0/19

activeAssociated VLANs--------------- ----------------Disabled Gi0/18, Te0/19

100-101
99
99

SwitchB#show running-configB!
vlan 99
private-vlan primaryprivate-vlan association add 100-101!
vlan 100
private-vlan community!
vlan 101
private-vlan isolated!
interface GigabitEthernet 0/18
switchport mode private-vlan hostswitchport private-vlan host-association 99 101!
interface GigabitEthernet 0/17
switchport mode private-vlan hostswitchport private-vlan host-association 99 100
interface GigabitEthernet 0/18
switchport mode private-vlan hostswitchport private-vlan host-association 99 101!

Common Errors


Layer-2 association is not performed between the primary VLAN and secondary VLANs of PVLAN, and a port
VLAN list fails to be added when isolated ports, promiscuous ports, and community ports are configured.

One host port fails to be associated with multiple PVLAN pairs.

6.6 Monitoring
Displaying
Description

Command6-14

Configuration Guide
Displays PVLAN configuration.

Configuring Private VLAN(beta)
show vlan private-vlan [ community | primary | isolated ]Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs PVLAN.

debug bridge pvlan

6-15

Configuration Guide

Configuring MSTP(beta)

7 Configuring MSTP(beta)
7.1 Overview
Spanning Tree Protocol (STP) is a Layer-2 management protocol. It cannot only selectively block redundant links toeliminate Layer-2 loops but also can back up links.
Similar to many protocols, STP is continuously updated from Rapid Spanning Tree Protocol (RSTP) to Multiple
Spanning Tree Protocol (MSTP) as the network develops.
For the Layer-2 Ethernet, only one active link can exist between two local area networks (LANs). Otherwise, abroadcast storm will occur. To enhance the reliability of a LAN, it is necessary to establish a redundant link and keepsome paths in backup state. If the network is faulty and a link fails, you must switch the redundant link to the active state.
STP can automatically activate the redundant link without any manual operations. STP enables devices on a LAN to:

Discover and start the best tree topology on the LAN.



Troubleshoot a fault and automatically update the network topology so that the possible best tree topology isalways selected.

The LAN topology is automatically calculated based on a set of bridge parameters configured by the administrator. The
best topology tree can be obtained by properly configuring these parameters.
RSTP is completely compatible with 802.1D STP. Similar to traditional STP, RSTP provides loop-free and redundancy
services. It is characterized by rapid speed. If all bridges in a LAN support RSTP and are properly configured by theadministrator, it takes less than 1 second (about 50 seconds if traditional STP is used) to re-generate a topology tree
after the network topology changes.
STP and RSTP have the following defects:

STP migration is slow. Even on point-to-point links or edge ports, it still takes two times of the forward delay forports to switch to the forwarding state.



RSTP can rapidly converge but has the same defect with STP:

Since all VLANs in a LAN share the samespanning tree, packets of all VLANs are forwarded along this spanning tree. Therefore, redundant links cannot be
blocked according to specific VLANs and data traffic cannot be balanced among VLANs.
MSTP, defined by the IEEE in 802.1s, resolves defects of STP and RSTP. It cannot only rapidly converge but also canenable traffic of different VLANs to be forwarded along respective paths, thereby providing a better load balancing
mechanism for redundant links.
In general, STP/RSTP works based on ports while MSTP works based on instances. An instance is a set of multiple
VLANs. Binding multiple VLANs to one instance can reduce the communication overhead and resource utilization.
Ruijie devices support STP, RSTP, and MSTP, and comply with IEEE 802.1D, IEEE 802.1w, and IEEE 802.1s.

Protocols andStandards
IEEE 802.1D: Media Access Control (MAC) Bridges

IEEE 802.1w: Part 3: Media Access Control (MAC) Bridges—Amendment 2: Rapid Reconfiguration

7-1

Configuration GuideConfiguring MSTP(beta)

IEEE 802.1s: Virtual Bridged Local Area Networks—Amendment 3: Multiple Spanning Trees

7.2 Applications
Application

Description

MSTP+VRRP Dual-Core Topology

With a hierarchical network architecture model, the MSTP+VRRP mode is used to
implement redundancy and load balancing to improve system availability of the
network.

BPDU Tunnel

In QinQ network environment, Bridge Protocol Data Unit (BPDU) Tunnel is used to
implement tunnel-based transparent transmission of STP packets.

7.2.1 MSTP+VRRP Dual-Core Topology
Scenario
The typical application of MSTP is the MSTP+VRRP dual-core solution. This solution is an excellent solution to improvesystem availability of the network. Using a hierarchical network architecture model, it is generally divided into threelayers (core layer, convergence layer, and access layer) or two layers (core layer and access layer). They form the core
network system to provide data exchange service.
The main advantage of this architecture is its hierarchical structure. In the hierarchical network architecture, all capacity
indicators, characteristics, and functions of network devices at each layer are optimized based on their network
locations and roles, enhancing their stability and availability.
Figure 8-1 MSTP+VRRP Dual-Core Topology

Remark

The topology is divided into two layers: core layer (Devices A and B) and access layer (Devices C and D).

s

Deployment
Core layer: Multiple MSTP instances are configured to realize load balancing. For example, two instances are
created: Instance 1 and Instance 2. Instance 1 maps VLAN 10 while Instance 2 maps VLAN 20. Device A is theroot bridge of Instances 0 and 1 (Instance 0 is CIST, which exists by default). Device B is the root bridge of
Instance 2.
7-2

Configuration Guide

Configuring MSTP(beta)Core layer: Devices A and B are the active VRRP devices respectively on VLAN 10 and VLAN 20.



Access layer: Configure the port directly connected to the terminal (PC or server) as a PortFast port, and enable
BPDU guard to prevent unauthorized users from accessing illegal devices.

7.2.2 BPDU Tunnel
Scenario
The QinQ network is generally divided into two parts:customer network and service provider (SP) network. You canenable BPDU Tunnel to calculate STP packets of the customer network independently of the SP network, thereby
preventing STP packets between the customer network from affecting the SP network.
Figure 8-2 BPDU Tunnel Topology

RemarkAs shown in the above figure, the upper part is the SP network and the lower part is the customer network.

s

The SP network consists of two provider edges (PEs): Provider S1 and Provider S2. Customer Network A1
and Customer Network A2 are a user's two sites in different regions. Customer S1 and Customer S2, accessdevices from the customer network to the SP network, access the SP network respectively through Provider
S1 and Provider S2.
Using BPDU Tunnel, Customer Network A1 and Customer Network A2 in different regions can perform unified
spanning tree calculation across the SP network, not affecting the spanning tree calculation of the SP
network.

Deployment
Enable basic QinQ on the PEs (Provider S1/Provider S2 in this example) so that data packets of the customer
network are transmitted within the specified VLAN on the SP network.

Enable STP transparent transmission on the PEs (Provider S1/Provider S2 in this example) so that the SP
network can transmit STP packets of the customer network through BPDU Tunnel.

7-3Configuration Guide

Configuring MSTP(beta)

7.3 Features
Basic Concepts



BPDU

To generate a stable tree topology network, the following conditions must be met:Each bridge has a unique ID consisting of the bridge priority and MAC address.

The overhead of the path from the bridge to the root bridge is called root path cost.



A port ID consists of the port priority and port number.

Bridges exchange BPDU packets to obtain information required for establishing the best tree topology. These packets
use the multicast address 01-80-C2-00-00-00 (hexadecimal) as the destination address.
A BPDU consists of the following elements:

Root bridge ID assumed by the local bridgeRoot path cost of the local bridge

Bridge ID (ID of the local bridge)

Message age (age of a packet)

Port ID (ID of the port sending this packet)

Forward-Delay Time, Hello Time, Max-Age Time are time parameters specified in the MSTP.

Other flags, such as flags indicating network topology changes and local port status.

If a bridge receives a BPDU with a higher priority (smaller bridge ID and lower root path cost) at a port, it saves the
BPDU information at this port and transmits the information to all other ports. If the bridge receives a BPDU with a lower
priority, it discards the information.
Such a mechanism allows information with higher priorities to be transmitted across the entire network. BPDU
exchange results are as follows:A bridge is selected as the root bridge.

Except the root bridge, each bridge has a root port, that is, a port providing the shortest path to the root bridge.

Each bridge calculates the shortest path to the root bridge.

Each LAN has a designated bridge located in the shortest path between the LAN and the root bridge. A port
designated to connect the bridge and the LAN is called designated port.



The root port and designated port enter the forwarding status.

Bridge ID

According to IEEE 802.1W, each bridge has a unique ID. The spanning tree algorithm selects the root bridge based on
the bridge ID. The bridge ID consists of eight bytes, of which the last six bytes are the MAC address of the bridge. In its
first two bytes (as listed in the following table), the first four bits indicate the priority; the last eight bits indicate thesystem ID for use in extended protocol. In RSTP, the system ID is 0. Therefore, the bridge priority should be a integral
multiple of 4,096.
-

Priority

System ID

7-4

Configuration Guide-

Configuring MSTP(beta)

Priority
11

10

9

8

7

6

5

4

3

2

1

Value 32768 16384 8192 4096 2048 1024

512

256

128

64

32

16

8

4

2

1

-

0

0

0

0

0

0

0

0

0

0

Bit



16

15

0

0

14

System ID

0

13

1

12

0

0

Spanning-Tree Timers

The following three timers affect the performance of the entire spanning tree:

Hello timer: Interval for periodically sending a BPDU packet.

Forward-Delay timer: Interval for changing the port status, that is, interval for a port to change from the listening
state to the learning state or from the learning state to the forwarding state when RSTP runs in STP-compatible
mode.



Max-Age timer: The longest time-to-live (TTL) of a BPDU packet. When this timer elapses, the packet isdiscarded.

Port Roles and Port States

Each port plays a role on a network to reflect different functions in the network topology.

Root port: Port providing the shortest path to the root bridge.

Designated port: Port used by each LAN to connect the root bridge.

Alternate port: Alternative port of the root port. Once the root port loses effect, the alternate port immediatelychanges to the root port.



Backup port: Backup port of the designated port. When a bridge has two ports connected to a LAN, the port withthe higher priority is the designated port while the port with the lower priority is the backup port.



Disabled port: Inactive port. All ports with the operation state being down play this role.

The following figures show the roles of different ports:
R = Root port

D = Designated port

A = Alternate port

B = Backup port

Unless otherwise specified, port priorities decrease from left to right.
Figure 8-3

7-5

Configuration Guide

Configuring MSTP(beta)

Figure 8-4

Figure 8-5

Each port has three states indicating whether to forward data packets so as to control the entire spanning tree topology.

Discarding: Neither forwards received packets nor learns the source MAC address.



Learning: Does not forward received packets but learns the source MAC address, which is a transitive state.

Forwarding: Forwards received packets and learns the source MAC address.

For a stable network topology, only the root port and designated port can enter the forwarding state while other ports
are always in discarding state.



Hop Count

Internal spanning trees (ISTs) and multiple spanning tree instances (MSTIs) calculate whether the BPDU packet time
expires based on an IP TTL-alike mechanism Hop Count, instead of Message Age and Max Age.
It is recommended to run the spanning-tree max-hops command in global configuration mode to configure the hopcount. In a region, every time a BPDU packet passes through a device from the root bridge, the hop count decreases by
1. When the hop count becomes 0, the BPDU packet time expires and the device discards the packet.
To be compatible with STP and RSTP outside the region, MSTP also retains the Message Age and Max Age
mechanisms.

Overview
FeatureDescription

STP

STP, defined by the IEEE in 802.1D, is used to eliminate physical loops at the data link layer in a
LAN.

RSTP

RSTP, defined by the IEEE in 802.1w, is optimized based on STP to rapidly converge the network
topology.

7-6Configuration Guide

Configuring MSTP(beta)

FeatureDescription

MSTP

MSTP, defined by the IEEE in 802.1s, resolves defects of STP, RSTP, and Per-VLAN Spanning
Tree (PVST). It cannot only rapidly converge but also can forward traffic of different VLANs along
respective paths, thereby providing a better load balancing mechanism for redundant links.

MSTP Optical

MSTP includes the following features: PortFast, BPDU guard, BPDU filter, TC protection, TC

Featuresguard, TC filter, BPDU check based on the source MAC address, BPDU filter based on the illegal
length, Auto Edge, root guard, and loop guard.

7.3.1 STP
STP is used to prevent broadcast storms incurred by loops and provide link redundancy.

Working Principle
For the Layer-2 Ethernet, only one active link can exist between two LANs. Otherwise, a broadcast storm will occur. To
enhance the reliability of a LAN, it is necessary to establish a redundant link and keep some paths in backup state. If the
network is faulty and a link fails, you must switch the redundant link to the active state. STP can automatically activate
the redundant link without any manual operations. STP enables devices on a LAN to:

Discover and start the best tree topology on the LAN.



Troubleshoot a fault and automatically update the network topology so that the possible best tree topology isalways selected.

The LAN topology is automatically calculated based on a set of bridge parameters configured by the administrator. The
best topology tree can be obtained by properly configuring these parameters.

7.3.2 RSTP
RSTP is completely compatible with 802.1D STP. Similar to traditional STP, RSTP provides loop-free and redundancy
services. It is characterized by rapid speed. If all bridges in a LAN support RSTP and are properly configured by theadministrator, it takes less than 1 second (about 50 seconds if traditional STP is used) to re-generate a topology tree
after the network topology changes.

Working Principle



Fast RSTP Convergence

RSTP has a special feature, that is, to make ports quickly enter the forwarding state.
STP enables a port to enter the forwarding state 30 seconds (two times of the Forward-Delay Time; the Forward-Delay
Time can be configured, with a default value of 15 seconds) after selecting a port role. Every time the topology changes,
the root port and designated port reselected by each bridge enter the forwarding state 30 seconds later. Therefore, ittakes about 50 seconds for the entire network topology to become a tree.
RSTP differs greatly from STP in the forwarding process. As shown in Figure 8-6, Switch A sends an RSTP Proposal
packet to Switch B. If Switch B finds the priority of Switch A higher, it selects Switch A as the root bridge and the port
receiving the packet as the root port, enters the forwarding state, and then sends an Agree packet from the root port to
Switch A. If the designated port of Switch A is agreed, the port enters the forwarding state. Switch B's designated port
resends a Proposal packet to extend the spanning tree by sequence. Theoretically, RSTP can recover the network tree
topology to rapidly converge once the network topology changes.

7-7Configuration Guide

Configuring MSTP(beta)

Figure 8-6

The above handshake process is implemented only when the connection between ports is in point-to-point mode.
To give the devices their full play, it is recommended not to enable point-to-point connection between devices.
Figure 8-7 and Figure 8-8 show the examples of non point-to-point connection.
Example of non point-to-point connection:
Figure 8-7

7-8

Configuration Guide

Configuring MSTP(beta)

Figure 8-8

Figure 8-9 shows an example of point-to-point connection.
Figure 8-9Compatibility Between RSTP and STP

RSTP is completely compatible with STP. RSTP automatically checks whether the connected bridge supports STP or
RSTP based on the received BPDU version number. If the port connects to an STP bridge, the port enters theforwarding state 30 seconds later, which cannot give RSTP its full play.
Another problem may occur when RSTP and STP are used together. As shown in the following figures, Switch A (RSTP)
connects to Switch B (STP). If Switch A finds itself connected to an STP bridge, it sends an STP BPDU packet.
However, if Switch B is replaced with Switch C (RSTP) but Switch A still sends STP BPDU packets, Switch C willassume itself connected to the STP bridge. As a result, two RSTP devices work under STP, greatly reducing theefficiency.
RSTP provides the protocol migration feature to forcibly send RSTP BPDU packets (the peer bridge must support
RSTP). In this case, Switch A is enforced to send an RSTP BPDU and Switch C then finds itself connected to the RSTP
bridge. As a result, two RSTP devices work under RSTP, as shown in Figure 8-10.
Figure 8-10

7-9

Configuration Guide

Configuring MSTP(beta)

Figure 8-11

7.3.3 MSTP
MSTP resolves defects of STP and RSTP. It cannot only rapidly converge but also can forward traffic of different VLANs
along respective paths, thereby providing a better load balancing mechanism for redundant links.

Working Principle
Ruijie devices support MSTP. MSTP is a new spanning tree protocol developed from traditional STP and RSTP and
includes the fast RSTP forwarding mechanism.
Since traditional spanning tree protocols are irrelevant to VLANs, problems may occur in specific network topologies:
As shown in Figure 8-12, Devices A and B are in VLAN 1 while Devices C and D are in VLAN 2, forming a loop.
Figure 8-12

If the link from Device A to Device B through Devices C and D costs less than the link from Device A direct to Device B,
the link between Device A and Device B enters the discarding state (as shown in Figure 8-13). Since Devices C and D
do not include VLAN 1 and cannot forward data packets of VLAN 1, VLAN 1 of Device A fails to communicate with
VLAN 1 of Device B.
Figure 8-12

7-10

Configuration Guide

Configuring MSTP(beta)

MSTP is developed to resolve this problem. It divides one or multiple VLANs of a device into an instance. Devices
configured with the same instance form an MST region to run an independent spanning tree (called IST). This MST
region, like a big device, implements the spanning tree algorithm with other MST regions to generate a complete
spanning tree called common spanning tree (CST).
Based on this algorithm, the above network can form the topology shown in Figure 8-13 under the MSTP algorithm:
Devices A and B are in MSTP region 1 in which no loop occurs, and therefore no link enters the discarding state. This
also applies to MSTP Region 2. Region 1 and Region 2, like two big devices having loops, select a link to enter thediscarding state based on related configuration.
Figure 8-13

This prevents loops to ensure proper communication between devices in the same VLAN.

MSTP Region Division

To give MSTP its due play, properly divide MSTP regions and configure the same MST configuration information fordevices in the same MSTP region.
MST configuration information include:

MST configuration name: Consists of at most 32 bytes to identify an MSTP region.



MST Revision Number: Consists of 16 bits to identify an MSTP region.



MST instance-VLAN mapping table: A maximum number of 64 instances (with their IDs ranging from 1 to 64) arecreated for each device and Instance 0 exists mandatorily. Therefore, the system supports a maximum number of
65 instances. Users can assign 1 to 4,994 VLANs belonging to different instances (ranging from 0 to 64) as
required. Unassigned VLANs belong to Instance 0 by default. In this case, each MSTI is a VLAN group andimplements the spanning tree algorithm of the MSTI specified in the BPDU packet, not affected by CIST and other
MSTIs.

Run the spanning-tree mst configuration command in global configuration mode to enter the MST configuration
mode to configure the above information.
MSTP BPDUs carry the above information. If the BPDU received by a device carries the same MST configuration
information with the information on the device, it regards that the connected device belongs to the same MST region
with itself. Otherwise, it regards the connected device originated from another MST region.
7-11

Configuration Guide

Configuring MSTP(beta)

It is recommended to configure the instance-VLAN mapping table after disabling MSTP. After the configuration,
re-enable MSTP to ensure stability and convergence of the network topology.



IST (Spanning Tree in an MSTP Region)

After MSTP regions are divided, each region selects an independent root bridge for each instance based on thecorresponding parameters such as bridge priority and port priority, assigns roles to each port on each device, andspecifies whether the port is in forwarding or discarding state in the instance based on the port role.
Through MSTP BPDU exchange, an IST is generated and each instance has their own spanning trees (MSTIs), in
which the spanning tree corresponding to Instance 0 and CST are uniformly called Common Instance Spanning Tree
(CIST). That is, each instance provides a single and loop-free network topology for their own VLAN groups.
As shown in Figure 8-15, Devices A, B, and C form a loop in Region 1. Device A has the highest priority in the CIST
(Instance 0) and thereby is selected as the region root. Then MSTP enables the link between A and C to enter thediscarding state based on other parameters. Therefore, for the VLAN group of Instance 0, only links from A to B andfrom B to C are available, interrupting the loop of this VLAN group.
Figure 8-14

As shown in Figure 8-16, Device B has the highest priority in the MSTI 1 (Instance 1) and thereby is selected as theregion root. Then MSTP enables the link between B and C to enter the discarding state based on other parameters.
Therefore, for the VLAN group of Instance 1, only links from A to B and from A to C are available, interrupting the loop of
this VLAN group.

7-12

Configuration Guide

Configuring MSTP(beta)

Figure 8-15

As shown in Figure 8-16, Device C has the highest priority in the MSTI 2 (Instance 2) and thereby is selected as theregion root. Then MSTP enables the link between B and C to enter the discarding state based on other parameters.
Therefore, for the VLAN group of Instance 2, only links from B to C and from A to C are available, interrupting the loopof this VLAN group.
Figure 8-16

Note that MSTP does not care which VLAN a port belongs to. Therefore, users should configure the path cost andpriority of a related port based on the actual VLAN configuration to prevent MSTP from interrupting wrong loops.



CST (Spanning Tree Between MSTP Regions)

Each MSTP region is like a big device for the CST. Different MSTP regions form a bit network topology tree called CST.
As shown in Fgiure 8-18, Device A, of which the bridge ID is the smallest, is selected as the root in the entire CST and
the CIST regional root in this region. In Region 2, since the root path cost from Device B to the CST root is lowest,
Device B is selected as the CIST regional root in this region. For the same reason, Device C is selected as the CIST
regional root.

7-13

Configuration Guide

Configuring MSTP(beta)

Figure 8-17

The CIST regional root may not be the device of which the bridge ID is the smallest in the region but indicates thedevice of which the root path cost from this region to the CST root is the smallest.
For the MSTI, the root port of the CIST regional root has a new role "master port". The master port acts as the outboundport of all instances and is in forwarding state for all instances. To make the topology more stable, we suggest that themaster port of each region to the CST root be on the same device of the region if possible.

Compatibility Among MSTP, RSTP, and STP

Similar to RSTP, MSTP sends STP BPDUs to be compatible with STP. For details, see "Compatibility Between RSTP
and STP".
Since RSTP processes MSTP BPDUs of the CIST, MSTP does not need to send RSTP BPDUs to be compatible with it.
Each STP or RSTP device is a single region and does not form the same region with any devices.

7.3.4 MSTP Optional Features
MSTP optional features mainly include PortFast port, BPDU guard, BPDU filter, TC guard, and guard. The optionalfeatures are mainly used to deploy MSTP configurations based on the network topology and application characteristics
in the MSTP network. This enhances the stability, robustness, and anti-attack capability of MSTP, meeting application
requirements of MSTP in different customer scenarios.

Working Principle



PortFast

If a port of a device connects directly to the network terminal, this port is configured as a PortFast port to directly enter
the forwarding state. If the PortFast port is not configured, the port needs to wait for 30 seconds to enter the forwarding
state. Figure 8-19 shows which ports of a device can be configured as PortFast ports.

7-14

Configuration Guide

Configuring MSTP(beta)

Figure 8-18

If a PortFast port still receives BPDUs, its Port Fast Operational State is Disabled and the port enters the forwarding
state according to the normal STP algorithm.



BPDU Guard

BPDU guard can be enabled globally or enabled on an interface.
It is recommended to run the spanning-tree portfast bpduguard default command in global configuration mode toenable global BPDU guard. If PortFast is enabled on a port or this port is automatically identified as an edge port, thisport enters the error-disabled state to indicate the configuration error immediately after receiving a BPDU. At the sametime, the port is disabled, indicating that a network device may be added by an unauthorized user to change the
network topology.
It is also recommended to run the spanning-tree bpduguard enable command in interface configuration mode toenable BPDU guard on a port (whether PortFast is enabled or not on the port). In this case, the port enters theerror-disabled state immediately after receiving a BPDU.

BPDU Filter

BPDU filter can be enabled globally or enabled on an interface.
It is recommended to run the spanning-tree portfast bpdufilter default command in global configuration mode toenable global BPDU filter. In this case, the PortFast port neither receives nor sends BPDUs and therefore the hostconnecting directly to the PortFast port receives no BPDUs. If the port changes its Port Fast Operational State to
Disabled after receiving a BPDU, BPDU filter automatically loses effect.
It is also recommended to run the spanning-tree bpdufilter enable command in interface configuration mode toenable BPDU filter on a port (whether PortFast is enabled or not on the port). In this case, the port neither receives nor
sends BPDUs but directly enters the forwarding state.



TC Protection

TC BPDUs are BPDU packets carrying the TC. If a switch receives such packets, it indicates the network topology
changes and the switch will delete the MAC address table. For Layer-3 switches in this case, the forwarding module isre-enabled and the port status in the ARP entry changes. When a switch is attacked by forged TC BPDUs, it will
frequently perform the above operations, causing heavy load and affecting network stability. To prevent this problem,
you can enable TC protection.

7-15

Configuration Guide

Configuring MSTP(beta)

TC protection can only be globally enabled or disabled. This function is disabled by default.
When TC protection is enabled, the switch deletes TC BPDUs within a specified period (generally 4 seconds) after
receiving them and monitors whether any TC BPDU packet is received during the period. If a device receives TC BPDU
packets during this period, it deletes them when the period expires. This can prevent the device from frequently deleting
MAC address entries and ARP entries.

TC Guard

TC protection ensures less dynamic MAC addresses and ARP entries removed when a large number of TC packets are
generated on the network. However, a device receiving TC attack packets still performs many removal operations andTC packets can be spread, affecting the entire network. Users can enable TC guard to prevent TC packets fromspreading globally or on a port. If TC guard is enabled globally or on a port, a port receiving TC packets filters these TC
packets or TC packets generated by itself so that TC packets will not be spread to other ports. This can effectively
control possible TC attacks in the network to ensure network stability. Particularly on Layer-3 devices, this function caneffectively prevent the access-layer device from flapping and interrupting the core route.
If TC guard is used incorrectly, the communication between networks is interrupted.
It is recommended to enable this function only when illegal TC attack packets are received in the network.
If TC guard is enabled globally, no port spreads TC packets to others. This function can be enabled only on laptop
access devices.
If TC guard is enabled on a port, the topology changes incurred and TC packets received on the port will not be
spread to other ports. This function can be enabled only on uplink ports, particularly on ports of the convergence
core.



TC Filter

If TC guard is enabled on a port, the port does not forward TC packets received and generated by the port to other ports
performing spanning tree calculation on the device. When the status of a port changes (for example, from blocking toforwarding), the port generates TC packets, indicating that the topology may have changed.
In this case, since TC guard prevents TC packets from spreading, the device may not clear the MAC addresses of theport when the network topology changes, causing a data forwarding error.
To resolve this problem, TC filter is introduced. TC filter does not process TC packets received by ports but processes
TC packets in case of normal topology changes. If TC filter is enabled, the address removal problem will be avoided
and the core route will not be interrupted when ports not enabled with PortFast frequently go up or down, and the corerouting entries can be updated in a timely manner when the topology changes.
TC filter is disabled by default.



BPDU Source MAC Address Check

BPDU source MAC address check prevents BPDU packets from maliciously attacking switches and causing MSTP
abnormal. When the switch connected to a port on a point-to-point link is determined, you can enable BPDU source
MAC address check to receive BPDU packets sent only by the peer switch and discard all other BPDU packets, thereby
preventing malicious attacks. You can enable the BPDU source MAC address check in interface configuration mode fora specific port. One port can only filter one MAC address. If you run the no bpdu src-mac-check command to disable
BPDU source MAC address check on a port, the port receives all BPDU packets.

7-16

Configuration GuideConfiguring MSTP(beta)

BPDU Filter

If the Ethernet length of a BPDU exceeds 1,500, this BPDU will be discarded, preventing receipt of illegal BPDU
packets.



Auto Edge

If the designated port of a device does not receive a BPDU from the downlink port within a specific period (3 seconds),
the device regards a network device connected to the designated port, configures the port as an edge port, andswitches the port directly into the forwarding state. The edge port will be automatically identified as a non-edge port
after receiving a BPDU.
You can run the spanning-tree autoedge disabled command to disable Auto Edge.
This function is enabled by default.
If Auto Edge conflicts with the manually configured PortFast, the manual configuration prevails.
Since this function is used for rapid negotiation and forwarding between the designated port and the downlink port,
STP does not support this function. If the designated port is in forwarding state, the Auto Edge configuration does
not take effect on this port. It takes only when rapid negotiation is re-performed, for example, when the network
cable is removed and plugged.
If BPDU filter has been enabled on a port, the port directly enters the forwarding state and is not automatically
identified as an edge port.
This function applies only to the designated port.



Root Guard

In the network design, the root bridge and backup root bridge are usually divided into the same region. Due to incorrect
configuration of maintenance personnel or malicious attacks in the network, the root bridge may receive configuration
information with a higher priority and thereby switches to the backup root bridge, causing incorrect changes in the
network topology. Root guard is to resolve this problem.
If root guard is enabled on a port, its roles on all instances are enforced as the designated port. Once the port receives
configuration information with a higher priority, it enters the root-inconsistent (blocking) state. If the port does notreceive configuration information with a higher priority within a period, it returns to its original state.
If a port enters the blocking state due to root guard, you can manually restore the port to the normal state by disablingroot guard on this port or disabling spanning tree guard (running spanning-tree guard none in interface configurationmode).
If root guard is used incorrectly, the network link will be interrupted.
If root guard is enabled on a non-designated port, this port will be enforced as a designated port and enter the
BKN state. This indicates that the port enters the blocking state due to root inconsistency.
If a port enters the BKN state due to receipt of configuration information with a higher priority in MST0, this port will
be enforced in the BKN state in all other instances.
Root guard and loop guard cannot take effect on a port at the same time.



Loop Guard

7-17

Configuration Guide

Configuring MSTP(beta)

Due to the unidirectional link failure, the root port or backup port becomes the designated port and enters the forwarding
state if it does not receive BPDUs, causing a network loop. Loop guard is to prevent this problem.
If a port enabled with loop guard does not receive BPDUs, the port switches its role but stays in discarding state till it
receives BPDUs and recalculates the spanning tree.
You can enable loop guard globally or on a port.
Root guard and loop guard cannot take effect on a port at the same time.
Before MSTP is restarted on a port, the port enters the blocking state in loop guard. If the port still receives no
BPDU after MSTP is restarted, the port will become a designated port and enter the forwarding state. Therefore, it
is recommended to identify the cause why a port enters the blocking state in loop protection and rectify the fault assoon as possible before restarting MSTP. Otherwise, the spanning tree topology will still become abnormal after
MSTP is restarted.



BPDU Transparent Transmission

In IEEE 802.1Q, the destination MAC address 01-80-C2-00-00-00 of the BPDU is used as a reserved address. That is,devices compliant with IEEE 802.1Q do not forward the BPDU packets received. However, devices may need totransparently transmit BPDU packets in actual network deployment. For example, if STP is disabled on a device, thedevice needs to transparently transmit BPDU packets so that the spanning tree between devices is properly calculated.
BPDU transparent transmission is disabled by default.
BPDU transparent transmission takes effect only when STP is disabled. If STP is enabled on a device, the device
does not transparently transmit BPDU packets.



BPDU Tunnel

The QinQ network is generally divided into two parts: customer network and SP network. Before a user packet enters
the SP network, it is encapsulated with the VLAN tag of an SP network and also retains the original VLAN tag as data.
As a result, the packet carries two VLAN tags to pass through the SP network. In the SP network, packets aretransmitted only based on the outer-layer VLAN tag. When packets leave the SP network, the outer-layer VLAN tag isremoved.
The STP packet transparent transmission feature, namely BPDU Tunnel, can be used to realize the transmission of
STP packets between the customer network without any impact on the SP network. If an STP packet sent from thecustomer network enters a PE, the PE changes the destination MAC address of the packet to a private address before
the packet is forwarded by the SP network. When the packet reaches the PE at the peer end, the PE changes thedestination MAC address to a public address and returns the packet to the customer network at the peer end, realizing
transparent transmission across the SP network. In this case, STP on the customer network is calculated independentlyof that on the SP network.

7.4 Configuration
Configuration
Enabling STP

Description and Command(Mandatory) It is used to enable STP.
Enables STP and configures basic attributes.

spanning-tree

7-18

Configuration Guide
Configuration

Configuring MSTP(beta)
Description and Command(Optional) It is used to configure basic attributes.
spanning-tree [ forward-time forward |hello-time hello | max-age age | max-hops

Configures basic attributes.

hop-count | tx-hold-count tx-hold-count ](Optional) It is used to configure the STP mode.
spanning-tree mode { stp | rstp | mstp }Configures the STP mode.

(Optional) It is used to be compatible with competitor devices.
Configuring STP

Enables the compatibility mode of a port.

spanning-tree compatible enable

Compatibility
clear spanning-tree detected-protocols
Configuring an
MSTP Region
Enabling Fast
RSTP
Convergence

Performs mandatory version check for
BPDUs.

(Optional) It is used to configure an MSTP region.
Enters the MST configuration mode.

spanning-tree mst configuration(Optional) It is used to configure whether the link type of a port is point-to-point connection.
spanning-tree link-type { point-to-point |shared }Configures the link type.

(Optional) It is used to configure the switch priority or port priority.
Configuring
Priorities

spanning-tree [ mst instance-id ] priority priority
spanning-tree [ mst instance-id ] port-priority
port-priority

Configures the switch priority.
Configures the port priority.

(Optional) It is used to configure the path cost of a port or the default path cost calculation
Configuring thePort Path Cost

Configuring Auto
Edge

method.
spanning-tree pathcost method { long | long

Configures the default path cost calculation

standard | short }method.

spanning-tree [ mst instance-id ] cost cost

Configures the port path cost.

(Optional) It is used to configure Auto Edge.
spanning-tree autoedge [ disabled ]Enables Auto Edge on a port. This function isenabled by default.

(Optional) It is used to enable PortFast-related features.
Enabling

spanning-tree portfast

Configures PortFast.

PortFast-related

spanning-tree portfast bpduguard default

Enables BPDU guard on all ports.

Featuresspanning-tree bpduguard { enabled | disabled }Configures BPDU guard on a port.

spanning-tree portfast bpdufilter default

Enables BPDU filter on all ports.

spanning-tree bpdufilter { enabled | disabled }Configures BPDU filter on a port.

Enabling
TC-related(Optional) It is used to enable TC-related features.
Enables TC protection.

spanning-tree tc-protection

7-19

Configuration Guide

Configuring MSTP(beta)

Configuration

Description and Command

Featuresspanning-tree tc-protection tc-guard

Enables TC guard on all ports.

spanning-tree tc-guard

Enables TC guard on a port.

spanning-tree ignore tc

Enables TC filter on a port.

Enabling BPDU

(Optional) It is used to enable BPDU source MAC address check.

Source MAC
Address Check

Enables BPDU source MAC address checkbpdu src-mac-check mac-address

on a port.

(Optional) It is used to enable port guard features.
Enabling
Guard-related
Featuresspanning-tree guard root

Enables root guard on a port.

spanning-tree loopguard default

Enables loop guard on all ports.

spanning-tree guard loop

Enables loop guard on a port.

spanning-tree guard none

Disables the guard feature on a port.

Enabling BPDU

(Optional) It is used to enable BPDU transparent transmission

Transparent
Transmission

bridge-frame forwarding protocol bpdu

Enables BPDU transparent transmission.

(Optional) It is used to enable BPDU Tunnel.
Enabling BPDU

l2protocol-tunnel stp

Enables BPDU Tunnel globally.

Tunnell2protocol-tunnel stp enable

Enables BPDU Tunnel on a port.

l2protocol-tunnel stp tunnel-dmac mac-address

Configures the transparent transmission
address of BPDU Tunnel.

7.4.1 Enabling STP
Configuration EffectEnable STP globally and configure the basic attributes. Configure the maximum hop count of a BPDU packet tochange the BPDU TTL and thereby affect the network topology.

Configure the STP mode.

Notes


STP is disabled by default. Once STP is enabled, the device starts to run STP. The device runs MSTP by default.



The default STP mode is MSTP mode.



STP and Transparent Interconnection of Lots of Links (TRILL) of the data center cannot be enabled at the same
time.



In a region, the BPDU sent by the root bridge includes a hop count. Every time a BPDU passes through a device
from the root bridge, the hop count decreases by 1. When the hop count becomes 0, the BPDU times out and thedevice discards the packet. This command specifies the number of devices a BPDU passes through in a region
before being discarded. Changing the maximum hop count will affect all instances. The default maximum hopcount of a BPDU packet is 20. Generally. If the network topology is so large that a BPDU packet exceeds thedefault 20 hops, it is recommended to change the maximum hop count.

Configuration Steps
7-20

Configuration Guide

Configuring MSTP(beta)Enabling STPMandatory.



Unless otherwise specified, enable STP on each device.



Run the spanning-tree command to enable STP.

Commandspanning-tree

Parameter

N/A

Description
Defaults

STP is disabled by default.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configure basic attributes

Optional.

Run the spanning-tree [ forward-time seconds | hello-time seconds | max-age seconds | max-hops hop-count |tx-hold-count tx-hold-count ] command to enable STP and configure basic attributes.



If the network topology is so large that a BPDU packet exceeds the default 20 hops, it is recommended to change
the maximum hop count.

Running the clear commands may lose vital information and thus interrupt services.



The forward-time ranges from 4 to 30. The hello-time ranges from 1 to 10. The max-age ranges from 6 to 40.

Commandspanning-tree [ forward-time forward | hello-time hello | max-age age | max-hops hop-count |tx-hold-count tx-hold-count ]Parameter

forward-time forward: Indicates the forward delay. The value ranges from 4 to 30 seconds.

Description

hello-time hello: Indicates the interval at which a device sends a BPDU packet. The value ranges from 1
to 10 seconds.
max-age age: Indicates the longest TTL of a BPDU packet. The value ranges from 6 to 40 seconds.
max-hops hop-count: Indicates the number of hops in a region that the BPDU message passes before
being dropped. The range is 1 to 40 hops.
tx-hold-count tx-hold-count: Indicates the maximum number of BPDUs sent per second. The value
ranges from 1 to 10.

Defaults

The forward-time is 15 seconds. The hello-time is 2 seconds. The max-age is 20 seconds. The max-hop
is 20. The tx-hold-count is 3.

Command

Global configuration mode

Mode
Usage Guide

The value ranges of forward-time, hello-time, and max-age are related. If one of them is modified, theother two ranges are affected. The three values must meet the following condition:2x(Hello Time+1 second) ≤ Max-Age Time ≤ 2x (Forward-Delay Time–1 second)
Otherwise, the topology may become unstable and the configuration will fail.

Configuring the STP Mode

7-21

Configuration Guide

Configuring MSTP(beta)

Optional.



According to related 802.1 protocol standards, STP, RSTP, and MSTP are mutually compatible, without any
configuration by the administrator. However, some vendors' devices do not work according to 802.1 protocol
standards, possibly causing incompatibility. Therefore, Ruijie provides a command for the administrator to switch
the STP mode to a lower version if other vendors' devices are incompatible with Ruijie devices.



Run the spanning-tree mode { stp | rstp | mstp } command to modify the STP mode.

Commandspanning-tree mode { stp | rstp | mstp }Parameter

stp: Spanning Tree Protocol (IEEE 802.1d)

Description

rstp: Rapid Spanning Tree Protocol (IEEE 802.1w)
mstp: Multiple Spanning Tree Protocol (IEEE 802.1s)

Defaults

The default value is mstp.

Command

Global configuration mode

Mode
Usage Guide

However, some vendors' devices do not work according to 802.1 protocol standards, possibly causing
incompatibility. If other vendors' devices are incompatible with Ruijie devices, run this command toswitch the STP mode to a lower version.

VerificationDisplay the configuration.

Configuration
Example

Enabling STP and Configuring Timer Parameters

Scenario
Figure 8-19

ConfiguratioEnable STP and set the STP mode to STP on the devices.

n StepsConfigure the timer parameters of root bridge DEV A as follows: Hello Time=4s, Max Age=25s,
Forward Delay=18s.

DEV A

Step 1: Enable STP and set the STP mode to STP.
Ruijie# configure terminal
Ruijie(config)# spanning-tree
Ruijie(config)# spanning-tree mode stp
Step 2: Configure the timer parameters of root bridge DEV A.
Ruijie(config)# spanning-tree hello-time 4

7-22

Configuration Guide

Configuring MSTP(beta)

Ruijie(config)# spanning-tree max-age 25
Ruijie(config)# spanning-tree forward-time 18
DEV B

Enable STP and set the STP mode to STP.
Ruijie# configure terminal
Ruijie(config)# spanning-tree
Ruijie(config)# spanning-tree mode stp

Verification



Run the show spanning-tree summary command to display the spanning tree topology andprotocol configuration parameters.

DEV A

Ruijie#show spanning-tree summary
Spanning tree enabled protocol stp
Root ID

Priority0

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

4 sec

Forward Delay 18 sec

Max Age 25 sec

0Address00d0.f822.3344

Hello Time

4 sec

Forward Delay 18 sec

Role Sts Cost

Prio

Max Age 25 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ----------------

DEV B

Gi0/18Desg FWD 20000

128

False

P2p

Gi0/17

Desg FWD 20000

128

False

P2p

Ruijie#show spanning-tree summary
Spanning tree enabled protocol stp
Root ID

Priority0

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

4 sec

Forward Delay 18 sec

Max Age 25 sec

32768

Address

001a.a917.78cc

Hello Time

2 sec

Role Sts Cost

Forward Delay 15 sec
Prio

Max Age 20 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ----------------



Gi0/18

Altn BLK 20000

128

False

P2p Bound(STP)

Gi0/17

Root FWD 20000

128

False

P2p Bound(STP)

Configuring the Maximum Hop Count of a BPDU Packet

7-23

Configuration Guide
Configuratio

Configuring MSTP(beta)

Set the maximum hop count of a BPDU packet to 25.

n StepsRuijie(config)# spanning-tree max-hops 25
Verification



Run the show spanning-tree command to display the configuration.

Ruijie# show spanning-tree
StpVersion : MSTP
SysStpStatus : ENABLED
MaxAge : 20
HelloTime : 2
ForwardDelay : 15
BridgeMaxAge : 20
BridgeHelloTime : 2
BridgeForwardDelay : 15
MaxHops: 25
TxHoldCount : 3
PathCostMethod : LongBPDUGuard : Disabled
BPDUFilter : Disabled
LoopGuardDef: Disabled###### mst 0 vlans map : ALL
BridgeAddr : 00d0.f822.3344
Priority: 0
TimeSinceTopologyChange : 2d:0h:46m:4s
TopologyChanges : 25
DesignatedRoot : 0.001a.a917.78cc
RootCost : 0
RootPort : GigabitEthernet 0/17
CistRegionRoot : 0.001a.a917.78cc
CistPathCost : 20000

Common Errors
The STP timer parameters will take effect only when the device is set as the root bridge of the STP.Configuring STP
Compatibility.

7.4.2 Configuring STP Compatibility
Configuration EffectEnable the compatibility mode of a port to realize interconnection between Ruijie devices and other SPs' devices.



Enable protocol migration to perform forcible version check to affect the compatibility between RSTP and STP.

Notes

7-24

Configuration GuideConfiguring MSTP(beta)

If the compatibility mode is enabled on a port, this port will add different MSTI information into the to-be-sent
BPDU based on the current port to realize interconnection between Ruijie devices and other SPs' devices.

Configuration Steps

Enabling the Compatibility Mode on a Port

Optional.

Commandspanning-tree compatible enable

Parameter

N/A

Description
Defaults

The compatibility mode is disabled on a port by default.

Command

Interface configuration mode

Mode
Usage Guide

If the compatibility mode is enabled on a port, this port will add different MSTI information into the
to-be-sent BPDU based on the current port to realize interconnection between Ruijie devices and otherSPs' devices.



Enabling Protocol Migration



Optional.



If the peer device supports RSTP, you can enforce version check on the local device to force the two devices to
run RSTP.



Run the clear spanning-tree detected-protocols [ interface interface-type interface-number ] command to
enforce version check on a port. For details, see "Compatibility Between RSTP and STP".

Commandclear spanning-tree detected-protocols [ interface interface-type interface-number ]Parameterinterface interface-type interface-number: Indicates a port.

Description
Defaults

N/A

CommandPrivileged EXEC mode

Mode
Usage Guide

This command is used to enforce a port to send RSTP BPDU packets and perform forcible check on
them.

VerificationDisplay the configuration.

Configuration
Example

Enabling STP Compatibility

7-25

Configuration Guide

Configuring MSTP(beta)

Scenario
Figure 8-20

Configuratio

n Steps

Configure Instances 1 and 2 on Devices A and B, and map Instance 1 with VLAN 10 and Instance
2 with VLAN 20.



Configure Gi0/17 and Gi0/18 to respectively belong to VLAN 10 and VLAN 20, and enable STP
compatibility.

DEV A

Step 1: Configure Instances 1 and 2, and map Instances 1 and 2 respectively with VLANs 10 and 20.
Ruijie#configure terminal
Ruijie(config)#spanning-tree mst configuration
Ruijie(config-mst)#instance 1 vlan 10
Ruijie(config-mst)#instance 2 vlan 20
Step 2: Configure the VLAN the port belongs to, and enable STP compatibility on the port.
Ruijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#switchport access vlan 10
Ruijie(config-if-GigabitEthernet 0/17)#spanning-tree compatible enable
Ruijie(config-if-GigabitEthernet 0/17)#exit
Ruijie(config)#interface gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)#switchport access vlan 20
Ruijie(config-if-GigabitEthernet 0/18)#spanning-tree compatible enable

DEV B

Perform the same steps as DEV A.

Verification



Run the show spanning-tree summary command to check whether the spanning tree topology iscorrectly calculated.

DEV A

Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : 1-9, 11-19, 21-4094
Root ID

Priority

32768

Address

001a.a917.78cc

this bridge is root
Hello Time
Bridge ID Priority

2 sec

Forward Delay 15 sec

Max Age 20 sec

32768

Address

001a.a917.78cc

Hello Time

2 sec

Forward Delay 15 sec

7-26

Max Age 20 sec

Configuration Guide
Interface

Configuring MSTP(beta)
Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/18

Desg FWD 20000

128

False

P2p

Gi0/17

Desg FWD 20000

128

False

P2p

MST 1 vlans map : 10
Region Root Priority
Address

32768
001a.a917.78cc

this bridge is region root
Bridge ID Priority
Address
Interface

32768
001a.a917.78cc

Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/17

Desg FWD 20000

128

False

P2p

MST 2 vlans map : 20
Region Root Priority
Address

32768
001a.a917.78cc

this bridge is region root
Bridge ID Priority
Address
Interface

32768
001a.a917.78cc

Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/18
DEV B

Desg FWD 20000

128

False

P2p

Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : 1-9, 11-19, 21-4094
Root ID

Priority

32768

Address

001a.a917.78cc

this bridge is root
Hello Time
Bridge ID Priority

Interface

2 sec

Forward Delay 15 sec

Max Age 20 sec

32768

Address00d0.f822.3344

Hello Time

4 sec

Role Sts Cost

Forward Delay 18 sec
Prio

Max Age 25 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/18

Altn BLK 20000

128

7-27

False

P2p

Configuration Guide
Gi0/17

Configuring MSTP(beta)
Root FWD 20000

128

False

P2p

MST 1 vlans map : 10
Region Root Priority
Address

32768
001a.a917.78cc

this bridge is region root
Bridge ID Priority
Address
Interface32768
00d0.f822.3344

Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/17

Root FWD 20000

128

False

P2p

MST 2 vlans map : 20
Region Root Priority
Address

32768
001a.a917.78cc

this bridge is region root
Bridge ID Priority
Address
Interface32768
00d0.f822.3344

Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/18

Root FWD 20000

128

False

P2p

Common Errors
N/A

7.4.3 Configuring an MSTP Region
Configuration EffectConfigure an MSTP region to adjust which devices belong to the same MSTP region and thereby affect the
network topology.

Notes


Optional. Configure an MSTP region when multiple devices need to belong to the same MSTP region.

To make multiple devices belong to the same MSTP region, configure the same name, revision number, andinstance-VLAN mapping table for them.

You can configure VLANs for Instances 0 to 64, and then the remaining VLANs are automatically allocated to
Instance 0. One VLAN belongs to only one instance.



It is recommended to configure the instance-VLAN mapping table after disabling STP. After the configuration,
re-enable MSTP to ensure stability and convergence of the network topology.

7-28

Configuration Guide

Configuring MSTP(beta)

Configuration Steps

Configuring an MSTP RegionRun the spanning-tree mst configuration command to enter the MST configuration mode.

Commandspanning-tree mst configuration

Parameter

N/A

Description
Defaults

N/A

Command

Global configuration mode

Mode
Usage GuideRun this command to enter the MST configuration mode.

Run the instance instance-id vlan vlan-range command to configure the MSTI-VLAN mapping.

Commandinstance instance-id vlan vlan-range

Parameter

instance-id: Indicates the MSTI ID, ranging from 0 to 64.

Description

vlan vlan-range: Indicates the VLAN ID, ranging from 1 to 4,094.

Defaults

The default instance-VLAN mapping is that all VLANs are in Instance 0.

Command

MST configuration mode

Mode
Usage Guide

To add a VLAN group to an MSTI, run this command.
For example,
instance 1 vlan 2-200: Adds VLANs 2 to 200 to Instance 1.
instance 1 vlan 2,20,200: Adds VLANs 2, 20, and 200 to Instance 1.
You can use the no form of this command to remove VLANs from an instance. Removed VLANs areautomatically forwarded to Instance 0.

Run the name name command to configure the MST name.

Commandname nameParameter

name: Indicates the MST name. It consists of a maximum of 32 bytes.

Description
Defaults

The default name is an empty character string.

Command

MST configuration mode

Mode
Usage GuideN/A

Run the revision version command to configure the MST version number.

Commandrevision version

Parameter

version: Indicates the MST revision number, ranging from 0 to 65,535.

Description
Defaults

The default revision number is 0.

Command

MST configuration mode

Mode
Usage Guide

N/A

Verification

7-29

Configuration Guide

Configuring MSTP(beta)Display the configuration.

Run the show spanning-tree mst configuration command to display the MSTP region configuration.

Configuration
Example

Enabling MSTP to Achieve VLAN Load Balancing in the MSTP+VRRP Topology

Scenario
Figure 98-21

ConfiguratioEnable MSTP and create Instances 1 and 2 on Switches A, B, C, and D.

n StepsConfigure Switch A as the root bridge of Instances 0 and 1 and Switch B as the root bridge of
Instance 2.

Configure Switch A as the VRRP master device of VLANs 1 and 10 and Switch B as the VRRP
master device of VLAN 20.

A

Step 1: Configure VLANs 10 and 20, and configure ports as Trunk ports.
A(config)#vlan 10A(config-vlan)#vlan 20A(config-vlan)#exit
A(config)#int range gi interface range gigabitethernet 0/17-18
A(config-if-range)#switchport mode trunk
A(config-if-range)#int ag 1A(config-if-AggregatePort 1)# switchport mode trunk

Step 2: Enable MSTP and create Instances 1 and 2.
A(config)#spanning-tree
A(config)# spanning-tree mst configuration
A(config-mst)#instance 1 vlan 10A(config-mst)#instance 2 vlan 20A(config-mst)#exit

Step 3: Configure Switch A as the root bridge of Instances 0 and 1.
A(config)#spanning-tree mst 0 priority 4096
A(config)#spanning-tree mst 1 priority 4096

7-30

Configuration Guide

Configuring MSTP(beta)

A(config)#spanning-tree mst 2 priority 8192

Step 4: Configure VRRP priorities to enable Switch A to act as the VRRP master device of VLAN 10, andconfigure the virtual gateway IP address of VRRP.
A(config)#interface vlan 10A(config-if-VLAN 10)ip address 192.168.10.2 255.255.255.0
A(config-if-VLAN 10) vrrp 1 priority 120
A(config-if-VLAN 10) vrrp 1 ip 192.168.10.1

Step 5 Set the VRRP priority to the default value 100 to enable Switch A to act as the VRRP backup
device of VLAN 20.
A(config)#interface vlan 20A(config-if-VLAN 20)ip address 192.168.20.2 255.255.255.0
A(config-if-VLAN 20) vrrp 1 ip 192.168.20.1
B

Step 1: Configure VLANs 10 and 20, and configure ports as Trunk ports.
B(config)#vlan 10B(config-vlan)#vlan 20
B(config-vlan)#exit
B(config)#int range gi interface range gigabitethernet 0/17-18
B(config-if-range)#switchport mode trunk
B(config-if-range)#int ag 1
B(config-if-AggregatePort 1)# switchport mode trunk

Step 2: Enable MSTP and create Instances 1 and 2.
B(config)#spanning-tree
B(config)# spanning-tree mst configuration
B(config-mst)#instance 1 vlan 10B(config-mst)#instance 2 vlan 20
B(config-mst)#exit

Step 3: Configure Switch A as the root bridge of Instance 2.
B(config)#spanning-tree mst 0 priority 8192
B(config)#spanning-tree mst 1 priority 8192
B(config)#spanning-tree mst 2 priority 4096

Step 4: Configure the virtual gateway IP address of VRRP.
B(config)#interface vlan 10B(config-if-VLAN 10)ip address 192.168.10.3 255.255.255.0
B(config-if-VLAN 10) vrrp 1 ip 192.168.10.1

Step 5 Set the VRRP priority to 120 to enable Switch B to act as the VRRP backup device of VLAN 20.
B(config)#interface vlan 20
B(config-if-VLAN 20)vrrp 1 priority 120
B(config-if-VLAN 20)ip address 192.168.20.3 255.255.255.0

7-31

Configuration Guide

Configuring MSTP(beta)

B(config-if-VLAN 20) vrrp 1 ip 192.168.20.1
C

Step 1: Configure VLANs 10 and 20, and configure ports as Trunk ports.
C(config)#vlan 10C(config-vlan)#vlan 20C(config-vlan)#exit
C(config)#int range gi interface range gigabitethernet 0/17-18
C(config-if-range)#switchport mode trunk

Step 2: Enable MSTP and create Instances 1 and 2.
C(config)#spanning-tree
C(config)# spanning-tree mst configuration
C(config-mst)#instance 1 vlan 10C(config-mst)#instance 2 vlan 20C(config-mst)#exit

Step 3: Configure the port connecting Device C directly to users as a PortFast port and enable BPDU
guard.
C(config)# int TenGigabitEthernet 0/19
C(config-if-TenGigabitEthernet 0/19)#spanning-tree portfast
C(config-if-TenGigabitEthernet 0/19)#spanning-tree bpduguard enable
D

Perform the same steps as Device C.

Verification



Run the show spanning-tree summary command to check whether the spanning tree topology iscorrectly calculated.

Run the show vrrp brief command to check whether the VRRP master/backup devices are
successfully created.

A

Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : 1-9, 11-19, 21-4094
Root ID

Priority

4096

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

4 sec

Forward Delay 18 sec

Max Age 25 sec

4096

Address00d0.f822.3344

Hello Time

4 sec

Role Sts Cost

Forward Delay 18 sec
Prio

Max Age 25 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Ag1

Desg FWD 19000

128

False

P2p

Gi0/17

Desg FWD 200000

128

False

P2p

Gi0/18Desg FWD 200000

128

False

P2p

7-32

Configuration Guide

Configuring MSTP(beta)

MST 1 vlans map : 10
Region Root Priority
Address

4096
00d0.f822.3344

this bridge is region root
Bridge ID Priority
Address
Interface4096
00d0.f822.3344

Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Ag1

Desg FWD 19000

128

False

P2p

Gi0/17

Desg FWD 200000

128

False

P2p

Gi0/18Desg FWD 200000

128

False

P2p

MST 2 vlans map : 20
Region Root Priority
Address

4096
001a.a917.78cc

this bridge is region root
Bridge ID Priority
Address
Interface8192
00d0.f822.3344

Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ----------------B

Ag1

Root FWD 19000

128

False

P2p

Gi0/17

Desg FWD 200000

128

False

P2p

Gi0/18Desg FWD 200000

128

False

P2p

Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : 1-9, 11-19, 21-4094
Root ID

Priority

4096

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

4 sec

Forward Delay 18 sec

Max Age 25 sec

8192

Address

001a.a917.78cc

Hello Time

2 sec

Role Sts Cost

Forward Delay 15 sec
Prio

Max Age 20 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Ag1

Root FWD 19000

128

7-33

False

P2p

Configuration Guide

Configuring MSTP(beta)

Gi0/17

Desg FWD 200000

128

False

P2p

Gi0/18Desg FWD 200000

128

False

P2p

MST 1 vlans map : 10
Region Root Priority
Address

4096
00d0.f822.3344

this bridge is region root
Bridge ID Priority
Address
Interface8192
001a.a917.78cc

Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Ag1

Root FWD 19000

128

False

P2p

Gi0/17

Desg FWD 200000

128

False

P2p

Gi0/18Desg FWD 200000

128

False

P2p

MST 2 vlans map : 20
Region Root Priority
Address

4096
001a.a917.78cc

this bridge is region root
Bridge ID Priority
Address
Interface4096
001a.a917.78cc

Role Sts Cost

Prio

OperEdge Type---------------- ---- --- ---------- -------- -------- ----------------C

Ag1

Desg FWD 19000

128

False

P2p

Gi0/17

Desg FWD 200000

128

False

P2p

Gi0/18Desg FWD 200000

128

False

P2p

Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : 1-9, 11-19, 21-4094
Root ID

Priority

4096

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

4 sec

Forward Delay 18 sec

Max Age 25 sec

32768

Address

001a.a979.00ea

Hello Time

2 sec

Role Sts Cost

Forward Delay 15 sec
Prio

7-34

Max Age 20 sec

Type OperEdge

Configuration Guide

Configuring MSTP(beta)---------------- ---- --- ---------- -------- ----- --------------Gi0/18

Altn BLK 200000

128

P2p

False

Gi0/17

Root FWD 200000

128

P2p

False

MST 1 vlans map : 10
Region Root Priority
Address

4096
00d0.f822.3344

this bridge is region root
Bridge ID Priority
Address
Interface

32768
001a.a979.00ea

Role Sts Cost

Prio

Type OperEdge---------------- ---- --- ---------- -------- ----- --------------Gi0/18

Altn BLK 200000

128

P2p

False

Gi0/17

Root FWD 200000

128

P2p

False

MST 2 vlans map : 20
Region Root Priority
Address

4096
001a.a917.78cc

this bridge is region root
Bridge ID Priority
Address
Interface

32768
001a.a979.00ea

Role Sts Cost

Prio

Type OperEdge---------------- ---- --- ---------- -------- ----- --------------Gi0/18

Root FWD 200000

128

P2p

False

Gi0/17

Altn BLK 200000

128

P2p

False

Omitted.

D

Common Errors


MST region configurations are inconsistent in the MSTP topology.



VLANs are not created before you configure the mapping between the instance and VLAN.



A device runs STP or RSTP in the MSTP+VRRP topology, but calculates the spanning tree according to thealgorithms of different MST regions.

7.4.4 Enabling Fast RSTP Convergence
Configuration EffectConfigure the link type to make RSTP rapidly converge.

Notes

7-35

Configuration GuideConfiguring MSTP(beta)

If the link type of a port is point-to-point connection, RSTP can rapidly converge. For details, see "Fast RSTP
Convergence". If the link type is not configured, the device automatically sets the link type based on the duplex
mode of the port. If a port is in full duplex mode, the device sets the link type to point-to-point. If a port is in half
duplex mode, the device sets the link type to shared. You can also forcibly configure the link type to determine
whether the port connection is point-to-point connection.

Configuration Steps

Configuring the Link Type

Optional.

Commandspanning-tree link-type { point-to-point | shared }Parameter

point-to-point: Forcibly configures the link type of a port to be point-to-point.

Description

shared: Forcibly configures the link type of a port to be shared.

Defaults

If a port is in full duplex mode, the link type of the port is point-to-point. If a port is in half duplex mode,
the link type of the port is shared.

Command

Interface configuration mode

Mode
Usage Guide

If the link type of a port is point-to-point connection, RSTP can rapidly converge. If the link type is notconfigured, the device automatically sets the link type based on the duplex mode of the port.

VerificationDisplay the configuration.

Run the show spanning-tree [ mst instance-id ] interface interface-type interface-number command to display
the spanning tree configuration of the port.

Configuration
Example

Enabling Fast RSTP Convergence

Configuratio

Set the link type of a port to point-to-point.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#spanning-tree link-type point-to-point
Verification



Run the show spanning-tree summary command to display the link type of the port.

Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : ALL
Root ID

Priority

32768

Address

001a.a917.78cc

this bridge is root
Hello Time
Bridge ID Priority

2 sec

Forward Delay 15 sec

32768

7-36

Max Age 20 sec

Configuration Guide

Interface

Configuring MSTP(beta)
Address00d0.f822.3344

Hello Time

2 sec

Role Sts Cost

Forward Delay 15 sec
Prio

Max Age 20 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/17

Root FWD 20000

128

False

P2p

Common Errors
N/A

7.4.5 Configuring Priorities
Configuration EffectConfigure the switch priority to determine a device as the root of the entire network and to determine the topologyof the entire network.

Configure the port priority to determine which port enters the forwarding state.

Notes


It is recommended to set the priority of the core device higher (to a smaller value) to ensure stability of the entire
network. You can assign different switch priorities to different instances so that each instance runs an independent
STP based on the assigned priorities. Devices in different regions use the priority only of the CIST (Instance 0). As
described in bridge ID, the switch priority has 16 optional values: 0, 4,096, 8,192, 12,288, 16,384, 20,480, 24,576,
28,672, 32,768, 36,864, 40,960, 45,056, 49,152, 53,248, 57,344, 61,440. They are integral multiples of 4,096. The
default value is 32,768.



If two ports are connected to a shared device, the device selects a port with a higher priority (smaller value) toenter the forwarding state and a port with a lower priority (larger value) to enter the discarding state. If the two
ports have the same priority, the device selects the port with a smaller port ID to enter the forwarding state. You
can assign different port priorities to different instances on a port so that each instance runs an independent STP
based on the assigned priorities.



Similar to the switch priority, the port priority also has 16 optional values: 0, 16, 32, 48, 64, 80, 96, 112, 128, 144,
160, 176, 192, 208, 224, 240. They are integral multiples of 16. The default value is 128.

Configuration Steps

Configuring the Switch Priority



Optional.

To change the root or topology of a network, configure the switch priority.

Commandspanning-tree [ mst instance-id ] priority priority

Parameter

mst instance-id: Indicates the instance ID, ranging from 0 to 64.

Description

priority priority: Indicates the switch priority. There are 16 optional values: 0, 4,096, 8,192, 12,288,
16,384, 20,480, 24,576, 28,672, 32,768, 36,864, 40,960, 45,056, 49,152, 53,248, 57,344, 61,440. They
are integral multiples of 4,096.

Defaults

The default value of instance-id is 0 while that of priority is 32,768.

7-37

Configuration Guide
Command

Configuring MSTP(beta)

Global configuration mode

Mode
Usage Guide

Configure the switch priority to determine a device as the root of the entire network and to determine thetopology of the entire network.

Configuring the Port Priority



Optional.

To change the preferred port entering the forwarding state, configure the port priority.

Commandspanning-tree [ mst instance-id ] port-priority port-priority

Parameter

mst instance-id: Indicates the instance ID, ranging from 0 to 64.

Description

port-priority port-priority: Indicates the port priority. There are 16 optional values: 0, 16, 32, 48, 64, 80,
96, 112, 128, 144, 160, 176, 192, 208, 224, 240. They are integral multiples of 4,096.

Defaults

The default value of instance-id is 0.
The default value of priority is 128.

Command

Interface configuration mode

Mode
Usage Guide

If a loop occurs in a region, the port with a higher priority is preferred to enter the forwarding state. If two
ports have the same priority, the port with a smaller port ID is selected to enter the forwarding state.
Run this command to determine which port in the loop of a region enters the forwarding state.

VerificationDisplay the configuration.

Run the show spanning-tree [ mst instance-id ] interface interface-type interface-number command to display
the spanning tree configuration of the port.

Configuration
Example

Configuring the Port Priority

Scenario
Figure 8-22

Configuratio

Configure the bridge priority so that DEV A becomes the root bridge of the spanning tree.

n StepsConfigure the priority of Gi0/18 on DEV A is 16 so that Gi0/18 on DEV B can be selected as theroot port.

7-38

Configuration Guide
DEV A

Configuring MSTP(beta)

Step 1: Enable STP and configure the bridge priority.
Ruijie(config)#spanning-tree
Ruijie(config)#spanning-tree mst 0 priority 0
Step 2: Configure the priority of GigabitEthernet 0/18.
Ruijie(config)# interface gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)#spanning-tree mst 0 port-priority 16

DEV B

Ruijie(config)#spanning-tree

Verification



Run the show spanning-tree summary command to display the topology calculation result of thespanning tree.

DEV A

Ruijie# Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : ALL
Root ID

Priority0

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

2 sec

Forward Delay 15 sec

Max Age 20 sec

0Address00d0.f822.3344

Hello Time

2 sec

Forward Delay 15 sec

Role Sts Cost

Prio

Max Age 20 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ----------------

DEV B

Gi0/18Desg FWD 20000

16

False

P2p

Gi0/17

Desg FWD 20000

128

False

P2p

Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : ALL
Root ID

Priority0

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

2 sec

Forward Delay 15 sec

Max Age 20 sec

32768

Address

001a.a917.78cc

Hello Time

2 sec

Role Sts Cost

Forward Delay 15 sec
Prio

Max Age 20 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/18

Root FWD 20000

128

False

P2p

Gi0/17

Altn BLK 20000

128

False

P2p

7-39

Configuration Guide

Configuring MSTP(beta)

Common Errors
N/A

7.4.6 Configuring the Port Path Cost
Configuration EffectConfigure the path cost of a port to determine the forwarding state of the port and the topology of the entire
network.



If the path cost of a port uses its default value, configure the path cost calculation method to affect the calculation
result.

Notes


A device selects a port as the root port if the path cost from this port to the root bridge is the lowest. Therefore, theport path cost determines the root port of the local device. The default port path cost is automatically calculated
based on the port rate (Media Speed). A port with a higher rate will have a low path cost. Since this method cancalculate the most scientific path cost, do not change the path cost unless required. You can assign different pathcosts to different instances on a port so that each instance runs an independent STP based on the assigned pathcosts.



If the port path cost uses the default value, the device automatically calculates the port path cost based on the port
rate. However, IEEE 802.1d-1998 and IEEE 802.1t define different path costs for the same link rate. The value is a
short integer ranging from 1 to 65,535 in 802.1d-1998 while is a long integer ranging from 1 to 200,000,000 in
IEEE 802.1t. The path cost of an aggregate port (AP) has two solutions: 1. Ruijie solution: Port Path Cost x 95%; 2.
Solution recommended in standards: 20,000,000,000/Actual link bandwidth of the AP, in which Actual link
bandwidth of the AP = Bandwidth of a member port x Number of active member ports. The administrator must
unify the path cost calculation method in the entire network. The default standard is the private long integer
standard.



The following table lists path costs automatically configured for different link rate in two solutions.

Port Rate

10M

IEEE 802.1dIEEE 802.1t

IEEE 802.1t(short)(long)(long standard)Common port

100

2000000

2000000

AP

95

1900000

2000000÷Linkupcnt

Common port

19200000200000AP

18190000200000÷Linkupcnt

Common port

4

20000

20000

AP

3

19000

20000÷Linkupcnt

Common port

2

2000

2000

AP

1

1900

20000÷Linkupcnt

Port

100M

1000M

10000M

Ruijie's long integer standard is used by default. After the solution is changed to the path cost solution
recommended by the standards, the path cost of an AP changes with the number of member ports in UP state. If
the port path cost changes, the network topology also will change.

7-40

Configuration GuideConfiguring MSTP(beta)

If an AP is static, Linkupcnt in the table is the number of active member ports. If an AP is an LACP AP, Linkupcnt
in the table is the number of member ports forwarding AP data. If no member port in the AP goes up, Linkupcnt is
1. For details about AP and LACP, see the Configuring AP.



The modified port path cost takes effect only on the Rx port.

Configuration Steps

Configuring the Default Path Cost Calculation MethodOptional.

To change the path cost calculation method, configure the default path cost calculation method.

Commandspanning-tree pathcost method { long | long standard | short }Parameter

long: Adopts the 802.1t standard (long) to configure path cost. The cost of a port path ranges from 1 to

Description

200000000. Aggregation Port Cost = Physical Port Cost * 95%.
long standard: Adopts the 802.1t standard (long standard) to configure path cost.The cost of the port
path ranges from 1 to 200000000. Aggregation Port Cost = Physical Port Cost / Linkupcnt.
short: Adopts the 802.1d standard to configure path cost. The cost of a port path ranges from 1 to65535. Aggregation Port Cost= Physical Port Cost * 95%

Defaults

The path cost specified in 802.1t (long) is used by default.

Command

Global configuration mode

Mode
Usage Guide

If the port path cost uses the default value, the device automatically calculates the port path cost basedon the port rate.

Configuring the Port Path Cost

Optional.

To determine which port or path data packets prefer to pass through, configure the port path cost.

Commandspanning-tree [ mst instance-id ] cost cost

Parameter

mst instance-id: Indicates the instance ID, ranging from 0 to 64.

Description

cost cost: Indicates the path cost, ranging from 1 to 200,000,000.

Defaults

The default value of instance-id is 0.
The default value is automatically calculated based on the port rate.
1000 Mbps—20000
100 Mbps—200000
10 Mbps—2000000

Command

Interface configuration mode

Mode
Usage Guide

A larger value of cost indicates a higher path cost.

VerificationDisplay the configuration.

7-41

Configuration GuideConfiguring MSTP(beta)

Run the show spanning-tree [mst instance-id] interface interface-type interface-number command to display thespanning tree configuration of the port.

Configuration
Example

Configuring the Port Path Cost

Scenario
Figure 8-23

Configuratio

Configure the bridge priority so that DEV A becomes the root bridge of the spanning tree.

n StepsConfigure the path cost of Gi 0/18 on DEV B is 1 so that Gi 0/18 can be selected as the root port.

DEV A

Ruijie(config)#spanning-tree
Ruijie(config)#spanning-tree mst 0 priority 0

DEV B

Ruijie(config)#spanning-tree
Ruijie(config)# interface gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# spanning-tree cost 1

Verification



Run the show spanning-tree summary command to display the topology calculation result of thespanning tree.

DEV A

Ruijie# Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : ALL
Root ID

Priority0

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

2 sec

Forward Delay 15 sec

Max Age 20 sec

0Address00d0.f822.3344

Hello Time

2 sec

Role Sts Cost

Forward Delay 15 sec
Prio

Max Age 20 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/18

Desg FWD 20000

128

False

P2p

Gi0/17

Desg FWD 20000

128

False

P2p

7-42

Configuration Guide
DEV B

Configuring MSTP(beta)

Ruijie#show spanning-tree summary
Spanning tree enabled protocol mstp
MST 0 vlans map : ALL
Root ID

Priority0

Address00d0.f822.3344

this bridge is root
Hello Time
Bridge ID Priority

Interface

2 sec

Forward Delay 15 sec

Max Age 20 sec

32768

Address

001a.a917.78cc

Hello Time

2 sec

Forward Delay 15 sec

Role Sts Cost

Prio

Max Age 20 sec

OperEdge Type---------------- ---- --- ---------- -------- -------- ---------------Gi0/18

Root FWD 1

128

False

P2p

Gi0/17

Altn BLK 20000

128

False

P2p

Common Errors


N/A

7.4.7 Configuring Auto Edge
Configuration EffectEnable Auto Edge. If a designated port does not receive any BPDUs within a specified time (3 seconds), it isautomatically identified as an edge port. However, if the port receives BPDUs, its Port Fast Operational State will
become Disabled.

Notes


Unless otherwise specified, do not disable Auto Edge.

Configuration Steps

Configuring Auto Edge



Optional.



Auto Edge is enabled by default.



In interface configuration mode, run the spanning-tree autoedge command to enable Auto Edge on a port andthe spanning-tree autoedge disabled command to disable it on a port.

Commandspanning-tree autoedge [ disabled ]Parameter

disabled: Disables Autoedge on the interface.

Description
Defaults

Auto Edge is enabled by default.

Command

Interface configuration mode

7-43

Configuration Guide

Configuring MSTP(beta)

Mode
Usage Guide

If the designated port of a device does not receive a BPDU from the downlink port within a specific period(3 seconds), the device regards a network device connected to the designated port, configures the port
as an edge port, and switches the port directly into the forwarding state. The edge port will be
automatically identified as a non-edge port after receiving a BPDU.
You can run the spanning-tree autoedge disabled command to disable Auto Edge.

VerificationDisplay the configuration.

Configuration
Example

Disabling Auto Edge on a Port

Configuratio

Disable Auto Edge on a port.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#spanning-tree autoedge disabled
Verification



Run the show spanning-tree interface command to display the spanning tree configuration of the
port.

Ruijie#show spanning-tree interface gi 0/17
PortAdminPortFast : Disabled
PortOperPortFast : Disabled
PortAdminAutoEdge : Disabled
PortOperAutoEdge : Disabled
PortAdminLinkType : point-to-point
PortOperLinkType : point-to-point
PortBPDUGuard : Disabled
PortBPDUFilter : Disabled
PortGuardmode : None###### MST 0 vlans mapped :ALL
PortState : forwarding
PortPriority : 128
PortDesignatedRoot : 0.00d0.f822.3344
PortDesignatedCost : 0
PortDesignatedBridge :0.00d0.f822.3344
PortDesignatedPortPriority : 128
PortDesignatedPort : 2
PortForwardTransitions : 6
PortAdminPathCost : 20000
PortOperPathCost : 20000
Inconsistent states : normal

7-44

Configuration Guide

Configuring MSTP(beta)

PortRole : designatedPort

Common Errors
If the designated port of a device does not receive a BPDU from the downlink port within a specific period (3 seconds),
the device regards a network device connected to the designated port, configures the port as an edge port, andswitches the port directly into the forwarding state. It is recommended to disable the Auto Edge function, if packet loss
or Tx/Rx packet delay exists in the network environment.

7.4.8 Enabling PortFast-related Features
Configuration EffectAfter PortFast is enabled on a port, the port directly enters the forwarding state. However, since the Port Fast
Operational State becomes disabled due to receipt of BPDUs, the port can properly run the STP algorithm andenter the forwarding state.



If BPDU guard is enabled on a port, the port enters the error-disabled state after receiving a BPDU.



If BPDU filter is enabled on a port, the port neither sends nor receives BPDUs.

Notes


The global BPDU guard takes effect only when PortFast is enabled on a port.



If BPDU filter is enabled globally, a PortFast-enabled port neither sends nor receives BPDUs. In this case, the hostconnecting directly to the PortFast-enabled port does not receive any BPDUs. If the port changes its Port Fast
Operational State to Disabled after receiving a BPDU, BPDU filter automatically fails.



The global BPDU filter takes effect only when PortFast is enabled on a port.

Configuration Steps

Enabling PortFastOptional.



If a port connects directly to the network terminal, configure this port as a PortFast port.



In global configuration mode, run the spanning-tree portfast default command to enable PortFast on all ports
and the no spanning-tree portfast default command to disable PortFast on all ports.

Commandspanning-tree portfast default

Parameter

N/A

Description
Defaults

PortFast is disabled on all ports by default.

Command

Global configuration mode

Mode
Usage Guide

After PortFast is enabled on all ports, the ports directly enter the forwarding state. However, since thePort Fast Operational State becomes disabled due to receipt of BPDUs, the ports can properly run the
STP algorithm and enter the forwarding state.



In interface configuration mode, run the spanning-tree portfast command to enable PortFast on a port and thespanning-tree portfast disabled command to disable PortFast on a port.

7-45

Configuration Guide

Configuring MSTP(beta)

Commandspanning-tree portfast [ disabled ]Parameter

disabled: Disables the portfast on the interface.

Description
Defaults

PortFast is disabled on a port by default.

Command

Interface configuration mode

Mode
Usage Guide

After PortFast is enabled on a port, the port directly enters the forwarding state. However, since the Port
Fast Operational State becomes disabled due to receipt of BPDUs, the port can properly run the STP
algorithm and enter the forwarding state.

Enabling BPDU Guard

Optional.



If device ports connect directly to network terminals, you can enable BPDU guard on these ports to prevent BPDU
attacks from causing abnormality in the spanning tree topology. A port enabled with BPDU guard enters theerror-disabled state after receiving a BPDU.



If device ports connect directly to network terminals, you can enable BPDU guard to prevent loops on the ports.
The prerequisite is that the downlink device (such as the hub) can forward BPDU packets.

In global configuration mode, run the spanning-tree portfast bpduguard default command to enable BPDU
guard on all ports and the no spanning-tree portfast bpduguard default command to disable BPDU guard on all
ports.

Commandspanning-tree portfast bpduguard default

Parameter

N/A

Description
Defaults

BPDU guard is globally disabled by default.

Command

Global configuration mode

Mode
Usage Guide

If BPDU guard is enabled on a port, the port enters the error-disabled state after receiving a BPDU. Run
the show spanning-tree command to display the configuration.



In interface configuration mode, run the spanning-tree bpduguard enabled command to enable BPDU guard on
a port and the spanning-tree bpduguard disabled command to disable BPDU guard on a port.

Commandspanning-tree bpduguard { enabled | disabled }Parameter

enabled: Enables BPDU guard on the interface.

Description

disabled: Disables BPDU guard on the interface.

Defaults

BPDU guard is disabled on a port by default.

Command

Interface configuration mode

Mode
Usage Guide

If BPDU guard is enabled on a port, the port enters the error-disabled state after receiving a BPDU.



Enabling BPDU Filter

Optional.

To prevent abnormal BPDU packets from affecting the spanning tree topology, you can enable BPDU filter on aport to filter abnormal BPDU packets.

7-46

Configuration GuideConfiguring MSTP(beta)

In global configuration mode, run the spanning-tree portfast bpdufilter default command to enable BPDU filter
on all ports and the no spanning-tree portfast bpdufilter default command to disable BPDU filter on all ports.

Commandspanning-tree portfast bpdufilter default

Parameter

N/A

Description
Defaults

BPDU filter is globally disabled by default.

Command

Global configuration mode

Mode
Usage Guide

If BPDU filter is enabled, corresponding ports neither send nor receive BPDUs.

In interface configuration mode, run the spanning-tree bpdufilter enabled command to enable BPDU filter on aport and the spanning-tree bpdufilter disabled command to disable BPDU filter on a port.

Commandspanning-tree bpdufilter { enabled | disabled }Parameter

enabled: Enables BPDU filter on the interface.

Description

disabled: Disables BPDU filter on the interface.

Defaults

BPDU filter is disabled on a port by default.

Command

Interface configuration mode

Mode
Usage Guide

If BPDU filter is enabled on a port, the port neither sends nor receives BPDUs.

VerificationDisplay the configuration.

Run the show spanning-tree [ mst instance-id ] interface interface-type interface-number command to display
the spanning tree configuration of the port.

Configuration
Example

Enabling PortFast on a Port

Scenario
Figure 8-24

Configuratio

Configure Gi 0/17 of DEV C as a PortFast port and enable BPDU guard.

7-47

Configuration Guide

Configuring MSTP(beta)n Steps
DEV C

Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# spanning-tree portfast%Warning: portfast should only be enabled on ports connected to a single
host. Connecting hubs, switches, bridges to this interface when portfast is
enabled,can cause temporary loops.
Ruijie(config-if-GigabitEthernet 0/17)#spanning-tree bpduguard enable

Verification



DEV C

Ruijie#show spanning-tree interface gigabitethernet 0/17

Run the show spanning-tree interface command to display the port configuration.

PortAdminPortFast : Enabled
PortOperPortFast : Enabled
PortAdminAutoEdge : Enabled
PortOperAutoEdge : Enabled
PortAdminLinkType : auto
PortOperLinkType : point-to-point
PortBPDUGuard : Enabled
PortBPDUFilter : Disabled
PortGuardmode : None###### MST 0 vlans mapped :ALL
PortState : forwarding
PortPriority : 128
PortDesignatedRoot : 0.00d0.f822.3344
PortDesignatedCost : 0
PortDesignatedBridge :0.00d0.f822.3344
PortDesignatedPortPriority : 128
PortDesignatedPort : 4
PortForwardTransitions : 1
PortAdminPathCost : 20000
PortOperPathCost : 20000
Inconsistent states : normal
PortRole : designatedPort

7.4.9 Enabling TC-related Features
Configuration Effect

If TC protection is enabled on a port, the port deletes TC BPDU packets within a specified time (generally 4
seconds) after receiving them, preventing MAC and ARP entry from being removed.



If TC guard is enabled, a port receiving TC packets filters TC packets received or generated by itself so that TC
packets are not spread to other ports. In this way, possible TC attacks are efficiently prevented to keep the
network stable.



TC filter does not process TC packets received by ports but processes TC packets in case of normal topology
changes.
7-48

Configuration Guide

Configuring MSTP(beta)

Notes


It is recommended to enable TC guard only when illegal TC attack packets are received in the network.

Configuration Steps

Enabling TC Protection



Optional.

In global configuration mode, run the spanning-tree tc-protection command to enable TC protection on all ports
and the no spanning-tree tc-protection command to disable TC protection on all ports.

TC protection can only be enabled or disabled globally.

Commandspanning-tree tc-protection

Parameter

N/A

Description
Defaults

TC protection is disabled by default.

Command

Global configuration mode

Mode
Usage Guide

N/A

Enabling TC Guard

Optional.

To filter TC packets received or generated due to topology changes, you can enable TC guard.

In global configuration mode, run the spanning-tree tc-protection tc-guard command to enable TC guard on all
ports and the no spanning-tree tc-protection tc-guard command to disable TC guard on all ports.

Commandspanning-tree tc-protection tc-guard

Parameter

N/A

Description
Defaults

TC guard is globally disabled by default.

Command

Global configuration mode

Mode
Usage GuideEnable TC guard to prevent TC packets from spreading.

In interface configuration mode, run the spanning-tree tc-guard command to enable TC guard on a port and theno spanning-tree tc-guard command to disable TC guard on a port.

Commandspanning-tree tc-guard

Parameter

N/A

Description
Defaults

TC guard is disabled on a port by default.

Command

Interface configuration mode

Mode
Usage GuideEnable TC guard to prevent TC packets from spreading.

Enabling TC Filter

7-49

Configuration Guide

Configuring MSTP(beta)

Optional.

To filter TC packets received on a port, you can enable TC filter on the port.



In interface configuration mode, run the spanning-tree ignore tc command to enable TC filter on a port and theno spanning-tree ignore tc command to disable it on a port.

Commandspanning-tree ignore tc

Parameter

N/A

Description
Defaults

TC filter is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

If TC filter is enabled on a port, the port does not process received TC packets.

VerificationDisplay the configuration.

Configuration
Example

Enabling TC Guard on a Port

Configuratio

Enable TC guard on a port.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#spanning-tree tc-guard
Verification



Run the show run interface command to display the TC guard configuration of the port.

Ruijie#show run interface gigabitethernet 0/17
interface GigabitEthernet 0/17
switchport mode trunk
spanning-tree tc-guard

Common Errors


If TC guard or TC filter is incorrectly configured, an error may occur during packet forwarding of the network device.
For example, when the topology changes, the device fails to clear MAC address in a timely manner, causing
packet forwarding errors.

7.4.10 Enabling BPDU Source MAC Address Check
Configuration EffectEnable BPDU source MAC address check. After this, a device receives only BPDU packets with the source MAC
address being the specified MAC address and discards other BPDU packets.

Notes

7-50

Configuration GuideConfiguring MSTP(beta)

When the switch connected to a port on a point-to-point link is determined, you can enable BPDU source MAC
address check so that the switch receives the BPDU packets sent only by the peer switch.

Configuration Steps

Enabling BPDU Source MAC Address Check

Optional.

To prevent malicious BPDU attacks, you can enable BPDU source MAC address check.

In interface configuration mode, run the bpdu src-mac-check mac-address command to enable BPDU source
MAC address check on a port and the no bpdu src-mac-check command to disable it on a port.

Commandbpdu src-mac-check mac-address

Parameter

mac-address: Indicates an MAC address. The device receives only BPDU packets with this address

Description

being the source MAC address. The input format is H.H.H.

Defaults

BPDU source MAC address check is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

BPDU source MAC address check prevents BPDU packets from maliciously attacking switches andcausing MSTP abnormal. When the switch connected to a port on a point-to-point link is determined, you
can enable BPDU source MAC address check to receive BPDU packets sent only by the peer switch
and discard all other BPDU packets, thereby preventing malicious attacks.
You can enable BPDU source MAC address check in interface configuration mode for a specific port.
One port can only filter one MAC address.

VerificationDisplay the configuration.

Configuration
Example

Enabling BPDU Source MAC Address Check on a Port

Configuratio

Enable BPDU source MAC address check on a port.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#bpdu src-mac-check 00d0.f800.1234
Verification



Run the show run interface command to display the spanning tree configuration of the port.

Ruijie#show run interface gigabitethernet 0/17
interface GigabitEthernet 0/17
switchport mode trunk
bpdu src-mac-check 00d0.f800.1234
spanning-tree link-type point-to-point

Common Errors

7-51

Configuration GuideConfiguring MSTP(beta)

If BPDU source MAC address check is enabled on a port, the port receives only BPDU packets with the configured
MAC address being the source MAC address and discards all other BPDU packets.

7.4.11 Enabling Guard-related Features
Configuration Effect

If root guard is enabled on a port, its roles on all instances are enforced as the designated port. Once the port
receives configuration information with a higher priority, it enters the root-inconsistent (blocking) state. If the port
does not receive configuration information with a higher priority within a period, it returns to its original state.

Due to the unidirectional link failure, the root port or backup port becomes the designated port and enters theforwarding state if it does not receive BPDUs, causing a network loop. Loop guard is to prevent this problem.

Notes


Root guard and loop guard cannot take effect on a port at the same time.

Configuration Steps

Enabling Root Guard

Optional.



The root bridge may receive configuration with a higher priority due to incorrect configuration by maintenancepersonnel or malicious attacks in the network. As a result, the current root bridge may lose its role, causing
incorrect topology changes. To prevent this problem, you can enable root guard on a designated port of a device.

In interface configuration mode, run the spanning-tree guard root command to enable root guard on a port andthe no spanning-tree guard root command to disable it on a port.

Commandspanning-tree guard root

Parameter

N/A

Description
Defaults

Root guard is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

If root guard is enabled, the current root bridge will not change due to incorrect configuration or illegal
packet attacks.

Enabling Loop Guard

Optional.

You can enable loop guard on a port (root port, master port, or AP) to prevent it from failing to receive BPDUs sentby the designated bridge, increasing device stability. Otherwise, the network topology will change, possibly
causing a loop.



In global configuration mode, run the spanning-tree loopguard default command to enable loop guard on all
ports and the no spanning-tree loopguard default command to disable it on all ports.

Commandspanning-tree loopguard default

7-52

Configuration Guide
Parameter

Configuring MSTP(beta)

N/A

Description
Defaults

Loop guard is disabled by default.

Command

Global configuration mode

Mode
Usage Guide

Enabling loop guard on a root port or backup port will prevent possible loops caused by BPDU receipt
failure.



In interface configuration mode, run the spanning-tree guard loop command to enable loop guard on a port andthe no spanning-tree guard loop command to disable it on a port.

Commandspanning-tree guard loop

Parameter

N/A

Description
Defaults

Loop guard is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

Enabling loop guard on a root port or backup port will prevent possible loops caused by BPDU receipt
failure.



Disabling Guard

Optional.

Commandspanning-tree guard none

Parameter

N/A

Description
Defaults

Guard is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

VerificationDisplay the configuration.

Configuration
Example

Enabling Loop Guard on a Port

7-53

Configuration Guide

Configuring MSTP(beta)

Scenario
Figure 8-25

Configuratio

Configure DEV A as the root bridge and DEV B as a non-root bridge on a spanning tree.

n Steps

Enable loop guard on ports Gi 0/17 and Gi 0/18 of DEV B.

DEV A

Ruijie(config)#spanning-tree
Ruijie(config)#spanning-tree mst 0 priority 0

DEV B

Ruijie(config)#spanning-tree
Ruijie(config)# interface range gigabitethernet 0/17-18
Ruijie(config-if-range)#spanning-tree guard loop

Verification



Run the show spanning-tree interface command to display the spanning tree configuration of the
port.

DEV A

Omitted.

DEV B

Ruijie#show spanning-tree interface gigabitethernet 0/17
PortAdminPortFast : Disabled
PortOperPortFast : Disabled
PortAdminAutoEdge : Enabled
PortOperAutoEdge : Disabled
PortAdminLinkType : auto
PortOperLinkType : point-to-point
PortBPDUGuard : Disabled
PortBPDUFilter : Disabled
PortGuardmode : Guard loop###### MST 0 vlans mapped :ALL
PortState : forwarding
PortPriority : 128
PortDesignatedRoot : 0.001a.a917.78cc
PortDesignatedCost : 0
PortDesignatedBridge :0.001a.a917.78cc
PortDesignatedPortPriority : 128
PortDesignatedPort : 17
PortForwardTransitions : 1

7-54

Configuration Guide

Configuring MSTP(beta)

PortAdminPathCost : 20000
PortOperPathCost : 20000
Inconsistent states : normal
PortRole : rootPort
Ruijie#show spanning-tree interface gigabitethernet 0/18
PortAdminPortFast : Disabled
PortOperPortFast : Disabled
PortAdminAutoEdge : Enabled
PortOperAutoEdge : Disabled
PortAdminLinkType : auto
PortOperLinkType : point-to-point
PortBPDUGuard : Disabled
PortBPDUFilter : Disabled
PortGuardmode : Guard loop###### MST 0 vlans mapped :ALL
PortState : discarding
PortPriority : 128
PortDesignatedRoot : 0.001a.a917.78cc
PortDesignatedCost : 0
PortDesignatedBridge :0.001a.a917.78cc
PortDesignatedPortPriority : 128
PortDesignatedPort : 18
PortForwardTransitions : 1
PortAdminPathCost : 20000
PortOperPathCost : 20000
Inconsistent states : normal
PortRole : alternatePort

Common Errors


If root guard is enabled on the root port, master port, or AP, the port may be incorrectly blocked.

7.4.12 Enabling BPDU Transparent Transmission
Configuration Effect

If STP is disabled on a device, the device needs to transparently transmit BPDU packets so that the spanning tree
between devices is properly calculated.

Notes


BPDU transparent transmission takes effect only when STP is disabled. If STP is enabled on a device, the device
does not transparently transmit BPDU packets.

Configuration Steps
7-55

Configuration Guide

Configuring MSTP(beta)Enabling BPDU Transparent Transmission

Optional.



If STP is disabled on a device that needs to transparently transmit BPDU packets, enable BPDU transparent
transmission.

In global configuration mode, run the bridge-frame forwarding protocol bpdu command to enable BPDU
transparent transmission and the no bridge-frame forwarding protocol bpdu command to disable it.



BPDU transparent transmission takes effect only when STP is disabled. If STP is enabled on a device, the device
does not transparently transmit BPDU packets.

Commandbridge-frame forwarding protocol bpdu

Parameter

N/A

Description
Defaults

BPDU transparent transmission is disabled by default.

Command

Global configuration mode

Mode
Usage Guide

In IEEE 802.1Q, the destination MAC address 01-80-C2-00-00-00 of the BPDU is used as a reserved
address. That is, devices compliant with IEEE 802.1Q do not forward the BPDU packets received.
However, devices may need to transparently transmit BPDU packets in actual network deployment. For
example, if STP is disabled on a device, the device needs to transparently transmit BPDU packets sothat the spanning tree between devices is properly calculated.
BPDU transparent transmission takes effect only when STP is disabled. If STP is enabled on a device,
the device does not transparently transmit BPDU packets.

VerificationDisplay the configuration.

Configuration
Example

Enabling BPDU Transparent Transmission

Scenario
Figure 8-26

STP is enabled on DEV A and DEV C while is disabled on DEV B.
Configuratio

n Steps

Enable BPDU transparent transmission on DEV B so that STP between DEV A and DEV C can becorrectly calculated.

DEV B

Ruijie(config)#bridge-frame forwarding protocol bpdu

Verification



DEV B

Ruijie#show run

Run the show run command to check whether BPDU transparent transmission is enabled.

bridge-frame forwarding protocol bpdu

7-56

Configuration Guide

Configuring MSTP(beta)

7.4.13 Enabling BPDU Tunnel
Configuration EffectEnable BPDU Tunnel so that STP packets from the customer network can be transparently transmitted across the
SP network. STP packet transmission between the customer network does not affect the SP network, causing
STP on the customer network to be calculated independently of that on the SP network.

Notes


BPDU Tunnel takes effect only when it is enabled in both global configuration mode and interface configuration
mode.

Configuration Steps

Enabling BPDU Tunnel(Optional) In a QinQ network, you can enable BPDU Tunnel if STP needs to be calculated separately between
customer networks and SP networks.

BPDU Tunnel is disabled by default.



BPDU Tunnel takes effect only when it is enabled in both global configuration mode and interface configuration
mode.



In global configuration mode, run the l2protocol-tunnel stp command to globally enable BPDU Tunnel and theno l2protocol-tunnel stp command to globally disable it.

Commandl2protocol-tunnel stp

Parameter

N/A

Description
Defaults

BPDU Tunnel is disabled by default.

Command

Global configuration mode

Mode
Usage Guide

BPDU Tunnel takes effect only when it is enabled in both global configuration mode and interface
configuration mode.

In interface configuration mode, run the l2protocol-tunnel stp enable command to enable BPDU Tunnel on aport and the no l2protocol-tunnel stp enable command to disable it on a port.

Commandl2protocol-tunnel stp enable

Parameter

N/A

Description
Defaults

BPDU Tunnel is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

BPDU Tunnel takes effect only when it is enabled in both global configuration mode and interface
configuration mode.

Run the l2protocol-tunnel stp tunnel-dmac mac-address command in global configuration mode to configure
the transparent transmission address of BPDU Tunnel.

Commandl2protocol-tunnel stp tunnel-dmac mac-address

7-57

Configuration Guide
Parameter

Configuring MSTP(beta)

mac-address: Indicates the STP address for transparent transmission.

Description
Defaults

The default MAC address is 01d0.f800.0005.

Command

Global configuration mode

Mode
Usage Guide

If an STP packet sent from a customer network enters a PE, the PE changes the destination MAC
address of the packet to a private address before the packet is forwarded by the SP network. When thepacket reaches the PE at the peer end, the PE changes the destination MAC address to a public
address and returns the packet to the customer network at the peer end, realizing transparent
transmission across the SP network. This private address is the transparent transmission address of
BPDU Tunnel.
Optional transparent transmission addresses of STP packets include 01d0.f800.0005,
011a.a900.0005, 010f.e200.0003, 0100.0ccd.cdd0, 0100.0ccd.cdd1, and 0100.0ccd.cdd2.
If no transparent transmission address is configured, BPDU Tunnel uses the default address
01d0.f800.0005.

Verification


Run the show l2protocol-tunnel stp command to display the BPDU Tunnel configuration.

Configuration
Example

Enabling BPDU Tunnel

Scenario
Figure 8-27

Configuratio

n Steps

Enable basic QinQ on the PEs (Provider S1/Provider S2 in this example) so that data packets ofthe customer network are transmitted within VLAN 200 on the SP network.

Enable STP transparent transmission on the PEs (Provider S1/Provider S2 in this example) so that

7-58

Configuration Guide

Configuring MSTP(beta)
the SP network can transmit STP packets of the customer network through BPDU Tunnel.

Provider S1Step 1: Create VLAN 200 on the SP network.
Ruijie#configure terminal
Ruijie(config)#vlan 200
Ruijie(config-vlan)#exit
Step 2: Enable basic QinQ on the port connected to the customer network and use VLAN 20 fortunneling.
Ruijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#switchport mode dot1q-tunnel
Ruijie(config-if-GigabitEthernet 0/17)#switchport dot1q-tunnel native vlan 200
Ruijie(config-if-GigabitEthernet 0/17)#switchport dot1q-tunnel allowed vlan add untagged 200
Step 3: Enable STP transparent transmission on the port connected to the customer network.
Ruijie(config-if-GigabitEthernet 0/17)#l2protocol-tunnel stp enable
Ruijie(config-if-GigabitEthernet 0/17)#exit
Step 4: Enable STP transparent transmission in global configuration mode.
Ruijie(config)#l2protocol-tunnel stp

Provider S2

Verification

Configure Provider S2 by performing the same steps.

Check whether the BPDU Tunnel configuration is correct.



Verify the Tunnel port configuration by checking whether: 1. The port type is dot1q-tunnel; 2. The
outer tag VLAN is consistent with the native VLAN and added to the VLAN list of the Tunnel port; 3.
The port that accesses the SP network is configured as an Uplink port.

Provider S1Step 1: Check whether the BPDU Tunnel configuration is correct.
Ruijie#show l2protocol-tunnel stp
L2protocol-tunnel: stp Enable
L2protocol-tunnel destination mac address: 01d0.f800.0005
GigabitEthernet 0/17 l2protocol-tunnel stp enable
Step 2: Check whether the QinQ configuration is correct.
Ruijie#show running-config
interface GigabitEthernet 0/17
switchport mode dot1q-tunnel
switchport dot1q-tunnel allowed vlan add untagged 200
switchport dot1q-tunnel native vlan 200
l2protocol-tunnel stp enablespanning-tree bpdufilter enable!

Provider S2

Verify Provider S2 configuration by performing the same steps.

Common Errors

7-59

Configuration GuideConfiguring MSTP(beta)

In the SP network, BPDU packets can be correctly transparently transmitted only when the transparent
transmission addresses of BPDU Tunnel are consistent.

7.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears the statistics of packets sent and received on a port.

clear spanning-tree counters [ interface interface-type
interface-number ]Clears the STP topology change information.

clear spanning-tree mst instance-id topochange
recordDisplaying
Description

Command

Displays MSTP parameters and spanning tree topology

show spanning-tree

information.
Displays the count of sent and received MSTP packets.

show spanning-tree counters

Displays the forwarding time.

show spanning-tree forward-time

Displays the hello time.

show spanning-tree hello time

Displays the ports that are blocked by root guard or loop

show spanning-tree inconsistentports

guard.
Displays BridgeMaxAge.

show spanning-tree max-age

Displays the maximum hop count.

show spanning-tree max-hops

Displays MSTP information of an instance.

show spanning-tree mst instance-id

Displays the path cost calculation method.

show spanning-tree pathcost method

Displays MSTP instances and corresponding port forwarding
status.
Displays the maximum number of BPDU packets sent per

show spanning-tree summary

show spanning-tree tx-hold-countsecond.

show spanning-tree [ mst instance-id ] interface

Displays MSTP information of a specified instance or all

interface-type interface-number [ bpdufilter | bpduguard

instances corresponding to a port

| link-type | portfast ]Displays the configuration of an MST region.

show spanning-tree mst configuration
show spanning-tree mst instance-id topochange

Displays topology changes of a port in an instance.

recordDisplays BPDU Tunnel information.

show l2protocol-tunnel stp

Debugging
System resources are occupied when debugging information is output. Therefore, disable the debugging switch
immediately after use.
Description

Command7-60

Configuration Guide

Configuring MSTP(beta)

Debugs all STPs.

debug mstp all

Debugs MSTP Graceful Restart (GR).

debug mstp gr

Debugs BPDU packet receiving.

debug mstp rx

Debugs BPDU packet sending.

debug mstp tx

Debugs MSTP events.

debug mstp event

Debugs loop guard.

debug mstp loopguard

Debugs root guard.

debug mstp rootguard

Debugs the bridge detection state machine.

debug mstp bridgedetect

Debugs the port information state machine.

debug mstp portinfo

Debugs the port protocol migration state machine.

debug mstp protomigrat

Debugs MSTP topology changes.

debug mstp topochange

Debugs the MSTP receiving state machine.

debug mstp receive

Debugs the port role transition state machine.

debug mstp roletran

Debugs the port state transition state machine.

debug mstp statetran

Debugs the MSTP sending state machine.

debug mstp transmit

7-61

Configuration Guide

Configuring GVRP(beta)

8 Configuring GVRP(beta)
8.1 Overview
The GARP VLAN Registration Protocol (GVRP) is an application of the Generic Attribute Registration Protocol (GARP)
used to dynamically configure and proliferate VLAN memberships.
GVRP simplifies VLAN configuration and management. It reduces the workload of manually configuring VLANs andadding ports to VLANs, and reduces the possibility of network disconnection due to inconsistent configuration. WithGVRP, you can dynamically maintain VLANs and add/remove ports to/from VLANs to ensure VLAN connectivity in a
topology.

Protocols andStandards
IEEE standard 802.1D
IEEE standard 802.1Q

8.2 Applications
Application

Description

GVRP Configuration in a LAN

Connect two switches in a local area network (LAN) and realize VLAN
synchronization.

GVRP PDUs Tunnel Application

Use the GVRP Protocol Data Units (PDUs) Tunnel feature to transparently
transmit GVRP packets through a tunnel in a QinQ network environment.

8.2.1 GVRP Configuration in a LAN
Scenario
Enable GVRP and set the GVRP registration mode to Normal to register and deregister all dynamic and static VLANs
between Device A and Device F.
Figure 9-1

8-1

Configuration Guide

Configuring GVRP(beta)

RemarkDevice A, Device B, Device C, Device D, Device E, and Device F are switches. The ports connected betweens

two devices are Trunk ports.
On Device A and Device F, configure static VLANs used for communication.
Enable GVRP on all switches.

Deployment
On each device, enable the GVRP and dynamic VLAN creation features, and ensure that dynamic VLANs can becreated on intermediate devices.



On Device A and Device F, configure static VLANs used for communication. Device B, Device C, Device D, andDevice E will dynamically learn the VLANs through GVRP.
It is recommended that the Spanning Tree Protocol (STP) be enabled to avoid loops in the customer network
topology.

8.2.2 GVRP PDUs Tunnel Application
Scenario
A QinQ network environment is generally divided into a customer network and a service provider (SP) network. The
GVRP PDUs Tunnel feature allows GVRP packets to be transmitted between customer networks without impact on SP
networks. The GVRP calculation in customer networks is separated from that in SP networks without interference.
Figure 9-2 GVRP PDUs Tunnel Application Topology

RemarkFigure 9-2 shows an SP network and a customer network. The SP network contains the provider edge (PE)sdevices Provider S1 and Provider S2. Customer Network A1 and Customer Network A2 are the same
customer's two sites in different locations. Customer S1 and Customer S2 are the access devices in thecustomer network, which are connected to the SP network through Provider S1 and Provider S2 respectively.
The GVRP PDUs Tunnel feature allows Customer Network A1 and Customer Network A2 to perform unified
GVRP calculation across the SP network, without impact on the SP network's GVRP calculation.

Deployment

8-2

Configuration GuideConfiguring GVRP(beta)

Enable basic QinQ on the PEs (Provider S1 and Provider S2) in the SP network to transmit data packets from thecustomer network through a specified VLAN in the SP network.

Enable GVRP transparent transmission on the PEs (Provider S1 and Provider S2) in the SP network to allow the
SP network to tunnel GVRP packets from the customer network via the GVRP PDUs Tunnel feature.

8.3 Features
Basic Concepts



GVRP

GVRP is an application of GARP used to register and deregister VLAN attributes in the following modes:When a port receives a VLAN attribute declaration, the port will register the VLAN attributes contained in the
declaration (that is, the port will join the VLAN).

When a port receives a VLAN attribute revocation declaration, the port will deregister the VLAN attributes
contained in the declaration (that is, the port will exit the VLAN).

Figure 9-3

Dynamic VLAN

A VLAN that can be dynamically created and deleted without the need for manual configuration is called a dynamic
VLAN.
You can manually convert a dynamic VLAN to a static VLAN, but not the way around.
A protocol state machine controls the joining of ports to dynamic VLANs created through GVRP. Only the Trunk portsthat receive GVRP VLAN attribute declaration can join these VLANs. You cannot manually add ports to dynamic
VLANs.



Message Types(1) Join message
When a GARP application entity hopes other GARP entities to register its attributes, it will send a Join message. Whena GARP entity receives a Join message from another entity or requires other entities to register its static attributes, it will
send a Join message. There are two types of Join message: JoinEmpty and JoinIn.



JoinEmpty message: Used to declare an unregistered attribute



JoinIn message: Used to declare a registered attribute(2) Leave message

8-3

Configuration Guide

Configuring GVRP(beta)

When a GARP application entity hopes other GARP entities to deregister its attributes, it will send a Leave message.
When a GARP entity receives a Leave message from another entity or requires other entities to deregister its staticallyderegistered attributes, it will send a Leave message. There are two types of Leave message: LeaveEmpty andLeaveIn.



LeaveEmpty message: Used to deregister an unregistered attribute

LeaveIn message: Used to deregister a registered attribute(3) LeaveAll message
Each GARP application entity starts its LeaveAll timer during startup. When the timer times out, the entity sends a
LeaveAll message to deregister all attributes to enable other GARP entities to reregister attributes. When the GARP
application entity receives a LeaveAll message from another entity, it also sends a LeaveAll message. The LeaveAlltimer is restarted when a LeaveAll message is sent again to initiate a new cycle.

Timer TypesGARP defines four timers used to control GARP message sending.
(1) Hold timer
The Hold timer controls the sending of GARP messages (including Join and Leave messages). When a GARP
application entity has its attributes changed or receives a GARP message from another entity, it starts the Hold timer.
During the timeout period, the GARP application entity encapsulates all GARP messages to be sent into packets as few
as possible, and sends the packets when the timer times out. This reduces the quantity of sent packets and saves
bandwidth resources.
(2) Join timer
The Join timer controls the sending of Join messages. After a GARP application entity sends a Join message, it waits
for one timeout interval of the Join timer to ensure that the Join message is reliably transmitted to another entity. If the
GARP application entity receives a JoinIn message from another entity before the timer times out, it will not resend theJoin message; otherwise, it will resend the Join message. Not each attribute has its own Join timer, but each GARP
application entity has one Join timer.
(3) Leave timer
The Leave timer controls attribute deregistration. When a GARP application entity hopes other entities to deregister oneof its attributes, it sends a Leave message. Other entities which receive the Leave message start the Leave timer. The
attribute will be deregistered only if these entities receive no Join message mapped to the attribute during the timeout
period.
(4) LeaveAll timer
Each GARP application entity starts its own LeaveAll timer upon startup. When the timer times out, the entity sends a
LeaveAll message to enable other entities to reregister attributes. Then the LeaveAll timer is restarted to initiate a newcycle.

GVRP Advertising Modes

GVRP allows a switch to inform other interconnected devices of its VLANs and instruct the peer device to create
specific VLANs and add the ports that transmit GVRP packets to corresponding VLANs.
Two GVRP advertising modes are available:

8-4

Configuration Guide

Configuring GVRP(beta)Normal mode: A device externally advertises its VLAN information, including dynamic and static VLANs.



Non-applicant mode: A device does not externally advertise its VLAN information.

GVRP Registration ModesA GVRP registration mode specifies whether the switch that receives a GVRP packet processes the VLAN informationin the packet, such as dynamically creating a new VLAN and adding the port that receives the packet to the VLAN.
Two GVRP registration modes are available:



Normal mode: Process the VLAN information in the received GVRP packet.

Disabled mode: No to process the VLAN information in the received GVRP packet.

Overview
FeatureDescription

Intra-Topology VLAN

Dynamically creates VLANs and adds/removes ports to/from VLANs, which reduces the manual

Information

configuration workload and the probability of VLAN disconnection due to missing configuration.

Synchronization

8.3.1 Intra-Topology VLAN Information Synchronization
Working Principle
GVRP is an application of GARP based on the GARP working mechanism. GVRP maintains the dynamic registration
information of VLANs on a device and propagates the information to other devices. A GVRP-enabled device receives
VLAN registration information from other devices and dynamically updates the local VLAN registration information. The
device also propagates the local VLAN registration information to other devices so that all devices in a LAN maintainconsistent VLAN information. The VLAN registration information propagated by GVRP includes the
manually-configured static registration information on the local device and the dynamic registration information fromother devices.



External VLAN Information Advertising

The Trunk port on a GVRP-enabled device periodically collects VLAN information within the port, including the VLANs
that the Trunk port joins or exits. The collected VLAN information is encapsulated in a GVRP packet to be sent to thepeer device. After the Trunk port on the peer device receives the packet, it resolves the VLAN information. Thencorresponding VLANs will be dynamically created, and the Trunk port will join the created VLANs or exit other VLANs.
For details about the VLAN information, see the above description of GVRP message types.



VLAN Registration and Deregistration

Upon receiving a GVRP packet, the switch determines whether to process the VLAN information in the packet
according to the registration mode of the corresponding port. For details, see the above description of GVRP
registration modes.

8.4 Configuration
Configuration

Description and Command

8-5

Configuration Guide
Configuration

Configuring GVRP(beta)
Description and Command(Mandatory) It is used to enable GVRP and dynamic VLAN creation.
gvrp dynamic-vlan-creation enable

Enables dynamic VLAN creation.
Switches to Trunk port mode. GVRP take effects

switchport mode trunk

only in Trunk mode.

switchport trunk allowed vlan all

Allows the traffic from all VLANs to pass through.

gvrp enable

Enables GVRP.

(Optional) It is used to configure the advertising mode and registration mode of a port.
Configures the advertising mode of a port. The
Configuring Basic

gvrp applicant state { normal |GVRP Features

non-applicant }Normal mode indicates to advertise VLAN
information externally by sending a GVRP packet.
The Non-applicant mode indicates not to advertiseand VLANVLAN information externally.

Information

Configures the registration mode of a port. The

Synchronization

Normal mode indicates to process the VLAN
information in the received GVRP packet, such as

gvrp registration mode { normal |dynamically creating VLANs and adding ports todisabled }VLANs. The Disabled mode indicates not toprocess the VLAN information in the received
GVRP packet.

(Optional) It is used to configure timers and the registration mode and advertising mode of a
port.
gvrp timer { join hold | leave leave | leaveall
leaveall }Configuring GVRP

Configures timers.

(Optional) It is used to configure GVRP PDUs transparent transmission.

PDUs Transparent
Transmission

bridge-frame forwarding protocol gvrp

Enables GVRP PDUs transparent transmission.

(Optional) It is used to configure the GVRP PDUs Tunnel feature.

Configuring the

Enables the GVRP PDUs Tunnel feature in global

l2protocol-tunnel gvrp

configuration mode.

GVRP PDUs
Tunnel Feature

Enables the GVRP PDUs Tunnel feature in

l2protocol-tunnel gvrp enableinterface configuration mode.

l2protocol-tunnel gvrp tunnel-dmac

Configures the transparent transmission address

mac-addressused by the GVRP PDUs Tunnel feature.

8.4.1 Configuring Basic GVRP Features and VLAN Information Synchronization
Configuration Effect

Dynamically create/delete VLANs and add/remove ports to/from VLANs.



Synchronize VLAN information between devices to ensure normal intra-topology communication.



Reduce the manual configuration workload and simplify VLAN management.

8-6

Configuration Guide

Configuring GVRP(beta)

Notes


GVRP must be enabled on both connected devices. GVRP information is transmitted only by Trunk Links. The
transmitted information contains the information of all VLANs on the current device, including dynamically learned
VLANs and manually configured VLANs.



If STP is enabled, only ports in Forwarding state participate in GVRP (such as receiving and sending GVRP PDUs)
and have their VLAN information propagated by GVRP.

All VLAN ports added by GVRP are tagged ports.

The system does not save the VLAN information that is dynamically learned by GVRP. The information will be lostwhen the device is reset and cannot be saved manually.

All devices that need to exchange GVRP information must maintain consistent GVRP timers (Join timer, Leave
timer, and Leaveall timer).



If STP is not enabled, all available ports can participate in GVRP. If Single Spanning Tree (SST) is enabled, only
ports in Forwarding state in the SST Context participate in GVRP. If Multi Spanning Tree (MST) is enabled, GVRP
can run in the Spanning Tree Context to which VLAN1 belongs. You cannot specify other Spanning Tree Context
for GVRP.

Configuration Steps

Enabling Dynamic VLAN Creation



Mandatory.

After dynamic VLAN creation is enabled on a device, the device will dynamically create VLANs upon receiving
GVRP Join messages.
The parameters of a dynamic VLAN created through GVRP cannot be modified manually.

Commandgvrp dynamic-vlan-creation enable

Parameter

N/A

Description
Defaults

By default, dynamic VLAN creation is disabled.

Command

Global configuration mode

Mode
Usage Guide

When a port receives a JoinIn or JoinEmpty message that indicates a non-existent VLAN on the local
device, GVRP may create this VLAN, depending on the configuration of this command.

Configuring Timers



Optional.



There are three GVRP timers: Join timer, Leave timer, and Leaveall timer, which are used to control message
sending intervals.



The timer interval relationships are as follows: The interval of the Leave timer must be three times or more greaterthan that of the Join timer; the interval of the Leaveall timer must be greater than that of the Leave timer.



The three timers are controlled by the GVRP state machine and can be triggered by each other.

Commandgvrp timer { join hold | leave leave | leaveall leaveall }8-7

Configuration Guide

Configuring GVRP(beta)

Parameter

join hold : Configures the maximum delay before sending the advertisement on the port. The actual

Description

sending interval is in the range from 0 to the maximum delay hold. The value ranges from 1 to 200 in theunit of milliseconds.
leave leave: Configures the waiting time before removing the VLAN from the port with the Leave
Message received. If the Join Message is received again within this time range, the port-VLAN relation
still exists and the timer becomes invalid. If no Join Message is received on the port, the port status willbe Empty and removed from the VLAN member list. The value ranges from 600 to 9999 in the unit ofmilliseconds.
leave all leaveall: Configures the minimum interval of sending the LeaveAll Message on the port. If the
LeaveAll Message is received before the timer expires, the timer re-counts. If the timer expires, send the
LeaveAll Message on the port and also send this Message to the port, so that the Leave timer begins
counting. The actual sending interval ranges from leaveall to the sum of leaveall and join. The value
ranges from 601 to 2147483647 in the unit of milliseconds.

Defaults

The default interval of the Join timer is 200 ms, that of the Leave timer is 600 ms, and that of the Leaveall
timer is 10,000 ms.

Command

Global configuration mode

Mode
Usage Guide

The interval of the Leave timer must be three times or more greater than that of the Join timer.
The interval of the Leaveall timer must be greater than that of the Leave timer.
The time unit is milliseconds.
The following timer intervals are recommended in actual networking:
Join timer: 6,000 ms (6s)
Leave timer: 30,000 ms (30s)
Leaveall timer: 120,000 ms (2 minutes)
Ensure that the GVRP timer settings on all interconnected GVRP devices are consistent;otherwise, GVRP may work abnormally.



Switching to Trunk Port Mode

Mandatory.



GVRP takes effect only on ports in Trunk mode.

Commandswitchport mode trunk

Parameter

N/A

Description
Defaults

The default mode is Access, which can be modified to Trunk.

Command

Interface configuration mode

Mode
Usage Guide

To restore all properties of a Trunk port to defaults, use the no switchport mode command.

Enabling GVRPMandatory.



Only GVRP-enabled devices can process GVRP packets.

8-8Configuration GuideConfiguring GVRP(beta)

After GVRP is enabled on a device, the device sends GVRP packets carrying VLAN information. If GVRP is
disabled on the device, the device does not send GVRP packets carrying VLAN information or process received
GVRP packets.

Commandgvrp enable

Parameter

N/A

Description
Defaults

By default, GVRP is disabled.

Command

Global configuration mode

Mode
Usage Guide

GVRP can be enabled only in global configuration mode. If GVRP is not enabled globally, you can still
set other GVRP parameters, but the parameter settings take effect only when GVRP starts running.

Configuring the Advertising Mode of a Port

Optional.



Two GVRP advertising modes are available: Normal (default) and Non-applicant.



Normal mode: Indicates that a device externally advertises its VLAN information.



Non-applicant mode: Indicates that a device does not externally advertise its VLAN information.

Commandgvrp applicant state { normal | non-applicant }Parameter

normal: Indicates that a port externally advertises VLAN information.

Description

non-applicant: Indicates that a port does not externally advertise VLAN information.

Defaults

By default, ports are allowed to send GVRP notification.

Command

Interface configuration mode

Mode
Usage Guide

This command is used to configure the GVRP advertising mode of a port.



Configuring the Registration Mode of a Port

Optional.



Two GVRP registration modes are available: Normal and Disabled.

To enable dynamic VLAN registration on a port, run the gvrp registration mode normal command. To disable
dynamic VLAN registration on a port, run the gvrp register mode disable command.



If dynamic VLAN registration is enabled, dynamic VLANs will be created on the local device when the port
receives a GVRP packet carrying VLAN information from the peer end. If dynamic VLAN registration is disabled,
no dynamic VLAN will be created on the local device when the port receives a GVRP packet from the peer end.
The two registration modes do not affect the static VLANs on the port. The registration mode for manually-createdstatic VLANs is always Fixed Registrar.

Commandgvrp registration mode { normal | disabled }Parameter

normal: Indicates that the port is allowed to join a dynamic VLAN.

Description

disabled: Indicates that the port is not allowed to join a dynamic VLAN.

Defaults

If GVRP is enabled, the port in Trunk mode is enabled with dynamic VLAN registration by default.

Command

Interface configuration mode

Mode

8-9

Configuration Guide
Usage Guide

Configuring GVRP(beta)

This command is used to configure the GVRP registration mode of a port.

Verification


Run the show gvrp configuration command to check the configuration.



Check whether a dynamic VLAN is configured and the corresponding port joins the VLAN.

Configuration
Example

Enabling GVRP in a Topology and Dynamically Maintaining VLANs and the VLAN-Port Relationship

Scenario
Figure 9-4

Configuratio

On Switch A and Switch C, configure VLANs used for communication in the customer network.

n Steps

Enable the GVRP and dynamic VLAN creation features on Switch A, Switch B, and Switch C.

Configure the ports connected between switches as Trunk ports, and ensure that the VLAN lists ofTrunk ports include the communication VLANs. By default, a Trunk port allows the traffic from all
VLANs to pass through.

A

Enable the GVRP function on Switch A, Switch B, and Switch C.



It is recommended that STP be enabled to avoid loops.

1. Create VLAN 1–200 used for communication in the customer network. Enable the GVRP dynamic
VLAN creation features.
A# configure terminalA(config)# vlan range 1-200
A(config)# gvrp dynamic-vlan-creation enable
2. Configure the port connected to Switch B as a Trunk port. By default, a Trunk port allows the traffic
from all VLANs to pass through.
A(config)# interface gigabitethernet 0/17
A(config-if-GigabitEthernet 0/17)# switchport mode trunk
A(config-if-GigabitEthernet 0/17)# exit
3. Enable the GVRP function.
A(config)# gvrp enable
4. Configure the advertising mode and registration mode of the Trunk port. The Normal mode is used bydefault and does not need to be configured manually.
A(config)# interface gigabitEthernet 0/17
A(config-if-GigabitEthernet 0/17)# gvrp applicant state normalA(config-if-GigabitEthernet 0/17)# gvrp registration mode normalA(config-if-GigabitEthernet 0/17)# end

C



B

1. Enable the GVRP and dynamic VLAN creation features.

The configuration on Switch C is the same as that on Switch A.

B# configure terminal
B(config)# gvrp dynamic-vlan-creation enable
2. Configure the ports connected to Switch A and Switch C as Trunk ports.

8-10

Configuration Guide

Configuring GVRP(beta)

B(config)# interface range GigabitEthernet 0/17-18
B(config-if-GigabitEthernet 0/17)# switchport mode trunk
B(config-if-GigabitEthernet 0/18)# exit
3. Enable the GVRP function.
B(config)# gvrp enable

Verification

Check whether the GVRP configuration on each device is correct. Check whether VLAN 2–100 are
dynamically created on Switch B and whether Port G 0/17 and Port G 0/18 on Switch B join the dynamic
VLANs.

A

A# show gvrp configuration
Global GVRP Configuration:
GVRP Feature:enabled
GVRP dynamic VLAN creation:enabled
Join Timers(ms):200
Leave Timers(ms):600
Leaveall Timers(ms):1000
Port based GVRP Configuration:
PORT-----------------------

Applicant Status

Registration Mode-----------------------------------------

normalnormalGigabitEthernet 0/17

B

B# show gvrp configuration
Global GVRP Configuration:
GVRP Feature:enabled
GVRP dynamic VLAN creation:enabled
Join Timers(ms):200
Leave Timers(ms):600
Leaveall Timers(ms):1000
Port based GVRP Configuration:
PORT

Applicant Status

Registration Mode-----------------------------------------

GigabitEthernet 0/17

normalnormalGigabitEthernet 0/18

normalnormal-----------------------C

C# show gvrp configuration
Global GVRP Configuration:
GVRP Feature:enabled
GVRP dynamic VLAN creation:enabled
Join Timers(ms):200
Leave Timers(ms):600
Leaveall Timers(ms):1000
Port based GVRP Configuration:
PORT----------------------GigabitEthernet 0/17

Applicant Status

Registration Mode-----------------------------------------

normalnormal8-11

Configuration Guide

Configuring GVRP(beta)

Common Errors


The ports connected between devices are not in Trunk mode.

The VLAN lists of the ports connected between devices do not include the VLANs used for communication in thecustomer network.



The GVRP advertising modes and registration modes of Trunk ports are not set to Normal.

8.4.2 Enabling GVRP PDUs Transparent Transmission
Configuration EffectEnable devices to transparently transmit GVRP PDU frames to realize normal inter-device GVRP calculation when
GVRP is not enabled.

Notes
GVRP PDUs transparent transmission takes effect only when GVRP is disabled. After GVRP is enabled, devices will
not transparently transmit GVRP PDU frames.

Configuration Steps

Configuring GVRP PDUs Transparent Transmission

Optional.

Perform this configuration when you need to enable devices to transparently transmit GVRP PDU frames when
GVRP is disabled.

CommandParameter

bridge-frame forwarding protocol gvrp
N/A

Description
Defaults

By default, GVRP PDUs transparent transmission is disabled.

Command

Global configuration mode

Mode
Usage Guide

In the IEEE 802.1Q standard, the destination MAC address 01-80-C2-00-00-06 for GVRP PDUs isreserved. Devices compliant with IEEE 802.1Q do not forward received GVRP PDU frames. However, in
actual network deployment, devices may need to transparently transmit GVRP PDU frames to realize
normal inter-device GVRP calculation when GVRP is not enabled.
GVRP PDUs transparent transmission takes effect only when GVRP is disabled. After GVRP is enabled,
devices will not transparently transmit GVRP PDU frames.

Verification
Run the show run command to check whether GVRP PDUs transparent transmission is enabled.

Configuration
Example

Configuring GVRP PDUs Transparent Transmission

8-12

Configuration Guide

Configuring GVRP(beta)

Scenario
Figure 9-5

Enable GVRP on DEV A and DEV C. (DEV B is not enabled with GVRP.)

Configuration Steps
DEV B

Verification
DEV B

Configure GVRP PDUs transparent transmission on DEV B to realize normal GVRP calculation between
DEV A and DEV C.
Ruijie(config)#bridge-frame forwarding protocol gvrp

Run the show run command to check whether GVRP PDUs transparent transmission is enabled.
Ruijie#show run
bridge-frame forwarding protocol gvrp

8.4.3 Configuring the GVRP PDUs Tunnel Feature
Configuration EffectTransparently transmit GVRP packets between customer networks through tunnels in SP networks without impact on
the SP networks, and thereby separate the GVRP calculation in customer networks from that in SP networks.

Notes
The GVRP PDUs Tunnel feature takes effect after it is enabled in global configuration mode and interface configuration
mode.

Configuration Steps

Configuring the GVRP PDUs Tunnel Feature(Optional) Perform this configuration when you need to separate GVRP calculation between customer networks
and SP networks in a QinQ environment.

Run the l2protocol-tunnel gvrp command in global configuration mode to enable the GVRP PDUs Tunnel
feature.

Commandl2protocol-tunnel gvrp

Parameter

N/A

Description
Defaults

By default, the GVRP PDUs Tunnel feature is disabled.

Command

Global configuration mode

Mode
Usage Guide

The GVRP PDUs Tunnel feature takes effect after it is enabled in global configuration mode andinterface configuration mode.

8-13

Configuration GuideConfiguring GVRP(beta)

Run the l2protocol-tunnel gvrp enable command in interface configuration mode to enable the GVRP PDUs
Tunnel feature.

Commandl2protocol-tunnel gvrp enable

Parameter

N/A

Description
Defaults

By default, the GVRP PDUs Tunnel feature is disabled.

Command

Interface configuration mode

Mode
Usage Guide

The GVRP PDUs Tunnel feature takes effect after it is enabled in global configuration mode andinterface configuration mode.

Run the l2protocol-tunnel gvrp tunnel-dmac mac-address command to configure the transparent transmission
address used by the GVRP PDUs Tunnel feature.

Commandl2protocol-tunnel gvrp tunnel-dmac mac-address

Parameter

mac-address: Indicates the GVRP address used by transparent transmission. The available GVRP

Description

PDUs TUNNEL addresses include 01d0.f800.0006 and 011a.a900.0006.

Defaults

The default address is 01d0.f800.0006.

Command

Global configuration mode

Mode
Usage GuideIn GVRP PDUs Tunnel application, when a GVRP packet from a customer network enters the PE in an
SP network, the destination MAC address of the packet is changed to a private address before thepacket is forwarded in the SP network. When the packet reaches the peer PE, the destination MAC
address is changed to a public address before the packet is sent to the customer network at the otherend. In this way, the GVRP packet can be transparently transmitted across the SP network. The private
address is the transparent transmission address used by the GVRP PDUs Tunnel feature.

Verification
Run the show l2protocol-tunnel gvrp command to check the GVRP PDUs Tunnel configuration.

Configuration
Example

Configuring the GVRP PDUs Tunnel Feature

8-14

Configuration Guide

Configuring GVRP(beta)

Scenario
Figure 9-6

ConfiguratioEnable basic QinQ on the PEs (Provider S1 and Provider S2) in the SP network to transmit data
packets from the customer network through VLAN 200 in the SP network.

n Steps

Enable GVRP transparent transmission on the PEs (Provider S1 and Provider S2) in the SP
network to allow the SP network to tunnel GVRP packets from the customer network via the GVRPPDUs Tunnel feature.

Provider S1Step 1: Create VLAN 200 of the SP network.
Ruijie#configure terminal
Ruijie(config)#vlan 200
Ruijie(config-vlan)#exit
Step 2: Enable basic QinQ on the port connected to the customer network to tunnel data from thecustomer network through VLAN 200.
Ruijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#switchport mode dot1q-tunnel
Ruijie(config-if-GigabitEthernet 0/17)#switchport dot1q-tunnel native vlan 200
Ruijie(config-if-GigabitEthernet 0/17)#switchport dot1q-tunnel allowed vlan add untagged 200
Step 3: Enable GVRP transparent transmission on the port connected to the customer network.
Ruijie(config-if-GigabitEthernet 0/17)#l2protocol-tunnel gvrp enable
Ruijie(config-if-GigabitEthernet 0/17)#exit
Step 4: Enable GVRP transparent transmission globally.
Ruijie(config)#l2protocol-tunnel gvrp

Provider S2

Verification

The configuration on Provider S2 is similar to that on Provider S1.



Check whether the GVRP PDUs Tunnel configuration is correct.



Check whether the Tunnel port is configured correctly. Pay attention to the following:

8-15

Configuration Guide

Provider S1

Configuring GVRP(beta)-

The port type is dot1q-tunnel.

-

The outer tag VLAN is the Native VLAN and added to the VLAN list of the Tunnel port.

-

The ports on the PEs in the uplink direction are configured as Uplink ports.

1. Check whether the GVRP PDUs Tunnel configuration is correct.
Ruijie#show l2protocol-tunnel gvrp
L2protocol-tunnel: Gvrp Enable
L2protocol-tunnel destination mac address: 01d0.f800.0006
GigabitEthernet 0/17 l2protocol-tunnel gvrp enable
2. Check whether the QinQ configuration is correct.
Ruijie#show running-config
interface GigabitEthernet 0/17
switchport mode dot1q-tunnel
switchport dot1q-tunnel allowed vlan add untagged 200
switchport dot1q-tunnel native vlan 200
l2protocol-tunnel gvrp enable!

Provider S2

The verification on Provider S2 is the same as that on Provider S1.

Common Errors
In an SP network, transparent transmission addresses are not configured consistently, which affects the transmission of
GVRP PDU frames.

8.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.

Description

CommandClears port counters.

clear gvrp statistics { interface-type interface-number | all }Displaying
Description

Command

Displays port counters.

show gvrp statistics { interface-type interface-number | all }Displays the current GVRP status.

show gvrp status

Displays the current GVRP configuration.

show gvrp configuration

Displays the information of the GVRP PDUs Tunnel
feature.

show l2protocol-tunnel gvrp

8-16

Configuration Guide

Configuring GVRP(beta)

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.

Description

Command

Enables GVRP event debugging.

debug gvrp event

Enables GVRP timer debugging.

debug gvrp timer

8-17Configuration Guide

Configuring LLDP(beta)

9 Configuring LLDP(beta)
9.1 Overview
The Link Layer Discovery Protocol (LLDP), defined in the IEEE 802.1AB standard, is used to discover the topology andidentify topological changes. LLDP encapsulates local information of a device into LLDP data units (LLDPDUs) in thetype/length/value (TLV) format and then sends the LLDPDUs to neighbors. It also stores LLDPDUs from neighbors in
the management information base (MIB) to be accessed by the network management system (NMS).
With LLDP, the NMS can learn about topology, for example, which ports of a device are connected to other devices andwhether the rates and duplex modes at both ends of a link are consistent. Administrators can quickly locate and rectify afault based on the information.
A Ruijie LLDP-compliant device is capable of discovering neighbors when the peer is either of the following:

Ruijie LLDP-compliant deviceEndpoint device that complies with the Link Layer Discovery Protocol-Media Endpoint Discovery (LLDP-MED)

Protocols andStandards
IEEE 802.1AB 2005: Station and Media Access Control Connectivity Discovery



ANSI/TIA-1057: Link Layer Discovery Protocol for Media Endpoint Devices

9.2 Applications
Application

Description

Displaying Topology

Multiple switches, a MED device, and an NMS are deployed in the network
topology.

Conducting Error Detection

Two switches are directly connected and incorrect configuration will be displayed.

9.2.1 Displaying Topology
Scenario
Multiple switches, a MED device, and an NMS are deployed in the network topology.
As shown in the following figure, the LLDP function is enabled by default and no additional configuration is required.



Switch A and Switch B discover that they are neighbors.



Switch A discovers its neighbor MED device, that is, IP-Phone, through port GigabitEthernet 0/1.

The NMS accesses MIB of switch A.

Figure 10-1

9-1

Configuration Guide

Configuring LLDP(beta)

RemarkRuijie Switch A, Switch B, and IP-Phone support LLDP and LLDP-MED.

s

LLDP on switch ports works in TxRx mode.
The LLDP transmission interval is 30 seconds and transmission delay is 2 seconds by default.

Deployment


Run LLDP on a switch to implement neighbor discovery.

Run the Simple Network Management Protocol (SNMP) on the switch so that the NMS acquires and sets
LLDP-relevant information on the switch.

9.2.2 Conducting Error Detection
Scenario
Two switches are directly connected and incorrect configuration will be displayed.
As shown in the following figure, the LLDP function and LLDP error detection function are enabled by default, and no
additional configuration is required.



After you configure a virtual local area network (VLAN), port rate and duplex mode, link aggregation, andmaximum transmission unit (MTU) of a port on Switch A, an error will be prompted if the configuration does notmatch that on Switch B, and vice versa.

Figure 10-2

RemarkRuijie Switch A and Switch B support LLDP.

s

LLDP on switch ports works in TxRx mode.
The LLDP transmission interval is 30 seconds and transmission delay is 2 seconds by default.

Deployment


Run LLDP on a switch to implement neighbor discovery and detect link fault.

9-2

Configuration Guide

Configuring LLDP(beta)

9.3 Features
Basic Concepts

LLDPDULLDPDU is a protocol data unit encapsulated into an LLDP packet. Each LLDPDU is a sequence of TLV structures. The
TLV collection consists of three mandatory TLVs, a series of optional TLVs, and one End Of TLV. The following figure
shows the format of an LLDPDU.
Figure 10-3 LLDPDU Format

In the preceding figure:

M indicates a mandatory TLV.



In an LLDPDU, Chassis ID TLV, Port ID TLV, Time To Live TLV, and End Of LLDPDU TLV are mandatory and
TLVs of other TLVs are optional.



LLDP Encapsulation Format

LLDP packets can be encapsulated in two formats: Ethernet II and Subnetwork Access Protocols (SNAP).
The following figure shows the format of LLDP packets encapsulated in the Ethernet II format.
Figure 10-4 Ethernet II Format

In the preceding figure:Destination Address: Indicates the destination MAC address, which is the LLDP multicast address
01-80-C2-00-00-0E.

Source Address: Indicates the source MAC address, which is the port MAC address.



Ethertype: Indicates the Ethernet type, which is 0x88CC.

LLDPDU: Indicates the LLDP protocol data unit.



FCS: Indicates the frame check sequence.

Figure 10-5 shows the format of LLDP packets encapsulated in the SNAP format.
Figure 9-5 SNAP Format

In the preceding figure:Destination Address: Indicates the destination MAC address, which is the LLDP multicast address
01-80-C2-00-00-0E.

Source Address: Indicates the source MAC address, which is the port MAC address.

9-3

Configuration Guide

SNAP-encoded

Configuring LLDP(beta)
Ethertype:

Indicates

theEthernet

type

of

the

SNMP

encapsulation,

which

is

AA-AA-03-00-00-00-88-CC.



LLDPDU: Indicates the LLDP protocol data unit.



FCS: Indicates the frame check sequence.



TLV

TLVs encapsulated into an LLDPDU can be classified into two types:

Basic management TLVs

The basic management TLV collection consists of two types of TLVs: mandatory TLVs and optional TLVs. A mandatory
TLV must be contained in an LLDPDU for advertisement and an optional TLV is contained selectively.
The following table describes basic management TLVs.
TLV Type

Description

Mandatory/Optional

End Of LLDPDU TLVIndicates the end of an LLDPDU, occupying two bytes.

Mandatory

Chassis ID TLV

Identifies a device with a MAC address.

Mandatory

Port ID TLV

Identifies a port sending LLDPDUs.

Fixed

Indicates the time to live (TTL) of local information on a neighbor.
Time To Live TLVWhen a device receives a TLV containing TTL 0, it deletes the

Mandatory

neighbor information.
Port Description TLV

Indicates the descriptor of the port sending LLDPDUs.

Optional

System Name TLV

Describes the device name.

Optional

System Description TLV

System Capabilities TLVManagement Address TLVIndicates the device description, including the hardware version,
software version, and operating system information.
Describes main functions of the device, such as the bridge,
routing, and relay functions.
Indicates the management address, which contains the interface
ID and object identifier (OID).

Optional

Optional

Optional

Ruijie LLDP-compliant switches support advertisement of basic management TLVs.



Organizationally specific TLVs

Different organizations, such as the IEEE 802.1, IEEE 802.3, IETF and device suppliers, define specific TLVs toadvertise specific information about devices. The organizationally unique identifier (OUI) field in a TLV is used to
distinguish different organizations.
Organizationally specific TLVs are optional and are advertised in an LLDPDU selectively. Currently, there are three
types of common organizationally specific TLVs: IEEE 802.1 organizationally specific TLVs, IEEE 802.3
organizationally specific TLVs, and LLDP-MED TLVs.
The following table describes IEEE 802.1 organizationally specific TLVs.
TLV Type

Description

Port VLAN ID TLVIndicates the VLAN identifier of a port.

Port And Protocol VLAN ID TLVIndicates the protocol VLAN identifier of a port.

VLAN Name TLVIndicates the VLAN name of a port.

Protocol Identity TLV

Indicates the protocol type supported by a port.

9-4

Configuration Guide

Configuring LLDP(beta)

Ruijie LLDP-compliant switches do not send the Protocol Identity TLV but receive this TLV.
The following table describes IEEE 802.3 organizationally specific TLVs.
TLV Type

Description
Indicates the rate and duplex mode of a port, and whether to

MAC/PHY Configuration//Status TLV

support and enable auto-negotiation.

Power Via MDI TLVIndicates the power supply capacity of a port.
Indicates the link aggregation capacity of a port and the

Link Aggregation TLV

current aggregation state.
Indicates the maximum size of the frame transmitted by a

Maximum Frame Size TLV

port.

Ruijie LLDP-compliant devices support advertisement of IEEE 802.3 organizationally specific TLVs.

LLDP-MED TLV

LLDP-MED is an extension to LLDP based on IEEE 802.1AB LLDP. It enables users to conveniently deploy the VoiceOver IP (VoIP) network and detect faults. It provides applications including the network configuration policies, device
discovery, PoE management, and inventory management, meeting requirements for low cost, effective management,
and easy deployment.
The following table describes LLDP-MED TLVs.
TLV Type

Description
Indicates the type of the LLDP-MED TLV encapsulated into an LLDPDU and

LLDP-MED Capabilities TLV

device type (network connectivity device or endpoint device), and whether tosupport LLDP-MED,.
Advertises the port VLAN configuration, supported application type (such as

Network Policy TLVvoice or video services), and Layer-2 priority information.

Location Identification TLV

Locates and identifies an endpoint device.

Extended Power-via-MDI TLVProvides more advanced power supply management.

Inventory – Hardware Revision TLV

Indicates hardware version of a MED device.

Inventory – Firmware Revision TLV

Indicates the firmware version of the MED device.

Inventory – Software Revision TLV

Indicates the software version of the MED device.

Inventory – Serial Number TLV

Indicates the serial number of the MED device.

Inventory – Manufacturer Name TLVIndicates the name of the manufacturer of the MED device.

Inventory – Model Name TLVIndicates the module name of the MED device.

Inventory – Asset ID TLVIndicates the asset identifier of the MED device, used for inventory
management and asset tracking.

Ruijie LLDP-compliant Ruijie devices support advertisement of LLDP-MED TLVs.

Overview
FeatureDescription

LLDP Work Mode

Configures the mode of transmitting and receiving LLDP packets.

LLDP Transmission

Enables directly connected LLDP-compliant devices to send LLDP packets to the peer.

Mechanism

9-5

Configuration Guide
LLDP Reception

Configuring LLDP(beta)
Enables directly connected LLDP-compliant devices to receive LLDP packets from the peer.

Mechanism

9.3.1 LLDP Work Mode
Configure the LLDP work mode so as to specify the LLDP packet transmission and reception mode.

Working Principle
LLDP provides three work modes:

TxRx: Transmits and receives LLDPDUs.

Rx Only: Only receives LLDPDUs.



Tx Only: Only transmits LLDPDUs.

When the LLDP work mode is changed, the port initializes the protocol state machine. You can set a port initialization
delay to prevent repeated initialization of a port due to frequent changes of the LLDP work mode.

RelatedConfiguration

Configuring the LLDP Work Mode

The default LLDP work mode is TxRx.
You can run the lldp mode command to configure the LLDP work mode.
If the work mode is set to TxRx, the device can both transmit and receive LLDP packets. If the work mode is set to Rx
Only, the device can only receive LLDP packets. If the work mode is set to Tx Only, the device can only transmit LLDP
packets. If the work mode is disabled, the device cannot transmit or receive LLDP packets.

9.3.2 LLDP Transmission Mechanism
LLDP packets inform peers of their neighbors. When the LLDP transmission mode is cancelled or disabled, LLDP
packets cannot be transmitted to neighbors.

Working Principle
LLDP periodically transmits LLDP packets when working in TxRx or Tx Only mode. When information about the local
device changes, LLDP immediately transmits LLDP packets. You can configure a delay time to avoid frequenttransmission of LLDP packets caused by frequent changes of local information.
LLDP provides two types of packets:Standard LLDP packet, which contains management and configuration information about the local device.



Shutdown packet: When the LLDP work mode is disabled or the port is shut down, LLDP Shutdown packets will betransmitted. A Shutdown packet consists of the Chassis ID TLV, Port ID TLV, Time To Live TLV, and End OF
LLDP TLV. TTL in the Time to Live TLV is 0. When a device receives an LLDP Shutdown packet, it considers thatthe neighbor information is invalid and immediately deletes it.

When the LLDP work mode is changed from disabled or Rx to TxRx or Tx, or when LLDP discovers a new neighbor(that is, a device receives a new LLDP packet and the neighbor information is not stored locally), the fast transmission

9-6

Configuration Guide

Configuring LLDP(beta)mechanism is started so that the neighbor quickly learns the device information. The fast transmission mechanism
enables a device to transmit multiple LLDP packets at an interval of 1 second.

RelatedConfiguration

Configuring the LLDP Work Mode

The default work mode is TxRx.
Run the lldp mode txrx or lldp mode tx command to enable the LLDP packet transmission function. Run the lldp
mode rx or no lldp mode command to disable the LLDP packet transmission function.
In order to enable LLDP packet reception, set the work mode to TxRx or Rx Only. If the work mode is set to Rx Only, thedevice can only receive LLDP packets.

Configuring the LLDP Transmission Delay

The default LLDP transmission delay is 2 seconds.
Run the lldp timer tx-delay command to change the LLDP transmission delay.
If the delay is set to a very small value, the frequent change of local information will cause frequent transmission of
LLDP packets. If the delay is set to a very large value, no LLDP packet may be transmitted even if local information ischanged.

Configuring the LLDP Transmission Interval

The default LLDP transmission interval is 30 seconds.
Run the lldp timer tx-interval command to change the LLDP transmission interval.
If the interval is set to a very small value, LLDP packets may be transmitted frequently. If the interval is set to a verylarge value, the peer may not discover the local device in time.

Configuring the TLVs to Be Advertised

By default, an interface is allowed to advertise TLVs of all types except Location Identification TLV.
Run the lldp tlv-enable command to change the TLVs to be advertised.

Configuring the LLDP Fast Transmission CountBy default, three LLDP packets are fast transmitted.
Run the lldp fast-count command to change the number of LLDP packets that are fast transmitted.

9.3.3 LLDP Reception Mechanism
A device can discover the neighbor and determine whether to age the neighbor information according to received LLDP
packets.

Working Principle
A device can receive LLDP packets when working in TxRx or Rx Only mode. After receiving an LLDP packet, a device
conducts validity check. After the packet passes the check, the device checks whether the packet contains information
about a new neighbor or about an existing neighbor and stores the neighbor information locally. The device sets the9-7Configuration Guide

Configuring LLDP(beta)

TTL of neighbor information according to the value of TTL TLV in the packet. If the value of TTL TLV is 0, the neighbor
information is aged immediately.

RelatedConfiguration

Configuring the LLDP Work Mode

The default LLDP work mode is TxRx.
Run the lldp mode txrx or lldp mode rx command to enable the LLDP packet reception function. Run the lldp modetx or no lldp mode command to disable the LLDP packet reception function.
In order to enable LLDP packet reception, set the work mode to TxRx or Rx Only. If the work mode is set to Tx Only, thedevice can only transmit LLDP packets.

9.4 Configuration
Configuration

Description and Command(Optional) It is used to enable or disable the LLDP function in global or interface configuration

Configuring the
LLDP Function

Configuring the
LLDP Work
Mode

mode.
lldp enable

Enables the LLDP function.

no lldp enable

Disables the LLDP function.

(Optional) It is used to configure the LLDP work mode.
lldp mode { rx | tx | txrx }Configures the LLDP work mode.

no lldp mode

Shuts down the LLDP work mode.

(Optional) It is used to configure the TLVs to be advertised.
Configures the basic management TLVs to be

lldp tlv-enable basic-tlv

advertised.
Cancels basic management TLVs.

no lldp tlv-enable basic-tlv

Configures the IEEE 802.1 organizationallylldp tlv-enable dot1-tlv

specific TLVs to be advertised.

Configuring the
TLVs to Be

Removes IEEE 802.1 organizationally specificno lldp tlv-enable dot1-tlv

TLVs.

Advertised

Configures the IEEE 802.3 organizationallylldp tlv-enable dot3-tlv

specific TLVs to be advertised.
Removes IEEE 802.3 organizationally specificno lldp tlv-enable dot3-tlv

TLVs.
Configures the LLDP-MED TLVs to be

lldp tlv-enable med-tlv

advertised.
Removes LLDP-MED TLVs.

no lldp tlv-enable med-tlv
Configures the(Optional) It is used to configure the management address to be advertised in LLDP packets.

9-8Configuration Guide
Configuration
Management
Address to Be
Advertised
Configuring the
LLDP Fast

Configuring LLDP(beta)

Description and Command
lldp management-address-tlv [ ip-address ]Configuring the
TTL Multiplieradvertised in LLDP packets.
Cancels the management address.

no lldp management-address-tlv(Optional) It is used to configure the number of LLDP packets that are fast transmitted.
Configures the LLDP fast transmission count.

lldp fast-count fast-count-value

Transmission
Count

Configures the management address to be

Restores the default LLDP fast transmission

no lldp fast-count

count.

(Optional) It is used to configure the TTL multiplier and transmission interval.
Configures the TTL multiplier.

lldp hold-multiplier ttl-value

andTransmission

no lldp hold-multiplier

Restores the default TTL multiplier.

Interval

lldp timer tx-interval tx-interval

Configures the transmission interval.

no lldp timer tx-interval

Restores the default transmission interval.

Configuring theTransmission
Delay
Configuring theInitialization
Delay(Optional) It is used to configure the delay time for LLDP packet transmission.
lldp timer tx-delay tx-delay

Configures the transmission delay.

no lldp timer tx-delay

Restores the default transmission delay.

(Optional) It is used to configure the delay time for LLDP to initialize on any interface.
lldp timer reinit-delay reinit-delay

Configures the initialization delay.

no lldp timer reinit-delay

Restores the default initialization delay.

(Optional) It is used to configure the LLDP Trap function.
Configuring thelldp notification remote-change enable

Enables the LLDP Trap function.

LLDP Trap

no lldp notification remote-change enable

Disables the LLDP Trap function.

Function

lldp timer notification-interval trap

Configures the LLDP Trap transmission interval.
Restores the default LLDP Trap transmission

no lldp timer notification-interval
Configuring theinterval.

(Optional) It is used to configure the LLDP error detection function.

LLDP Error
Detectionlldp error-detect

Enables the LLDP error detection function.

Functionno lldp error-detect

Disables the LLDP error detection function.

Configuring the
LLDP(Optional) It is used to configure the LLDP encapsulation format.
Sets the LLDP encapsulation format to SNAP.

lldp encapsulation snap

Encapsulation
Format

Sets the LLDP encapsulation format to Ethernet

no lldp encapsulation snap

II.

(Optional) It is used to configure the LLDP network policy.
Configuring the
LLDP Network
Policylldp network-policy profile profile-num

Configures an LLDP network policy.

no lldp network-policy profile profile-num

Deletes an LLDP network policy.

(Optional) It is used to configure the Voice VLAN policy.

9-9Configuration Guide
Configuration

Configuring LLDP(beta)

Description and Command{ voice | voice-signaling } vlan

Configures a Voice VLAN policy.

no { voice | voice-signaling } vlan

Deletes a Voice VLAN policy.

(Optional) It is used to configure the interface to advertise the LLDP network policy.
lldp tlv-enable med-tlv network-policy profile

Configures the interface to advertise the LLDP

[ profile-number ]network policy.

no lldp tlv-enable med-tlv network-policy

Configures the interface to advertise no LLDP

profile [ profile-number ]network policy.

(Optional) It is used to configure the civic address of a device.
lldp location civic-location identifier id

Creates a civic address of a device

no lldp location civic-location identifier id

Deletes a civic address of a device(Optional) It is used to configure the civic address of a device.
{ country | state | county | city | division |neighborhood | street-group | leading-street-dir| trailing-street-suffix | street-suffix | number |street-number-suffix | landmark |additional-location-information | name |Configures the civic address of a device.

postal-code | building | unit | floor | room |type-of-place | postal-community-name |post-office-box | additional-code } ca-word
no { country | state | county | city | division |Configuring theneighborhood | street-group | leading-street-dir

Civic Address| trailing-street-suffix | street-suffix | number |street-number-suffix | landmark |additional-location-information | name |Deletes civic address of a device.

postal-code | building | unit | floor | room |type-of-place | postal-community-name |post-office-box | additional-code } ca-word(Optional) It is used to configure the device type.
device-type device-type

Configures the device type.

no device-type

Deletes the device type.

(Optional) It is used to configure the TLVs to be advertised.

Configuring theEmergency
Telephonelldp tlv-enable med-tlv location civic-location

Configures the civic address in Location

identifier id

Identification TLV to be advertised.

no lldp tlv-enable med-tlv location

Removes the civic address in Location

civic-location identifier id

Identification TLV to be advertised.

(Optional) It is used to configure the emergency telephone number of a device.
lldp location elin identifier id elin-location

Configures the emergency telephone number of

tel-number

a device.

9-10

Configuration Guide
Configuration
NumberConfiguring LLDP(beta)

Description and Command
Deletes the emergency telephone number of ano lldp location elin identifier id

device.

(Optional) It is used to configure the TLVs to be advertised.
lldp tlv-enable med-tlv location elin identifier id

Configures the emergency telephone number in
Location Identification TLV to be advertised.

no lldp tlv-enable med-tlv location elin

Removes the emergency telephone number in

identifier id

Location Identification TLV to be advertised.

9.4.1 Configuring the LLDP Function
Configuration EffectEnable or disable the LLDP function.

Notes


To make the LLDP function take effect on an interface, you need to enable the LLDP function globally and on theinterface.

Configuration Steps

Optional.

Configure the LLDP function in global or interface configuration mode.

Enabling the LLDP Function

Commandlldp enable

Parameter

N/A

Description
Defaults

This function is enabled by default.

Command

Global configuration mode/Interface configuration mode

Mode
Usage Guide

The LLDP function takes effect on an interface only after it is enabled in global configuration mode andinterface configuration mode.

Verification
Display LLDP status



Check whether the LLDP function is enabled in global configuration mode.

Check whether the LLDP function is enabled in interface configuration mode.

Related Commands



Disabling the LLDP Function

Commandno lldp enable

Parameter

N/A

9-11

Configuration Guide

Configuring LLDP(beta)

Description
Defaults

This function is enabled by default.

Command

Global configuration mode/Interface configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Disabling the LLDP Function

Configuratio

Disable the LLDP function in global configuration mode.

n StepsRuijie(config)#no lldp enable

Verification

Display global LLDP status.
Ruijie(config)#show lldp status
Global status of LLDP: Disable

Common Errors


If the LLDP function is enabled on an interface but disabled in global configuration mode, the LLDP function does
not take effect on the interface.



A port can learn a maximum of five neighbors.



If a neighbor does not support LLDP but it is connected to an LLDP-supported device, a port may learn information
about the device that is not directly connected to the port because the neighbor may forward LLDP packets.

9.4.2 Configuring the LLDP Work Mode
Configuration Effect

If you set the LLDP work mode to TxRx, the interface can transmit and receive packets.



If you set the LLDP work mode to Tx, the interface can only transmit packets but cannot receive packets.



If you set the LLDP work mode to Rx, the interface can only receive packets but cannot transmit packets.



If you disable the LLDP work mode, the interface can neither receive nor transmit packets.

Notes


LLDP runs on physical ports (AP member ports for AP ports). Stacked ports and VSL ports do not support LLDP.

Configuration Steps

Optional.



Set the LLDP work mode to Tx or Rx as required.

Configuring the LLDP Work Mode

Commandlldp mode { rx | tx | txrx }9-12

Configuration Guide
Parameterrx: Only receives LLDPDUs.

Description

tx: Only transmits LLDPDUs.

Configuring LLDP(beta)

txrx: Transmits and receives LLDPDUs.
Defaults

The default is txrx.

Command

Interface configuration mode

Mode
Usage Guide

To make LLDP take effect on an interface, make sure to enable LLDP globally and set the LLDP work
mode on the interface to Tx, Rx or TxRx.

Verification
Display LLDP status information on an interface

Check whether the configuration takes effect.

Related Commands



Disabling the LLDP Work Mode

Commandno lldp mode

Parameter

N/A

Description
Defaults

The default is txrx.

Command

Interface configuration mode

Mode
Usage Guide

After the LLDP work mode on an interface is disabled, the interface does not transmit or receive LLDP
packets.

Configuration
Example

Configuring the LLDP Work Mode

Configuratio

Set the LLDP work mode to Tx in interface configuration mode.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#lldp mode tx

Verification

Display LLDP status information on the interface.
Ruijie(config-if-GigabitEthernet 0/17)#show lldp status interface gigabitethernet 0/17
Port [GigabitEthernet 0/17]
Port status of LLDP

: Enable

Port state: UP

Port encapsulation: Ethernet II

Operational mode

: TxOnly

Notification enable: NO

Error detect enable: YES

Number of neighbors

: 0

9-13

Configuration Guide
Number of MED neighbors

Configuring LLDP(beta): 0

9.4.3 Configuring the TLVs to Be Advertised
Configuration EffectConfigure the type of TLVs to be advertised to specify the LLDPDUs in LLDP packets.

Configuration Steps

Optional.

Configure the type of TLVs to be advertised on an interface.

Configuring Optional Basic Management TLVs to Be Advertised

Commandlldp tlv-enable basic-tlv { all | port-description | system-capability | system-description |system-name }Parameter

all: Indicates all optional basic management TLVs are advertised.

Description

port-description: Indicates the Port Description TLV is advertised.
system-capability: Indicates the System Capabilities TLV is advertised.
system-description: Indicates the System Description TLV is advertised.
system-name: Indicates the System Name TLV is advertised.

Defaults

All optional basic management TLVs are advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

The mandatory Basic management TLVs must be advertised in LLDPDU.
You do not need to run this command to configure the mandatory Basic management TLVs to be
advertised.

Configuring IEEE 802.1 TLVs to Be Advertised

Commandlldp tlv-enable dot1-tlv { all | port-vlan-id | protocol-vlan-id [ vlan-id ] | vlan-name [ vlan-id ] }Parameter

all: Indicates the Port VLAN ID TLV, the Port And Protocol VLAN ID TLV and the VLAN Name TLV are

Description

advertised.
port-vlan-id: Indicates the Port VLAN ID TLV is advertised.
protocol-vlan-id [ vlan-id ]: Indicates the Port and Protocol VLAN ID TLV is advertised. The Port
Protocol VLAN ID rangs from 1 to 4,094.
vlan-name [ vlan-id ]: Indicates the VLAN Name TLV is advertised. The VLAN ID rangs from 1 to 4,094.

Defaults

All the IEEE 802.1 TLVs are advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuring IEEE 802.3 TLVs to Be Advertised

Commandlldp tlv-enable dot3-tlv { all | link-aggregation | mac-physic | max-frame-size | power }Parameter

all: Indicates all the IEEE 802.3 organizationally specific TLVs are advertised.

Description

link-aggregation: Indicates the Link Aggregation TLV is advertised.

9-14

Configuration Guide

Configuring LLDP(beta)

mac-physic: Indicates the MAC/PHY Configuration/Status TLV is advertised.
max-frame-size: Indicates the Maximum Frame Size TLV is advertised.
power: Indicates the Power Via MDI TLV is advertised.
Defaults

All the IEEE 802.3 TLVs are not advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

If you want to configure the LLDP-MED Capability TLV, configure the LLDP 802.3 MAC/PHY TLV first.

Configuring LLDP MED TLVs to Be Advertised

Commandlldp tlv-enable med-tlv { all | capability | inventory | location civic-location identifier id | location
elin identifier id | network-policy profile [ profile-num ] | power-over-ethernet } }Parameter

all: Indicates all LLDP-MED TLVs except the Location Identification TLV are advertised.

Description

capability: Indicates the LLDP-MED Capabilities TLV is advertised.
Inventory: Indicates the inventory management TLV is advertised, which contains the hardware version,
firmware version, software version, SN, manufacturer name, module name, and asset identifier.
location civic-location identifier id: Indicates the civic address of the Location Identification TLV isadvertised. The civic address policy ID rangs from 1 to 1,024.
location elin identifier id: Indicates the emergency telephone number of the Location Identification TLV
is advertised. The emergency telephone number policy ID rangs from 1 to 1,024.
network-policy profile [ profile-num ]: Indicates the Network Policy TLV is advertised. The network
policy ID rangs from 1 to 1,024.
power-over-ethernet: Indicates the Extended Power-via-MDI TLV is advertised.

Defaults

All types of LLDP-MED TLVs are not advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

If you want to configure LLDP-MED TLVs, configure the LLDP-MED Capability TLV before configuringother types of LLDP-MED TLVs.
If you want to configure the LLDP-MED Capability TLV, configure the LLDP 802.3 MAC/PHY TLV first.
If a device is connected to an IP-Phone that supports LLDP-MED, you can configure the Network Policy
TLV to deliver policy configuration to the IP-Phone.

VerificationDisplay the configuration of TLVs to be advertised on an interface

Check whether the configuration takes effect.

Related Commands



Removing Optional Basic Management TLVs

Commandno lldp tlv-enable basic-tlv { all | port-description | system-capability | system-description |system-name }Parameter

all: Indicates all optional basic management TLVs are not advertised.

Description

port-description: Indicates the Port Description TLV is not advertised.
system-capability: Indicates the System Capabilities TLV is not advertised.

9-15

Configuration Guide

Configuring LLDP(beta)system-description: Indicates the System Description TLV is not advertised.
system-name: Indicates the System Name TLV is not advertised.
Defaults

All optional basic management TLVs are advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

The mandatory basic management TLVs must be advertised in LLDPDU.
You cannot run this command to remove the mandatory Basic management TLVs to be advertised.

Removing IEEE 802.1 TLVs

Commandno lldp tlv-enable dot1-tlv { all | port-vlan-id | protocol-vlan-id | vlan-name }Parameter

all: Indicates the Port VLAN ID TLV, the Port And Protocol VLAN ID TLV and the VLAN Name TLV are

Description

not advertised.
port-vlan-id: Indicates the Port VLAN ID TLV is not advertised.
protocol-vlan-id: Indicates the Port And Protocol VLAN ID TLV is not advertised. The Port Protocol
VLAN ID ranges from 1 to 4,094.
vlan-name: Indicates the VLAN Name TLV is not advertised. The VLAN ID ranges from 1 to 4,094.

Defaults

All the IEEE 802.1 TLVs are advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

Removing IEEE 802.3 TLVs

Commandno lldp tlv-enable dot3-tlv { all | link-aggregation | mac-physic | max-frame-size | power }Parameter

all: Indicates all the IEEE 802.3 organizationally specific TLVs are not advertised.

Description

link-aggregation: Indicates the Link Aggregation TLV is not advertised.
mac-physic: Indicates the MAC/PHY Configuration/Status TLV is not advertised.
max-frame-size: Indicates the Maximum Frame Size TLV is not advertised.
power: Indicates the Power Via MDI TLV is not advertised.

Defaults

All the IEEE 802.3 TLVs are not advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

If you want to remove the LLDP 802.3 MAC/PHY TLV, remove the LLDP-MED Capability TLV first.

Removing LLDP MED TLVs

Commandno lldp tlv-enable med-tlv { all | capability | inventory | location civic-location identifier id | location
elin identifier id | network-policy profile [ profile-num ] | power-over-ethernet } }Parameter

all: Indicates all LLDP-MED TLVs except the Location Identification TLV are not advertised.

Description

capability: Indicates the LLDP-MED Capabilities TLV is not advertised.
Inventory: Indicates the inventory management TLV is not advertised, which contains the hardware
version, firmware version, software version, SN, manufacturer name, module name, and asset identifier.
locationcivic-location identifier id: Indicates the civic address of the Location Identification TLV is notadvertised. The civic address policy ID ranges from 1 to 1,024.
location elin identifier id: Indicates the emergency telephone number of the Location Identification TLV
is not advertised. The emergency telephone number policy ID ranges from 1 to 1,024.

9-16

Configuration Guide

Configuring LLDP(beta)

network-policy profile [ profile-num ]: Indicates the Network Policy TLV is not advertised. The network
policy ID ranges from 1 to 1,024.
power-over-ethernet: Indicates the Extended Power-via-MDI TLV is not advertised.
Defaults

All types of LLDP-MED TLVs are not advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

If you want to remove the LLDP 802.3 MAC/PHY TLV, remove the LLDP-MED Capability TLV first.
If you want to remove LLDP-MED TLVs, remove the LLDP-MED Capability TLV after removing othertypes of LLDP-MED TLVs.

Configuration
Example

Configuring TLVs to Be Advertised

Configuratio

Cancel the advertisement of the IEEE 802.1 organizationally specific Port And Protocol VLAN ID TLV.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#no lldp tlv-enable dot1-tlv protocol-vlan-id

Verification

Display LLDP TLV configuration in interface configuration mode.
Ruijie(config-if-GigabitEthernet 0/17)#show lldp tlv-config interface gigabitethernet 0/17
LLDP tlv-config of port [GigabitEthernet 0/17]
NAME

STATUS DEFAULT------------------------------ ------ ------Basic optional TLV:Port Description TLV

YES

YES

System Name TLV

YES

YES

System Description TLV

YES

YES

System Capabilities TLV

YES

YES

Management Address TLV

YES

YES

Port VLAN ID TLV

YES

YES

Port And Protocol VLAN ID TLV

NO

YES

VLAN Name TLV

YES

YES

MAC-Physic TLV

YES

YES

Power via MDI TLV

YES

YES

Link Aggregation TLV

YES

YES

Maximum Frame Size TLV

YES

YES

IEEE 802.1 extend TLV:IEEE 802.3 extend TLV:LLDP-MED extend TLV:Capabilities TLV

YES

9-17

YES

Configuration Guide

Configuring LLDP(beta)

Network Policy TLV

YES

YES

Location Identification TLVNONOExtended Power via MDI TLV

YES

YES

Inventory TLV

YES

YES

9.4.4 Configures the Management Address to Be Advertised
Configuration EffectConfigure the management address to be advertised in LLDP packets in interface configuration mode.

After the management address to be advertised is cancelled, the management address in LLDP packets is subject
to the default settings.

Notes


LLDP runs on physical ports (AP member ports for AP ports). Stacked ports and VSL ports do not support LLDP.

Configuration Steps

Optional.

Configure the management address to be advertised in LLDP packets in interface configuration mode.

Configuring the Management Address to Be Advertised

Commandlldp management-address-tlv [ ip-address ]Parameter

ip-address: Indicates the management address to be advertised in an LLDP packet.

Description
Defaults

A management address is advertised through LLDP packets by default.
The management address is the IPv4 address of the minimum VLAN supported by the port.
If no IPv4 address is configured for the VLAN, LLDP keeps searching for the qualified IP address.
If no IPv4 address is found, LLDP searches for the IPv6 address of the minimum VLAN supported by theport.
If no IPv6 address is found, the loopback address 127.0.0.1 is used as the management address.

Command

Interface configuration mode

Mode
Usage Guide

N/A

VerificationDisplay LLDP information on a local interface

Check whether the configuration takes effect.

Related Commands



Canceling the Management Address

Commandno lldp management-address-tlv

Parameter

N/A

9-18

Configuration Guide

Configuring LLDP(beta)

Description
Defaults

A management address is advertised through LLDP packets by default.
The management address is the IPv4 address of the minimum VLAN supported by the port.
If no IPv4 address is configured for the VLAN, LLDP keeps searching for the qualified IP address.
If no IPv4 address is found, LLDP searches for the IPv6 address of the minimum VLAN supported by theport.
If no IPv6 address is found, the loopback address 127.0.0.1 is used as the management address.

Command

Interface configuration mode

Mode
Usage Guide

A management address is advertised through LLDP packets by default.

The management address isthe IPv4 address of the minimum VLAN supported by the port. If no IPv4 address is configured for the
VLAN, LLDP keeps searching for the qualified IP address.
If no IPv4 address is found, LLDP searches for the IPv6 address of the minimum VLAN supported by theport.
If no IPv6 address is found, the loopback address 127.0.0.1 is used as the management address.

Configuration
Example

Configuring the Management Address to Be Advertised

Configuratio

Set the management address to 192.168.1.1 on an interface.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#lldp management-address-tlv 192.168.1.1

Verification

Display configuration on the interface.
Ruijie(config-if-GigabitEthernet 0/17)#show

lldp local-information interface GigabitEthernet

0/1
Lldp local-information of port [GigabitEthernet 0/17]
Port ID type: Interface name

Port id: GigabitEthernet 0/17

Port description: GigabitEthernet 0/17

Management address subtype: ipv4

Management address: 192.168.1.1

Interface numbering subtype: ifIndex

Interface number: 1

Object identifier:

802.1 organizationally information
Port VLAN ID: 1

Port and protocol VLAN ID(PPVID) : 1
PPVID Supported: YES

PPVID Enabled

: NO

9-19

Configuration Guide

Configuring LLDP(beta)

VLAN name of VLAN 1: VLAN0001

Protocol Identity:

802.3 organizationally information
Auto-negotiation supported: YES

Auto-negotiation enabled: YES

PMD auto-negotiation advertised: 1000BASE-T full duplex mode, 100BASE-TX full duplex mode,

100BASE-TX half duplex mode, 10BASE-T full duplex mode, 10BASE-T half duplex mode
Operational MAU type: speed(100)/duplex(Full)

PoE support: NO

Link aggregation supported: YES

Link aggregation enabled: NO

Aggregation port ID: 0

Maximum frame Size

: 1500

LLDP-MED organizationally information
Power-via-MDI device type

: PD

Power-via-MDI power source: LocalPower-via-MDI power priority:

Power-via-MDI power value:

Model name: Model name

9.4.5 Configuring the LLDP Fast Transmission Count
Configuration EffectConfigure the number of LLDP packets that are fast transmitted.

Configuration Steps

Optional.

Configure the number of LLDP packets that are fast transmitted in global configuration mode.

Configuring the LLDP Fast Transmission Count

Commandlldp fast-count fast-count-value

Parameter

fast-count-value: Indicates the number of LLDP packets that are fast transmitted. The value ranges from

Description

1 to 10.

Defaults

The default value is 3.

Command

Global configuration mode

Mode
Usage Guide

N/A

VerificationDisplaying the global LLDP status information

9-20

Configuration GuideConfiguring LLDP(beta)

Check whether the configuration takes effect.

Related Commands



Restoring the Default LLDP Fast Transmission Count

Commandno lldp fast-countParameter

N/A

Description
Defaults

The default value is 3.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring the LLDP Fast Transmission Count

Configuratio

Set the LLDP fast transmission count to 5 in global configuration mode.

n StepsRuijie(config)#lldp fast-count 5

Verification

Display the global LLDP status information.
Ruijie(config)#show lldp status
Global status of LLDP

: Enable

Neighbor information last changed time :Transmit interval: 30s

Hold multiplier: 4

Reinit delay: 2sTransmit delay: 2s

Notification interval: 5s

Fast start counts: 5

9.4.6 Configuring the TTL Multiplier and Transmission Interval
Configuration EffectConfigure the TTL multiplier.



Configure the LLDP packet transmission interval.

Configuration Steps

Optional.

Perform the configuration in global configuration mode.

Configuring the TTL MultiplierCommandlldp hold-multiplier ttl-value

9-21

Configuration Guide
Parameter

Configuring LLDP(beta)

ttl-value: Indicates the TLL multiplier. The value ranges from 2 to 10. The default value is 4.

Description
Defaults

The default value is 4.

Command

Global configuration mode

Mode
Usage Guide

In an LLDP packet. the value of Time To Live TLV is calculated based on the following formula: Time toLive TLV= TTL multiplier x Packet transmission interval + 1. Therefore, you can modify the Time to LiveTLV in LLDP packets by configuring the TTL multiplier.



Configuring the Transmission IntervalCommandlldp timer tx-interval tx-intervalParametertx-interval: Indicates the LLDP packet transmission interval in seconds. The value ranges from 5 to

Description

32,768.

Defaults

The default value is 30.

Command

Global configuration mode

Mode
Usage Guide

N/A

VerificationDisplay LLDP status information on an interface

Check whether the configuration takes effect.

Related Commands



Restoring the Default TTL MultiplierCommandno lldp hold-multiplierParameter

N/A

Description
Defaults

The default value is 4.

Command

Global configuration mode

Mode
Usage Guide

In an LLDP packet, the value of Time To Live TLV is calculated based on the following formula: Time toLive TLV = TTL multiplier x Packet transmission interval + 1. Therefore, you can modify the Time to LiveTLV in LLDP packets by configuring the TTL multiplier.



Restoring the Default Transmission IntervalCommandno lldp timer tx-intervalParameter

N/A

Description
Defaults

The default value is 30.

Command

Global configuration mode

Mode
Usage Guide

N/A

9-22

Configuration Guide

Configuring LLDP(beta)

Configuration
Example

Configuring the TTL Multiplier and Transmission Interval

Configuratio

Set the TTL multiplier to 3 and the transmission interval to 20 seconds. The TTL of local devicen Stepsinformation on neighbors is 61 seconds.
Ruijie(config)#lldp hold-multiplier 3
Ruijie(config)#lldp timer tx-interval 20

Verification

Display the global LLDP status information.
Ruijie(config)#lldp hold-multiplier 3
Ruijie(config)#lldp timer tx-interval 20
Ruijie(config)#show lldp status
Global status of LLDP

: Enable

Neighbor information last changed time :Transmit interval: 20s

Hold multiplier: 3

Reinit delay: 2sTransmit delay: 2s

Notification interval: 5s

Fast start counts: 3

9.4.7 Configuring the Transmission Delay
Configuration EffectConfigure the delay time for LLDP packet transmission.

Configuration Steps

Optional.

Perform the configuration in global configuration mode.

VerificationDisplaying the global LLDP status information



Check whether the configuration takes effect.

Configuring the Transmission Delay

Commandlldp timer tx-delay tx-delay

Parametertx-delay: Indicates the transmission delay in seconds. The value ranges from 1 to 8,192.

Description
Defaults

The default value is 2.

Command

Global configuration mode

Mode
Usage Guide

When local information of a device changes, the device immediately transmits LLDP packets to its

9-23

Configuration Guide

Configuring LLDP(beta)

neighbors. Configure the transmission delay to prevent frequent transmission of LLDP packets
caused by frequent changes of local information.

Related Commands



Restoring the Default Transmission Delay

Commandno lldp timer tx-delay

Parameter

N/A

Description
Defaults

The default value is 2.

Command

Global configuration mode

Mode
Usage Guide

When local information of a device changes, the device immediately transmits LLDP packets to its
neighbors. Configure the transmission delay to prevent frequent transmission of LLDP packets causedby frequent changes of local information.

Configuration
Example

Configuring the Transmission Delay

Configuratio

Set the transmission delay to 3 seconds.

n StepsRuijie(config)#lldp timer tx-delay 3

Verification

Display the global LLDP status information.
Ruijie(config)#show lldp status
Global status of LLDP

: Enable

Neighbor information last changed time :Transmit interval: 30s

Hold multiplier: 4

Reinit delay: 2sTransmit delay: 3s

Notification interval: 5s

Fast start counts: 3

9.4.8 Configuring the Initialization Delay
Configuration EffectConfigure the delay time for LLDP to initialize on any interface.

Configuration Steps

Optional.

Configure the delay time for LLDP to initialize on any interface.

9-24

Configuration GuideConfiguring LLDP(beta)

Configuring the Initialization Delay

Commandlldp timer reinit-delay reinit-delay

Parameter

reinit-delay: Indicates the initialization delay in seconds. The value ranges from 1 to 10 seconds.

Description
Defaults

The default value is 2.

Command

Global configuration mode

Mode
Usage Guide

Configure the initialization delay to prevent frequent initialization of the state machine caused byfrequent changes of the port work mode.

VerificationDisplay the global LLDP status information



Check whether the configuration takes effect.

Related Commands



Restoring the Default Initialization Delay

Commandno lldp timer reinit-delay

Parameter

N/A

Description
Defaults

The default value is 2.

Command

Global configuration mode

Mode
Configure the initialization delay to prevent frequent initialization of the state machine caused by

Usage Guide

frequent changes of the port work mode.

Configuration
Example

Configuring the Initialization Delay

Configuratio

Set the initialization delay to 3 seconds.

n StepsRuijie(config)#lldp timer reinit-delay 3

Verification

Display the global LLDP status information.
Ruijie(config)#show lldp status
Global status of LLDP

: Enable

Neighbor information last changed time :Transmit interval: 30s

Hold multiplier: 4

Reinit delay: 3s

Transmit delay: 2s

Notification interval

: 5s

9-25

Configuration Guide

Configuring LLDP(beta)

Fast start counts: 3

9.4.9 Configuring the LLDP Trap Function
Configuration EffectConfigure the interval for transmitting LLDP Trap messages.

Configuration Steps

Enabling the LLDP Trap Function



Optional.

Perform the configuration in interface configuration mode.

Commandlldp notification remote-change enable

Parameter

N/A

Description
Defaults

This function is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

The LLDP Trap function enables a device to send its local LLDP information (such as neighbor discovery
and communication link fault) to the NMS server so that administrators learn about the network
performanceConfiguring the LLDP Trap Transmission Interval

Optional.

Perform the configuration in global configuration mode.

Commandlldp timer notification-interval trap

Parameter

trap: Indicates the interval for transmitting LLDP Trap messages in seconds. The value ranges from 5 to

Description

3,600.

Defaults

The default value is 5 seconds.

Command

Global configuration mode

Mode
Usage Guide

Configure the LLDP Trap transmission interval to prevent frequent transmission of LLDP Trap
messages. LLDP changes detected within this interval will be transmitted to the NMS server.

VerificationDisplay LLDP status information



Check whether the LLDP Trap function is enabled.

Check whether the interval configuration takes effect.

Related Commands

9-26

Configuration GuideConfiguring LLDP(beta)

Disabling the LLDP Trap Function

Commandno lldp notification remote-change enable

Parameter

N/A

Description
Defaults

This function is disabled by default.

Command

Interface configuration mode

Mode
Usage Guide

The LLDP Trap function enables a device to send its local LLDP information (such as neighbor discovery
and communication link fault) to the NMS server so that administrators learn about the network
performance.



Restoring the LLDP Trap Transmission IntervalCommandno lldp timer notification-intervalParameter

N/A

Description
Defaults

The default value is 5 seconds.

Command

Global configuration mode

Mode
Usage Guide

Configure the LLDP Trap transmission interval to prevent frequent transmission of LLDP Trap
messages. LLDP changes detected within this interval will be transmitted to the NMS server.

Configuration
Example

Enabling the LLDP Trap Function and Configuring the LLDP Trap Transmission Interval

Configuratio

Enable the LLDP Trap function and set the LLDP Trap transmission interval to 10 seconds.

n StepsRuijie(config)#lldp timer notification-interval 10
Ruijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#lldp notification remote-change enable

Verification

Display LLDP status information.
Ruijie(config-if-GigabitEthernet 0/17)#show lldp status
Global status of LLDP

: Enable

Neighbor information last changed time :Transmit interval: 30s

Hold multiplier: 4

Reinit delay: 2sTransmit delay: 2s

Notification interval: 10s

Fast start counts: 3-----------------------------------------------------------Port [GigabitEthernet 0/17]------------------------------------------------------------

9-27

Configuration Guide

Configuring LLDP(beta)

Port status of LLDP

: Enable

Port state: UP

Port encapsulation: Ethernet II

Operational mode

: RxAndTx

Notification enable: YES

Error detect enable: YES

Number of neighbors: 0

Number of MED neighbors: 0

9.4.10 Configuring the LLDP Error Detection Function
Configuration EffectEnable the LLDP error detection function. When LLDP detects an error, the error is logged.

Configure the LLDP error detection function to detect VLAN configuration at both ends of a link, port status,
aggregate port configuration, MTU configuration, and loops.

Notes
N/A

Configuration Steps

Optional.

Enable or disable the LLDP error detection function in interface configuration mode.

Enabling the LLDP Error Detection Function

Commandlldp error-detect

Parameter

N/A

Description
Defaults

This function is enabled by default.

Command

Interface configuration mode

Mode
Usage Guide

The LLDP error detection function relies on specific TLVs in LLDP packets exchanged between devices
at both ends of a link. Therefore, a device needs to advertise correct TLVs to ensure the LLDP error
detection function.

VerificationDisplay LLDP status information on an interface

Check whether the configuration takes effect.

Related Commands



Disabling the LLDP Error Detection Function

Commandno lldp error-detect

9-28

Configuration Guide
Parameter

Configuring LLDP(beta)

N/A

Description
Defaults

This function is enabled by default.

Command

Interface configuration mode

Mode
Usage Guide

The LLDP error detection function relies on specific TLVs in LLDP packets exchanged between devices
at both ends of a link. Therefore, a device needs to advertise correct TLVs to ensure the LLDP error
detection function.

Configuration
Example

Enabling the LLDP Error Detection Function

Configuratio

Enable the LLDP error detection function on interface GigabitEthernet 0/1.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#lldp error-detect

Verification

Display LLDP status information on the interface.
Ruijie(config-if-GigabitEthernet 0/17)#show lldp status interface gigabitethernet 0/17
Port [GigabitEthernet 0/17]
Port status of LLDP

: Enable

Port state: UP

Port encapsulation: Ethernet II

Operational mode

: RxAndTx

Notification enable: NO

Error detect enable: YES

Number of neighbors: 0

Number of MED neighbors: 0

9.4.11 Configuring the LLDP Encapsulation Format
Configuration EffectConfigure the LLDP encapsulation format.

Configuration Steps

Optional.

Configure the LLDP encapsulation format on an interface.



Setting the LLDP Encapsulation Format to SNAP

Commandlldp encapsulation snap

Parameter

N/A

Description
Defaults

The LLDP encapsulation format is Ethernet II.

9-29

Configuration Guide
Command

Configuring LLDP(beta)

Interface configuration mode

Mode
Usage Guide

The LLDP encapsulation format configuration on a device and its neighbors must be consistent.

VerificationDisplay LLDP status information of an interface

Check whether the configuration takes effect.

Related Commands



Restoring the Default LLDP Encapsulation Format (Ethernet II)

Command

No lldp encapsulation snap

Parameter

N/A

Description
Defaults

The LLDP encapsulation format is Ethernet II.

Command

Interface configuration mode

Mode
Usage Guide

The LLDP encapsulation format configuration on a device and its neighbors must be consistent.

Configuration
Example

Setting the LLDP Encapsulation Format to SNAP

Configuratio

Set the LLDP encapsulation format to SNAP.

n StepsRuijie(config)#interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)#lldp encapsulation snap

Verification

Display LLDP status information on the interface.
Ruijie(config-if-GigabitEthernet 0/17)#show lldp status interface gigabitethernet 0/17
Port [GigabitEthernet 0/17]
Port status of LLDP

: Enable

Port state: UP

Port encapsulation: SnapOperational mode

: RxAndTx

Notification enable: NO

Error detect enable: YES

Number of neighbors: 0

Number of MED neighbors

: 0

9-30

Configuration Guide

Configuring LLDP(beta)

9.4.12 Configuring the LLDP Network Policy
Configuration EffectConfigure the LLDP Network Policy.



If a device is connected to an IP-Phone that supports LLDP-MED, you can configure the Network Policy TLV topush policy configuration to the IP-Phone, , which enables the IP-Phone to change the tag and QoS of voicestreams. In addition to the LLDP Network Policy, perform the following steps on the device: 1. Enable the VoiceVLAN function and add the port connected to the IP-Phone to the Voice VLAN. 2. Configure the port connected to
the IP-Phone as a QoS trusted port (the trusted DSCP mode is recommended). 3. If 802.1X authentication is alsoenabled on the port, configure a secure channel for the packets from the Voice VLAN. If the IP-Phone does notsupport LLDP-MED, enable the voice VLAN function and add the MAC address of the IP-Phone to the VoiceVLAN OUI list manually.



For the configuration of the QoS trust mode, see Configuring IP QoS; for the configuration of the Voice VLAN, see
Configuring Voice VLAN; for the configuration of the secure channel, see Configuring ACL.

Configuration Steps

Optional.

Configuring the LLDP Network Policy

Commandlldp network-policy profile profile-num

Parameter

profile-num: Indicates the ID of an LLDP Network Policy. The value ranges from 1 to 1,024.

Description
Defaults

No LLDP Network Policy is configured by default.

Command

Global configuration mode

Mode
Usage Guide

Run this command to enter the LLDP network policy mode after specifying a policy ID.
After entering the LLDP network policy mode, run the { voice | voice-signaling } vlan command to
configure a specific network policy.

Configuring the Voice VLAN Policy

Command{ voice | voice-signaling } vlan { { { vlan-id | dot1p } [ cos cos | dscp dscp ] } | untagged | none }Parameter

voice: Voice application.

Description

voice-signaling: Voice-signaling application.
vlan-id: The tagged frame is sent in the voice VLAN in VoIP. The tagged frame includes user_priority
and vlan id. The VLAN ID of voice flow ranges from 1 to 4094.
dot1p: The tagged frame is sent in the voice VLAN in VoIP. The tagged frame includes user_priority andvlan id is 0.
cos cos: The tagged frame is sent in the voice VLAN in VoIP. The CoS (Class of service) value of thevoice flow ranges from 0 to 7. The default value is 5.
dscp dscp: The tagged frame is sent in the voice VLAN in VoIP. The DSCP (Differentiated services code
point) value of the voice flow ranges from 0 to 63. The default value is 46.
untagged: The network policy is not advertised. VoIP determines the network policy based on its
configuration.

9-31

Configuration Guide

Configuring LLDP(beta)none: The untagged frame is sent in the voice VLAN in VoIP. In this case, the value of vlan id and cos
are ignored.
Defaults

No Voice VLAN Policy is configured by default.

Command

LLDP Network Policy mode

Mode
Usage Guide

N/A

Configuring LLDP MED TLVs to Be Advertised

Commandlldp tlv-enable med-tlv network-policy profile [ profile-num ]Parameter

network-policy [ profile-num ]: Indicates the Network Policy TLV is advertised. The network policy ID

Description

rangs from 1 to 1,024.

Defaults

The Network Policy TLV is advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

If a device is connected to an IP-Phone that supports LLDP-MED, you can configure the Network Policy
TLV to deliver policy configuration to the IP-Phone.

VerificationDisplaying the LLDP network policy configuration.



Check whether the configuration takes effect.

Related Commands



Deleting the LLDP Network Policy

Commandno lldp network-policy profile profile-num

Parameter

profile-num: Indicates the LLDP Network Policy ID. The value ranges from 1 to 1,024.

Description
Defaults

No LLDP Network Policy is configured by default.

Command

Interface configuration mode

Mode
Usage Guide

Run this command to enter the LLDP network policy mode after specifying a policy ID.
After entering the LLDP network policy mode, run the { voice | voice-signaling } vlan command to
configure a specific network policy.

Deleting the Voice VLAN Policy

Commandno { voice | voice-signaling } vlan

Parameter

N/A

Description
Defaults

No Voice VLAN Policy is configured by default.

Command

LLDP Network Policy mode

Mode
Usage Guide

N/A

Removing LLDP MED TLV Configuration

9-32

Configuration Guide

Configuring LLDP(beta)

Commandno lldp tlv-enable med-tlv network-policy profile [ profile-num ]Parameter

network-policy [ profile-num ]: Indicates the Network Policy TLV is not advertised. The network policy

Description

ID rangs from 1 to 1,024.

Defaults

The Network Policy TLV is advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring the LLDP Network Policy

Configuratio

Set the Network Policy TLV to 1 for LLDP packets to be advertised by port GigabitEthernet 0/17 and set

n Stepsthe VLAN ID of the Voice application to 3, COS to 4, and DSCP to 6.
Ruijie#config
Ruijie(config)#lldp network-policy profile 1
Ruijie(config-lldp-network-policy)# voice vlan 3 cos 4
Ruijie(config-lldp-network-policy)# voice vlan 3 dscp 6
Ruijie(config-lldp-network-policy)#exit
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# lldp tlv-enable med-tlv network-policy profile 1

Verification

Display the LLDP network policy configuration on the local device.
network-policy information:-------------------------network policy profile :1
voice vlan 3 cos 4
voice vlan 3 dscp 6

9.4.13 Configuring the Civic Address
Configuration EffectConfigure the civic address of a device.

Configuration Steps

Optional.

Perform this configuration in LLDP Civic Address configuration mode.

Configuring a Common Address of a Device

Commandlldp location civic-location identifier id

Parameter

id: ID of a common address of a network device, in the range from 1 to 1024.

9-33

Configuration Guide

Configuring LLDP(beta)

Description
Defaults

No common address is configured by default.

Command

Global configuration mode

Mode
Usage GuideThis command can be used to enter the LLDP Civic Address configuration mode.

Configuring the Civic Address of a Device

Command{ country | state | county | city | division | neighborhood | street-group | leading-street-dir |trailing-street-suffix | street-suffix | number | street-number-suffix | landmark |additional-location-information | name | postal-code | building | unit | floor | room | type-of-place |postal-community-name | post-office-box | additional-code } ca-word

Parametercountry: Indicates the country code, with two characters. CH indicates China.

Description

state: Indicates the CA type is 1.
county: Indicates that the CA type is 2.
city: Indicates that the CA type is 3.
division: Indicates that the CA type is 4.
neighborhood: Indicates that the CA type is 5.
street-group: Indicates that the CA type is 6.
leading-street-dir: Indicates that the CA type is 16.
trailing-street-suffix: Indicates that the CA type is 17.
street-suffix: Indicates that the CA type is 18.
number: Indicates that the CA type is 19.
street-number-suffix: Indicates that the CA type is 20.
landmark: Indicates that the CA type is 21.
additional-location-information: Indicates that the CA type is 22.
name: Indicates that the CA type is 23.
postal-code: Indicates that the CA type is 24.
building: Indicates that the CA type is 25.
unit: Indicates that the CA type is 26.
floor: Indicates that the CA type is 27.
room: Indicates that the CA type is 28.
type-of-place: Indicates that the CA type is 29.
postal-community-name: Indicates that the CA type is 30.
post-office-box: Indicates that the CA type is 31.
additional-code: Indicates that the CA type is 32.
ca-word: Indicates the address.

Defaults

No civic address is configured by default.

Command

LLDP Civic Address configuration mode

Mode
Usage GuideAfter entering the LLDP Civic Address configuration mode, configure the LLDP civic address.

Configuring the Device Type

Commanddevice-type device-type

Parameter

device-type: Indicates the device type. The value ranges from 0 to 2. The default value is 1.

9-34

Configuration Guide
Description

Configuring LLDP(beta)

0 indicates that the device type is DHCP server.



1 indicates that the device type is switch.



2 indicates that the device type is LLDP MED.

Defaults

No device type is configured by default.

Command

LLDP Civic Address configuration mode

Mode
Usage GuideAfter entering the LLDP Civic Address configuration mode, configure the device type.

Configuring the Civic Address in Location Identification TLV to Be Advertised

Commandlldp tlv-enable med-tlv location civic-location identifier id

Parameter

med-tlv: Indicates the LLDP MED TLV.

Description

location: Indicates the Location Identification TLV.
civic-location: Indicates the civic address information and postal information.
identifier id: Indicates the policy ID, ranging from 1 to 1,024.

Defaults

The Location Identification TLV is not advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

VerificationDisplay the LLDP civic address of the local deviceCheck whether the configuration takes effect.

Related Commands



Deleting a common address of a Device

Commandno lldp location civic-location identifier id

Parameter

id: ID of a common address of a network device, in the range from 1 to 1024.

Description
Defaults

No common address is configured by default.

Command

Global configuration mode

Mode
Usage Guide

N/ADeleting the Civic Address of a Device

Commandno { country | state | county | city | division | neighborhood | street-group | leading-street-dir |trailing-street-suffix | street-suffix | number | street-number-suffix | landmark |additional-location-information | name | postal-code | building | unit | floor | room | type-of-place |postal-community-name | post-office-box | additional-code }Parameter

N/A

Description
Defaults

No civic address is configured by default.

Command

LLDP Civic Address configuration mode

9-35

Configuration Guide

Configuring LLDP(beta)

Mode
Usage GuideAfter entering the LLDP Civic Address configuration mode, configure the LLDP civic address.

Restoring the Device Type

Commandno device-type

Parameter

N/A

Description
Defaults

No device type is configured by default.

Command

LLDP Civic Address configuration mode

Mode
Usage GuideAfter entering the LLDP Civic Address configuration mode, restore the default settings.

Removing the Civic Address in Location Identification TLVCommandno lldp tlv-enable med-tlv location civic-location identifier id

Parameter

med-tlv: Indicates the LLDP MED TLV.

Description

location: Indicates the Location Identification TLV.
civic-location: Indicates the civic address information and postal information.
identifier id: Indicates the policy ID, ranging from 1 to 1,024.

Defaults

The Location Identification TLV is not advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring the Civic Address of a Device

Configuratio

Set the address of port GigabitEthernet 0/17 as follows: set country to CH, city to Fuzhou, and postaln Stepscode to 350000.
Ruijie#config
Ruijie(config)#lldp location civic-location identifier 1
Ruijie(config-lldp-civic)# country CH
Ruijie(config-lldp-civic)# city Fuzhou
Ruijie(config-lldp-civic)# postal-code 350000
Ruijie(config-lldp-civic)# exit
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# lldp tlv-enable med-tlv location civic-location
identifier 1

Verification

Run the show lldp location civic-location { identifier id | interface interface-type interface-number |static } command to display the LLDP civic address of port GigabitEthernet 0/17.
Ruijie# show lldp location civic-location identifier 1

9-36

Configuration Guide

Configuring LLDP(beta)

civic location information:-------------------------Identifier:1

country:CHdevice type

:1

city

:Fuzhou

postal-code:350000

9.4.14 Configuring the Emergency Telephone Number
Configuration EffectConfigure the emergency telephone number of a device.

Configuration Steps

Optional.

Perform this configuration in global configuration mode.

Configuring the Emergency Telephone Number of a Device

Commandlldp location elin identifier id elin-location tel-number

Parameter

id: Indicates the identifier of an emergency telephone number. The value ranges from 1 to 1,024.

Description

tel-number: Indicates emergency telephone number, containing 10-25 characters.

Defaults

No emergency telephone number is configured by default.

Command

Global configuration mode

Mode
Usage GuideRun this command to configure the emergency telephone number.

Configuring the Emergency Telephone Number in Location Identification TLV to Be Advertised

Commandlldp tlv-enable med-tlv location elin identifier id

Parameter

med-tlv: Indicates the LLDP MED TLV.

Description

location: Indicates the Location Identification TLV.
elin: Indicates the emergency telephone number.
identifier id: Indicates the policy ID, ranging from 1 to 1,024.

Defaults

The Location Identification TLV is not advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

VerificationDisplay the emergency telephone number of the local deviceCheck whether the configuration takes effect.

Related Commands

9-37

Configuration GuideConfiguring LLDP(beta)

Deleting the Emergency Telephone Number of a Device

Commandno lldp location elin identifier id

Parameter

id: Indicates the identifier of an emergency telephone number. The value ranges from 1 to 1,024.

Description
Defaults

No emergency telephone number is configured by default.

Command

Global configuration mode

Mode
Usage Guide

N/A

Canceling the Emergency Telephone Number in Location Identification TLVCommandno lldp tlv-enable med-tlv location elin identifier id

Parameter

med-tlv: Indicates the LLDP MED TLV.

Description

location: Indicates the Location Identification TLV.
elin: Indicates the emergency telephone number.
identifier id: Indicates the policy ID, ranging from 1 to 1,024.

Defaults

The Location Identification TLV is not advertised on an interface by default.

Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring the Emergency Telephone Number of a Device

Configuratio

Set the emergency telephone number of port GigabitEthernet 0/17 to 085283671111.

n StepsRuijie#config
Ruijie(config)#lldp location elin identifier 1 elin-location 085283671111
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# lldp tlv-enable med-tlv location elin identifier 1

Verification

Run the show lldp location elin { identifier id | interface interface-type interface-number | static }command to display the emergency telephone number of port GigabitEthernet 0/17.
Ruijie# show lldp location elin interface gigabitethernet 0/17
elin location information:------------------------Identifier:1elin number:085283671111

9-38

Configuration Guide

Configuring LLDP(beta)

9.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears LLDP statistics.

clear lldp statistics [ interface interface-type interface-number ]Clears LLDP neighbor information.

clear lldp table [ interface interface-type interface-number ]Displaying
Description

Command

Displays LLDP information on the local device, which willshow lldp local-information [ global | interface

be organized as TLVs and sent to neighbors.

interface-type interface-number ]Displays the LLDP civic address or emergency telephoneshow lldp location { civic-location | elin-location }number of a local device.

{ identifier id | interface interface-type interface-number |static }Displays LLDP information on a neighbor.

show lldp neighbors [ interface interface-type
interface-number ] [ detail ]Displays the LLDP network policy configuration of the local

show lldp network-policy { profile [ profile-num ] |device.

interface interface-type interface-number }Displays LLDP statistics.

show lldp statistics [ global | interface interface-type
interface-number ]Displays LLDP status information.

show lldp status [ interface interface-type
interface-number ]Displays the configuration of TLVs to be advertised by ashow lldp tlv-config [interface interface-type

port.

interface-number ]Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs LLDP error processing.

debug lldp error

Debugs LLDP event processing.

debug lldp event

Debugs LLDP hot backup processing.

debug lldp ha

Debugs the LLDP packet reception.

debug lldp packet

Debugs the LLDP state machine.

debug lldp stm

9-39

Configuration Guide

Configuring ERPS(beta)

10 Configuring ERPS(beta)
10.1 Overview
Ethernet Ring Protection Switching (ERPS), also known as G.8032, is a ring protection protocol developed by theInternational Telecommunication Union (ITU). It is a data link layer protocol designed for Ethernet rings. ERPS prevents
broadcast storms caused by data loops in an idle Ethernet ring and can rapidly recover the communication between
nodes in the event that a link is disconnected in the Ethernet ring.
The Spanning Tree Protocol (STP) is another technique used to solve the Layer-2 loop problem. STP is at the matureapplication stage but requires a relatively long (seconds) convergence time compared to ERPS. ERPS reaches aLayer-2 convergence speed of less than 50 ms, faster than that of STP.

Scenario

ITU-T G.8032/Y.1344: Ethernet ring protection switching

10.2 Applications
Application

Description

Single-Ring Protection

Only one ring exists in a network topology.

Tangent-Ring Protection

Two rings in a network topology share one device.

Intersecting-Ring Protection

Two or more rings in a network topology share one link.

10.2.1 Single-Ring Protection
Scenario
Only one ring in a network topology needs to be protected.
In Figure 12-1, the network topology has only one ring, only one ring protection link (RPL) owner node, and only one
RPL. All nodes must belong to the same ring automatic protection switching (R-APS) virtual local area network (VLAN).

All devices in the ring network must support ERPS.



Each link between devices must be a direct link without any intermediate device.

10-1Configuration Guide

Configuring ERPS(beta)

Figure 12-1

Remark

The four devices in the ring network are aggregation switches.

s

Deployment
All nodes in the physical topology are connected in ring mode.



ERPS blocks the RPL to prevent loops. In Figure 12-1, the link between Node 1 and Node 2 is an RPL.

ERPS is used to detect failures on each link between adjacent nodes.

10.2.2 Tangent-Ring Protection
Scenario
The two rings in a network topology that share one device need to be protected.
In Figure 12-2, the two rings in the network topology share one device. Each ring has only one PRL owner node andonly one RPL. The two rings belong to different R-APS VLANs.

All devices in the ring network must support ERPS.



Each link between devices must be a direct link without any intermediate device.

Figure 12-2

RemarkThe devices in the ring network are aggregation switches.

10-2Configuration Guide

Configuring ERPS(beta)s

Deployment
All nodes in the physical topology are connected in ring mode.



ERPS blocks the RPL of each ring to prevent loops.



ERPS is used to detect failures on each link between adjacent nodes.

10.2.3 Intersecting-Ring Protection
Scenario
Two or more rings in a network topology share one link. (Each link between intersecting nodes must be a direct link
without any intermediate node.)
In Figure 12-3, four rings exist in the network topology. Each ring has only one PRL owner node and only one RPL. The
four rings belong to different R-APS VLANs.

All devices in the ring network must support ERPS.



Each link between devices must be a direct link without any intermediate device.

Figure 12-3

RemarkThe devices in the ring network are aggregation switches.

s

Deployment
All nodes in the physical topology are connected in ring mode.



ERPS blocks the RPL of each ring to prevent loops.



ERPS is used to detect failures on each link between adjacent nodes.

10-3Configuration Guide

Configuring ERPS(beta)

10.3 Features
Basic Concepts



Ethernet Ring

Ethernet rings are classified into common Ethernet rings and Ethernet subrings.

Common Ethernet ring: Is an Ethernet topology with ring connection.

Ethernet subring: An open topology that is mounted on other rings or networks through intersecting nodes andforms a closed topology with the channel between the intersecting nodes belonging to other rings or networks.

An Ethernet ring (a common Ethernet ring or an Ethernet subring) can be in one of the following states:

Idle state: The physical links in the entire ring network are reachable.

Protection state: A physical link in the ring network is disconnected.

Link and Channel

RPL: An Ethernet ring (a common Ethernet ring or an Ethernet subring) has only one RPL. When an Ethernet ringis idle, the RPL is blocked and does not forward data packets to prevent loops. In Figure 13-2, the link between
Node 1 and Node 4 is the RPL of ERPS 1, and Node 4 blocks the RPL port (the port mapped to the RPL). The link
between Node 4 and Node 5 is the RPL of ERPS 2, and Node 5 blocks the RPL port.



Subring link: Belongs to a subring in intersecting rings and is controlled by the subring. In Figure 13-3, ERPS 1 isa common Ethernet ring, and ERPS 2 is an Ethernet subring. The link between Node 4 and Node 5 and the link
between Node 3 and Node 5 belong to ERPS 2. The other links belong to ERPS 1.
The link between Node 3 and Node 4 belongs to ERPS 1 rather than ERPS 2, and the link is not controlled by
ERPS 2.



R-APS virtual channel: Transmits ERPS packets of subrings between intersecting nodes in intersecting rings,
but it does not belong to the subring. In Figure 13-3, Node 1 blocks the RPL, and the packets of subring ERPS 2
are transmitted through the direct link between Node 3 and Node 4 in Ethernet ring ERPS 1. The direct link
between Node 3 and Node 4 is the R-APS virtual channel of ERPS 2.



Node

Each device in an Ethernet ring is a node.
ERPS has the following node roles for a specific Ethernet ring:

RPL owner node: A node that is adjacent to an RPL and is used to block the RPL to prevent loops when the
Ethernet ring is free of faults. An Ethernet ring (a common Ethernet ring or an Ethernet subring) has only one RPL
owner node. In Figure 2, Node 1 functions as the RPL owner node of Ethernet ring ERPS 1, and Node 6 functions
as the RPL owner node of Ethernet subring ERPS 2.



Non-RPL owner node: Any other node than the RPL owner node in an Ethernet ring. In Figure 2, nodes except
Node 1 and Node 6 are non-RPL owner nodes of their respective rings.

ERPS has the following roles globally (not for a specific Ethernet ring):

10-4

Configuration GuideConfiguring ERPS(beta)

Intersecting node: A node that belongs to multiple intersecting Ethernet rings. In Figure 13-3, Node 3 and Node 4
are intersecting nodes.



Non-intersecting node: A node that belongs to only one intersecting Ethernet ring. In Figure 13-3, Node 2 is a
non-intersecting node.



VLAN

ERPS supports two types of VLAN: R-APS VLAN and data VLAN.

R-APS VLAN: A VLAN for transmitting ERPS packets. On a device, the ports accessing an ERPS ring belong to
the R-APS VLAN, and only such ports can join the R-APS VLAN. R-APS VLANs of different ERPS rings must be
different. IP address configuration is prohibited on the R-APS VLAN ports.

Data VLAN: A VLAN for transmitting data packets. Both ERPS ports and non-ERPS ports can be assigned to adata VLAN.
R-APS VLANs of different ERPS rings must be configured differently to differentiate packets of different ERPS
rings; otherwise, ERPS may be abnormal.



ERPS Packet

ERPS packets (also called R-APS packets) are classified into Signal Fail (SF) packets, No Request (NR) packets, No
Request, RPL Blocked (NR, RB) packets, and flush packets.

SF packet: When the link of a node is down, the node sends SF packets to notify other nodes of its link failure.

NR packet: When the failed link is restored, the node sends an NR packet to notify the RPL owner node of its link
recovery.

(RR, RB) packet: When all nodes in an ERPS ring function properly, the RPL owner node sends (RR, RB) packets
periodically.



Flush packet: In an intersecting ring, when a topology change occurs in a subring, the intersecting nodes send
flush packets to notify other devices in the Ethernet ring to which the subring is connected.



ERPS Timer

ERPS timers include the Holdoff timer, Guard timer, and WTR timer.



Holdoff timer: Is used to minimize frequent ERPS topology switching due to intermittent link failures. After you
configure the Holdoff timer, ERPS performs topology switching only if the link failure still persists after the timer
times out.



Guard timer: Is used to prevent a device from receiving expired R-APS messages. When the device detects thata link failure is cleared, it sends link recovery packets and starts the Guard timer. During the period before timer
expiration, all packets except flush packets indicating a subring topology change will be discarded.



Wait-to-restore (WTR) timer: Is effective only for RPL owner devices to avoid ring status misjudgment. When an
RPL owner device detects that a failure is cleared, it does perform topology switching immediately but only if the
Ethernet ring is recovered after the WTR timer times out. If a ring failure is detected again before timer expiration,
the RPL owner device cancels the timer and does not perform topology switching.

Overview

10-5Configuration Guide

Configuring ERPS(beta)

FeatureDescription

Ring Protection

Prevents broadcast storms caused by data loops and can rapidly recover the communication
between nodes in the event that a link is disconnected in the Ethernet ring.

Load Balancing

Configures multiple Ethernet subrings in one ring network and forwards the traffic of different
VLANs through different Ethernet subrings to balance load.

10.3.1 Ring Protection
Ring protection prevents broadcast storms caused by data loops and can rapidly recover the communication between
nodes in the event that a link is disconnected in the Ethernet ring.

Working Principle

Normal StatusAll nodes in the physical topology are connected in ring mode.



ERPS blocks the RPL to prevent loops.



ERPS is used to detect failures on each link between adjacent nodes.

Link FailureA node adjacent to a failed node detects the failure.

The nodes adjacent to a failed link block the failed link and send SF packets to notify other nodes in the same ring.



The R-APS (SF) packet triggers the RPL owner node to unblock the RPL port. All nodes update their MAC
address entries and ARP/ND entries and the ring enters the protection state.

Link Recovery

When a failed link is restored, adjacent nodes still block the link and send NR packets indicating that no local
failure exists.

When the RPL owner node receives the first R-APS (NR) packet, it starts the WTR timer.

When the timer times out, the RPL owner node blocks the RPL and sends an (NR, RB) packet.

After receiving the (NR, RB) packet, other nodes update their MAC address entries and ARP/ND entries, and thenode that sends the NR packet stops periodic packet transmission and unblocks the port.



The ring network is restored to the normal state.

RelatedConfiguration

Configuring the R-APS VLAN

By default, no R-APS VLAN is configured.
Run the erps raps-vlan command to configure the R-APS VLAN (management VLAN) of an ERPS ring to transmit
ERPS packets.

Configuring an ERPS Ring

Run the rpl-port command in R-APS VLAN mode to configure the ERPS ring mapped to an R-APS VLAN.

10-6

Configuration GuideConfiguring ERPS(beta)

Configuring an RPL and an RPL Owner NodeRun the rpl-port command in R-APS VLAN mode to specify an RPL and an RPL owner node.

10.3.2 Load Balancing
You can configure multiple Ethernet subrings in one physical ring network and forward the traffic of different VLANs
through different Ethernet subrings to balance load.

Working Principle
The multiple VLANs in a ring network can have their respective traffic forwarded by different paths through ERPS tobalance load.
Figure 12-4 Single-Ring Load Balancing

In a physical ring network, multiple Ethernet rings can be configured to forward traffic of different VLANs (called
protected VLANs) by different topologies to realize load balancing.
In Figure 12-4, two Ethernet rings are configured with different protected VLANs in the physical ring network. Node 1 isthe RPL owner node of ERPS 1 and Node 3 is RPL owner node of ERPS 2. With such configurations, data of different
VLANs can be transmitted by different links to realize single-ring load balancing.

RelatedConfiguration

Configuring the Protected VLAN of an Ethernet Ring

Run the protected-instance command in R-APS VLAN mode to configure a protected VLAN set to realize loadbalancing.

10.4 Configuration
Configuration
Single-Ring
Configuration

Description and Command(Mandatory)It is used to enable ERPS globally.
Enables ERPS globally.

erps enable

10-7Configuration Guide
Configuration(BasicConfiguring ERPS(beta)

Description and Command(Mandatory) It is used to configure the R-APS VLAN of an Ethernet ring.

Function)
Configures the R-APS VLAN of an Ethernet ring.

erps raps-vlan
ring-port west { interface-type interface-number |virtual-channel } east { interface-type

Configures the member ports of an Ethernet
ring. .

interface-number | virtual-channel }rpl-port { west | east } [ rpl-owner ](Optional) Configures the RPL owner node.

state enable

Enables the ERPS protocol of the specified ring.

Tangent-Ring

Tangent-ring configuration is based on single-ring configuration. Two single-ring need to be

Configuration

configured first.
(Optional) It is used to associate the Ethernet ring with its sub-rings..

Intersecting-Rin
g Configuration

associate sub-ring raps-vlan sub-ring-vlan-list(Optional) It is used to enable subring topology change notification.
Enables subring topology change notification.

sub-ring tc-propagation enable
Load Balancing
Configuration

ERPS
Configuration
Modification

Associates Ethernet subrings.

(Optional) It is used to specify the instance protected by the Ethernet ring.
Specifies the instance protected by the Ethernet

protected-instance instance-id-listring.

(Optional) It is used to configure the ERPS timer.
timer { holdoff-time holdoff | guard-time guard |wtr-time wtr }Configures the ERPS timer.

(Optional) It is used to configure ERPS monitoring.
ERPS
Monitoring

Monitors the logical state of the ERPS linkerps monitor link-state by oam

through OAM.

Configuration

Monitors the physical state of the ERPS linkno erps monitor link-state by oam

directly.

10.4.1 Single-Ring Configuration (Basic Function)
Configuration Effect

The single-ring scenario is the basic scenario of ERPS.



Build an ERPS single-ring topology to realize data link redundancy.

In an ERPS ring network, quickly switch services from a failed link to a normal link.

Notes


Only one RPL owner node and only one RPL can be configured in one ERPS ring.

All nodes in one ERPS ring must belong to the same R-APS VLAN.

Only trunk ports can join an ERPS ring, and the trunk attributes cannot be modified after the port joins the ring.

10-8

Configuration GuideConfiguring ERPS(beta)

The ports in an ERPS ring do not participate in STP calculation regardless of whether the ERPS ring is enabled ornot. When you configure an ERPS ring, ensure that loops will not occur when STP calculation is disabled on ports
in the ring.



ERPS does not use the same ports as RERP and REUP.

Configuration Steps

Configuring the R-APS VLAN of an Ethernet Ring

(Mandatory) Perform this configuration in global configuration mode.

Configure the same R-APS VLAN on all switches in the ERPS ring to transmit ERPS packets.

Commanderps raps-vlan vlan-id

Parametervlan-id: R-APS VLAN ID. The VLAN ID ranges from 1 to 4094.

Description
Command

Global configuration mode

Mode
Usage Guide

ERPS takes effect in a ring only after ERPS is enabled globally and for the ring respectively.

Configuring ERPS Ring Ports(Mandatory) Perform this configuration in R-APS VLAN mode.

Configure the ports that form the ERPS ring as ERPS ring ports.

Commandring-port west { interface-type interface-number | virtual-channel } east { interface-type
interface-number | virtual-channel }Parameter

west interface-type interface-number: Specifies an interface as the West port of the ERPS ring.

Description

west virtual-channel: Specifies the virtual interface as the West port of the ERPS ring.
east interface-type interface-number: Specifies an interface as the East port of the ERPS ring.
east virtual-channel: Specifies the virtual interface as the East port of the ERPS ring.

Command

R-APS VLAN mode

Mode
Usage Guide

The R-APS VLAN must be the unused VLAN on a device. VLAN 1 cannot be configured as the R-APS
VLAN.
In an Ethernet ring, different devices must be configured with the same R-APS VLAN.
If you need to transparently transmit ERPS packets on a device not configured with ERPS, ensure that
only the two ports on the device connected to the ERPS ring allow packets from the R-APS VLAN of the
ERPS ring to pass through. Otherwise, packets from other VLANs may be transparently transmitted to
the R-APS VLAN, causing impact on the ERPS ring.
The feature is not supported by G.hn ports.

Configuring an RPL Owner Port

(Mandatory) Perform this configuration in R-APS VLAN mode.

Configure a single device in each ERPS ring as an RPL owner node, which will control the port to be blocked.

10-9Configuration Guide

Configuring ERPS(beta)

Commandrpl-port { west | east } [ rpl-owner ]Parameter

west: Specifies the West port as an RPL owner port.

Description

east: Specifies the East port as an RPL owner port.

Command

R-APS VLAN mode

Mode
Usage Guide

Each ring can be configured with only one RPL and only one RPL owner node.
The feature is not supported by G.hn ports.

Enabling the Specified R-APS Ring

(Mandatory) Perform this configuration in R-APS VLAN mode.

Enable the specified R-APS ring in the same R-APS VLAN on each switch.

Commandstate enable

Parameter

N/A

Description
Command

R-APS VLAN mode

Mode
Usage Guide

ERPS takes effect in a ring only after ERPS is enabled globally and for the ring respectively.

Enabling ERPS Globally(Mandatory) Perform this configuration in global configuration mode.

Enable ERPS globally on each switch in the ERPS ring.

Commanderps enable

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

ERPS takes effect in a ring only after ERPS is enabled globally and for the ring respectively.

Verification


Run the show erps command one each node to check the configuration.

Configuration
Example10-10

Configuration Guide

Configuring ERPS(beta)

Scenario
Figure 12-5

Configuratio

Configure the R-APS VLAN in privileged mode.

n StepsConfigure the link mode of ports in the Ethernet ring.

Enter R-APS VLAN mode and configure the ports to be added to the Ethernet ring and participate
in ERPS calculation.

Node 1Specify the RPL owner port.

Enable ERPS in the specified ring.

Enable ERPS globally.

# Enter privileged mode.
Ruijie# configure terminal# Configure the R-APS VLAN.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# exit
# Configure the link mode of ports in the Ethernet ring.
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport mode trunk
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-GigabitEthernet 0/18)# exit
# Enter ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
# Configure the ports to be added to the Ethernet ring and participate in ERPS calculation.
Ruijie(config-erps 4093)# ring-port west gigabitethernet 0/17 east gigabitethernet 0/18
# Enable ERPS in the specified ring.
Ruijie(config-erps 4093)# state enable# Enable ERPS globally.
Ruijie(config-erps 4093)# exit
Ruijie(config)# erps enable

Node 2The configuration on Node 2 is the same as that on Node 1.

Node 3The configuration on Node 3 is the same as that on Node 1.

Node 4# Enter privileged mode.
Ruijie# configure terminal

10-11Configuration Guide

Configuring ERPS(beta)# Configure the R-APS VLAN.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# exit
# Configure the link mode of ports in the Ethernet ring.
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport mode trunk
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-GigabitEthernet 0/18)# exit
# Enter ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
# Configure the ports to be added to the Ethernet ring and participate in ERPS calculation.
Ruijie(config-erps 4093)# ring-port west gigabitethernet 0/17 east gigabitethernet 0/18
# Specify the RPL owner port.
Ruijie(config-erps 4093)# rpl-port east rpl-owner# Enable ERPS in the specified ring.
Ruijie(config-erps 4093)# state enable
Ruijie(config-erps 4093)# exit
# Enable ERPS globally.
Ruijie(config)# erps enable

Verification

Run the show erps command one each node to check the configuration. The configuration on Node 1
and Node 4 is used as an example.

Node 1

Ruijie# show erps
ERPS Information
Global Status: Enabled

Link monitored by: Not Oam--------------------------------------------

Node 4R-APS VLAN

: 4093

Ring Status: EnabledWest Port: Gi 0/17 (Forwardin)

East Port: Gi 0/18 (Forwardin)

RPL Port: NoneProtected VLANs: ALL

RPL Owner: Enabled

Holdoff Time: 0 milliseconds

Guard Time

: 500 milliseconds

WTR Time: 2 minutes

Current Ring State: IdleAssociate R-APS VLAN:

Ruijie# show erps
ERPS Information
Global Status: Enabled

10-12Configuration Guide
Link monitored by

Configuring ERPS(beta): Not Oam-------------------------------------------R-APS VLAN

: 4093

Ring Status: EnabledWest Port: Gi 0/17 (Forwardin)

East Port: Gi 0/18 (Blocking)

RPL Port: East Port

Protected VLANs: ALL

RPL Owner: Enabled

Holdoff Time: 0 milliseconds

Guard Time

: 500 milliseconds

WTR Time: 2 minutes

Current Ring State: IdleAssociate R-APS VLAN:

Common Errors


The R-APS ring has been enabled but ERPS is not enabled globally, so ERPS still does not take effect.

Multiple RPL owner nodes are configured in one ring.



Different R-APS VLANs are configured for the nodes in one ring.

10.4.2 Tangent-Ring Configuration
Configuration EffectConfigure a tangent ring that consists of two ERPS rings sharing one device to realize data link redundancy.

Quickly switch services from a failed link in one ERPS ring to a normal link.

Notes


The tangent-ring configuration is basically the same as the single-ring configuration. You only need to associate
the two ERPS rings on the tangent node.

Only one RPL owner node and only one RPL can be configured in each ERPS ring.

All nodes in one ERPS ring must belong to the same R-APS VLAN.

Only trunk ports can join an ERPS ring, and the trunk attributes cannot be modified after the port joins the ring.

The ports in an ERPS ring do not participate in STP calculation regardless of whether the ERPS ring is enabled ornot. When you configure an ERPS ring, ensure that loops will not occur when STP calculation is disabled on ports
in the ring.



ERPS does not use the same ports as RERP and REUP.

Configuration Steps

The tangent-ring configuration is basically the same as the single-ring configuration. You only need to associate
the two ERPS rings on the tangent node.



See the commands in section 12.4.1 "Single-Ring Configuration (Basic Function)."

10-13

Configuration Guide

Configuring ERPS(beta)

Verification


Run the show erps command one each node to check the configuration.

Configuration
ExampleScenario
Figure1012-6

Configuratio

Configure the R-APS VLAN in privileged mode.

n StepsConfigure the link mode of ports in the Ethernet ring.

Enter R-APS VLAN mode and configure the ports to be added to the Ethernet ring and participate
in ERPS calculation.

Node 1Specify the RPL owner port.

Enable ERPS in the specified ring.

Enable ERPS globally.

# Enter privileged mode.
Ruijie# configure terminal# Configure R-APS VLAN 4093.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# exit
# Configure the link mode of ports in the Ethernet ring.
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/17
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/18
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# exit
# Enter ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
# Configure the ports to be added to the Ethernet ring and participate in ERPS calculation.
Ruijie(config-erps 4093)# ring-port west gigabitEthernet gigabitethernet 0/17 east
gigabitEthernet gigabitethernet 0/18
# Enable ERPS in the specified ring.
Ruijie(config-erps 4093)# state enable
Ruijie(config-erps 4093)# exit

10-14Configuration Guide

Configuring ERPS(beta)# Enable ERPS globally.
Ruijie(config)# erps enable
Node 2The configuration on Node 2 is the same as that on Node 1.

Node 3

Ruijie# configure terminal# Configure R-APS VLAN 4093.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# exit
# Configure the link mode of ports in the Ethernet ring.
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/17
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/18
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# exit
# Enter ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# ring-port west gigabitEthernet gigabitethernet 0/17 east
gigabitEthernet gigabitethernet 0/18
Ruijie(config-erps 4093)# state enable
Ruijie(config-erps 4093)# exit

Node 4

Ruijie# configure terminal# Configure R-APS VLAN 4093.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# exit
# Configure the link mode of ports in the Ethernet ring.
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/17
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/18
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# exit
# Enter ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# ring-port west gigabitEthernet gigabitethernet 0/17 east
gigabitEthernet gigabitethernet 0/18
# Specify the RPL owner port.
Ruijie(config-erps 4093)# rpl-port east rpl-owner
Ruijie(config-erps 4093)# state enable
Ruijie(config-erps 4093)# exit
Ruijie(config)# erps enable

Verification

Run the show erps command one each node to check the configuration. The configuration on Node 3 isused as an example.
Ruijie# show erps

10-15Configuration Guide

Configuring ERPS(beta)

ERPS Information
Global Status: Enabled

Link monitored by: Not Oam-------------------------------------------R-APS VLAN

: 4093

Ring Status: EnabledWest Port: Gi 0/17 (Forwarding)

East Port: Gi 0/18 (Forwarding)

RPL Port: East Port

Protected VLANs: ALL

RPL Owner: Disabled

Holdoff Time: 0 milliseconds

Guard Time

: 500 milliseconds

WTR Time: 2 minutes

Current Ring State: IdleAssociate R-APS VLAN:

Common Errors


The R-APS ring has been enabled but ERPS is not enabled globally, so ERPS still does not take effect.

Multiple RPL owner nodes are configured in one ring.



Different R-APS VLANs are configured for the nodes in one ring.

10.4.3 Intersecting-Ring Configuration
Configuration EffectConfigure multiple ERPS rings to share links, thus realizing data link redundancy.

Quickly switch services from a failed link in one ERPS ring to a normal link.

Notes


Only one RPL owner node and only one RPL can be configured in each ERPS ring.

All nodes in one ERPS ring must belong to the same R-APS VLAN.

All nodes in the Ethernet ring must be associated with their respective subrings.

Only trunk ports can join an ERPS ring, and the trunk attributes cannot be modified after the port joins the ring.

The ports in an ERPS ring do not participate in STP calculation regardless of whether the ERPS ring is enabled ornot. When you configure an ERPS ring, ensure that loops will not occur when STP calculation is disabled on ports
in the ring.



ERPS does not use the same ports as RERP and REUP.

Configuration Steps
Perform the following configuration after you complete the single-ring configuration described above:Enabling Subring Topology Change Notification
10-16

Configuration Guide

Configuring ERPS(beta)(Optional) Perform this configuration in R-APS VLAN mode.

Enable subring topology change notification on intersecting nodes.



If the link between intersecting nodes is faulty or blocked in the event of a subring topology change, theintersecting nodes will send packets to instruct the nodes in other Ethernet rings associated with the subring to
update the topology.

Commandsub-ring tc-propagation enable

Parameter

enable: Enables subring topology change notification.

Description
Command

R-APS VLAN mode

Mode
Usage Guide

Run this command only on intersecting nodes.



Associating Ethernet Subrings(Optional) Perform this configuration in R-APS VLAN mode.

Associate nodes in the main ring with Ethernet subrings.

After nodes are associated with Ethernet subrings, ERPS packets of the subrings can be transmitted to other
Ethernet rings.

Commandassociate sub-ring raps-vlan sub-ring-vlan-list

Parameter

sub-ring-vlan-list: Indicates the R-APS VLANs of subrings. The VLAN ID ranges from 1 to 4094.

Description
Command

R-APS VLAN mode

Mode
Usage Guide

Run this command on all nodes in the Ethernet ring to allow its subrings to transmit ERPS packets to the
Ethernet ring.
After nodes are associated with subrings, ERPS packets of the subrings can be transmitted to other
Ethernet rings. You can also use the command provided by the VLAN module to configure VLAN and its
member ports to allow ERPS packets of subrings to be transmitted to other Ethernet rings while avoiding
information leakage to user networks.
The feature is not supported by G.hn ports.

Verification


Run the show erps command one each node to check the configuration.

Configuration
Example10-17

Configuration Guide

Configuring ERPS(beta)

Scenario
Figure1010-7

Configuratio

Configure the R-APS VLAN in privileged mode.

n StepsConfigure the link mode of ports in the Ethernet ring.

Enter R-APS VLAN mode and configure the ports to be added to the Ethernet ring and participate
in ERPS calculation.

Node 1Specify the RPL owner port.

Enable ERPS in the specified ring.



Associate nodes in the Ethernet ring with subrings.

Enable subring topology change notification on intersecting nodes.

Enable ERPS globally.

# Enter privileged mode.
Ruijie# configure terminal# Configure R-APS VLAN 4093.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# exit
# Configure the link mode of ports in the Ethernet ring.
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/17
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/18
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# exit
# Enter ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
# Configure the ports to be added to the Ethernet ring and participate in ERPS calculation.
Ruijie(config-erps 4093)# ring-port west gigabitEthernet gigabitethernet 0/17 east
gigabitEthernet gigabitethernet 0/18
# Specify the port and RPL owner node for the RPL.
Ruijie(config-erps 4093)# rpl-port east rpl-owner# Enable ERPS in the specified ring.
Ruijie(config-erps 4093)# state enable

10-18Configuration Guide

Configuring ERPS(beta)# Enable ERPS globally.
Ruijie(config-erps 4093)# exit
Ruijie(config)# erps enable
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# associate sub-ring raps-vlan 100,200
Node 2# Enter privileged mode.
Ruijie# configure terminal# Configure R-APS VLAN 4093.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# exit
# Configure the link mode of ports in the Ethernet ring.
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/17
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitEthernet gigabitethernet 0/18
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-gigabitEthernet GigabitEthernet 0/18)# exit
# Enter ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
# Configure the ports to be added to the Ethernet ring and participate in ERPS calculation.
Ruijie(config-erps 4093)# ring-port west gigabitEthernet gigabitethernet 0/17 east
gigabitEthernet gigabitethernet 0/18
# Enable ERPS in the specified ring.
Ruijie(config-erps 4093)# state enable# Enable ERPS globally.
Ruijie(config-erps 4093)# exit
Ruijie(config)# erps enable
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# associate sub-ring raps-vlan 100,200

Node 3# Perform the following configuration on Node 3 based on the configuration on Node 2:

Node 4# Perform the following configuration on Node 4 based on the configuration on Node 2.

Verification

Run the show erps command one each node to check the configuration. The configuration on Node 3 isused as an example.
Ruijie# show erps
ERPS Information
Global Status: Enabled

Link monitored by: Not Oam-------------------------------------------R-APS VLAN

: 4093

Ring Status: EnabledWest Port: Gi 0/17 (Forwarding)

East Port: Gi 0/18 (Blocking)

RPL Port: East Port

Protected VLANs

: ALL

10-19

Configuration Guide

Configuring ERPS(beta)

RPL Owner: Disabled

Holdoff Time: 0 milliseconds

Guard Time

: 500 milliseconds

WTR Time: 2 minutes

Current Ring State: IdleAssociate R-APS VLAN

: 100,200

Common Errors


The R-APS ring has been enabled but ERPS is not enabled globally, so ERPS still does not take effect.

Multiple RPL owner nodes are configured in one ERPS ring.



Different R-APS VLANs are configured for the nodes in one ERPS ring.

The nodes in the man ring are not associated with Ethernet subrings.

10.4.4 Load Balancing Configuration
Configuration EffectControl the direction of data flows in an ERPS ring to realize load balancing.

When a link in the ring network enabled with load balancing fails, the traffic can be quickly switched to a normal
link.

Notes


Before you configure load balancing, configure the VLAN-instance relationship in MST configuration mode.

When you configure load balancing, add all data VLANs of the devices to the ERPS protected VLAN list; otherwise,
any unprotected VLAN will cause loops.



Only trunk ports can join an ERPS ring, and the trunk attributes cannot be modified after the port joins the ring.

The ports in an ERPS ring do not participate in STP calculation regardless of whether the ERPS ring is enabled ornot. When you configure an ERPS ring, ensure that loops will not occur when STP calculation is disabled on ports
in the ring.



ERPS does not use the same ports as RERP and REUP.

Configuration Steps
Perform the following configuration after you complete the single-ring configuration described above:Configuring the Protected VLAN of an Ethernet Ring

(Optional) Perform this configuration in global configuration mode.

When you configure load balancing for an Ethernet ring, you must specify the protected VLAN.



Configuring the Protected VLAN of an Ethernet Ring

Commandprotected-instance instance-id-list

Parameter

instance-id-list: Indicates the instance protected by the Ethernet ring. The instance ID ranges from 0 to

Description

64

10-20

Configuration Guide
Command

Configuring ERPS(beta)

R-APS VLAN mode

Mode
Usage Guide

The protected instance of the Ethernet ring is the protected VLAN.

Verification


Run the show erps command one each node to check the configuration.

Configuration
ExampleScenario
Figure 12-8

Configuratio

Configure the R-APS VLAN in privileged mode.

n StepsConfigure the link mode of ports in the Ethernet ring.

Configure the protected VLAN of the Ethernet ring.

Enter R-APS VLAN mode and configure the ports to be added to the Ethernet ring and participate
in ERPS calculation.

Node 1Specify the RPL owner port.

Enable ERPS in the specified ring.

Enable ERPS globally.

# Enter privileged mode.
Ruijie# configure terminal# Configure the Ethernet subring ERPS 1 as follows:# Configure the link mode of ports in ERPS 1.
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport mode trunk
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# interface gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-GigabitEthernet 0/18)# exit
# Configure the protected VLAN, RPL owner port, and RPL of ERPS 1.
Ruijie(config)# spanning-tree mst configuration
Ruijie(config-mst)# instance 1 vlan 1-2000
Ruijie(config-mst)# exit

10-21

Configuration Guide

Configuring ERPS(beta)

Ruijie(config)# erps raps-vlan 100
Ruijie(config-erps 100)# protected-instance 1
Ruijie(config-erps 100)# ring-port west gigabitethernet 0/17 east gigabitethernet 0/18
Ruijie(config-erps 100)# rpl-port west rpl-owner# Configure the Ethernet subring ERPS 2 as follows:# Configure the ports to be added to ERPS 2 and participate in ERPS calculation.
Ruijie(config)# spanning-tree mst configuration
Ruijie(config-mst)# instance 2 vlan 2001-4094
Ruijie(config-mst)# exit
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# protected-instance 2
Ruijie(config-erps 4093)# ring-port west gigabitethernet 0/17 east gigabitethernet 0/18
# Enable ERPS in ERPS 2 and globally respectively.
Ruijie(config-erps 4093)# state enable
Ruijie(config-erps 4093)# exit
Ruijie(config)# erps enable
Node 2# The configuration on Node 2 is the same as that on Node 1, except that RPL configuration is not
required on Node 2.

Node 3# The configuration on Node 3 is the same as that on Node 1, except that RPL configuration is not
required on Node 3.
# Configure the RPL of ERPS 2 on Node 3. The RPL of ERPS 1 does not need to be configured on Node3.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# rpl-port east rpl-owner

Node 4The configuration on Node 4 is the same as that on Node 2.

Verification

Run the show erps command one each node to check the configuration. The configuration on Node 1 isused as an example.

Node 1

Ruijie# show erps
ERPS Information
Global Status: Enabled

Link monitored by: Not Oam-------------------------------------------R-APS VLAN

: 200

Ring Status: EnabledWest Port: Gi 0/17 (Blocking)

East Port: Gi 0/18 (Forwarding)

RPL Port: West Port

Protected VLANs: 1-2000RPL Owner: Enabled

Holdoff Time: 0 milliseconds

Guard Time

: 500 milliseconds

WTR Time: 2 minutes

Current Ring State: Idle10-22

Configuration Guide
Associate R-APS VLAN

Configuring ERPS(beta):-------------------------------------------R-APS VLAN

: 4093

Ring Status: EnabledWest Port: Gi 0/17 (Forwarding)

East Port: Gi 0/18 (Blocking)

RPL Port: West Port

Protected VLANs: 2001-4094

RPL Owner: Enabled

Holdoff Time: 0 milliseconds

Guard Time

: 500 milliseconds

WTR Time: 2 minutes

Current Ring State: IdleAssociate R-APS VLAN:

Common Errors


The R-APS ring has been enabled but ERPS is not enabled globally, so ERPS still does not take effect.

Multiple RPL owner nodes are configured in one ERPS ring.



Different R-APS VLANs are configured for the nodes in one ERPS ring.

10.4.5 ERPS Configuration Modification
Configuration Effect

Switch configuration smoothly when the ERPS ring topology is changed.

Notes


When you modify the ERPS configuration on a device, to avoid loops, first run the shutdown command to shut
down an ERPS port in the ring. When the configuration is completed, run the no shutdown command to restart
the port.

All nodes in one ERPS ring must belong to the same R-APS VLAN.



If you only need to modify the ERPS timers, skip this section.

Configuration Steps
Run the shutdown command to shut down an ERPS port and disable ERPS. Then modify the ERPS configurationaccording to section 10.4.1 "Single-Ring Configuration (Basic Function)" and complete the following settings, which are
optional.

Configuring the Holdoff Timer, Guard Timer, and WRT Timer

Optional.

Perform this configuration in R-APS VLAN mode based on the actual application requirements.

Commandtimer { holdoff-time holdoff | guard-time guard | wtr-time wtr }10-23

Configuration Guide

Configuring ERPS(beta)

Parameter

holdoff: Indicates the Holdoff timer interval. The value ranges from 0 to 100, in the unit of 100

Description

milliseconds. The default value is 0.
guard: Indicates the Guard timer interval. The value ranges from 1 to 200, in the unit of 10 milliseconds.
The default value is 50.
wtr: Indicates the WTR timer interval. The value ranges from 1 to 12, in the unit of minutes. The default
value is 2.

Default

Holdoff timer: 0 milliseconds.
Guard timer: 500 milliseconds.
WTP timer: 2 seconds.

Command

R-APS VLAN mode

Mode
Usage GuideHoldoff timer: Is used to minimize frequent ERPS topology switching due to intermittent link
failures. After you configure the Holdoff timer, ERPS performs topology switching only if the link
failure still persists after the timer times out.



Guard timer: Is used to prevent a device from receiving expired R-APS messages. When thedevice detects that a link failure is cleared, it sends link recovery packets and starts the Guard
timer. During the period before timer expiration, all packets except flush packets indicating a
subring topology change will be discarded.



WTR timer: Is effective only for RPL owner devices to avoid ring status misjudgment. When an RPL
owner device detects that a failure is cleared, it does perform topology switching immediately but
only if the Ethernet ring is recovered after the WTR timer times out. If a ring failure is detectedagain before timer expiration, the RPL owner device cancels the timer and does not perform
topology switching.

Verification


Run the show erps command one each node to check the configuration.

Configuration
ExampleScenario
Figure 12-9

Configuration Steps

ERPS configuration exists in the ring. The ERPS ports need to be switched because of a physicaltopology change.

10-24

Configuration GuideConfiguring ERPS(beta)
Run the shutdown command to shut down a link in the ring and configure the link mode of ports
after switching.

Node 1Disable ERPS in the ring in R-APS VLAN mode.



Reconfigure the ports that will participate in ERPS calculation.

Enable ERPS in the ring.

Modify the ERPS timers.

# Enter privileged mode.
Ruijie# configure terminal# Shutdown a link in the ring in interface configuration mode to avoid loops.
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# shutdown
Ruijie(config-if-GigabitEthernet 0/17)# exit
# Configure the link mode of ports in the Ethernet ring.
Ruijie(config)# interface gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# switchport mode trunk
Ruijie(config-if-GigabitEthernet 0/18)# exit
# Enter ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
# Disable ERPS.
Ruijie(config-erps 4093)# no state enable# Delete the previous ring configuration.
Ruijie(config-erps 4093)# no ring-port# Reconfigure the ports that will participate in ERPS calculation. Change Gig 0/17 to Gig 0/18.
Ruijie(config-erps 4093)# ring-port west gigabitethernet 0/17 east gigabitethernet 0/18
# Enable ERPS.
Ruijie(config-erps 4093)# state enable

Node 4# Enter privileged mode.
Ruijie# configure terminal# Modify timers in ERPS configuration mode.
Ruijie(config)# erps raps-vlan 4093
Ruijie(config-erps 4093)# timer wtr-time 1
Wait for 1 minute. When the ERPS ring is restored to Idle, run the show erps command on Node 1 andNode 4 to check the configuration.

Node 1

Ruijie# show erps
ERPS Information
Global Status: Enabled

Link monitored by: Not Oam-------------------------------------------R-APS VLAN

: 4093

Ring Status: EnabledWest Port: Gi 0/17 (Forwardin)

East Port: Gi 0/18 (Forwardin)

RPL Port: NoneProtected VLANs

: ALL

10-25

Configuration Guide

Node 4

Configuring ERPS(beta)

RPL Owner: Enabled

Holdoff Time: 0 milliseconds

Guard Time

: 500 milliseconds

WTR Time: 2 minutes

Current Ring State: IdleAssociate R-APS VLAN:

Ruijie# show erps
ERPS Information
Global Status: Enabled

Link monitored by: Not Oam-------------------------------------------R-APS VLAN

: 4093

Ring Status: EnabledWest Port: Gi 0/17 (Forwardin)

East Port: Gi 0/18 (Blocking)

RPL Port: East Port

Protected VLANs: ALL

RPL Owner: Enabled

Holdoff Time: 0 milliseconds

Guard Time

: 500 milliseconds

WTR Time: 1 minutes

Current Ring State: IdleAssociate R-APS VLAN:

Common Errors
When the configuration is completed, the R-APS ring is not enabled again or the shutdown ports are not restarted
by using the no shutdown command.

10.4.6 ERPS Monitoring Configuration
Configuration EffectNetwork management includes Operation, Administration and Maintenance (OAM). There are two ways to monitor thestate of the ERPS link.



Not OAM: Monitors the physical state of ERPS link directly, including up and down. Compared with OAM
monitoring, this method is more efficient.



OAM: Monitors the logical state of the ERPS link by OAM, including unidirectional link fault, bidirectional link fault
and normal. It takes more time to converge when the network topology changes.

You can change the ERPS monitoring method only when ERPS is disabled.

Configuration Steps

Configuring ERPS Monitoring

Optional.

10-26

Configuration Guide

Configuring ERPS(beta)

Commanderps monitor link-state by oam vlan vlan-id

Parametervlan-id :Indicates the VLAN that monitors link state. The VLAN ID ranges from 1 to 4094.

Description
Command

R-APS VLAN mode

Mode
Usage Guide

Each ring can be configured with only one RPL and only one RPL owner node.

10.5 Monitoring
Displaying
Description

Command

Displays the ERPS configuration and status of devices.

show erps [ global | raps_vlan vlan-id [ sub_ring ] ]10-27

IP Address & Application Configuration
1. Configuring IP Address and Service
2. Configuring ARP
3. Configuring IPv6
4. Configuring DHCP
5. Configuring DHCPv6
6. Configuring DNS
7. Configuring FTP Server
8. Configuring FTP Client
9. Configuring Network Connectivity Test Tool
10. Configuring TCP
11. Configuring IPv4/IPv6 REF

1-1

Configuration Guide

Configuring IP Addresses and Services

1 Configuring IP Addresses and Services
1.1 Overview
Internet Protocol (IP) sends packets to the destination from the source by using logical addresses, namely IP addresses.
At the network layer, routers forward packets based on IP addresses.

Protocols andStandards


RFC 1918: Address Allocation for Private Internets



RFC 1166: Internet Numbers

1.2 Applications
Application

Description

Configuring an IP Address for

Two networks communicate through one switch interface.

Communication

1.2.1 Configuring an IP Address for Communication
Scenario
A switch is connected to a Local Area Network (LAN), which is divided into two network segments, namely, 172.16.1.0/24
and 172.16.2.0/24. Computers in the two network segments can communicate with the Internet through switches andcomputers between the two network segments can communicate with each other.
Figure 1-1 Configuring IP Addresses

Deployment
Configure two IP addresses on VLAN1. One is a primary IP address and the other is a secondary IP address.

1-1

Configuration GuideConfiguring IP Addresses and Services

On hosts in the network segment 172.16.1.0/24, set the gateway to 172.16.1.1; on hosts in the network segment
172.16.2.0/24, set the gateway to 172.16.2.1.

1.3 Features
Basic Concepts

IP Address

An IP address consists of 32 bits in binary. To facilitate writing and description, an IP address is generally expressed indecimal. When expressed in decimal, an IP address is divided into four groups, with eight bits in each group. The value
range of each group is from 0 to 255, and groups are separated by a full stop ".". For example, "192.168.1.1" is an IP
address expressed in decimal.
IP addresses are used for interconnection at the IP layer. A 32-bit IP address consists of two parts, namely, the networkbits and the host bits. Based on the values of the first several bits in the network part, IP addresses in use can beclassified into four classes.
For a class A address, the most significant bit is 0.7 bits indicate a network ID, and 24 bits indicate a local address. There
are 128 class A networks in total.
Figure 1-2

Class A IP

0

8

16

24

Network ID

Host ID

32

address
For a class B address, the first two most significant bits are 10.14 bits indicate a network ID, and 16 bits indicate a local
address. There are 16,348 class B networks in total.
Figure 1-3

Class B IP

1

0

8

16

24

Network ID

Host ID

32

address
For a class C address, the first three most significant bits are 110.21 bits indicate a network ID, and 8 bits indicate a local
address. There are 2,097,152 class C networks in total.
Figure 1-4
8Class C IP

1

1

0

16

24

Network ID

32

Host ID

address

For a class D address, the first four most significant bits are 1110 and other bits indicate a multicast address.
Figure 1-5

1-2

Configuration Guide

Configuring IP Addresses and Services
8

Class D IP

1

1

1

0

16

24

32

Multicast address

address

The addresses with the first four most significant bits 1111 cannot be assigned. These addresses are called class E
addresses and are reserved.
When IP addresses are planned during network construction, IP addresses must be assigned based on the property of
the network to be built. If the network needs to be connected to the Internet, users should apply for IP addresses to thecorresponding agency. In China, you can apply to China Internet Network Information Center (CNNIC) for IP addresses.
Internet Corporation for Assigned Names and Numbers (ICANN) is the final organization responsible for IP address
assignment. If the network to be built is an internal private network, users do not need to apply for IP addresses. However,IP addresses cannot be assigned at random. It is recommended to assign dedicated private network addresses.
The following table lists reserved and available addresses.
Class

Class A network

Address Range

Status

0.0.0.0 - 0.255.255.255

Reserved

1.0.0.0 - 126.255.255.255

Available

127.0.0.0 - 127.255.255.255

Reserved

128.0.0.0 - 191.254.255.255

Available

191.255.0.0 - 191.255.255.255

Reserved

192.0.0.0 - 192.0.0.255

Reserved

192.0.1.0 - 223.255.254.255

Available

223.255.255.0 - 223.255.255.255

Reserved

224.0.0.0 - 239.255.255.255

Multicast address

240.0.0.0 - 255.255.255.254

Reserved

255.255.255.255

Broadcast address

Class B network

Class C network

Class D network

Class E network

Three address ranges are dedicated to private networks. These addresses are not used in the Internet. If the networks towhich these addresses are assigned need to be connected to the Internet, these IP addresses need to be converted into
valid Internet addresses. The following table lists private address ranges. Private network addresses are defined in RFC
1918.
Class

Address Range

StatusClass A network

10.0.0.0 - 10.255.255.255

1 class A network

Class B network

172.16.0.0 - 172.31.255.255

16 class B networks

1-3Configuration Guide

Configuring IP Addresses and Services

Class C network

192.168.0.0 - 192.168.255.255

256 class C networks

For assignment of IP addresses, TCP/UDP ports, and other codes, refer to RFC 1166.

Subnet Mask

A subnet mask is also a 32-bit value. The bits that identify the IP address are the network address. In a subnet mask, theIP address bits corresponding to the bits whose values are 1s are the network address, and the IP address bits
corresponding to the bits whose values are 0s are the host address. For example, for class A networks, the subnet mask
is 255.0.0.0. By using network masks, you can divide a network into several subnets. Subnetting means to use some bitsof the host address as the network address, thus decreasing the host capacity, and increasing the number of networks. In
this case, network masks are called subnet masks.



Broadcast Packet

Broadcast packets refer to the packets destined for all hosts on a physical network. Ruijie products support two types ofbroadcast packets: (1) directed broadcast, which indicates that all hosts on the specified network are packet receivers andthe host bits of a destination address are all 1s; (2) limited broadcast, which indicates that all hosts on all networks arepacket receivers and the 32 bits of a destination address are all 1s.



ICMP Packet

Internet Control Message Protocol (ICMP) is a sub-protocol in the TCP/IP suite for transmitting control messages between
IP hosts and network devices. It is mainly used to notify corresponding devices when the network performance becomesabnormal.



TTLTime to Live (TTL) refers to the number of network segments where packets are allowed to pass before the packets are
discarded. The TTL is a value in an IP packet. It informs the network whether packets should be discarded as the packets
stay on the network for a long time.

FeaturesFeatureDescription

IP Address

The IP protocol can run on an interface only after the interface is configured with an IP address.

Broadcast Packet

Broadcast addresses are configured and broadcast packets are forwarded and processed.

Processing
Sending ICMPICMP packets are sent and received.

Packets
Limiting

This function prevents Denial of Service (DoS) attacks.

Transmission Rate of
ICMP Error Packets
IP MTU

Maximum Transmission Unit (MTU) of IP packets on an interface is configured.

IP TTLThe TTL of unicast packets and broadcast packets is configured.

1-4

Configuration Guide

Configuring IP Addresses and Services

FeatureDescription

IP Source RouteSource routes are checked.

1.3.1 IP Address
IP addresses are obtained on an interface in the following ways:
1.

Manually configuring IP addresses

2.

Obtaining IP addresses through DHCP

3.

Obtaining IP addresses through PPP negotiation

These approaches are mutually exclusive. If you configure a new approach to obtain an IP address, the old IP address will
be overwritten.
For details on how to obtain IP addresses through DHCP, see the “DHCP” chapter. The following describes the otherthree approaches for obtaining IP addresses.



Configuring the IP Address for an Interface

A device can receive and send IP packets only after the device is configured with an IP address. Only the interface
configured with an IP address can run the IP protocol.

Configuring Multiple IP Addresses for an Interface

Ruijie products support multiple IP address configuration on one interface, of which one is a primary IP address and theothers are secondary IP addresses. Theoretically, the number of secondary IP addresses is not limited. However,secondary IP addresses must belong to different networks and secondary IP addresses must be in different networks
from primary IP addresses. In network construction, secondary IP addresses are often used in the following
circumstances:

A network does not have enough host addresses. For example, a LAN now needs one class C network to allocate
254 addresses. However, when the number of hosts exceeds 254, one class C network is not enough and anotherclass C network is needed. In this case, two networks need to be connected. Therefore, more IP addresses areneeded.



Many old networks are based on L2 bridged networks without subnetting. You can use secondary IP addresses to
upgrade the network to a routing network based on IP layer. For each subnet, one device is configured with one IP
address.

When two subnets of one network are isolated by another network, you can connect the isolated subnets by creatinga subnet of the isolated network and configuring a secondary address. One subnet cannot be configured on two or
more interfaces of a device.

Obtaining an IP Addresses through PPP Negotiation
This command is supported on point-to-point interfaces only.

Through this configuration, a point-to-point interface accepts the IP address assigned by the peer end through PPP
negotiation.

1-5

Configuration Guide

Configuring IP Addresses and Services

Related Configuration

Configuring an Interface with One or More IP Addresses

By default, an interface is not configured with an IP address.



The ip address command is used to configure an IP address for an interface.

After an IP address is configured, the IP address can be used for communication when it passes conflict detection.



The ip address ip-address mask secondary command can be used to configure multiple secondary IP addresses.

1.3.2 Broadcast Packet Processing
Working Principle
Broadcast is divided into two types. One is limited broadcast, and the IP address is 255.255.255.255. Because thebroadcast is prohibited by routers, the broadcast is called local network broadcast. The other is directed broadcast. All
host bits are 1s, for example, 192.168.1.255/24. The broadcast packets with these IP addresses can be forwarded.
If IP network devices forward limited broadcast packets (destination IP address is 255.255.255.255), the network may beoverloaded, which severely affects network performance. This circumstance is called broadcast storm. Devices provide
some approaches to confine broadcast storms within the local network and prevent continuous spread of broadcast
storms. L2 network devices such as bridges and switches forward and spread broadcast storms.
The best way to avoid broadcast storm is to assign a broadcast address to each network, which is directed broadcast.
This requires the IP protocol to use directed broadcast rather than limited broadcast to spread data.
For details about broadcast storms, see RFC 919 and RFC 922.
Directed broadcast packets refer to the broadcast packets destined for a subnet. For example, packets whose destination
address is 172.16.16.255 are called directed broadcast packets. However, the node that generates the packets is not amember of the destination subnet.
After receiving directed broadcast packets, the devices not directly connected to the destination subnet forward thepackets. After directed broadcast packets reach the devices directly connected to the subnet, the devices convert directedbroadcast packets to limited broadcast packets (destination IP address is 255.255.255.255) and broadcast the packets toall hosts on the destination subnet at the link layer.

Related Configuration

Configuring an IP Broadcast Address

By default, the IP broadcast address of an interface is 255.255.255.255.

To define broadcast packets of other addresses, run the ip broadcast-address command on the interface.

Forwarding Directed Broadcast Packets



By default, directed broadcast packets cannot be forwarded.

On the specified interface, you can run the ip directed-broadcast command to enable directed broadcast packets
forwarding. In this way, the interface can forward directed broadcast packets to networks that are directly connected.
Broadcast packets can be transmitted within the destination subnet without affecting forwarding of other directedbroadcast packets.

1-6

Configuration GuideConfiguring IP Addresses and Services

On an interface, you can define an Access Control List (ACL) to transmit certain directed broadcast packets. After an
ACL is defined, only directed broadcast packets that match the ACL are forwarded.

1.3.3 Sending ICMP Packets
Working Principle

ICMP Protocol Unreachable Message

A device receives non-broadcast packets destined for itself, and the packets contain the IP protocol that cannot beprocessed by the device. The device sends an ICMP protocol unreachable message to the source host. Besides, if thedevice does not know a route to forward packets, it also sends an ICMP host unreachable message.



ICMP Redirection Message

Sometimes, a route may be less than optimal, which makes a device send packets from the interface that receives
packets. If a device sends packets from an interface on which it receives the packets, the device sends an ICMP
redirection message to the source, informing the source that the gateway is another device on the same subnet. In thisway, the source sends subsequent packets according to the optimal path.



ICMP Mask Response Message

Sometimes, a network device sends an ICMP mask request message to obtain the mask of a subnet. The network device
that receives the ICMP mask request message sends a mask response message.

Related Configuration

Enabling ICMP Protocol Unreachable Message



By default, the ICMP Protocol unreachable message function is enabled on an interface.

You can run the [ no ] ip unreachables command to disable or enable the function.

Enabling ICMP Redirection Message



By default, the ICMP redirection message function is enabled on an interface.

You can run the [ no ] ip redirects command to disable or enable the function.

Enabling ICMP Mask Response Message



By default, the ICMP mask response message function is enabled on an interface.

You can run the [ no ] ip mask-reply command to disable or enable the function.

1.3.4 Limiting Transmission Rate of ICMP Error Packets
Working Principle
This function limits the transmission rate of ICMP error packets to prevent DoS attacks by using the token bucket
algorithm.
If an IP packet needs to be fragmented but the Don’t Fragment (DF) bit in the header is set to 1, the device sends an
ICMP destination unreachable packet (code 4) to the source host. This ICMP error packet is used to discover the path
MTU. When there are too many other ICMP error packets, the ICMP destination unreachable packet (code 4) may not be

1-7

Configuration Guide

Configuring IP Addresses and Services

sent. As a result, the path MTU discovery function fails. To avoid this problem, you should limit the transmission rate of
ICMP destination unreachable packets and other ICMP error packets respectively.

Related Configuration

Configuring the Transmission Rate of ICMP Destination Unreachable Packets Triggered by DF Bit in the IP
Header

The default transmission rate is 10 packets every 100 milliseconds.



The ip icmp error-interval DF command can be used to configure the transmission rate.

Configuring the Transmission Rate of Other ICMP Error Packets

The default transmission rate is 10 packets every 100 milliseconds.



The ip icmp error-interval command can be used to configure the transmission rate.

1.3.5 IP MTUWorking Principle
If an IP packet exceeds the IP MTU size, the RGOS software splits the packet. For all devices in the same physicalnetwork segment, the IP MTU of interconnected interfaces must be the same. You can adjust the link MTU of interfaces
on Ruijie products. After the link MTU of interfaces is changed, the IP MTU of interfaces will be changed. The IP MTU ofinterfaces automatically keeps consistent with the link MTU of interfaces. However, if the IP MTU of interfaces is adjusted,
the link MTU of interfaces will not be changed.

Related Configuration



Setting the IP MTU

By default, the IP MTU of an interface is 1500.



The ip mtu command can be used to set the IP packet MTU.

1.3.6 IP TTL
Working Principle
An IP packet is transmitted from the source address to the destination address through routers. After a TTL value is set,
the TTL value decreases by 1 every time when the IP packet passes a router. When the TTL value drops to zero, therouter discards the packet. This prevents infinite transmission of useless packets and waste of bandwidth.

Related Configuration



Setting the IP TTL

By default, the IP TTL of an interface is 64.

The ip ttl command can be used to set the IP TTL of an interface.

1-8

Configuration Guide

Configuring IP Addresses and Services

1.3.7 IP Source RouteWorking Principle
Ruijie products support IP source routes. When a device receives an IP packet, it checks the options such as source route,loose source route, and record route in the IP packet header. These options are detailed in RFC 791. If the device detectsthat the packet enables one option, it responds; if the device detects an invalid option, it sends an ICMP parameter error
message to the source and then discards the packet.
After the IP source route is enabled, the source route option is added to an IP packet to test the throughput of a specificnetwork or help the packet bypasses the failed network. However, this may cause network attacks such as source
address spoofing and IP spoofing.

Related Configuration

Configuring an IP Source Route

By default, the IP source route function is enabled.

The ip source-route command can be used to enable or disable the function.

1.4 Configuration
Configuration

Description and Command(Mandatory) It is used to configure an IP address and allow the IP protocol to run on an

Configuring the IP Addresses

interface.

of an Interface

Manually configures the IP address of an

ip addressinterface.

(Optional) It is used to set an IP broadcast address and enable directed broadcast
forwarding.
Configuring Broadcast
Forwarding

ip broadcast-address

Configures an IP broadcast address.

ip directed-broadcast

Enables directed broadcast forwarding.

(Optional) It is used to enable ICMP packet forwarding.

Configuring ICMP

Enables ICMP unreachable messages andip unreachables

host unreachable messages.

Forwarding

Configuring the Transmission

ip redirects

Enables ICMP redirection messages.

ip mask-reply

Enables ICMP mask response messages.

(Optional)

1-9

Configuration Guide

Configuration

Configuring IP Addresses and Services

Description and Command

Rate of ICMP Error Packets

Configures the transmission rate of ICMP
ip icmp error-interval DF

destination unreachable packets triggeredby the DF bit in the IP header.
Configures the transmission rate of ICMP

ip icmp error-interval

error packets and ICMP redirection packets.

(Optional) It is used to configure the IP MTU on an interface.
Setting the IP MTU
Sets the MTU value.

ip mtu(Optional) It is used to configure the TTL of unicast packets and broadcast packets.
Setting the IP TTL
Sets the TTL value.

ip ttlConfiguring an IP Source
Route(Optional) It is used to check the source routes.
Enables the IP source route function.

ip source-route

1.4.1 Configuring the IP Addresses of an Interface
Configuration EffectConfigure the IP address of an interface for communication.

Notes


N/A

Configuration Steps

Configuring the IP Address of an Interface



Mandatory

Perform the configuration in L3 interface configuration mode.

Obtaining the IP Address of an Interface through PPP Negotiation



Optional

If a point-to-point interface is not configured with an IP address, obtain an IP address through PPP negotiation.



Perform the configuration in L3 interface configuration mode.

Verification
Run the show ip interface command to check whether the configuration takes effect.

Related Commands



Manually Configuring the IP Address of an Interface

1-10Configuration Guide

Configuring IP Addresses and Services

Command

ip address ip-address network-mask [ secondary ]Parameter

ip-address: 32-bit IP address, with 8 bits for each group. The IP address is expressed in decimal and groups

Description

are separated by a full stop (.).
network-mask: 32-bit network mask. Value 1 indicates the mask bit and 0 indicates the host bit. Every 8 bits
form one group. The network mask is expressed in decimal and groups are separated by a full stop (.).
secondary: Secondary IP address.

Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring an IP Address for an Interface

Configuration

Configure IP address 192.168.23.110 255.255.255.0 on interface vlan 1.

Steps
Ruijie# configure terminal
Ruijie(config)#interface vlan 1
Ruijie(config-if-VLAN 1)#ip address 192.168.23.110 255.255.255.0
Verification

Run the show ip interface command to check whether the configuration takes effect.
Ruijie#show ip interface vlan 1
VLAN 1
IP interface state is: UP
IP interface type is: BROADCAST
IP interface MTU is: 1500
IP address is:
10.52.25.137/21 (primary)
192.168.1.200/24
IP address negotiate is: OFF
Forward direct-broadcast is: OFF
ICMP mask reply is: ON
Send ICMP redirect is: ON
Send ICMP unreachable is: ON
DHCP relay is: OFF

1-11

Configuration Guide

Configuring IP Addresses and Services
Fast switch is: ON
Help address is:
Proxy ARP is: OFF

ARP packet input number: 1816117
Request packet: 1785578

Reply packet: 30539

Unknown packet: 0

TTL invalid packet number: 0
ICMP packet input number: 32
Echo request: 22

Echo reply: 10

Unreachable: 0

Source quench: 0

1.4.2 Configuring Broadcast Forwarding
Configuration Effect
Set the broadcast address of an interface to 0.0.0.0 and enable directed broadcast forwarding.

Notes
N/A

Configuration Steps

Configuring an IP Broadcast Address(Optional) Some old hosts may identify broadcast address 0.0.0.0 only. In this case, set the broadcast address of thetarget interface to 0.0.0.0.

Perform the configuration in L3 interface configuration mode.

Enabling Directed Broadcast Forwarding(Optional) If you want to enable a host to send broadcast packets to all hosts in a domain that it is not in, enabledirected broadcast forwarding.

Perform the configuration in L3 interface configuration mode.

Verification
Run the show running-config interface command to check whether the configuration takes effect.

Related Commands

Configuring an IP Broadcast Address

1-12

Configuration Guide

Configuring IP Addresses and Services

Command

ip broadcast-address ip-address

Parameter

ip-address: Broadcast address of an IP network.

Description
Command

Interface configuration mode

Mode
Usage Guide

Generally, the destination address of IP broadcast packets is all 1s, which is expressed as 255.255.255.255.
The RGOS software can generate broadcast packets of other IP addresses through definition and receive
self-defined broadcast packets and the broadcast packets with address 255.255.255.255.

Allowing Forwarding of Directed Broadcast Packets

Command

ip directed-broadcast [ access-list-number ]Parameteraccess-list-number: Access list number, ranging from 1 to 199 and from1300 to 2699. After an ACL is

Description

defined, only directed broadcast packets that match the ACL are forwarded.

Command

Interface configuration mode

Mode
Usage Guide

If the no ip directed-broadcast command is run on an interface, the RGOS software will discard directedbroadcast packets received from the network that is directly connected.

Configuration
ExampleConfiguration

On interface vlan 1, set the destination address of IP broadcast packets to 0.0.0.0 and enable directed

Steps

broadcast forwarding.
Ruijie#configure terminal
Ruijie(config)#interface vlan 1
Ruijie(config-if-VLAN 0/1)# ip broadcast-address 0.0.0.0
Ruijie(config-if-VLAN 0/1)# ip directed-broadcast

Verification

Run the show ip interface command to check whether the configuration takes effect.
Ruijie# show running-config interface vlan 1
interface VLAN 1
ip directed-broadcast
ip address dhcp
ip broadcast-address 0.0.0.0

1-13

Configuration Guide

Configuring IP Addresses and Services

1.4.3 Configuring ICMP Forwarding
Configuration EffectEnable ICMP unreachable messages, ICMP redirection messages, and mask response messages on an interface.

Notes
N/A

Configuration Steps

Enabling ICMP Unreachable Messages

By default, ICMP unreachable messages are enabled.

(Optional) The no ip unreachables command can be used to disable ICMP unreachable messages.



Perform the configuration in L3 interface configuration mode.

Enabling ICMP Redirection Messages

By default, ICMP redirection messages are enabled.

(Optional) The no ip redirects command can be used to disable ICMP redirection messages.



Perform the configuration in L3 interface configuration mode.

Enabling ICMP Mask Response Messages

By default, ICMP mask response messages are enabled.

(Optional) The no ip mask-reply command can be used to disable ICMP mask response messages.



Perform the configuration in L3 interface configuration mode.

Verification
Run the show ip interface command to check whether the configuration takes effect.

Related Commands

Enabling ICMP Unreachable Messages

Command

ip unreachables

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

N/AEnabling ICMP Redirection Messages

Command

ip redirects

1-14

Configuration Guide

Parameter

Configuring IP Addresses and Services

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

N/AEnabling ICMP Mask Response Messages

Command

ip mask-reply

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuration
ExampleConfiguration

Enable ICMP unreachable messages, ICMP redirection messages, and mask response messages on

Stepsinterface vlan 1.
Ruijie# configure terminal
Ruijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ip unreachables
Ruijie(config-if-VLAN 1)# ip redirects
Ruijie(config-if-VLAN 1)# ip mask-reply

Verification

Run the show ip interface command to check whether the configuration takes effect.

1-15

Configuration Guide

Configuring IP Addresses and Services

Ruijie# show ip interface vlan 1
VLAN 1
IP interface state is: UP
IP interface type is: BROADCAST
IP interface MTU is: 1500
IP address is:
10.52.25.137/21 (primary)
192.168.1.200/24
IP address negotiate is: OFF
Forward direct-broadcast is: OFF
ICMP mask reply is: ON
Send ICMP redirect is: ON
Send ICMP unreachable is: ON
DHCP relay is: OFF
Fast switch is: ON
Help address is:
Proxy ARP is: OFF
ARP packet input number: 1821610
Request packet: 1791006

Reply packet: 30604

Unknown packet: 0

TTL invalid packet number: 0
ICMP packet input number: 32
Echo request: 22

Echo reply: 10

Unreachable: 0

Source quench: 0Routing redirect: 0

1.4.4 Configuring the Transmission Rate of ICMP Error Packets
Configuration EffectConfigure the transmission rate of ICMP error packets.

Notes
N/A

1-16

Configuration Guide

Configuring IP Addresses and Services

Configuration Steps

Configuring the Transmission Rate of ICMP Destination Unreachable Packets Triggered by the DF Bit in the
IP Header

OptionalPerform the configuration in global configuration mode.

Configuring the Transmission Rate of Other ICMP Error Packets

OptionalPerform the configuration in global configuration mode.

Verification
Run the show running-config command to check whether the configuration takes effect.

Related Commands

Configuring the Transmission Rate of ICMP Destination Unreachable Packets Triggered by the DF Bit in the
IP HeaderCommandip icmp error-interval DF milliseconds [ bucket-size ]Parameter

milliseconds: Refresh cycle of a token bucket. The value range is from 0 to 2,147,483,647 and the default

Description

value is 100 milliseconds. When the value is 0, the transmission rate of ICMP error packets is not limited.
bucket-size: Number of tokens contained in a token bucket. The value range is from 1 to 200 and the default
value is 10.

Command

Global configuration mode.

Mode
Usage Guide

This function limits the transmission rate of ICMP error packets to prevent DoS attacks by using the token
bucket algorithm.
If an IP packet needs to be fragmented but the DF bit in the header is set to 1, the device sends an ICMP
destination unreachable packet (code 4) to the source host. This ICMP error packet is used to discover thepath MTU. When there are too many other ICMP error packets, the ICMP destination unreachable packet(code 4) may not be sent. As a result, the path MTU discovery function fails. To avoid this problem, you
should limit the transmission rate of ICMP destination unreachable packets and other ICMP error packets
respectively.
It is recommended to set the refresh cycle to integral multiples of 10 milliseconds. If the refresh cycle is set
to a value greater than 0 and smaller than 10 milliseconds, the refresh cycle that actually takes effect is 10
milliseconds. For example, if the refresh rate is set to 1 per 5 milliseconds, the refresh rate that actuallytakes effect is 2 per 10 milliseconds. If the refresh cycle is not integral multiples of 10 milliseconds, therefresh cycle that actually takes effect is automatically converted to integral multiples of 10 milliseconds. For
example, if the refresh rate is set to 3 per 15 milliseconds, the refresh rate that actually takes effect is 2 per
10milliseconds.

1-17

Configuration GuideConfiguring IP Addresses and Services

Configuring the Transmission Rate of Other ICMP Error Packets

Commandip icmp error-interval milliseconds [ bucket-size ]Parameter

milliseconds: Refresh cycle of a token bucket. The value range is 0 to 2,147,483,647, and the default value

Description

is 100 (ms). When the value is 0, the transmission rate of ICMP error packets is not limited.
bucket-size: Number of tokens contained in a token bucket. The value range is 1 to 200 and the default
value is 10.

Command

Global configuration mode.

Mode
Usage Guide

This function limits the transmission rate of ICMP error packets to prevent DoS attacks by using the token
bucket algorithm.
It is recommended to set the refresh cycle to integral multiples of 10 milliseconds. If the refresh cycle is set
to a value greater than 0 and smaller than 10 milliseconds, the refresh cycle that actually takes effect is 10
milliseconds. For example, if the refresh rate is set to 1 per 5 milliseconds, the refresh rate that actuallytakes effect is 2 per 10 milliseconds. If the refresh cycle is not integral multiples of 10 milliseconds, therefresh cycle that actually takes effect is automatically converted to integral multiples of 10 milliseconds. For
example, if the refresh rate is set to 3 per 15 milliseconds, the refresh rate that actually takes effect is 2 per
10 milliseconds.

Configuration
ExampleConfiguration

Set the transmission rate of ICMP destination unreachable packets triggered the DF bit in IP header to 100

Steps

packets per second and the transmission rate of other ICMP error packets to 10 packets per second.
Ruijie(config)# ip icmp error-interval DF 1000 100
Ruijie(config)# ip icmp error-interval 1000 10

Verification

Run the show running-config command to check whether the configuration takes effect.
Ruijie# show running-config | include ip icmp error-interval
ip icmp error-interval 1000 10
ip icmp error-interval DF 1000 100

1.4.5 Setting the IP MTU
Configuration Effect
Adjust the IP packet MTU.

Notes
N/A

1-18

Configuration Guide

Configuring IP Addresses and Services

Configuration Steps(Optional) When the IP MTU of interconnected interfaces is different on devices in the same physical network
segment, set the IP MTU to the same value.

Perform the configuration in Layer 3 interface configuration mode.

Verification
Run the show ip interface command to check whether the configuration takes effect.

Related Commands



Setting the IP MTU

Command

ip mtu bytes

Parameter

bytes: IP packet MTU. The value range is from 68 to 1,500 bytes.

Description
Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuration
ExampleConfiguration

Set the IP MTU of interface gigabitEthernet 0/1 to 512 bytes.

Steps
Ruijie# configure terminal
Ruijie(config)# interface vlan 1
Ruijie(config-if- VLAN 1)# ip mtu 512
Verification

Run the show ip interface command to check whether the configuration takes effect.
Ruijie# show ip interface vlan 1
IP interface MTU is: 512

1.4.6 Setting the IP TTL
Configuration Effect
Modify the IP TTL value of an interface.

Notes
N/A

1-19

Configuration Guide

Configuring IP Addresses and Services

Configuration Steps

OptionalPerform the configuration in L3 interface configuration mode.

Verification
Run the show run-config command to check whether the configuration takes effect.

Related Commands



Setting the IP TTL

Command

ip ttl value

Parameter

value: TTL value. The value range is from 0 to 255.

Description
Command

Global configuration mode.

Mode
Usage Guide

N/A

Configuration
ExampleConfiguration

Set the TTL of unicast packets to 100.

Steps
Ruijie# configure terminal
Ruijie(config)# ip ttl 100
Verification

Run the show run-config command to check whether the configuration takes effect.
Ruijie# show running-config
ip ttl 100

1.4.7 Configuring an IP Source Route
Configuration EffectEnable or disable the IP source route function.

Notes
N/A

Configuration Steps

By default, the IP source route function is enabled.

(Optional) The no ip source-route command can be used to disable the IP source route function.
1-20

Configuration Guide

Configuring IP Addresses and Services

Verification
Run the show run-config command to check whether the configuration takes effect.

Related Commands

Configuring an IP Source RouteCommandip source-route

Parameter

N/A

Description
Command

Global configuration mode.

Mode
Usage Guide

N/A

Configuration
ExampleConfiguration

Disable the IP source route function.

Steps
Ruijie# configure terminal
Ruijie(config)# no ip source-route
Verification

Run the show run-config command to check whether the configuration takes effect.
Ruijie# show running-config
no ip source-route

1.5 Monitoring
Displaying
Description

Command

Displays the IP address of an interface.

show ip interface [ interface-type interface-number | brief ]Displays IP packet statistics.

show ip packet statistics [ total | interface-name ]Displays statistics on sent and received IP
packets in the protocol stack.

show ip packet queue

Displays IPv4 raw sockets.

show ip raw-socket [ num ]Displays all IPv4 sockets.

show ip sockets

1-21

Configuration Guide

Displays IPv4 UDP sockets.

show ip udp [ local-port num | peer-port num ]Displays IPv4 UDP socket statistics.

show ip udp statistics

1-22

Configuration Guide

Configuring ARP

2 Configuring ARP
2.1 Overview
In a local area network (LAN), each IP network device has two addresses: (1) local address. Since the local address is
contained in the header of the data link layer (DLL) frame, it is a DLL address. However, it is processed by the MAC
sublayer at the DLL and thereby is usually called the MAC address. MAC addresses represent IP network devices on
LANs. (2) network address. Network addresses on the Internet represent IP network devices and also indicate the
networks where the devices reside.
In a LAN, two IP devices can communicate with each other only after they learn the 48-bit MAC address of each other.
The process of obtaining the MAC address based on the IP address is called address resolution. There are two types ofaddress resolution protocols: (1) Address Resolution Protocol (ARP); (2) Proxy ARP. ARP and Proxy ARP are described
respectively in RFC 826 and RFC 1027.
ARP is used to bind the MAC address with the IP address. When you enter an IP address, you can learn thecorresponding MAC address through ARP. Once the MAC address is obtained, the IP-MAC mapping will be saved to the
ARP cache of the network device. With the MAC address, the IP device can encapsulate DLL frames and send them tothe LAN. By default, IP and ARP packets on the Ethernet are encapsulated in Ethernet II frames.

Protocols andStandards


RFC 826: An Ethernet Address Resolution Protocol

RFC 1027: Using ARP to implement transparent subnet gateways

2.2 Applications
Application

Description

LAN-based ARP

A user learns the MAC addresses of other users in the same network segment
through ARP.

Proxy ARP-based Transparent

With Proxy ARP, a user can directly communicate with users in another network

Transmission

without knowing that it exists.

2.2.1 LAN-based ARP
Scenario
ARP is required in all IPv4 LANs.



A user needs to learn the MAC addresses of other users through ARP to communicate with them.

2-1

Configuration Guide

Configuring ARPFigure 2-1

Remarks

A is a router.
B is a switch. It acts as the gateway.
C, D, and E are hosts.

Deployment
Enable ARP in a LAN to implement IP-MAC mapping.

2.2.2 Proxy ARP-based Transparent Transmission
Scenario
Transparent transmission across IPv4 LANs is performed.

Enable Proxy ARP on the router to achieve direct communication between users in different network segments.

Figure 2-2

Remarks

A is a router connecting two LANs.
B and C are hosts in different subnets. No default gateway is configured for them.

Deployment
Enable Proxy ARP on the subnet gateway. After configuration, the gateway can act as a proxy to enable a host
without any route information to obtain MAC addresses of IP users in other subnets.

2-2

Configuration Guide

Configuring ARP

2.3 Features
Overview
FeatureDescription

Static ARP

Users can manually specify IP-MAC mapping to prevent the device from learning incorrect ARP
entries.

ARP Attributes

Users can specify the ARP entry timeout, ARP request retransmission times and interval, andmaximum number of unresolved ARP entries.

ARP-based IP Guard

You can set the number of IP packets for triggering ARP drop to prevent a large number of
unknown unicast packets from being sent to the CPU.

2.3.1 Static ARP
Static ARP entries can be configured manually or assigned by the authentication server. The manually configured ones
prevail. Static ARP can prevent the device from learning incorrect ARP entries.

Working Principle
If static ARP entries are configured, the device does not actively update ARP entries and these ARP entries permanently
exist.
When the device forwards Layer-3 packets, the static MAC address is encapsulated in the Ethernet header as thedestination MAC address.

Related Configuration

Enabling Static ARP

Run the arp ip-address mac-address type command in global configuration mode to configure static ARP entries. By
default, no static ARP entry is configured. ARP encapsulation supports only the Ethernet II type, which is represented byARPA.

2.3.2 ARP Attributes
Users can specify the ARP timeout, ARP request retransmission interval and times, maximum number of unresolved ARP
entries, maximum number of ARP entries on an interface, and maximum number of ARP entries on a board.

Working Principle

ARP Timeout

The ARP timeout only applies to the dynamically learned IP-MAC mapping. When the ARP entry timeout expires, thedevice sends a unicast ARP request packet to detect whether the peer end is online. If it receives an ARP reply from thepeer end, it does not delete this ARP entry. Otherwise, the device deletes this ARP entry.
When the ARP timeout is set to a smaller value, the mapping table stored in the ARP cache is more accurate but ARP
consumes more network bandwidth.

2-3Configuration GuideConfiguring ARP

ARP Request Retransmission Interval and Times

The device consecutively sends ARP requests to resolve an IP address to a MAC address. The shorter the retransmissioninterval is, the faster the resolution is. The more times the ARP request is retransmitted, the more likely the resolution will
succeed and the more bandwidth ARP will consume.

Maximum Number of Unresolved ARP Entries

In a LAN, ARP attacks and scanning may cause a large number of unresolved ARP entries generated on the gateway. As
a result, the gateway fails to learn the MAC addresses of the users. To prevent such attacks, users can configure themaximum number of unresolved ARP entries.

Related Configuration

Configuring the ARP Timeout

Run the arp timeout seconds command in interface configuration mode to configure the ARP timeout. The default
timeout is 3,600 seconds. You can change it based on actual situations.



Configuring the ARP Request Retransmission Interval and Times

Run the arp retry interval seconds command in global configuration mode to configure the ARP request
retransmission interval. The default interval is 1 second. You can change it based on actual situations.



Run the arp retry times number command in global configuration mode to configure the ARP request
retransmission times. The default number of retransmission times is 5. You can change it based on actual situations.



Configuring the Maximum Number of Unresolved ARP Entries

Run the arp unresolve number command in global configuration mode to configure the maximum number of unresolved
ARP entries. The default value is the maximum number of ARP entries supported by the device. You can change it basedon actual situations.

2.3.3 ARP-based IP Guard
Working Principle
When receiving unresolved IP packets, the switch cannot forward them through the hardware and thereby need to send
them to the CPU for address resolution. If a large number of such packets are sent to the CPU, the CPU will be congested,affecting other services on the switch.
After ARP-based IP guard is enabled, the switch receiving ARP request packets counts the number of packets in which
the destination IP address hits this ARP entry. If this number is equal to the configured number, the switch sets a drop
entry in the hardware so that the hardware will not send the packets with this destination IP address to the CPU. After theaddress resolution is complete, the switch continues to forward the packets with this destination IP address.

Related Configuration

Enabling ARP-based IP GuardRun the arp anti-ip-attack command in global configuration mode to configure the number of IP packets fortriggering ARP drop.

2-4

Configuration GuideConfiguring ARP

By default, the switch discards the corresponding ARP entry after it receives three unknown unicast packets
containing the same destination IP address.

2.4 Configuration
Configuration

Description and Command(Optional) It is used to enable static IP-MAC binding.

Enabling Static ARP
Enables static ARP.

arp

(Optional) It is used to specify the ARP timeout, ARP request retransmission interval andtimes, maximum number of unresolved ARP entries and maximum number of ARP
entries on an interface.
Configures the ARP timeout.

arp timeout

Configuring ARP Attributes

Configures the ARP request retransmission

arp retry intervalinterval.
Configures the number of ARP request

arp retry times

retransmission times.
Configures the maximum number ofarp unresolve

unresolved ARP entries.

(Optional) It is used to prevent a large number of IP packets from being sent to the CPU.
Enabling ARP-based IP
Guard

Configures the number of IP packets forarp anti-ip-attack

triggering ARP drop.

2.4.1 Enabling Static ARP
Configuration Effect
Users can manually specify IP-MAC mapping to prevent the device from learning incorrect ARP entries.

Notes
After a static ARP entry is configured, the Layer-3 switch learns the physical port corresponding to the MAC address in thestatic ARP entry before it performs Layer-3 routing.

Configuration Steps

Configuring Static ARP Entries



Optional.

You can configure a static ARP entry to bind the IP address of the uplink device with its MAC address to prevent
MAC change caused by ARP attacks.

2-5

Configuration GuideConfiguring ARP

Configure static ARP entries in global configuration mode.

Verification
Run the show running-config command to check whether the configuration takes effect. Or run the show arp staticcommand to check whether a static ARP cache table is created.

Related Commands

Configuring Static ARP Entries

Commandarp ip-address mac-address type

Parameter

ip-address: Indicates the IP address mapped to a MAC address, which is in four-part dotted-decimal format.

Description

mac-address: Indicates the DLL address, consisting of 48 bits.
type: Indicates the ARP encapsulation type. For an Ethernet interface, the keyword is arpa.

Command

Global configuration mode

Mode
Usage Guide

The RGOS queries a 48-bit MAC address based on a 32-bit IP address in the ARP cache table.
Since most hosts support dynamic ARP resolution, usually the static ARP mapping are not configured. Use
the clear arp-cache command to delete the dynamic ARP entries.

Configuration
ExampleScenario
Figure 2-3

Configuration

Configure a static ARP entry on B to statically bind the IP address of A with the MAC address.

Steps
Ruijie(config)#arp 192.168.23.1 00D0.F822.334B arpa
Verification

Run the show arp static command to display the static ARP entry.
Ruijie(config)# show arp static
ProtocolAddress

Age(min)Hardware

Type

Internet

192.168.23.1<static>

00D0.F822.334B

arpa

2-6

InterfaceConfiguration Guide
1

Configuring ARP
static arp entries exist.

Common Errors


The MAC address in static ARP is incorrect.

2.4.2 Configuring ARP Attributes
Configuration Effect
Users can specify the ARP timeout, ARP request retransmission interval and times, maximum number of unresolved ARP
entries, maximum number of ARP entries on an interface, and maximum number of ARP entries on a board.

Configuration Steps

Configuring the ARP Timeout

Optional.



In a LAN, if a user goes online/offline frequently, it is recommended to set the ARP timeout small to delete invalid
ARP entries as soon as possible.

Configure the ARP timeout in interface configuration mode.

Configuring the ARP Request Retransmission Interval and Times

Optional.



If the network resources are insufficient, it is recommended to set the ARP request retransmission interval great andthe retransmission times small to reduce the consumption of network bandwidths.

Configure the ARP request retransmission interval and times in global configuration mode.

Configuring the Maximum Number of Unresolved ARP Entries



Optional.



If the network resources are insufficient, it is recommended to set the maximum number of unresolved ARP entries
small to reduce the consumption of network bandwidths.

Configure the maximum number of unresolved ARP entries in global configuration mode.

Verification
Run the show arp timeout command to display the timeouts of all interfaces.
Run the show running-config command to display the ARP request retransmission interval and times, maximum numberof unresolved ARP entries, maximum number of ARP entries on an interface, and maximum number of ARP entries on aboard.

Related Commands

Configuring the ARP Timeout

Commandarp timeout seconds

2-7

Configuration Guide

Parameter

Configuring ARP

seconds: Indicates the timeout in seconds, ranging from 0 to 2,147,483. The default value is 3,600.

Description
Command

Interface configuration mode

Mode
Usage Guide

The ARP timeout only applies to the dynamically learned IP-MAC mapping. When the ARP timeout is set toa smaller value, the mapping table stored in the ARP cache is more accurate but ARP consumes more
network bandwidth. Unless otherwise specified, do not configure the ARP timeout.

Configuring the ARP Request Retransmission IntervalCommandarp retry interval seconds

Parameterseconds: Indicates the ARP request retransmission interval in seconds, ranging from 1 to 3,600. The default

Description

value is 1.

Command

Global configuration mode

Mode
Usage Guide

If a device frequently sends ARP requests, affecting network performance, you can set the ARP request
retransmission interval longer. Ensure that this interval does not exceed the ARP timeout.

Configuring the ARP Request Retransmission Times

Commandarp retry times number

Parameter

number: Indicates the number of times the same ARP request is sent, in the range from 1 to 100. When it is

Description

set as 1, it indicates that the ARP request is not retransmitted, only one ARP request message is sent.

Command

Global configuration mode

Mode
Usage Guide

The switch sends the ARP request message frequently, and thus causing problems like network busy. In
this case, you can set the retry times of the ARP request smaller. In general, the retry times should not be
set too large.

Configuring the Maximum Number of Unresolved ARP Entries

Commandarp unresolve number

Parameter

number: Indicates the maximum number of unresolved ARP entries, ranging from 1 to 8,192. The default

Description

value is 8,192.

Command

Global configuration mode

Mode
Usage Guide

If a large number of unresolved entries exist in the ARP cache table and remain in the table after a while, it isrecommended to use this command to limit the number of unresolved ARP entries.

2-8

Configuration Guide

Configuring ARP

Configuration
ExampleScenario
Figure 2-4

Configuration



Set the ARP timeout to 60 seconds on port vlan 1.

Steps



Set the maximum number of learned ARP entries to 300 on port vlan 1.



Set the ARP request retransmission interval to 3 seconds.



Set the ARP request retransmission times to 4.



Set the maximum number of unresolved ARP entries to 4,096.



Set the maximum number of learned ARP entries to 1,000 on Sub Slot 2 of Slot 1.

Ruijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# arp timeout 60
Ruijie(config-if-VLAN 1)# arp cache interface-limit 300
Ruijie(config-if-VLAN 1)# exit
Ruijie(config)# arp retry interval 3
Ruijie(config)# arp retry times 4
Ruijie(config)# arp unresolve 4096
Verification



Run the show arp timeout command to display the timeout of the interface.

Run the show running-config command to display the ARP request retransmission interval andtimes, maximum number of unresolved ARP entries and maximum number of ARP entries on theinterface,.

Ruijie# show arp timeout
Interfacearp timeout(sec)--------------------------------------

GigabitEthernet 0/1

60

GigabitEthernet 0/2

3600

GigabitEthernet 0/4

3600

GigabitEthernet 0/5

3600

2-9

Configuration Guide

Configuring ARPGigabitEthernet 0/7

3600

VLAN 1003600

VLAN 111

3600

Ruijie(config)# show running-config
arp unresolve 4096
arp retry times 4
arp retry interval 3!
interface GigabitEthernet 0/1
arp cache interface-limit 300

2.4.3 Enabling ARP-based IP Guard
Configuration Effect
When the CPU receives the specified number of packets in which the destination IP address hits the ARP entry, allpackets with this destination IP address will not be sent to the CPU afterwards.

Notes
ARP-based IP guard is supported on switches.

Configuration Steps

Optional.



By default, when three unknown unicast packets are sent to the switch CPU, the drop entry is set. Users can run thiscommand to adjust the number of packets for triggering ARP drop based on the network environment. Users canalso disable this function.

Configure ARP-based IP guard in global configuration mode.

Verification
Run the show running-config command to check whether the configuration takes effect.

Related Commands

Enabling ARP-based IP Guard

Commandarp anti-ip-attack num

Parameternum: Indicates the number of IP packets for triggering ARP drop. The value ranges from 0 to 100.

Description
Command

0 indicates that ARP-based IP guard is disabled. The default value is 3.
Interface configuration mode

2-10

Configuration Guide

Configuring ARP

Mode
Usage Guide

If hardware resources are sufficient, run the arp anti-ip-attack num command to set the number of IP
packets for triggering ARP drop to a small value. If hardware resources are insufficient, run the arp
anti-ip-attack num command to set the number of IP packets for triggering ARP drop to a large value,or disable this function.

Configuration
ExampleScenario
Figure 2-5

Configuration

Enable ARP-based IP guard on B.

Steps
Ruijie(config)#arp anti-ip-attack 10
Verification

Run the show running-config command to check whether the configuration takes effect.
Ruijie# show running-config

Building configuration...
Current configuration : 53 bytes
arp anti-ip-attack 10

2.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

Command2-11

Configuration Guide

Clears dynamic ARP entries. In

clear arp-cache [ ip [ mask ] ] | interface interface-type interface-number ]gateway authentication mode,
dynamic ARP entries inauthentication VLANs are notcleared.

Displaying
Description

Displays the ARP table in detail.

Commandshow arp [ detail ] [ interface-type interface-number | ip [ mask ] | mac-address |static | complete | incomplete ]Displays the ARP table.

show ip arp

Displays the ARP entry counter.

show arp counter

Displays the details of the Address
Resolution Protocol (ARP) cachetable.
Displays the statistics of ARP
packets.
Displays the timeout of dynamic ARP
entries.

show arp detail [ interface-type interface-number | ip [ mask ] | mac-address | static |complete | incomplete ]show arp packet statistics [ interface-type interface-number ]show arp timeout

Debugging
System resources are occupied when debugging information is output. Therefore, disable the debugging switch
immediately after use.
Description

CommandDebugs ARP packet sending anddebug arp

receiving.
Debugs the creation and deletion of

debug arp event

ARP entries.

2-12

Configuration Guide

Configuring IPv6

3 Configuring IPv6
3.1 Overview
As the Internet develops rapidly and IPv4 address space is becoming exhausted, IPv4 limitations become more and more
obvious. At present, many researches and practices on Internet Protocol Next Generation (IPng) have been conducted.
The IPng working group of the Internet Engineering Task Force (IETF) has formulated an IPng protocol named IP Version
6 (IPv6), which is described in RFC 2460.

Main Features

Larger Address Space

Compared with 32 bits in an IPv4 address, the length of an IPv6 address is extended to 128 bits. Therefore, the address
space has approximately 2128 addresses. IPv6 adopts a hierarchical address allocation mode to support address
allocation of multiple subnets from the Internet core network to intranet subnet.



Simpler Packet Header Format

Since the design principle of the IPv6 packet header is to minimize the overhead of the packet header, some non-key
fields and optional fields are removed from the packet header to the extended packet header. Therefore, although thelength of an IPv6 address is four times of that of an IPv4 address, the IPv6 packet header is only two times of the IPv4
packet header. The IPv6 packet header makes device forwarding more efficient. For example, with no checksum in the
IPv6 packet header, the IPv6 device does not need to process fragments (fragmentation is completed by the initiator).

Efficient Hierarchical Addressing and Routing Structure

IPv6 uses a convergence mechanism and defines a flexible hierarchical addressing and routing structure. Multiple
networks at the same layer are represented as a uniform network prefix on the upstream device, greatly reducing routing
entries maintained by the device and routing and storage overheads of the device.

Easy Management: Plug and Play (PnP)

IPv6 provides automatic discovery and auto-configuration functions to simplify management and maintenance of network
nodes. For example, Neighbor Discovery (ND), MTU Discovery, Router Advertisement (RA), Router Solicitation (RS), andauto-configuration technologies provide related services for PnP. Particularly, IPv6 offers two types of auto-configuration:stateful auto-configuration and stateless auto-configuration. In IPv4, Dynamic Host Configuration Protocol (DHCP)
realizes auto-configuration of the host IP address and related parameters. IPv6 inherits this auto-configuration service
from IPv4 and called it stateful auto-configuration (see DHCPv6). Besides, IPv6 also offers the statelessauto-configuration service.During stateless auto-configuration, a host automatically obtains the local address of the link,address prefix of the local device, and other related configurations.



Security

As an optional extension protocol of IPv4, Internet Protocol Security (IPSec) is a part of IPv6 to provide security for IPv6
packets. At present, IPv6 provides two mechanisms: Authentication Header (AH) and Encapsulated Security Payload(ESP). AH provides data integrity and authenticates IP packet sources to ensure that the packets originate from the nodes
identified by the source addresses. ESP provides data encryption to realize end-to-end encryption.

3-1

Configuration GuideConfiguring IPv6

Better QoS Support

A new field in the IPv6 packet header defines how to identify and process data streams. The Flow Label field in the IPv6
packet header is used to authenticate a data flow. Using this field, IPv6 allows users to propose requirements on thecommunication quality. , A device can identify all packets belonging to a specific data stream based on this field andprocess these packets according to user requirements.



New Protocol for Neighboring Node Interaction

IPv6 Neighbor Discovery Protocol (NDP) uses a series of Internet Control Message Protocol Version 6 (ICMPv6) packets
to implement interactive management of neighboring nodes (nodes on the same link). IPv6 uses NDP packets andefficient multicast/unicast ND packets instead of broadcast-based Address Resolution Protocol (ARP) and Control
Message Protocol Version 4 (ICMPv4) router discovery packets.

Extensibility

With strong extensibility, IPv6 features can be added to the extended packet header following the IPv6 packet header.
Unlike IPv4, the IPv6 packet header can support at most 40 bytes of options. For an IPv6 packet, the length of theextended packet header is restricted only by the maximum number of bytes in the packet.

Protocols andStandards


RFC 4291

IP Version 6 Addressing Architecture

RFC 2460Internet Protocol, Version 6 (IPv6) Specification



RFC 4443

Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification



RFC 4861

Neighbor Discovery for IP version 6 (IPv6)



RFC 4862

IPv6 Stateless Address Auto-configuration



RFC 5059

Deprecation of Type 0 Routing Headers in IPv6

3.2 Applications
Application

Description

Communication Based on IPv6

Two PCs communicate with each other using IPv6 addresses.

Addresses

3.2.1 Communication Based on IPv6 Addresses
Scenario
As shown in Figure 3-1, Host 1 and Host 2 communicate with each other using IPv6 addresses.
Figure 3-1

3-2

Configuration Guide

Configuring IPv6

Deployment
Hosts can use the stateless address auto-configuration or DHCPv6 address assignment mode. After addresses are
configured, hosts can communicate with each other using IPv6 addresses.

3.3 Features
Overview
FeatureDescription

IPv6 Address

The IPv6 address format makes IPv6 have a larger address space and flexible representation

Formatapproach.

IPv6 Address TypeIPv6 identifies network applications based on addresses.

IPv6 Packet Header

IPv6 simplifies the fixed and extended packet headers to improve the data packet processing andFormatforwarding efficiency of the device.

IPv6 Neighbor

ND functions include router discovery, prefix discovery, parameter discovery, address

Discovery

auto-configuration, address resolution (like ARP), next-hop determination, Neighbor
Unreachability Detection (NUD), Duplicate Address Detection (DAD), and redirection.

IPv6 Source RoutingThis feature is used to specify the intermediate nodes that a packet passes through along the pathto the destination address. It is similar to the IPv4 loose source routing option and loose record
routing option.

Restricting theThis feature prevents DoS attacks.

Sending Rate of
ICMPv6 Error
Messages
IPv6 HOP-LIMITThis feature prevents useless unicast packets from being unlimitedly transmitted on the network
and wasting network bandwidth.

3.3.1 IPv6 Address Format
An IPv6 address is represented in the X:X:X:X:X:X:X:X format, where X is a 4-digit hexadecimal integer (16 bits). Each
address consists of 8 integers, with a total of 128 bits (each integer contains 4 hexadecimal digits and each digit contains
four bits). The following are three valid IPv6 addresses:

3-3Configuration Guide

Configuring IPv6

2001:ABCD:1234:5678:AAAA:BBBB:1200:2100
800:0:0:0:0:0:0:1
1080:0:0:0:8:800:200C:417A
These integers are hexadecimal, where A to F represent 10 to 15. Each integer in the address must be represented,
except the leading zeros in each integer. If an IPv6 address contains a string of zeros (as shown in the second and third
examples above), a double colon (::) can be used to represent these zeros. That is, 800:0:0:0:0:0:0:1 can be represented
as 800::1.
A double colon indicates that this address can be extended to a complete 128-bit address. In this approach, only when the
16-bit integers are all 0s, can they can be replaced with a double colon. A double colon can exist once in an IPv6 address.
In IPv4/IPv6 mixed environment, an address has a mixed representation. In an IPv6 address, the least significant 32 bits
can be used to represent an IPv4 address. This IPv6 address can be represented in a mixed manner, that is,
X:X:X:X:X:X:d.d.d.d, where X is a hexadecimal integer and d is a 8-bit decimal integer. For example,
0:0:0:0:0:0:192.168.20.1 is a valid IPv6 address. It can be abbreviated to :::192.168.20.1. Typical applications are
IPv4-compatible IPv6 addresses and IPv4-mapped IPv6 addresses. If the first 96 bits are 0 in an IPv4-compatible IPv6
address, this address can be represented as ::A.B.C.D, e.g., ::1.1.1.1. IPv4-compatible addresses have been abolished atpresent. IPv4-mapped IPv6 addresses are represented as ::FFFF:A.B.C.D to represent IPv4 addresses as IPv6
addresses. For example, IPv4 address 1.1.1.1 mapped to an IPv6 address is represented as ::FFFF:1.1.1.1.
Since an IPv6 address is divided into two parts: subnet prefix and interface ID, it can be represented as an address withan additional value according to an address allocation method like Classless Inter-Domain Routing (CIDR). The additional
value indicates how many bits (subnet prefix) in the address represent the network part. That is, the IPv6 node addresscontains the prefix length. The prefix length is separated from the IPv6 address by a slash. For example, in
12AB::CD30:0:0:0:0/60, the prefix length used for routing is 60 bits.

Related Configuration

Configuring an IPv6 AddressNo IPv6 address is configured on interfaces by default.



Run the ipv6 address command to configure an IPv6 address on an interface.

After configuration, a host can communicate with others using the configured IPv6 address based on DAD.

3.3.2 IPv6 Address TypeRFC 4291 defines three types of IPv6 addresses:

Unicast address: ID of a single interface. Packets destined to a unicast address are sent to the interface identified bythis address.

Multicast address: ID of an interface group (the interfaces generally belong to different nodes). Packets destined to a
multicast address are sent to all interfaces included in this address.



Anycast address: ID of an interface group. Packets destined to an anycast address are sent to one interface includedin this address (the nearest interface according to the routing protocol).
IPv6 does not define broadcast addresses.

These three types of addresses are described as follows:

3-4Configuration GuideConfiguring IPv6

Unicast Addresses

Unicast addresses fall into five types: unspecified address, loopback address, link-local address, site-local address, andglobal unicast address. At present, site-local addresses have been abolished. Except unspecified, loopback, and link-local
addresses, all other addresses are global unicast addresses.



Unspecified address

The unspecified address is 0:0:0:0:0:0:0:0, which is usually abbreviated to ::. It has two general purposes:
1.

If a host has no unicast address when started, it uses the unspecified address as the source address to send an RS
packet to obtain prefix information from the gateway and thereby generate a unicast address.

2.

When an IPv6 address is configured for a host, the device detects whether the address conflicts with addresses ofother hosts in the same network segment and uses the unspecified address as the source address to send a
Neighbor Solicitation (NS) packet (similar to a free ARP packet).



Loopback address

The loopback address is 0:0:0:0:0:0:0:1, which is usually abbreviated to ::1. Similar to IPv4 address 127.0.0.1, theloopback address is generally used by a node to send itself packets.

Link-local address

The format of a link-local address is as follows:
Figure 3-2

The link-local address is used on a single network link to assign IDs to hosts. The address identified by the first 10 bits inthe prefix is the link-local address. A device never forwards packets in which the source or destination address contains
the link-local address. The intermediate 54 bits in the address are all 0s. The last 64 bits represent the interface ID, whichallows a single network to connect 264-1 hosts.



Site-local address

The format of a site-local address is as follows:
Figure 3-3

A site-local address is used to transmit data within a site. A device never forwards packets in which the source ordestination address contains the site-local address to the Internet. That is, these packets can be forwarded only within thesite. A site can be assumed as an enterprise's local area network (LAN). Such addresses are similar to IPv4 private
addresses such as 192.168.0.0/16. RFC 3879 has abolished site-local addresses. New addresses do not support the first
10 bits as the prefix and are all regarded as global unicast addresses. Existing addresses can continue to use this prefix.

Global unicast address

The format of a global unicast address is as follows:

3-5Configuration Guide

Configuring IPv6

Figure 3-4

Among global unicast addresses, there is a type of IPv4-embedded IPv6 addresses, including IPv4-compatible IPv6
addresses and IPv4-mapped IPv6 addresses. They are used for interconnection between IPv4 nodes and IPv6 nodes.
The format of an IPv4-compatible IPv6 address is as follows:
Figure 3-5

The format of an IPv4-mapped IPv6 address is as follows:
Figure 3-6

IPv4-compatible IPv6 addresses are mainly used on automatic tunnels. Nodes on automatic tunnels support both IPv4
and IPv6. Using these addresses, IPv4 devices transmit IPv6 packets over tunnels. At present, IPv4-compatible IPv6
addresses have been abolished. IPv4-mapped IPv6 addresses are used by IPv6 nodes to access IPv4-only nodes. For
example, if the IPv6 application on an IPv4/IPv6 host requests to resolve the name of an IPv4-only host, the name server
dynamically generates an IPv4-mapped IPv6 address and returns it to the IPv6 application.

Multicast Addresses

The format of an IPv6 multicast address is as follows:
|

8

|

4|

4|

112 bits|+--------+----+----+---------------------------------------------+|11111111|flgs|scop|group ID|+--------+----+----+---------------------------------------------+
The first byte in the address is all 1s, representing a multicast address.



Flag field

The flag field consists of four bits. Currently only the fourth bit is specified to indicate whether this address is a known
multicast address assigned by the Internet Assigned Numbers Authority (IANA) or a temporary multicast address in acertain scenario. If the flag bit is 0, this address is a known multicast address. If the flag bit is 1, this address is atemporary multicast address. The remaining three flag bits are reserved for future use.



Scope field

3-6

Configuration Guide

Configuring IPv6

The scope field consists of four bits to indicate the multicast range. That is, a multicast group includes the local node, local
link, local site, and any node in the IPv6 global address space.

Group ID field

The group ID consists of 112 bits to identify a multicast group. A multicast ID can represent different groups based on theflag and scope fields.
IPv6 multicast addresses are prefixed with FF00::/8. One IPv6 multicast address usually identifies interfaces on a seriesof different nodes. After a packet is sent to a multicast address, the packet is then forwarded to the interfaces on eachnode identified by this multicast address. For a node (host or device), you must add the following multicast addresses:
3.

Multicast address for all nodes on the local link, that is, FF02::1

4.

Solicited-node multicast address, prefixed with FF02:0:0:0:0:1:FF00:0000/104

If the node is a device, it also has to be added to the multicast address of all devices on the local link, that is, FF02::2.
The solicited-node multicast address corresponds to the IPv6 unicast and anycast address. You must add acorresponding solicited-node multicast address for each configured unicast and anycast address of an IPv6 node. The
solicited-node multicast address is prefixed with FF02:0:0:0:0:1:FF00:0000/104. The remaining 24 bits are composed ofthe least significant 24 bits of the unicast or anycast address. For example, if the unicast address is
FE80::2AA:FF:FE21:1234, the solicited-node multicast address is FF02::1:FF21:1234.
The solicited-node multicast address is usually used in NS packets. Its address format is as follows:
Figure 3-7Anycast Addresses

Similar to a multicast address, an anycast address can also be shared by multiple nodes. The difference is that only one
node in the anycast address receives data packets while all nodes included in the multicast address receive data packets.
Since anycast addresses are allocated to the normal IPv6 unicast address space, they have the same formats withunicast addresses. Every member in an anycast address must be configured explicitly for easier recognition.
Anycast addresses can be allocated only to devices and cannot be used as source addresses of packets.
RFC 2373 redefines an anycast address called subnet-router anycast address. Figure 3-8 shows the format of asubnet-router anycast address. Such an address consists of the subnet prefix and a series of 0s (interface ID).
The subnet prefix identifies a specified link (subnet). Packets destined to the subnet-router anycast address will be
forwarded to a device on this subnet. A subnet-router anycast address is usually used by the application on a node tocommunicate with a device on a remote subnet.
Figure 3-8

3-7

Configuration Guide

Configuring IPv6

Related Configuration

Configuring an IPv6 AddressNo IPv6 address is configured on interfaces by default.



Run the ipv6 address command to configure the IPv6 unicast address and anycast address of an interface.

After an interface goes up, it will automatically join the corresponding multicast group.

3.3.3 IPv6 Packet Header Format
Figure 3-9 shows the format of the IPv6 packet header.
Figure 3-9

The IPv4 packet header is in unit of four bytes. The IPv6 packet header consists of 40 bytes, in unit of eight bytes. The
IPv6 packet header has the following fields:VersionThis field consists of 4 bits. In an IPv6 address, this field must be 6.



Traffic ClassThis field consists of 8 bits. This field indicates the service provided by this packet, similar to the TOS field in an IPv4
address.



Flow LabelThis field consists of 20 bits to identify packets belonging to the same service flow. One node can act as the Tx source ofmultiple service flows. The flow label and source address uniquely identify one service flow.

3-8Configuration GuideConfiguring IPv6

Payload Length

This field consists of 16 bits, including the packet payload length and the length of IPv6 extended options (if available).
That is, it includes the IPv6 packet length except the IPv6 packet header.



Next Header

This field indicates the protocol type in the header field following the IPv6 packet header. Similar to the Protocol field in the
IPv4 address header, the Next Header field is used to indicate whether the upper layer uses TCP or UDP. It can also be
used to indicate existence of the IPv6 extension header.



Hop Limit

This field consists of 8 bits. Every time a device forwards a packet, the field value reduced by 1. If the field value reaches 0,
this packet will be discarded. It is similar to the Lifetime field in the IPv4 packet header.

Source AddressThis field consists of 128 bits and indicates the sender address in an IPv6 packet.

Destination AddressThis field consists of 128 bits and indicates the receiver address in an IPv6 packet.
At present, IPv6 defines the following extension headers:

Hop-By-Hop Options

This extension header must follow the IPv6 packet header. It consists of option data to be checked on each node along
the path.

Routing Options (Type 0 routing header)This extension header indicates the nodes that a packet passes through from the source address to the destination
address. It consists of the address list of the passerby nodes. The initial destination address in the IPv6 packet header isthe first address among the addresses in the routing header, but not the final destination address of the packet. After thenode corresponding to the destination address in the IPv6 packet header receives a packet, it processes the IPv6 packet
header and routing header, and sends the packet to the second address, the third address, and so on in the routing
header list till the packet reaches the final destination address.

Fragment

The source node uses this extension header to fragment the packets of which the length exceeds the path MTU (PMTU).



Destination Options

This extension header replaces the option fields of IPv4. At present, the Destination Options field can only be filled withintegral multiples of 64 bits (eight bytes) if required. This extension header can be used to carry information to be checkedby the destination node.

Upper-layer header

This extension header indicates the protocol used at the upper layer, such as TCP (6) and UDP (17).
Another two extension headers AH and ESP will be described in the Configuring IPSec.

3-9

Configuration Guide

Configuring IPv6

3.3.4 IPv6 Neighbor Discovery
NDP is a basic part of IPv6. Its main functions include router discovery, prefix discovery, parameter discovery, address
auto-configuration, address resolution (like ARP), next-hop determination, NUD, DAD, and redirection. NDP defines five
ICMP packets: RS (ICMP type: 133), RA (ICMP type: 134), NS (similar to ARP request, ICMP type: 135), NA (similar to
ARP reply, ICMP type: 136), ICMP Redirect (ICMP type: 137).
All the above ICMP packets carry one or multiple options. These options are optional in some cases but are significant inother cases. NDP mainly defines five options: Source Link-Layer Address Option, Type=1; Target Link-Layer Address
Option, Type=2; Prefix Information Option, Type=3; Redirection Header Option, Type=4; MTU Option, Type=5.

Address Resolution

When a node attempts to communicate with another, the node has to obtain the link-layer address of the peer end bysending it an NS packet. In this packet, the destination address is the solicited-node multicast address corresponding to
the IPv6 address of the destination node. This packet also contains the link-layer address of the source node. After
receiving this NS packet, the peer end replies with an NA packet in which the destination address is the source address of
the NS packet, that is, the link-layer address of the solicited node. After receiving this NA packet, the source node cancommunicate with the destination node.
Figure 3-10 shows the address resolution process.
Figure 3-10

NUD

If the reachable time of a neighbor has elapsed but an IPv6 unicast packet needs to be sent to it, the device performs
NUD.
While performing NUD, the device can continue to forward IPv6 packets to the neighbor.

DAD

To know whether the IPv6 address configured for a host is unique, the device needs to perform DAD by sending an NS
packet in which the source IPv6 address is the unspecified address.
If a device detects an address conflict, this address is set to the duplicate status so that the device cannot receive IPv6
packets with this address being the destination address. Meanwhile, the device also starts a timer for this duplicate
address to periodically perform DAD. If no address conflict is detected in re-detection, this address can be properly used.

Router, Prefix, and Parameter Discovery

3-10Configuration Guide

Configuring IPv6

A device periodically sends RA packets to all local nodes on the link.
Figure 3-11 shows the RA packet sending process.
Figure 3-11

An RA packet usually contains the following content:

One or multiple IPv6 address prefixes (used for on-link determination or stateless address auto-configuration)

Validity of the IPv6 address prefixHost auto-configuration method (stateful or stateless)

Default device information (whether the device acts as the default device; if yes, the interval for acting as the default
device is also included.)

Other information provided for host configuration, such as hop limit, MTU, and NS retransmission interval

RA packets can also be used as replies to the RS packets sent by a host. Using RS packets, a host can obtain theauto-configured information immediately after started rather than wait for the RA packets sent by the device. If no unicast
address is configured for a newly started host, the host includes the unspecified address (0:0:0:0:0:0:0:0) as the source
address in the RS packet. Otherwise, the host uses the configured unicast address as the source address and themulticast address of all local routing devices (FF02::2) as the destination address in the RS packet. As a reply to the RS
packet, the RA packet uses the source address of the RS packet as the destination address (if the source address is theunspecified address, it uses the multicast address of all local nodes (FF02::1).
In an RA packet, the following parameters can be configured:Ra-interval: Interval for sending the RA packet.

Ra-lifetime: Lifetime of a router, that is, whether the device acts as the default router on the local link and the interval
for acting as the default router.

Prefix: Prefix of an IPv6 address on the local link. It is used for on-link determination or stateless address
auto-configuration, including other parameter configurations related to the prefix.

Ns-interval: NS packet retransmission interval.

Reachabletime: Period when the device regards a neighbor reachable after detecting a Confirm Neighbor
Reachability event.

Ra-hoplimit: Hops of the RA packet, used to set the hop limit for a host to send a unicast packet.

Ra-mtu: MTU of the RA packet.

Managed-config-flag: Whether a host receiving this RA packet obtains the address through statefulauto-configuration.

3-11

Configuration GuideConfiguring IPv6

Other-config-flag: Whether a host receiving this RA packet uses DHCPv6 to obtain other information except the IPv6
address for auto-configuration.

Configure the above parameters when configuring IPv6 interface attributes.

Redirection

If a router receiving an IPv6 packet finds a better next hop, it sends the ICMP Redirect packet to inform the host of thebetter next hop. The host will directly send the IPv6 packet to the better next hop next time.

Maximum Number of Unresolved ND EntriesYou can configure the maximum number of unresolved ND entries to prevent malicious scanning network segmentsfrom generating a large number of unresolved ND entries and occupying excessive memory space.

Maximum Number of Neighbor Learning Entries on an InterfaceYou can configure the maximum number of neighbor learning entries on an interface to prevent neighbor learning
attacks from occupying ND entries and memory space of the device and affecting forwarding efficiency of the device.

Related Configuration

Enabling IPv6 Redirection



By default, ICMPv6 Redirect packets can be sent on IPv6 interfaces.

Run the no ipv6 redirects command in interface configuration mode to prohibit an interface from sending Redirect
packets.

Configuring IPv6 DAD

By default, an interface sends one NS packet to perform IPv6 DAD.

Run the ipv6 nd dad attempts value command in interface configuration mode to configure the number of NS
packets consecutively sent by DAD. Value 0 indicates disabling DAD for IPv6 addresses on this interface.

Run the no ipv6 nd dad attempts command to restore the default configuration.



By default, the device performs DAD on duplicate IPv6 addresses every 60 seconds.

Run the ipv6 nd dad retry value command in global configuration mode to configure the DAD interval. Value 0
indicates disabling DAD for the device.



Run the no ipv6 nd dad retry command to restore the default configuration.

Configuring the Reachable Time of a NeighborThe default reachable time of an IPv6 neighbor is 30s.

Run the ipv6 nd reachable-time milliseconds command in interface configuration mode to modify the reachable
time of a neighbor.

Configuring the Stale Time of a NeighborThe default stale time of an IPv6 neighbor is 1 hour. After the time elapses, the device performs NUD.



Run the ipv6 nd stale-time seconds command in interface configuration mode to modify the stale time of aneighbor.

3-12

Configuration Guide

Configuring IPv6



Configuring Prefix Information



By default, the prefix in an RA packet on an interface is the prefix configured in the ipv6 address command on theinterface.

Run the ipv6 nd prefix command in interface configuration mode to add or delete prefixes and prefix parametersthat can be advertised.

Enabling/disabling RA Suppression



By default, an IPv6 interface does not send RA packets.

Run the no ipv6 nd suppress-ra command in interface configuration mode to disable RA suppression.

Configuring the Maximum Number of Unresolved ND EntriesThe default value is 0, indicating no restriction. It is only restricted to the ND entry capacity supported by the device.



Run the ipv6 nd unresolved number command in global configuration mode to restrict the number of unresolved
neighbors. After the entries exceed this restriction, the device does not actively resolve subsequent packets.

Configuring the Maximum Number of ND Entries Learned on an Interface



Run the ipv6 nd cache interface-limit value command in interface configuration mode to restrict the number ofneighbors learned on an interface. The default value is 0, indicating no restriction.

3.3.5 IPv6 Source Routing
Working Principle
Similar to the IPv4 loose source routing and loose record routing options, the IPv6 routing header is used to specify theintermediate nodes that the packet passes through along the path to the destination address. It uses the following format:
Figure 3-12

The Segments Left field is used to indicate how many intermediate nodes are specified in the routing header for the
packet to pass through from the current node to the final destination address.
Currently, two routing types are defined: 0 and 2. The Type 2 routing header is used for mobile communication. RFC 2460
defines the Type 0 routing header (similar to the loose source routing option of IPv4). The format of the Type 0 routing
header is as follows:
Figure 3-13

3-13

Configuration Guide

Configuring IPv6

The following example describes the application of the Type 0 routing header, as shown in Figure 3-14.
Figure 3-14

Host 1 sends Host 2 a packet specifying the intermediate nodes Router 2 and Router 3. The following table lists thechanges of fields related to the IPv6 header and routing header during the forwarding process.
Transmission

Fields in the IPv6 Header

Fields Related to the Type 0 Routing Header

Source address=1000::2

Segments Left=2

Destination address=1001::1 (Address of Router

Address 1=1002::1 (Address of Router 3)

NodeHost 1

2)

Address 2=1003::2 (Address of Host 2)

Router 1

No change

Router 2

Source address=1000::2

Segments Left=1

Destination address=1002::1 (Address of Router

Address 1=1001::1 (Address of Router 2)

3-14

Configuration Guide

Router 3

Configuring IPv6

3)

Address 2=1003::2 (Address of Host 2)

Source address=1000::2

Segments Left=0

Destination address=1003::2 (Address of Host 2)

Address 1=1001::1 (Address of Router 2)
Address 1=1002::2 (Address of Router 3)

Host 2

No change

The forwarding process is as follows:1.

Host 1 sends a packet in which the destination address is Router 2's address 1001::1, the Type 0 routing header isfilled with Router 3's address 1002::1 and Host 2's address 1003::2, and the value of the Segments Left field is 2.

2.

Router 1 forwards this packet to Router 2.

3.

Router 2 changes the destination address in the IPv6 header to Address 1 in the routing header. That is, thedestination address becomes Router 3's address 1002::1, Address 1 in the routing header becomes Router 2's
address 1001::1, and the value of the Segments Left field becomes 1. After modification, Router 2 forwards thepacket to Router 3.

4.

Router 3 changes the destination address in the IPv6 header to Address 2 in the routing header. That is, thedestination address becomes Host 2's address 1003::2, Address 2 in the routing header becomes Router 3's
address 1002::1, and the value of the Segments Left field becomes 0. After modification, Router 3 forwards thepacket to Host 2.

The Type 0 routing header may be used to initiate DoS attacks. As shown in Figure 3-15, Host 1 sends packets to Host 2
at 1 Mbps and forges a routing header to cause multiple round-trips between Router 2 and Router 3 (50 times from Router
2 to Router 3 and 49 times from Router 3 to Router 2). At the time, the routing header generates the traffic amplification
effect:" 50 Mbps from Router 2 to Router 3 and 49 Mbps from Router 3 to Router 2." Due to this security problem, RFC
5095 abolished the Type 0 routing header.
Figure 3-15

3-15

Configuration Guide

Configuring IPv6

Related Configuration

Enabling IPv6 Source Routing

The Type 0 routing header is not supported by default.



Run the ipv6 source-route command in global configuration mode to enable IPv6 source routing.

3.3.6 Restricting the Sending Rate of ICMPv6 Error Messages
Working Principle
The destination node or intermediate router sends ICMPv6 error messages to report the errors incurred during IPv6 data
packet forwarding and transmission. There are mainly four types of error messages: Destination Unreachable, Packet Too
Big, Time Exceeded, and Parameter Problem.
When receiving an invalid IPv6 packet, a device discards the packet and sends back an ICMPv6 error message to thesource IPv6 address. In the case of invalid IPv6 packet attacks, the device may continuously reply to ICMPv6 error
messages till device resources are exhausted and thereby fail to properly provide services. To solve this problem, you can
restrict the sending rate of ICMPv6 error messages.
If the length of an IPv6 packet to be forwarded exceeds the IPv6 MTU of the outbound interface, the router discards thisIPv6 packet and sends back an ICMPv6 Packet Too Big message to the source IPv6 address. This error message ismainly used as part of the IPv6 PMTUD process. If the sending rate of ICMPv6 error messages is restricted due toexcessive other ICMPv6 error messages, ICMPv6 Packet Too Big messages may be filtered, causing failure of IPv6PMTUD. Therefore, it is recommended to restrict the sending rate of ICMPv6 Packet Too Big messages independently ofother ICMPv6 error messages.
Although ICMPv6 Redirect packets are not ICMPv6 error messages, Ruijie recommends restricting their rates together
with ICMPv6 error messages except Packet Too Big messages.

Related Configuration

Configuring the Sending Rate of ICMPv6 Packet Too Big MessagesThe default rate is 10 per 100 ms.



Run the ipv6 icmp error-interval too-big command to configure the sending rate of ICMPv6 Packet Too Big
messages.

Configuring the Sending Rate of Other ICMPv6 Error MessagesThe default rate is 10 per 100 ms.



Run the ipv6 icmp error-interval command to configure the sending rate of other ICMPv6 error messages.

3.3.7 IPv6 Hop Limit
Working Principle
An IPv6 data packet passes through routers from the source address and destination address. If a hop limit is configured,
it decreases by one every time the packet passes through a router. When the hop limit decreases to 0, the router discards
the packet to prevent this useless packet from being unlimitedly transmitted on the network and wasting network
bandwidth. The hop limit is similar to the TTL of IPv4.

3-16

Configuration Guide

Configuring IPv6

Related Configuration

Configuring the IPv6 Hop LimitThe default IPv6 hop limit of a device is 64.

Run the ipv6 hop-limit command to configure the IPv6 hop limit of a device.

3.4 Configuration
Configuration

Description and Command(Mandatory) It is used to configure IPv6 addresses and enable IPv6.

Configuring an IPv6

ipv6 enable

Enables IPv6 on an interface.

ipv6 address

Configures the IPv6 unicast address of an interface.

ipv6 general-prefix

Configures the IPv6 general prefix

Address

Automatically configures an IPv6 stateless address for a

ipv6 address autoconfig

network interface(Optional) It is used to enable IPv6 redirection on an interface.
Enables IPv6 redirection on an interface.

ipv6 redirects(Optional) It is used to enable DAD.
Configures the number of consecutive NS packets sent

ipv6 nd dad attempts

during DAD.

(Optional) It is used to configure ND parameters.
Configures the reachable time of a neighbor.

ipv6 nd reachable-time
Configuring IPv6 NDP

Configures the address prefix to be advertised in an RA

ipv6 nd prefix

packet.
Enables RA suppression on an interface.

ipv6 nd suppress-ra(Optional) It is used to configure the maximum number of unresolved ND entries.
Configures the maximum number of unresolved ND

ipv6 nd unresolved

entries.

(Optional) It is used to configure the maximum number of neighbors learned on aninterface.

3-17

Configuration Guide

Configuration

Configuring IPv6

Description and Command
ipv6 nd cache

Configures the maximum number of neighbors learned oninterface-limit

an interface.

(Optional) It is used to restrict the MTU of IPv6 packets sent on an interface.
Enabling PMTUD
Configures the IPv6 MTU.

ipv6 mtu(Optional) It is used to enable IPv6 source routing.
Enabling IPv6 Source
Routing

Configures the device to forward IPv6 packets carrying

ipv6 source-routethe routing header.

Optional.
Configuring the Sending

ipv6 icmp error-interval

Configures the sending rate of ICMPv6 Packet Too Big

Rate of ICMPv6 Error

too-big

messages.

Messages
Configures the sending rates of other ICMPv6 error

ipv6 icmp error-interval

messages and ICMPv6 Redirect packets.

(Optional) It is used to restrict the hop limit of IPv6 unicast packets sent on an
Configuring the IPv6 Hopinterface.

Limit
Configures the IPv6 hop limit.

ipv6 hop-limit

3.4.1 Configuring an IPv6 Address
Configuration EffectConfigure the IPv6 address of an interface to implement IPv6 network communication.

Configuration Steps

Enabling IPv6 on an Interface

(Optional) If you do not want to enable IPv6 by configuring an IPv6 address, run the ipv6 enable command.

Configuring the IPv6 Unicast Address of an Interface



Mandatory.

Verification
Run the show ipv6 interface command to check whether the configured address takes effect.

Related Commands

Enabling IPv6 on an Interface

Commandipv6 enable

3-18Configuration Guide

Parameter

Configuring IPv6

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

IPv6 can be enabled on an interface by two methods: (1) running the ipv6 enable command in interface
configuration mode; (2) configuring an IPv6 address on the interface.
If an IPv6 address is configured on an interface, IPv6 is automatically enabled on this interface. In thiscase, IPv6 cannot be disabled even when you run the no ipv6 enable command.

Configuring the IPv6 Unicast Address of an Interface

Commandipv6 address ipv6-address / prefix-length
ipv6 address ipv6-prefix / prefix-length eui-64
ipv6 address prefix-name sub-bits / prefix-length [ eui-64 ]Parameteripv6-address: Indicates the IPv6 address, which must comply with the address format defined in RFC

Description

4291. Separated by a colon (:), each address field consists of 16 bits and is represented by hexadecimal
digits.
ipv6-prefix: Indicates the IPv6 address prefix, which must comply with the address format defined in RFC
4291.
prefix-length: Indicates the length of the IPv6 address prefix, that is, the part representing the network in
the IPv6 address.
prefix-name: Indicates the name of the universal prefix. This specified universal prefix is used to create
the interface address.
sub-bits: Indicates the subprefix bits and host bits of the address to be concatenated with the prefixes
provided by the general prefix specified with the prefix-name parameter. This value is combined with theuniversal prefix to create the interface address. This value must be in the form documented in RFC
4291.
eui-64: Indicates the created IPv6 address, consisting of the configured address prefix and 64-bit
interface ID.

Command

Interface configuration mode

Mode
Usage Guide

If an IPv6 interface is created and is Up state, the system automatically generates a link-local address
for this interface.
The IPv6 address of an interface can also be created by the universal prefix mechanism. That is, IPv6
address = Universal prefix + Sub prefix + Host bits. The universal prefix can be configured by running theipv6 general-prefix command or learned by the prefix discovery function of the DHCPv6 client (see theConfiguring DHCPv6). Sub prefix + Host bits are specified by the sub-bits and prefix-length parametersin the ipv6 address command.

3-19

Configuration Guide

Configuring IPv6

If you run the no ipv6 address command without specifying an address, all manually configured
addresses will be deleted.
Run the no ipv6 address ipv6-prefix/prefix-length eui-64 command to delete the configured address.

Configuring the IPv6 General Prefix

Commandipv6 general-prefix prefix-name ipv6-prefix/prefix-length

Parameter

prefix-name: Indicates the general prefix name.

Description

ipv6-prefix: Indicates the network prefix value of the general prefix following the format defined in RFC
4291.
prefix-length: Indicates the length of the general prefix.

Command

Interface configuration mode

Mode
Usage Guide

It is convenient to number the network by using the general prefix, which defines a prefix so that many
longer specified prefixes could refer to it. These specified prefixes are updated whenever the generalprefix changes. If the network number changes, modify the general prefix.
A general prefix could contain multiple prefixes.
These longer specified prefixes are usually used for the IPv6 address configuration on the interface.



Automatically Configuring an IPv6 Stateless Address for a Network Interface

Commandipv6 address autoconfig [ default ]Parameter

default: If this keyword is configured, a default routing is generated. Note that only one Layer 3 interface

Description

on the entire device is allowed to use the default keyword.

Command

Interface configuration mode

Mode
Usage Guide

The stateless automatic address configuration is that when receiving the Route Advertisement (RA)message, the device could use the prefix information of the RA message to automatically generate the
EUI-64 interface address.
If the RA message contains the flag of the “other configurations”, the interface will obtain these “otherconfigurations” through the DHCPv6. The “other configurations” usually means the IPv6 address of the
DNS server, the IPv6 address of the NTP server, etc.

Configuration
Example

Configuring an IPv6 Address on an Interface

Configuratio

Enable IPv6 on the vlan 1 interface and add IPv6 address 2000::1 to the interface.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ipv6 enable
Ruijie(config-if-VLAN 1)# ipv6 address 2000::1/64

3-20

Configuration Guide

Verification

Configuring IPv6

Run the show ipv6 interface command to verify that an address is successfully added to the
GigabitEthernet 0/1 interface.
Ruijie# show ipv6 interface VLAN 1
interface VLAN 1 is Up, ifindex: 4097, vrf_id 0
address(es):
Mac Address: 00:20:30:40:50:8d
INET6: 2000::1 , subnet is 2000::/64
INET6: FE80::220:30FF:FE40:508D , subnet is FE80::/64
Joined group address(es):FF01::1
FF02::1
FF02::2
FF02::1:FF00:0
FF02::1:FF00:1
FF02::1:FF40:508D
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND router advertisements are sent every 200 seconds<160--240>
ND router advertisements live for 1800 secondsinterface VLAN 1 is Down, ifindex: 1, vrf_id
0
address(es):
Mac Address: 00:00:00:00:00:00
INET6: FE80::200:FF:FE00:1 [ TENTATIVE ], subnet is FE80::/64
INET6: 2000::1 [ TENTATIVE ], subnet is 2000::/64
Joined group address(es):MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled

3-21

Configuration Guide

Configuring IPv6ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND router advertisements are sent every 200 seconds<160--240>
ND router advertisements live for 1800 seconds
RG-S29 series do not support the VRF parameter. The above example is for reference purpose.
Please take the actual device as standard.

3.4.2 Configuring IPv6 NDP
Configuration EffectConfigure NDP-related attributes, for example, enable IPv6 redirection and DAD.

Notes
RA suppression is enabled on interfaces by default. To configure a device to send RA packets, run the no ipv6 nd
suppress-ra command in interface configuration mode.

Configuration Steps

Enabling IPv6 Redirection on an Interface

(Optional) IPv6 redirection is enabled by default.



To disable IPv6 redirection on an interface, run the no ipv6 redirects command.

Configuring the Number of Consecutive NS Packets Sent During DAD

Optional.

To prevent enabling DAD for IPv6 addresses on an interface or modify the number of consecutive NS packets sent
during DAD, run the ipv6 nd dad attempts command.

Configuring the Reachable Time of a NeighborOptional.

To modify the reachable time of a neighbor, run the ipv6 nd reachable-time command.

Enabling/Disabling RA Suppression on an Interface

Optional.



If a device needs to send RA packets, run the no ipv6 nd suppress-ra command.

Configuring the Maximum Number of Unresolved ND Entries



Optional.

3-22

Configuration GuideConfiguring IPv6

If a large number of unresolved ND entries are generated due to scanning attacks, run the ipv6 nd unresolved
command to restrict the number of unresolved neighbors.

Configuring the Maximum Number of ND Entries Learned on an Interface

Optional.



If the number of IPv6 hosts is controllable, run the ipv6 nd cache interface-limit command to restrict the number ofneighbors learned on an interface. This prevents ND learning attacks from occupying the memory space andaffecting device performance.

Verification
Run the following commands to check whether the configuration is correct:

show ipv6 interface interface-type interface-num: Check whether the configurations such as the redirection function,
reachable time of a neighbor, and NS sending interval take effect.

show ipv6 interface interface-type interface-num ra-inifo: Check whether the prefix and other information
configured for RA packets are correct.

show run

Related Commands

Enabling IPv6 Redirection on an Interface

Commandipv6 redirects

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

All ICMPv6 error messages are transmitted at a limited transmission rate. By default, a maximum
number of 10 ICMPv6 error messages are transmitted per second (10 pps).

Configuring the Number of Consecutive NS Packets Sent During DAD

Commandipv6 nd dad attempts value

Parameter

value: Indicates the number of NS packets.

Description
Command

Interface configuration mode

Mode
Usage Guide

You need to enable DAD before configuring an IPv6 address on an interface. Then the address is intentative state. If no address conflict is detected by DAD, this address can be correctly used. If an
address conflict is detected and the interface ID of this address uses EUI-64, duplicate link-layer
addresses exist on this link. In this case, the system automatically disables this interface to prevent
IPv6-related operations on this interface). At the time, you must configure a new address and restart the

3-23Configuration Guide

Configuring IPv6

interface to re-enable DAD. When an interface changes from the down state to the up state, DAD isre-enabled for the addresses on this interface.

Configuring the Reachable Time of a Neighbor

Commandipv6 nd reachable-time milliseconds

Parameter

milliseconds: Indicates the reachable time of a neighbor, ranging from 0 to 3,600,000. The unit is

Description

millisecond. The default value is 30s.

Command

Interface configuration mode

Mode
Usage Guide

A device detects unreachable neighbors based on the configured reachable time. The shorter theconfigured reachable time, the faster the device detects unreachable neighbors but the more it
consumes network bandwidth and device resources. Therefore, it is not recommended to set this time
too small.
The configured value is advertised in an RA packet and is also used on the device. If the value is 0, thereachable time is not specified on the device and it is recommended to use the default value.

Configuring the Address Prefix to Be Advertised in an RA Packet

Commandipv6 nd prefix { ipv6-prefix/prefix-length | default } [ [ valid-lifetime { infinite | preferred-lifetime } ] | [ atvalid-date preferred-date ] | [ infinite { infinite | preferred-lifetime } ] ] [ no-advertise ] | [ [ off-link ][ no-autoconfig ] ]Parameteripv6-prefix: Indicates the network ID of IPv6, which must comply with the address representation format

Descriptionin RFC 4291.
prefix-length: Indicates the length of the IPv6 address prefix. A slash (/) must be added before the prefix.
valid-lifetime: Indicates the period when a host receiving the prefix of an RA packet regards the prefix
valid. The value ranges from 0 to 4,294,967,295. The default value is 30 days.
preferred-lifetime: Indicates the preferred period when a host receiving the prefix of an RA packet
regards the prefix valid. The value ranges from 0 to 4,294,967,295. The default value is 7 days.
at valid-date preferred-date: Indicates the valid date and preferred deadline configured for the RA prefix.
It uses the format of dd+mm+yyyy+hh+mm.
infinite: Indicates that the prefix is permanently valid.
default: Indicates that the default parameter configuration is used.
no-advertise: Indicates that the prefix is not advertised by a router.
off-link: If the prefix of the destination address in the IPv6 packet sent by a host matches the configured
prefix, the device regards the destination address on the same link and directly reachable. Thisparameter indicates that this prefix does not require on-link determination.
no-autoconfig: Indicates that the prefix in the RA packet received by a host cannot be used for address
auto-configuration.

3-24

Configuration Guide

Command

Configuring IPv6

Interface configuration mode

Mode
Usage Guide

This command can be used to configure parameters related to each prefix, including whether toadvertise this prefix. By default, an RA packet uses the prefix configured by running the ipv6 addresscommand. Run the ipv6 nd prefix command to add other prefixes.
Run the ipv6 nd prefix default command to configure the default parameters for an interface. That is, if
no parameter is specified when a prefix is added, use the parameters configured in the ipv6 nd prefix
default command as the parameters of the new prefix. The default parameter configurations areabandoned once a parameter is specified for the prefix. That is, when you use the ipv6 nd prefix
default command to modify the default parameter configurations, only the prefix configured for thedefault parameters changes and configurations of the prefix remain the same.
at valid-date preferred-date: You can specify the valid date of the prefix in two methods: 1) specifying afixed time for each prefix in an RA packet; 2) specifying the deadline. In the second method, the valid
date of the prefix in each RA packet decreases till it becomes 0.

Enabling/Disabling RA Suppression on an Interface

Commandipv6 nd suppress-ra

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage GuideTo enable RA suppression on an interface, run the ipv6 suppress-ra command.

Configuring the Maximum Number of Unresolved ND Entries

Commandipv6 nd unresolved number

Parameter

number: Indicates the maximum number of unresolved ND entries.

Description
Command

Global configuration mode

Mode
Usage Guide

To prevent malicious scanning attacks from creating a large number of unresolved ND entries andoccupying entry resources, you can restrict the number of unresolved ND entries.



Configuring the Maximum Number of ND Entries Learned on an Interface

Commandipv6 nd cache interface-limit value

Parameter

value: Indicates the maximum number of neighbors learned by an interface.

Description

3-25

Configuration Guide

Command

Configuring IPv6

Interface configuration mode

Mode
Usage Guide

Restricting the number of ND entries learned on an interface can prevent malicious neighbor attacks. If
this number is not restricted, a large number of ND entries will be generated on the device, occupyingexcessive memory space. The configured value must be equal to or greater than the number of the ND
entries learned by the interface. Otherwise, the configuration does not take effect. The configuration is
subject to the ND entry capacity supported by the device.

Configuration
Example

Enabling IPv6 Redirection on an Interface

Configuratio

Enable IPv6 redirection on interface VLAN 1.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ipv6 redirects
Verification

Run the show ipv6 interface command to check whether the configuration takes effect.
Ruijie# show ipv6 interface vlan 1
interface VLAN 1 is Up, ifindex: 4097, vrf_id 0
address(es):
Mac Address: 00:20:30:40:50:8d
INET6: 2000::1 , subnet is 2000::/64
INET6: FE80::220:30FF:FE40:508D , subnet is FE80::/64
Joined group address(es):FF01::1
FF02::1
FF02::2
FF02::1:FF00:0
FF02::1:FF00:1
FF02::1:FF40:508D
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds

3-26

Configuration Guide

Configuring IPv6

ND advertised reachable time is 0 milliseconds
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND router advertisements are sent every 200 seconds<160--240>
ND router advertisements live for 1800 seconds



Configuring IPv6 DAD

Configuratio

Configure the interface to send three consecutive NS packets during DAD.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ipv6 nd dad attempts 3
Verification

Run the show ipv6 interface command to check whether the configuration takes effect.
Ruijie# show ipv6 interface gigabitEthernet 0/1
interface VLAN 1 is Up, ifindex: 4097, vrf_id 0
address(es):
Mac Address: 00:20:30:40:50:8d
INET6: 2000::1 , subnet is 2000::/64
INET6: FE80::220:30FF:FE40:508D , subnet is FE80::/64
Joined group address(es):FF01::1
FF02::1
FF02::2
FF02::1:FF00:0
FF02::1:FF00:1
FF02::1:FF40:508D
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 3
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND router advertisements are sent every 200 seconds<160--240>

3-27

Configuration Guide

Configuring IPv6

ND router advertisements live for 1800 seconds
RG-S29 series do not support the VRF parameter. The above example is for reference purpose.
Please take the actual device as standard.



Configuring Prefix Information in an RA Packet

Configuratio

Add a prefix 1234::/64 to interface vlan 1.

n StepsRuijie(config)# interface vlan 0/1
Ruijie(config-if-VLAN 1)# ipv6 nd prefix 1234::/6
Verification

Run the show ipv6 interface command to check whether the configuration takes effect.
Ruijie# show ipv6 interface vlan 1 ra-info
VLAN 1: UP (RA is suppressed)
RA timer is stopped
waits: 0, initcount: 0
statistics: RA(out/in/inconsistent): 0/0/0, RS(input): 0
Link-layer address: 00:20:30:40:50:8D
Physical MTU: 1500
ND router advertisements live for 1800 seconds
ND router advertisements are sent every 200 seconds<160--240>
Flags: !M!O, Adv MTU: 1500
ND advertised reachable time is 0 milliseconds
ND advertised retransmit time is 0 milliseconds
ND advertised CurHopLimit is 64
Prefixes: <total: 2>
1000::/6(Def, CFG, vltime: 2592000, pltime: 604800, flags: LA)
2000::/64(Def, Auto, vltime: 2592000, pltime: 604800, flags: LA)Disabling RA Suppression

Configuratio

Disable RA suppression on an interface.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# no ipv6 nd suppress-ra
Verification

Run the show running-config command to check whether the configuration takes effect.

3-28

Configuration Guide

Configuring IPv6

Ruijie# show run interface vlan 1

Building configuration...
Current configuration : 125 bytes

interface vlan 1
ipv6 enable
no ipv6 nd suppress-ra!

Configuring the Maximum Number of Unresolved ND Entries

Configuratio

Set the maximum number of unresolved ND entries to 200.

n StepsRuijie(config)# ipv6 nd unresolved 200
Verification

Run the show running-config command to check whether the configuration takes effect.
Ruijie# show running-config

ipv6 nd unresolved 200!

Configuring the Maximum Number of ND Entries Learned on an Interface

Configuratio

Set the maximum number of ND entries learned on an interface to 100.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ipv6 nd cache interface-limit 100
Verification

Run the show running-config command to check whether the configuration takes effect.
Ruijie# show running-config!
interface vlan 1
ipv6 nd cache interface-limit 100!

3-29

Configuration Guide

Configuring IPv6

3.4.3 Enabling PMTUD
Configuration Effect
When sending an IPv6 packet, a host fragments the packet based on the PMTU.

Notes
The IPv6 MTU of an interface must be less than or equal to the interface MTU.

Configuration Steps

Configuring the IPv6 MTU of an Interface

Optional.

Verification


Run the show running-config command to check whether the configuration is correct.

Run the show ipv6 interface command to check whether the IPv6 MTU of an interface is correct.



Capture the locally sent IPv6 packets whose length exceeds the PMTU. The packet capture result shows that the
IPv6 packet is fragmented based on the PMTU.

Related Commands

Configuring the IPv6 MTU of an Interface

Commandipv6 mtu bytes

Parameter

bytes: Indicates the MTU of an IPv6 packet, ranging from 1280 to 1500. The unit is byte.

Description
Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring the IPv6 MTU of an Interface

Configuratio

Change the IPv6 MTU of interface vlan 1 to 1,300.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ipv6 mtu 1300
Verification

Run the show ipv6 interface command to check whether the configuration takes effect.
Ruijie# show ipv6 interface vlan 1
interface vlan 1 is Down, ifindex: 1, vrf_id 0
address(es):
Mac Address: 00:d0:f8:22:33:47

3-30

Configuration Guide
Configuratio

Configuring IPv6

Change the IPv6 MTU of interface vlan 1 to 1,300.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ipv6 mtu 1300
Verification

Run the show ipv6 interface command to check whether the configuration takes effect.
INET6: FE80::2D0:F8FF:FE22:3347 [ TENTATIVE ], subnet is FE80::/64
INET6: 1020::1 [ TENTATIVE ], subnet is 1020::/64
INET6: 1023::1 [ TENTATIVE ], subnet is 1023::/64
Ruijie# show ipv6 interface
Joined group address(es):MTU is 1300 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND router advertisements are sent every 200 seconds<160--240>
ND router advertisements live for 1800 seconds

3.4.4 Enabling IPv6 Source Routing
Configuration Effect
RFC 5095 abolished the Type 0 routing header. Ruijie devices do not support the Type 0 routing header by default. The
administrator can run the ipv6 source-route command to in global configuration mode to enable IPv6 source routing.

Configuration Steps

Enabling IPv6 Source Routing

Optional.

To enable IPv6 source routing, run the ipv6 source-route command.

Verification
The device can properly forward packets carrying the Type 0 routing header.

Related Commands

Enabling IPv6 Source Routing

3-31

Configuration Guide

Commandipv6 source-route

Parameter

N/A

Configuring IPv6

Description
Command

Global configuration mode

Mode
Usage Guide

Since the Type 0 header may cause the device prone to DoS attacks, the device does not forward IPv6
packets carrying the routing header by default, but still processes IPv6 packets with itself being the finaldestination address and the Type 0 routing header.

Configuration
Example

Enabling IPv6 Source Routing

Configuratio

Enable IPv6 source routing.

n StepsRuijie(config)# ipv6 source-route
Verification

Run the show running-config command to check whether the configuration takes effect.
Ruijie# show running-config | include ipv6 source-routeipv6 source-route

3.4.5 Configuring the Sending Rate of ICMPv6 Error Messages
Configuration EffectConfigure the sending rate of ICMPv6 error messages.

Configuration Steps

Configuring the Sending Rate of ICMPv6 Packet Too Big Messages

Optional.



If a device receives many IPv6 packets with the packet length exceeding the IPv6 MTU of the outbound interface
and thereby sends many ICMPv6 Packet Too Big messages to consume much CPU resources, run the ipv6 icmp
error-interval too-big command to restrict the sending rate of this error message.

Configuring the Sending Rate of Other ICMPv6 Error Messages

Optional.



If a device receives many illegal IPv6 packets and thereby generates many ICMPv6 error messages, run the ipv6
icmp error-interval command to restrict the sending rate of ICMPv6 error messages. (This command does notaffect the sending rate of ICMPv6 Packet Too Big messages.)

3-32

Configuration Guide

Configuring IPv6

Verification
Run the show running-config command to check whether the configuration takes effect.

Related Commands

Configuring the Sending Rate of ICMPv6 Packet Too Big Messages

Commandipv6 icmp error-interval too-big milliseconds [ bucket-size ]Parameter

milliseconds: Indicates the refresh period of a token bucket, ranging from 0 to 2,147,483,647. The unit is

Description

millisecond. The default value is 100. If the value is 0, the sending rate of ICMPv6 error messages is not
restricted.
bucket-size: Indicates the number of tokens in a token bucket, ranging from 1 to 200. The default value
is 10.

Command

Global configuration mode

Mode
Usage Guide

To prevent DoS attacks, use the token bucket algorithm to restrict the sending rate of ICMPv6 error
messages.
If the length of an IPv6 packet to be forwarded exceeds the IPv6 MTU of the outbound interface, theswitch discards this IPv6 packet and sends back an ICMPv6 Packet Too Big message to the source IPv6
address. This error message is mainly used as part of the IPv6 PMTUD process. If other ICMPv6 error
messages are excessive, ICMPv6 Packet Too Big messages cannot be sent, causing failure of IPv6PMTUD. Therefore, it is recommended to restrict the sending rate of ICMPv6 Packet Too Big messages
independently of other ICMPv6 error messages.
Since the precision of the timer is 10 milliseconds, it is recommended to set the refresh period of a token
bucket to an integer multiple of 10 milliseconds. If the refresh period of the token bucket is between 0
and 10, the actual refresh period is 10 milliseconds. For example, if the sending rate is set to 1 every 5
milliseconds, two error messages are sent every 10 milliseconds in actual situations. If the refresh periodof the token bucket is not an integer multiple of 10 milliseconds, it is automatically converted to an
integer multiple of 10 milliseconds. For example, if the sending rate is set to 3 every 15 milliseconds, twotokens are refreshed every 10 milliseconds in actual situations.



Configuring the Sending Rate of Other ICMPv6 Error Messages

Commandipv6 icmp error-interval milliseconds [ bucket-size ]Parameter

milliseconds: Indicates the refresh period of a token bucket, ranging from 0 to 2,147,483,647. The unit is

Description

millisecond. The default value is 100. If the value is 0, the sending rate of ICMPv6 error messages is not
restricted.
bucket-size: Indicates the number of tokens in a token bucket, ranging from 1 to 200. The default value
is 10.

Command

Global configuration mode

Mode

3-33

Configuration Guide

Usage Guide

Configuring IPv6

To prevent DoS attacks, use the token bucket algorithm to restrict the sending rate of ICMPv6 error
messages.
Since the precision of the timer is 10 milliseconds, it is recommended to set the refresh period of a token
bucket to an integer multiple of 10 milliseconds. If the refresh period of the token bucket is between 0
and 10, the actual refresh period is 10 milliseconds. For example, if the sending rate is set to 1 every 5
milliseconds, two error messages are sent every 10 milliseconds in actual situations. If the refresh periodof the token bucket is not an integer multiple of 10 milliseconds, it is automatically converted to an
integer multiple of 10 milliseconds. For example, if the sending rate is set to 3 every 15 milliseconds, twotokens are refreshed every 10 milliseconds in actual situations.

Configuration
Example

Configuring the Sending Rate of ICMPv6 Error Messages

Configuratio

Set the sending rate of the ICMPv6 Packet Too Big message to 100 pps and that of other ICMPv6 errorn Stepsmessages to 10 pps.
Ruijie(config)# ipv6 icmp error-interval too-big 1000 100
Ruijie(config)# ipv6 icmp error-interval 1000 10

Verification

Run the show running-config command to check whether the configuration takes effect.
Ruijie# show running-config | include ipv6 icmp error-interval
ipv6 icmp error-interval 1000 10
ipv6 icmp error-interval too-big 1000 100

3.4.6 Configuring the IPv6 Hop Limit
Configuration EffectConfigure the number of hops of a unicast packet to prevent the packet from being unlimitedly transmitted.

Configuration Steps

Configuring the IPv6 Hop Limit

Optional.

To modify the number of hops of a unicast packet, run the ipv6 hop-limit value command.

Verification


Run the show running-config command to check whether the configuration is correct.



Capture the IPv6 unicast packets sent by a host. The packet capture result shows that the hop-limit field value in the
IPv6 header is the same as the configured hop limit.

3-34

Configuration Guide

Configuring IPv6

Related Commands

Configuring the IPv6 Hop Limit

Commandipv6 hop-limit value

Parameter

value: Indicates the number of hops of a unicast packet sent by the device. The value ranges from 1 to

Description

255.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring the IPv6 Hop Limit

Configuratio

Set the IPv6 hop limit of a device to 250.

n StepsRuijie(config)# ipv6 hop-limit 250
Verification

Run the show running-config command to check whether the configuration takes effect.
Ruijie# show running-config
ipv6 hop-limit 254

3.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears the dynamically learned

clear ipv6 neighbors [ interface-id ]neighbors.

Displaying
Description
Displays IPv6 information of aninterface.
Displays the IPv6 addresses.

Commandshow ipv6 interface [ [ interface-id ] [ ra-info ] ] [ brief [ interface-id ] ]show ipv6 address [ interface-name ]3-35

Configuration Guide
Displays the information of thegeneral prefix.
Displays the statistics of one IPv6
neighbors.
Displaysthestatistics

of

IPv6

packets.
Displays all IPv6 raw sockets.
Displays the neighbor routers andthe advertisementshow ipv6 general-prefix

show ipv6 neighbors statistics

show ipv6 packet statistics [ total | interface-name ]show ipv6 raw-socket [ num ]show ipv6 routers [ interface-type interface-number ]Displays all IPv6 sockets.

show ipv6 sockets

Displays all IPv6 UDP sockets.

show ipv6 udp [ local-port num ] [ peer-port num ]Displays the statistics of IPv6 UDP
sockets.
Displays neighbor information.

show ipv6 udp statistics
show ipv6 neighbors [ verbose ] [ interface-id ] [ ipv6-address ] [ static ]Debugging
System resources are occupied when debugging information is output. Therefore, disable the debugging switch
immediately after use.
Description

CommandDebugs ND entry learning.

debug ipv6 nd

3-36

Configuration Guide

Configuring DHCP

4 Configuring DHCP
4.1 Overview
The Dynamic Host Configuration Protocol (DHCP) is a LAN protocol based on the User Datagram Protocol (UDP) for
dynamically assigning reusable network resources, for example, IP addresses.
The DHCP works in Client/Server mode. A DHCP client sends a request message to a DHCP server to obtain an IP
address and other configurations. When a DHCP client and a DHCP server are not in a same subnet, they need a DHCP
relay to forward DHCP request and reply packets.

Protocols andStandards


RFC 2131: Dynamic Host Configuration Protocol

RFC 2132: DHCP Options and BOOTP Vendor Extensions



RFC 3046: DHCP Relay Agent Information Option

4.2 Applications
Application

Description

Providing DHCP Service in a LAN

Assigns IP addresses to clients in a LAN.

Enabling DHCP Client

Enables DHCP Client.

Deploying DHCP Relay in Wired Network

In a wired network, users from different network segments requests IP
addresses.

4.2.1 Providing DHCP Service in a LAN
Scenario
Assign IP addresses to four users in a LAN.
For example, assign IP addresses to User 1, User 2, User 3 and User 4, as shown in the following figure.

The four users are connected to Server S through A, B, C and D.

4-1

Configuration Guide

Configuring DHCP

Figure 4-1

Remarks

S is an egress gateway working as a DHCP server.
A, B, C and D are access switches achieving layer-2 transparent transmission.
User 1, User 2, User 3 and User 4 are LAN users.

Deployment
Enable DHCP Server on S.

Deploy layer-2 VLAN transparent transmission on A, B, C and D.

User 1, User 2, User 3 and User 4 initiate DHCP client requests.

4.2.2 Enabling DHCP Client
Scenario
Access switches A, B, C and D in a LAN request server S to assign IP addresses.
For example, enable DHCP Client on the interfaces of A, B, C and D to request IP addresses, as shown in the following
figure.
Figure 4-2

RemarkS is an egress gateway working as a DHCP server.

s

A, B, C and D are access switches with DHCP Client enabled on the interfaces.

4-2

Configuration Guide

Configuring DHCP

Deployment
Enable DHCP Server on S.

Enable DHCP Client on the interfaces of A, B, C and D.

4.2.3 Deploying DHCP Relay in Wired Network
Scenario
As shown in the following figure, Switch C and Switch D are access devices for the users in VLAN 10 and VLAN 20
respectively. Switch B is a gateway, and Switch A is a core device. The requirements are listed as follows:
Switch A works as a DHCP server to assign IP addresses of different network segments dynamically to users in different
VLANs.
Users in VLAN 10 and VLAN 20 obtain IP addresses dynamically.
Figure 4-3 DHCP Relay

Remarks

Switch C and Switch D are access devices.
Switch B is a gateway.
Switch A is a core device.

Deployment
Configure layer-2 communication between Switch B and Switch C as well as between Switch B and Switch D.

On Switch B, specify a DHCP server address and enable DHCP Relay.

On Switch A, create DHCP address pools for VLAN 10 and VLAN 20 respectively, and enable DHCP Server.

4.3 Features
Basic Concepts



DHCP Server

4-3

Configuration Guide

Configuring DHCP

Based on RFC 2131, Ruijie DHCP server assigns IP addresses to clients and manages these IP addresses.



DHCP Client

DHCP Client enables a device to automatically obtain an IP address and configurations from a DHCP server.



DHCP Relay

When a DHCP client and a DHCP server are not in a same subnet, they need a DHCP relay to forward DHCP request andreply packets.



Lease

Lease is a period of time specified by a DHCP server for a client to use an assigned IP address. An IP address is active
when leased to a client. Before a lease expires, a client needs to renew the lease through a server. When a lease expires
or is deleted from a server, the lease becomes inactive.

Excluded Address

An excluded address is a specified IP address not assigned to a client by a DHCP server.

Address PoolAn address pool is a collection of IP addresses that a DHCP server may assign to clients.



Option TypeAn option type is a parameter specified by a DHCP server when it provides lease service to a DHCP client. For example, apublic option include the IP addresses of a default gateway (router), WINS server and a DNS server. DHCP server allows
configuration of other options. Though most options are defined in the RFC 2132, you can add user-defined options.

Overview
FeatureDescription

DHCP Server

Enables DHCP Server on a device, and it may assign IP addresses dynamically and pushes
configurations to DHCP clients.

DHCP Relay Agent

Enables DHCP Relay on a device, and it may forward DHCP request and reply packets
across different network segments.

DHCP Client

Enables DHCP Client on a device, and it may obtain IP addresses and configurations
automatically from a DHCP server.

4.3.1 DHCP Server
Working Principle



DHCP Working Principle

Figure 4-4

4-4

Configuration Guide

Configuring DHCP

A host requests an IP address through DHCP as follows:1.

A host broadcasts a DHCP discover packet to find DHCP servers in a network.

2.

DHCP servers unicast/broadcast (based on the property of the host packet) DHCP offer packets to the host,
containing an IP address, a MAC address, a domain name and a lease.

3.

The host broadcasts a DHCP request packet to formally request an IP address.

4.

A DHCP server sends a DHCP ACK unicast packet to the host to acknowledge the request.
A DHCP client may receive DHCPOFFER packets from multiple DHCP servers, but usually it accepts only the first
DHCPOFFER packet. Besides, the address specified in a DHCPOFFER packet is not necessarily assigned. Instead,
it is retained by the DHCP server until a client sends a formal request.

To formally request an IP address, a client broadcasts a DHCPREQUEST packet so that all DHCP servers sending
DHCPOFFER packets may receive the packet and release OFFER IP addresses.
If a DHCPOFFER packet contains invalid configuration parameters, a client will send a DHCPDECLINE packet to theserver to decline the configuration.
During the negotiation, if a client does not respond to the DHCPOFFER packets in time, servers will send DHCPNAK
packets to the client and the client will reinitiate the process.
During network construction, Ruijie DHCP servers have the following features:

Low cost. Usually the static IP address configuration costs more than DHCP configuration.

Simplified configuration. Dynamic IP address assignment dramatically simplifies device configuration

Centralized management. You can modify the configuration for multiple subnets by simply modifying the DHCP
server configuration.



Address Pool

After a server receives a client's request packet, it chooses a valid address pool, determines an available IP address fromthe pool through PING, and pushes the pool and address configuration to the client. The lease information is saved locallyfor validity check upon lease renewal.
An address pool may carry various configuration parameters as follows:

An IP address range, which is the range of IP addresses that are available.



A gateway address. A maximum of 8 gateway addresses are supported.

A DNS address. A maximum of 8 DNS addresses are supported.

A lease period notifying clients of when to age an address and request a lease renewal.

4-5Configuration GuideConfiguring DHCP

VRRP Monitoring

In a Virtual Router Redundancy Protocol (VRRP) scenario, Ruijie devices enabled with DHCP provide a command tomonitor the VRRP status of the interface. To an interface configured with VRRP address and VRRP monitoring, a DHCP
server only processes the DHCP clients' request packets from the interface in Master state, and other packets are
discarded. If no VRRP address is configured, the DHCP server does not monitor the VRRP status, and all DHCP packets
are processed. VRRP monitoring is configured on only layer-3 interfaces. It is disabled by default, namely, only the Masterdevice processes the DHCP service.



ARP-Based Offline Detection

Ruijie devices enabled with DHCP provide a command to enable ARP-based offline detection. After this function isenabled, a DHCP server will receive an ARP aging notification when a client gets offline, and start retrieving the client's
address. If the client does not get online within a period of time (5 minutes by default), the DHCP server will retrieve theaddress and assign it to another client. If the client gets online again, the address is still valid.



Adding Pseudo Server Detection

If a DHCP server is deployed illegally, a client interacts with this server while requesting an IP address and a wrong
address will be assigned to the client. This server is a pseudo server. Ruijie devices enabled with DHCP provides acommand to enable pseudo server detection. After it is enabled, DHCP packets are checked for Option 54 (Server
Identifier Option). If the content of Option 54 is different from the actual DHCP server identifier, the IP address of thepseudo server and port receiving the packets will be recorded. The pseudo server detection is only an after-event security
function and cannot prevent an illegal DHCP server from assigning IP addresses to clients.

Related Configuration

Enabling DHCP Server Globally

By default, DHCP Server is disabled.

Run the service dhcp command to enable the DHCP Server.



Run the service dhcp command globally to enable DHCP service.

Configuring Address Pool

By default, no address pool is configured.

Run the ip dhcp pool command to configure an IP address range, a gateway and a DNS.



If no address pool is configured, no addresses will be assigned.

4.3.2 DHCP Relay Agent
Working Principle
The destination IP address of DHCP request packets is 255.255.255.255, and these packets are forwarded within asubnet. To achieve IP address assignment across network segments, a DHCP relay agent is needed. The DHCP relay
agent unicasts DHCP request packets to a DHCP server and forwards DHCP reply packets to a DCHP client. The DHCP
relay agent serves as a repeater connecting a DHCP client and a DHCP server of different network segments by
forwarding DHCP request packets and DHCP reply packets. The Client-Relay-Server mode achieves management of IP
addresses across multiple network segments by only one DHCP server. See the following figure.

4-6

Configuration Guide

Configuring DHCP

Figure 4-5 DHCP Relay Scenario

VLAN 10 and VLAN 20 correspond to the segments 10.0.0.1/16 and 20.0.0.1/16 respectively. A DHCP server with IP
address 30.0.0.2 is in segment 30.0.0.1/16. To achieve management of dynamic IP addresses in VLAN 10 and VLAN 20
by the DHCP server, you only need to enable DHCP Relay on a gateway and configure IP address 30.0.0.2 for the DHCP
server.



DHCP Relay Agent Information (Option 82)

As defined in RFC 3046, an option can be added to indicate a DHCP client's network information when DHCP Relay is
performed, so that a DHCP server may assign IP addresses of various privileges based on more accurate information.
The option is called Option 82. Currently, Ruijie devices support four schemes of relay agent information, which aredescribed respectively as follows:
1.

Relay agent information option dot1x: This scheme should be implemented with 802.1X authentication and the
RG-SAM products. Specifically, RG-SAM products push the IP privilege during 802.1X authentication. A DHCP relay
agent forms a Circuit ID sub-option based on the IP privilege and the VLAN ID of a DHCP client. The option format isshown in the following figure.

Figure 4-6 Option Format

2.

Relay agent information option82: This scheme serves without correlation with other protocol modules. A DHCP
relay agent forms an Option 82 based on the physical port receiving DHCP request packets and the MAC address ofthe device. The option format is shown in the following figure.

Figure 4-7 Agent Circuit ID

4-7

Configuration Guide
3.

Configuring DHCP

Relay agent information option82: This scheme serves without correlation with other protocol modules. Comparedwith previous Option 82, this option supports user-defined content, which may change. By default, a DHCP relay
agent forms Option 82 according to the information of the physical port receiving DHCP packets, device MAC
address and device name. The option format is shown in the following figure.

Figure 4-8 Option82.1-circuit-id

Figure 4-9 Option82-remote-id

DHCP Relay Check Server-ID

In DHCP environment, multiple DHCP servers are deployed for a network, achieving server backup to ensure
uninterrupted network operation. After this function is enabled, the DHCP request packet sent by a client contains aserver-id option specifying a DHCP server. In alleviating the burden on servers in specific environments, you need toenable this function on a relay agent to send a packet to a specified DHCP server rather than all DHCP servers.



DHCP Relay suppression

After you configure the ip dhcp relay suppression command on an interface, DHCP request packets received on theinterface will be filtered, and the other DHCP request packets will be forwarded.

Related Configuration

Enabling DHCP Relay

By default, DHCP Relay is disabled.

You may run the service dhcp command to enable DHCP Relay.

You need to enable DHCP Relay before it works.

Configuring IP Address for DHCP Server

By default, no IP address is configured for a DHCP server.

You may run the ip helper-address command to configure an IP address for a DHCP server. The IP address can be
configured globally or on a layer-3 interface. A maximum of 20 IP addresses can be configured for a DHCP server.

When an interface receives a DHCP request packet, the DHCP server configuration on the interface prevails overthat configured globally. If the interface is not configured with DHCP server addresses, the global configuration takes
effect.



Enabling DHCP Option 82

4-8

Configuration Guide

Configuring DHCP

By default, DHCP Option 82 is disabled.

You may run the ip dhcp relay information option82 command to enable DHCP Option 82.

Enabling DHCP Relay Check Server-ID

By default, DHCP Relay check server-id is disabled.

You may run the ip dhcp relay check server-id command to enable DHCP Relay check server-id.

Enabling DHCP Relay Suppression



By default, DHCP Relay suppression is disabled on all interfaces.

You may run the ip dhcp relay suppression command to enable it on an interface.

4.3.3 DHCP Client
Working Principle
A DHCP client broadcasts a DHCP discover packet after entering the Init state. Then it may receive multiple DHCP offer
packets. It chooses one of them and responds to the corresponding DHCP server. After that, it sends lease renewal
request packets in the Renew and Rebind processes of an aging period to request lease renewal.

Related Configuration

Enabling DHCP Client on Interface

By default, DHCP Client is disabled.

In interface configuration mode, you may run the ip address dhcp command to enable DHCP Client.

You need to enable DHCP Client to enable DHCP service.

The configuration takes effect on a layer-3 interface, for example, an SVI or a routed port.

4.4 Configuration
Configuring DHCP Server

Configuration

Description and Command(Mandatory) It is used to enable DHCP Server to achieve dynamic IP
address assignment.

Configuring Dynamic IP Address

service dhcp

Enables DHCP Server.

ip dhcp pool

Configures an address pool.
Configures the network number andnetwork

subnet mask of a DHCP address pool.

(Optional) It is used to configure the properties of an address pool.

4-9Configuration Guide

Configuration

Configuring DHCP

Description and Command
default-router

Configures a default gateway of a client.

lease

Configures an address lease.

next-server

Configures a TFTP server address

bootfile

Configures a boot file of a client.

domain-name

Configures a domain name of a client.

dns-server

Configures a domain name server.

netbios-name-server

Configures a NetBIOS WINS server.

netbios-node-type

Configures a NetBIOS node type on aclient.
Configures an alarm threshold of anlease-thresholdaddress pool.
optionConfigures a user-defined option.

pool-status

Enables or disables an address pool.

(Optional) It is used to statically assign an IP address to a client.
Configures an address pool name andip dhcp poolenters address pool configuration mode.
Configures the IP address and subnet

host
Configuring Static IP Address

mask of a client host.
hardware-address

Configures a client hardware address.

client-identifier

Configures a unique client identifier.

client-name

Configures a client name.

(Optional) It is used to configure the class rules.

Configuring Class Rules of the DHCP

ip dhcp classConfigures Class rules

relay agent information

Enablestheoption82

information

configuration mode.

Serverrelay-information hex

Configures

theoption82

information

matched with class rules.
Associates class rules with address pools.

class

4-10

Configuration Guide

Configuration

Configuring DHCP

Description and Command
Configures the IP address range matchedaddress range

with a class rule.
ip dhcp use class

Enables the CLASS to allocate addresses.

(Optional) It is used to configure the properties of a DHCP server.
ip dhcp excluded-address

Configures an excluded IP address.

ip dhcp force-send-nak

Configures Compulsory NAK reply by aConfiguring Global Properties of

DHCP server.

DHCP Server

ip dhcp monitor-vrrp-state

Configures VRRP status monitoring.

ip dhcp ping packets

Configures ping times.

ip dhcp ping timeout

Configures a ping timeout.

Configuring DHCP Relay

Configuration

Description and Command(Mandatory) It is used to enable DHCP Relay.

Configuring Basic DHCP Relay

Enables DHCP Relay.

service dhcp

Functions
ip helper-address

Configures an IP Address of a DHCP
Server.

(Optional) It is used to assign IP addresses of different privileges to clientsin combination with the information of a physical port. This function cannot
Configuring DHCP Relay Option 82

be used together with the dhcp option dot1x command.
ip dhcp relay information
option82

Enables DHCP option82.

(Optional) It is used to enable a DHCP Relay agent to send DHCP request
packets only to a specified server.
Configuring DHCP Relay Check
Enables a DHCP Relay agent to sendServer-ID
ip dhcp relay check server-id

DHCP request packets only to a specified
server(Optional) It is used to shield DHCP request packets on an interface.
Configuring DHCP Relay Suppression
ip dhcp relay suppression

Configuring DHCP Client

4-11

Enables DHCP Relay Suppression.

Configuration Guide

Configuration

Configuring DHCP

Description and Command(Mandatory) It is used to enable DHCP Client.
Enables an Ethernet interface, aConfiguring DHCP Client

PPP/HDLC-encapsulated or

ip address dhcp

FR-encapsulated interface to obtain IP
addresses through DHCP.

4.4.1 Configuring Dynamic IP Address
Configuration Effect
Provide all DHCP clients with DHCP service including assigning IP addresses and gateways.

Notes
A DHCP server and a DHCP relay share the service dhcp command, but a device cannot function as a DHCP server andrelay at the same time. When a device is configured with a valid address pool, it acts as a server and forwards packets.
Otherwise, it serves as a relay agent.

Configuration Steps

Enabling DHCP Server

Mandatory. It achieves dynamic IP address assignment.

Run the service dhcp command in global configuration mode.

Configuring Address Pool

Mandatory. It is used to create an IP address pool.

Run the ip dhcp pool command in global configuration mode.

Configuring Network Number and Subnet Mask of DHCP Address Pool

Mandatory. It defines a range of dynamically assigned addresses.

Run the network command in DHCP address pool configuration mode.

Configuring Default Gateway of Client

Optional. It is used to configure a gateway address.

Run the default-router command in DHCP address pool configuration mode.

Configuring Address Lease

Optional. It is used to configure an IP address lease, which is 24h by default.



Run the lease command in DHCP address pool configuration mode.

Configuring TFTP Server AddressOptional. It is used to configure a TFTP server address.

4-12Configuration Guide

Configuring DHCP

Run the next-server command in DHCP address pool configuration mode.

Configuring Domain Name of Client

Optional. It is used to configure the domain name of a client.

Run the domain-name command in DHCP address pool configuration mode.

Configuring DNS

Optional. It is used to configure a DNS address.

Run the dns command in DHCP address pool configuration mode.

Configuring NetBIOS WINS Server

Optional. It is used to configure a NetBIOS WINS server address.

Run the netbios-name-server command in DHCP address pool configuration mode.

Configuring NetBIOS Node Type on Client

Optional. It is used to configure a NetBIOS node type.

Run the netbios-name-type command in DHCP address pool configuration mode.

Configuring Alarm Threshold of Address Pool

Optional. It is used to manage the number of leases. When a threshold (90% by default) is reached, an alarm will be
printed.



Run the lease-threshold command in DHCP address pool configuration mode.

Configuring User-Defined Option



Optional. It is used to configure user-defined options.



Run the option command in DHCP address pool configuration mode.

Enabling or Disabling Address Pool

Optional. It is used to enable or disable an address pool. It is enabled by default.



Run the pool-status command in DHCP address pool configuration mode.

Verification
Connect a DHCP client and a DHCP server.

Check whether the client obtains configurations on the server.

Related Commands

Enabling DHCP Server

Commandservice dhcp

Parameter

N/A

Description

4-13

Configuration Guide

Command

Configuring DHCP

Global configuration mode

Mode
Usage Guide

Enable DHCP Server and DHCP Relay. A DHCP server and a DHCP relay share the service dhcp
command. When a device is configured with a valid address pool, it acts as a server and forwards
packets. Otherwise, it serves as a relay agent.

Configuring Address Pool

Commandip dhcp pool dhcp-pool

Parameterpool-name: Indicates the name of an address pool.

Description
Command

Global configuration mode

Mode
Usage Guide

Before assigning an IP address to a client, you need to configure an address pool name and enter
DHCP address pool configuration mode.

Configuring Network Number and Subnet Mask of DHCP Address Pool

Commandnetwork network-number mask [ low-ip-address high-ip-address ]Parameter

network-number: Indicates the network number of an IP address pool.

Description

mask: Indicates the subnet mask of an IP address pool. If no subnet mask is defined, the natural subnet
mask is applied.

Command

DHCP address pool configuration mode

Mode
Usage Guide

To configure dynamic address assignment, you need to configure a network number and subnet mask ofan address pool to provide a DHCP server with a range of addresses. The IP addresses in a pool are
assigned in order. If an address is assigned or exists in the target network segment, the next address will
be checked until a valid address is assigned.
For Ruijie products, addresses are assigned based on the client’s physical address and ID. Therefore,
one client will not be assigned two leases from one address pool. In case of topological redundancy
between a client and a server, address assignment may fail.
To avoid such failures, a network administrator needs to prevent path redundancy in network
construction, for example, by adjusting physical links or network paths.

Configuring Default Gateway of Client

Commanddefault-router address [ address2…address8 ]Parameter

address: Indicates the IP address of a default gateway. Configure at least one IP address.

Description

ip-address2…ip-address8: (Optional) A maximum of 8 gateways can be configured.

4-14

Configuration Guide

Command

Configuring DHCP

DHCP address pool configuration mode

Mode
Usage Guide

Configure a default gateway of a client, and a server will push the gateway configuration to the client.
The IP addresses of the default gateway and the client should be in a same network.

Configuring Address Lease

Commandlease { days [ hours ] [ minutes ] | infinite }Parameter

days: Defines a lease in the unit of day.

Description

hours: (Optional) Defines a lease in the unit of hour. Please define days before hours.
minutes: (Optional) Defines a lease in the unit of minute. Please define days and hours before minutes.
infinite: Defines an unlimited lease.

Command

DHCP address pool configuration mode

Mode
Usage Guide

The default lease of an IP address assigned by a DHCP server is 1 day. When a lease is expiring soon,a client needs to request a lease renewal. Otherwise the IP address cannot be used after the lease is
expired.

Configuring TFTP Server Address

Commandnext-server ip-address [ ip-address2…ip-address8 ]Parameter

days: Defines a lease in the unit of day.

Description

hours: (Optional) Defines a lease in the unit of hour. Please define days before hours.
minutes: (Optional) Defines a lease in the unit of minute. Please define days and hours before minutes.
infinite: Defines an unlimited lease.

Command

DHCP address pool configuration mode

Mode
Usage Guide

The default lease of an IP address assigned by a DHCP server is 1 day. When a lease is expiring soon,a client needs to request a lease renewal. Otherwise, the IP address cannot be used after the lease is
expired.

Configures Boot File on Client

Commandbootfile filename

Parameterfile-name: Defines a boot file name.

Description
Command

DHCP address pool configuration mode

4-15

Configuration Guide

Configuring DHCP

Mode
Usage Guide

A boot file is a bootable image file used when a client starts up. The file is usually an OS downloaded by
a DHCP client.

Configuring Domain Name of Client

Commanddomain-name domain

Parameter

domain-name: Defines a domain name of a DHCP client.

Description
Command

DHCP address pool configuration mode

Mode
Usage Guide

You may define a domain name for a client. When the client accesses network through the host name,the domain name will be added automatically to complete the host name.



Configuring DNSCommanddns-server { ip-address [ ip-address2…ip-address8 ] | use-dhcp-client interface-type
interface-number }Parameter
Description

ip-address: Defines an IP address of a DNS server. Configure at least one IP address.
ip-address2…ip-address8: (Optional) A maximum of 8 DNS servers can be configured.
use-dhcp-client interface-type interface-number: A DHCP client learns its DNS server via RGOS
software.

Command

DHCP address pool configuration mode

Mode
Usage Guide

If a client accesses network resources through the domain name, you need to configure a DNS server toresolve the domain name.



Configuring NetBIOS WINS Server

Commandnetbios-name-server address [ address2…address8 ]Parameter

address: Defines an IP address of a WINS server. Configure at least one IP address.

Description
Commandip-address2…ip-address8: (Optional) A maximum of 8 WINS servers can be configured.
DHCP address pool configuration mode

Mode
Usage Guide

WINS is a domain name service through which a Microsoft TCP/IP network resolves a NetNBIOS nameto an IP address. A WINS server is a Windows NT server. When a WINS server starts, it receives aregistration request from a WINS client. When the client shuts down, it sends a name release message,
so that the computers in the WINS database and on the network are consistent.

4-16

Configuration GuideConfiguring DHCP

Configuring NetBIOS Node Type on Client

Commandnetbios-node-type type

Parameter

type: Defines a NetBIOS node type with one of the following approaches.

Description

1. A hexadecimal number, ranging from 0 to FF. Only followings values are available.


b-node

p-node

m-node

8 for h-node

2. A character string.

Commandb-node for a broadcast node;

p-node for a peer-to-peer node;m-node for a mixed node;h-node for a hybrid mode.

DHCP address pool configuration mode

Mode
Usage Guide

There are four types of NetBIOS nodes of a Microsoft DHCP client. (1) A broadcast node. For such anode, NetBIOS name resolution is requested through broadcast. (2) A peer-to-peer node. The client
sends a resolution request to the WINS server. (3) A mixed node. The client broadcasts a resolution
request and sends the resolution request to the WINS server. (4) A hybrid node. The client sends a
resolution request to the WINS server. If no reply is received, the client will broadcast the resolution
request. By default, a Microsoft operating system is a broadcast or hybrid node. If no WINS server isconfigured, it is a broadcast node. Otherwise, it is a hybrid node.

Configuring User-Defined Option

Commandoption code { ascii string | hex string | ip ip-address }Parameter

code: Defines a DHCP option code.

Description

ascii string: Defines an ASCII character string.
hex string: Defines a hexadecimal character string.
ip ip-address: Defines an IP address.

Command

DHCP address pool configuration mode

Mode
Usage Guide

The DHCP allows transmitting configuration information to a host via a TCP/IP network. DHCP packets
contain the option field of definable content. A DHCP client should be able to receive a DHCP packet
carrying at least 312 bytes option. Besides, the fixed data field in a DHCP packet is also called an option.

Enabling or Disabling Address Pool
4-17

Configuration Guide

Configuring DHCP

Commandpool-status { enable | disable }Parameter

enable: Enables an address pool.

Description

disable: Disable an address pool.
It is enabled by default.

Command

DHCP address pool configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring Address Pool

ConfiguratioDefine an address pool net172.

n StepsThe network segment is 172.16.1.0/24.

The default gateway is 172.16.1.254.

The address lease is 1 day.



Excluded addresses range from 172.16.1.2 to 172.16.1.100.

Ruijie(config)# ip dhcp excluded-address 172.16.1.2 172.16.1.100
Ruijie(dhcp-config)# ip dhcp pool net172
Ruijie(dhcp-config)# network 172.16.1.0 255.255.255.0
Ruijie(dhcp-config)# default-router 172.16.1.254
Ruijie(dhcp-config)# lease 1
Verification

Run the show running-config command to display the configuration.
Ruijie# show running-config | begin ip dhcp
ip dhcp excluded-address 172.16.1.2 172.16.1.100
ip dhcp pool net172
network 172.16.1.0 255.255.255.0default-router 172.16.1.254
lease 1

4.4.2 Configuring Static IP Address
Configuration Effect
Assign specific IP addresses and push configuration to specific DHCP clients.

4-18

Configuration Guide

Configuring DHCP

Notes
N/A

Configuration Steps

Configuring Address Pool Name and Entering Address Pool Configuration Mode

Mandatory. It is used to create an IP address pool.

Run the ip dhcp pool command in global configuration mode.

Configuring IP Address and Subnet Mask of Client

Mandatory. It is used to configure a static IP address and a subnet mask.

Run the host command in DHCP address pool configuration mode.

Configuring Hardware Address of Client

Optional. It is used to configure a MAC address.

Run the hardware-address command in DHCP address pool configuration mode.

Configures Unique Client Identifier

Optional. It is used to configure a static user identifier (UID).



Run the client-identifier command in DHCP address pool configuration mode.

Configuring Client Name

Optional. It is used to configure a static client name.



Run the host-name command in DHCP address pool configuration mode.

Verification
Check whether the client obtains the IP address when it is online.

Related Commands

Configuring Address Pool

Commandip dhcp pool dhcp-pool

Parameterpool-name: Indicates the name of an address pool.

Description
Command

Global configuration mode

Mode
Usage Guide

Before assigning an IP address to a client, you need to configure an address pool name and enter
address pool configuration mode.

Manual IP Address Binding

4-19

Configuration Guide

Command

Configuring DHCP

host ip-address [ netmask ]client-identifier unique-identifierclient-name nameParameter
Description

ip-address: Defines the IP address of a DHCP client.
netmask: Defines the subnet mask of a DHCP client.
unique-identifier: Defines the hardware address (for example, aabb.bbbb.bb88) and identifier (forexample, 01aa.bbbb.bbbb.88) of a DHCP client.
name: (Optional) It defines a client name using ASCII characters. The name excludes a domain name.
For example, name a host mary rather than mary.rg.com.

Command

DHCP address pool configuration mode

Mode
Usage Guide

Address binding means mapping between an IP address and a client's MAC address. There are two kindof address binding. (1) Manual binding. Manual binding can be deemed as a special DHCP address poolwith only one address. (2) Dynamic binding. A DHCP server dynamically assigns an IP address from apool to a client when it receives a DHCP request, creating mapping between the IP address and theclient's MAC address.
To configure manual binding, you need to define a host pool and then specify a DHCP client's IP
address and hardware address or identifier. A hardware address is a MAC address. A client identifier
includes a network medium type and a MAC address. A Microsoft client is usually identified by a client
identifier rather than a MAC address. For the codes of medium types, refer to the Address Resolution
Protocol Parameters section in the RFC 1700. The Ethernet type is 01.

Configuring Hardware Address of Client

Commandhardware-address hardware-address [ type ]Parameter

hardware-address: Defines the MAC address of the DHCP client.

Description

type: Indicates the hardware platform protocol of the DHCP client. It uses the string definition or digits
definition.
String option:
Ethernet
ieee802
Digits option:
1 (10M Ethernet)
6 (IEEE 802)

Command

DHCP address pool configuration mode

Mode

4-20

Configuration Guide

Usage Guide

Configuring DHCP

This command can be used only when the DHCP is defined by manual binding.

Configuration
Example

Dynamic IP Address Pool

Configuratio

Configure address pool VLAN 1 with IP address 20.1.1.0 and subnet mask 255.255.255.0.

n Steps

The default gateway is 20.1.1.1.

The lease time is 1 day.

Ruijie(config)# ip dhcp pool vlan1
Ruijie(dhcp-config)# network 20.1.1.0 255.255.255.0
Ruijie(dhcp-config)# default-router 20.1.1.1
Ruijie(dhcp-config)# lease 1 0 0
Verification

Run the show running-config command to display the configuration.
Ruijie# show running-config | begin ip dhcp
ip dhcp pool vlan1
network 20.1.1.0 255.255.255.0
default-router 20.1.1.1
lease 1 0 0

Manual Binding

ConfiguratioThe host address is 172.16.1.101 and the subnet mask is 255.255.255.0.

n StepsThe host name is Billy.rg.com.

The default gateway is 172.16.1.254.

The MAC address is 00d0.df34.32a3.

Ruijie(config)# ip dhcp pool Billy
Ruijie(dhcp-config)# host 172.16.1.101 255.255.255.0
Ruijie(dhcp-config)# client-name Billy
Ruijie(dhcp-config)# hardware-address 00d0.df34.32a3 Ethernet
Ruijie(dhcp-config)# default-router 172.16.1.254
Verification

Run the show running-config command to display the configuration.
Ruijie# show running-config | begin ip dhcp
ip dhcp pool Billyhost 172.16.1.101 255.255.255.0

4-21

Configuration Guide

Configuring DHCP

client-name Billy
hardware-address 00d0.df34.32a3 Ethernet
default-router 172.16.1.254

4.4.3 Configuring Class Rules of the DHCP Server
Configuration Effect
After class rules are configured, the DHCP server can assign IP addresses in different network segments to STAs basedon the option82 information carried by the STAs.

Notes
The configured class rules take effect only after they are associated with corresponding address pools.

Configuration Steps

Configuring Class Rules



Run the ip dhcp class command to add class rules.

Run the relay agent information command to enter the option82 information configuration mode.

Run the relay-information hex command to configure matched option82 content.



Associating Class Rules with Address Pools



Run the class command to associate class rules.

Run the address range command to configure assigned IP address segments after class rules are matched.

Verification
Run the show run command to check whether the configuration is successful.

Related Commands

Configuring Class Rules

Commandip dhcp class class-nameParameter

N/A

Description
Command

Configuration mode

Mode
Usage Guide

This command is used for server configuration. Configure class rules if IP addresses in different network
segments need to be assigned based on the option information.

Entering the option82 Information Configuration Mode

Commandrelay agent information

4-22

Configuration Guide

Parameter

Configuring DHCP

N/A

Description
Command

Configuration mode

Mode
Usage GuideThis command is used for server configuration and to enter the option82 information configuration mode.

Configuring the option82 Information Matched with Class Rules

Commandrelay-information hex

Parameter

N/A

Description
Command

Configuration mode

Mode
Usage Guide

This command is used for server configuration and to configure the option82 information matched with classrules.



Associating Class Rules with Address Pools

Commandclass class-nameParameter

N/A

Description
Command

Configuration mode

Mode
Usage Guide

This command is used for server configuration and to associate configured class rules with destination
address pools.

Configuring the IP Address Range Matched with a Class Rule

Commandaddress range start-ip end-ip

Parameter

N/A

Description
Command

Configuration mode

Mode
Usage Guide

This command is used for server configuration and to configure the range of the IP address assigned to an
STA when a class rule is matched.

4-23

Configuration Guide

Configuring DHCP

Configuration
Example

Configuring Class Rules

Configuration

1: Create a global class rule, for example, test-class.

Steps
Ruijie(config)# ip dhcp class test-class
2: Enter the relay-agent-info configuration mode.
Ruijie(config-dhcp-class)# relay agent information
3: Add the option82 information sent from a specified port as the matching rule.
Ruijie(config-dhcp-class-relayinfo)# relay-information hex 010400100201020301002
4: Associate the class rule with an address pool and specify the address network segment.
Ruijie(config)# ip dhcp pool test-pool
Ruijie(dhcp-config)# class test-class
Ruijie(config-dhcp-pool-class)# address range 1.1.1.10 1.1.1.20
Verification

Run the show running-config command to check whether the configuration is successful.
Ruijie# show running-config
ip dhcp class test-classrelay agent information
relay-information hex 0104001002010203010020!
ip dhcp pool test-poolclass test-classaddress range 1.1.1.10 1.1.1.20

4.4.4 Configuring Global Properties of DHCP Server
Configuration EffectEnable a server with specific functions, for example, ping and compulsory NAK.

Notes
Configuring the command may cause exceptions on other servers.

Configuration Steps

Configuring Excluded IP Address

4-24

Configuration Guide

Configuring DHCP

Optional. Configure some addresses or address ranges as unavailable.

Run the ip dhcp excluded-address command in global configuration mode.

Configuring Compulsory NAK Reply

Optional. A server replies to a wrong address request with a NAK packet.

Run the ip dhcp force-send-nak command in global configuration mode.

Configuring VRRP Status Monitoring

Optional. After configuration, DHCP packets are processed by the Master server.



Run the ip dhcp monitor-vrrp-state command in global configuration mode.

Configuring Ping Times

Optional. Check the address reachability with the ping command. The default is 2.

Run the ip dhcp ping packet command in global configuration mode.

Configuring Ping Timeout

Optional. Check the address reachability with the ping command. The default is 500 ms.



Run the ip dhcp ping timeout command in global configuration mode.



Detecting User Offline Detection

Configure a DHCP server to detect whether the client is offline or not. If a client does not get online after being offline
for a period, the address assigned to the client will be retrieved.

Verification
Run the dhcp-server command, and check the configuration during address assignment.

Related Commands

Configuring Excluded IP Address

Commandip dhcp excluded-address low-ip-address [ high-ip-address ]Parameter

low-ip-address: Indicates a start IP address.

Description
Commandhigh-ip-address: Indicates an end IP address.
Global configuration mode

Mode
Usage Guide

Unless otherwise specified, a DHCP server assigns all the addresses from an IP address pool to DHCP
clients. To reserve some addresses (e.g., addresses already assigned to the server or devices), youneed to configure these addresses as excluded addresses. To configure a DHCP server, it isrecommended to configure excluded addresses to avoid address conflict and shorten detection time
during address assignment.

Configuring Compulsory NAK Reply

4-25

Configuration Guide

Commandip dhcp force-send-nak

Parameter

N/A

Configuring DHCP

Description
Command

Global configuration mode

Mode
Usage Guide

The server sends a NAK packet only when it finds the client's lease record. When a DHCP client crosses
the network, a DHCP server cannot find lease record of the client and will not reply with a NAK packet.
The client sends request packets continually before obtaining an IP address again after timeout.
Consequently, it takes a long to obtain an IP address. This also occurs when a DHCP server loses alease after restart and a client requests lease renewal. In this case, you may configure a command toforce the DHCP server to reply with a NAK packet even though it cannot find the lease record so that theclient may obtain an IP address rapidly. Please note that the command is disabled by default. To enable
it, only one DHCP server can be configured in a broadcast domain.

Configuring Ping Times

Commandip dhcp ping packets [ number ]Parameter

number: (Optional) Ranges from 0 to 10. 0 indicates the ping function is disabled. The default is two

Description

pings.

Command

Global configuration mode

Mode
Usage Guide

By default, when a DHCP server assigns an IP address from a pool, it runs the Ping command twice(one packet per time). If there is no reply, the server takes the address as idle and assigns it to a client. If
there is a reply, the server takes the address as occupied and assigns another address.

Configuring Ping Timeout

Commandip dhcp ping timeout milliseconds

Parameter

milliseconds: Indicates the time that it takes for a DHCP server to wait for a ping reply. The value ranges

Description

from 100 ms to 10,000 ms.

Command

Global configuration mode

Mode
Usage Guide

By default, if a DHCP server receives no Ping reply within 500 ms, the IP address is available. You may
adjust the ping timeout to change the time for a server to wait for a reply.

Configuration
Example

Configuring Ping

4-26

Configuration Guide

Configuring DHCP

Configuratio

Set ping times to 5.

n StepsSet ping timeout to 800ms.

Ruijie(config)# ip dhcp ping packet 5
Ruijie(config)# ip dhcp ping timeout 800
Verification

Run the show running-config command to display the configuration.
Ruijie# show running-config | begin ip dhcp
ip dhcp ping packet 5
ip dhcp ping timeout 800

Configuring Excluded IP Address

Configuratio

Configure the excluded IP address from 192.168.0.0 to 192.168.255.255.

n StepsRuijie(config)# ip dhcp excluded-address 192.168.0.0 192.168.255.255
Verification

Run the show running-config command to display the configuration.
Ruijie(config)# show running-config | begin ip dhcp
ip dhcp excluded-address 192.168.0.0 192.168.255.255

4.4.5 Configuring Basic DHCP Relay Functions
Configuration Effect

Deploy dynamic IP management in Client–Relay–Server mode to achieve communication between a DHCP client
and a DHCP server, which are in different network segments.

Notes


To enable DHCP Relay, you need to configure IPv4 unicast routing in a network.

Configuration Steps

Enabling DHCP Relay



Mandatory.



Unless otherwise specified, you need to enable DHCP Relay on a device.

Configuring IP Address for DHCP Server

Mandatory.



You need to configure an IP address for a DHCP server.

4-27

Configuration Guide

Configuring DHCP

Verification


Check whether a client obtains an IP address through DHCP Relay.

Related Commands

Enabling DHCP Relay

Commandservice dhcp

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring IP Address for DHCP Server

Command

ip helper-address { cycle-mode | A.B.C.D }Parameter

cycle-mode: Indicates that DHCP request packets are forwarded to all DHCP servers.

Description
Command

A.B.C.D: Indicates the IP address of a server.
Global configuration mode/interface configuration mode

Mode
Usage Guide

You may configure the function on a layer-3 interface, such as a routed port, a L3 AP port, SVI andloopback interface.
The configured interface must be accessible via IPv4 unicast routing.

Configuration
Example

Configuring DHCP Relay in Wired Connection

Scenario
Figure 4-10

ConfiguratioEnable a client with DHCP to obtain an IP address.

n Steps

Enable the DHCP Relay function on a DHCP relay agent.

Configure DHCP Server.

A

Enable a client with DHCP to obtain an IP address.

4-28

Configuration Guide

B

Configuring DHCP

Enable DHCP Relay.
Ruijie(config)# service dhcp
Configure a global IP address of a DHCP server.
Ruijie(config)# ip helper-address 172.2.2.1
Configure an IP address for the port connected to the client.
Ruijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ip address 192.1.1.1 255.255.255.0
Configure an IP address for the port connected to the server.
Ruijie(config)# interface vlan 2
Ruijie(config-if-VLAN 2)# ip address 172.2.2.2 255.255.255.0

C

Enable DHCP Server.
Ruijie(config)# service dhcp
Configure an address pool.
Ruijie(config)# ip dhcp pool relay
Ruijie (dhcp-config)#network 192.1.1.0 255.255.255.0
Ruijie (dhcp-config)#default-router 192.1.1.1
Configure an IP address for the port connected to the relay agent.
Ruijie(config)# interface gigabitEthernet 0/1
Ruijie(config-if-gigabitEthernet 0/1)# ip address 172.2.2.1 255.255.255.0

Verification

Check whether the client obtains an IP address.


Check whether the client obtains an IP address.



Check the DHCP Relay configuration.

A

The user device obtains an IP address.

B

After login to the DHCP relay agent, run the show running-config command in privileged EXEC mode
to display DHCP Relay configuration.
Ruijie# show running-config
service dhcp
ip helper-address 172.2.2.1!
interface GigabitEthernet 0/1
ip address 192.1.1.1 255.255.255.0!
interface GigabitEthernet 0/2

4-29

Configuration Guide

Configuring DHCP

ip address 172.2.2.2 255.255.255.0!

Common Errors
IPv4 unicast routing configuration is incorrect.



DHCP Relay is disabled.

No routing between DHCP relay agent and DHCP server is configured.

No IP address is configured for the DHCP server.

4.4.6 Configuring DHCP Relay Option 82
Configuration Effect

Through a DHCP relay agent, a server may assign IP addresses of different privileges to the clients more accurately
based on the option information.

Notes


You need to enable the DHCP Relay function.

Configuration Steps

Enabling Basic DHCP Relay Functions



Mandatory.



Unless otherwise specified, you need to enable DHCP Relay on a device.

Enables DHCP Option82

By default, DHCP Option 82 is disabled.

You may run the ip dhcp relay information option82 command to enable or disable DHCP Option 82.

Verification


Check whether the client obtains an IP address based on Option 82.

Related Commands

Enabling DHCP Option 82

Commandip dhcp relay information option82

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

N/A

4-30

Configuration Guide

Configuring DHCP

Configuration
Example

Enabling DHCP Option 82

ConfiguratioEnable DHCP Option 82.

n StepsConfigure sub-option commands.

Ruijie(config)# ip dhcp relay information option82
Verification

After login to the DHCP relay agent, run the show running-config command in privileged EXEC mode
to display DHCP Relay configuration.
Ruijie# show running-config | include ip dhcp relay
ip dhcp relay information option82

Common ErrorsBasic DHCP Relay functions are not configured.

4.4.7 Configuring DHCP Relay Check Server-ID
Configuration EffectAfter you configure the ip dhcp relay check server-id, a DHCP Relay agent will forward DHCP request packets
only to the server specified by the option server-id command. Otherwise, they are forwarded to all DHCP servers.

Notes


You need to enable basic DHCP Relay functions.

Configuration Steps

Enabling DHCP Relay Check Server-ID

By default, DHCP Relay check server-id is disabled.

You may run the ip dhcp relay check server-id command to enable DHCP Relay check server-id.

Verification
Check whether a DHCP Relay agent sends DHCP request packets only to the server specified by the option server-id
command.

Related Commands

Configuring DHCP Relay Check Server-ID

Commandip dhcp relay check server-id

Parameter

N/A

Description

4-31

Configuration Guide

Command

Configuring DHCP

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring DHCP Relay Check Server-ID

ConfiguratioEnable DHCP Relay. Omitted.

n Steps

Enable DHCP Relay check server-id on an interface.

Ruijie# configure terminal
Ruijie(config)# ip dhcp relay check server-id
Verification

After login to the DHCP relay agent, run the show running-config command in privileged EXEC mode
to display DHCP Relay configuration.
Ruijie# show running-config | include check server-id
ip dhcp relay check server-id
Ruijie#Common ErrorsBasic DHCP Relay functions are not configured.

4.4.8 Configuring DHCP Client
Configuration EffectEnable DHCP Client on a device so that it obtains IP addresses and configurations dynamically.

Notes
Ruijie products support DHCP Client configuration on Ethernet, FR, PPP and HDLC interfaces.

Configuration Steps
Run the ip address dhcp command on an interface.

Verification
Check whether the interface obtains an IP address.

Related Commands

Configuring DHCP Client

Command

ip address dhcp

4-32

Configuration Guide

Parameter

Configuring DHCP

N/A

Description
Command

Interface configuration mode

Mode
Usage



Ruijie products support dynamic IP address obtainment by an Ethernet interface.

Guide



Ruijie products support dynamic IP address obtainment by a PPP-encapsulated interface.

Ruijie products support dynamic IP address obtainment by an FR-encapsulated interface.

Ruijie products support dynamic IP address obtainment by an HDLC-encapsulated interface.

Configuration
Example

Configuring DHCP Client

Configuratio

1: Enable port VLAN 1 with DHCP to obtain an IP address.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ip address dhcp
Verification

1: Run the show running-config command to display the configuration.
Ruijie# show running-config | begin ip address dhcp
ip address dhcp

4.5 Monitoring
Clearing
Running the clear commands may lose vital information and interrupt services.
Description

CommandClears DHCP address binding.

clear ip dhcp binding { address | *}Clears DHCP address conflict.

clear ip dhcp conflict { address | *}Clears statistics of a DHCP server.

clear ip dhcp server statistics

Clears statistics of a DHCP relay.

clear ip dhcp relay statistics

Clears statistics of DHCP server

clear ip dhcp server rate

performance.

4-33

Configuration Guide

Configuring DHCP

Clears the address assigned by theclear ip dhcp history { * | mac-address }DHCP server.

Displaying
Description

Command

Displays the excluded address.

show dhcp exclude

Displays DHCP lease.

show dhcp lease

Displays the binding address.

show dhcp manual-bind

Displays all DHCP address poolshow dhcp namenames.
Displays whether DHCP server isshow dhcp state

enabled.
Displays the configuration of ashow dhcp pool namespecified address pool.
Displays DHCP sockets.

show ip dhcp socket

Displays assigned IP addresses.

show ip dhcp binding

Displays created address pools.

show ip dhcp pool

Displays statistics of DHCP Server.

show ip dhcp server statistics

Displays conflicted addresses.

show ip dhcp conflict

Displays DHCP lease history.

show ip dhcp history

Displays the address pool ID andshow ip dhcp identifier

address

utilization of

a DHCP

server.
Displays statistics of DHCP Relay.

show ip dhcp relay-statistics

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs DHCP agent.

debug ip dhcp server agent

Debugs DHCP hot backup.

debug ip dhcp server ha

4-34

Configuration Guide

Debugs DHCP address pools.

debug ip dhcp server pool

Debugs DHCP VRRP.

debug ip dhcp server vrrp

Debugs all DHCP servers.

debug ip dhcp server all

Debugs DHCP packets.

debug ip dhcp client

Debugs DHCP Relay events.

debug ip dhcp relay

4-35

Configuration Guide

Configuring DHCPv6

5 Configuring DHCPv6
5.1 Overview
The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) is a protocol that allows a DHCP server to transfer
configurations (such as IPv6 addresses) to IPv6 nodes.
As compared with other IPv6 address allocation methods, such as manual configuration and stateless automatic addressconfiguration, DHCPv6 provides the address allocation, prefix delegation, and configuration parameter allocation.



DHCPv6 is a stateful protocol for automatically configuring addresses and flexibly adding and reusing network
addresses, which can record allocated addresses and enhance network manageability.



By using the prefix delegation of DHCPv6, uplink network devices can allocate address prefixes to downlink network
devices, which implements flexible station-level automatic configuration and flexible control of station address space.



The DHCPv6 configuration parameter allocation solves the problem that parameters cannot be obtained through astateless automatic address configuration protocol and allocates DNS server addresses and domain names to hosts.

DHCPv6 is a protocol based on the client/server model. A DHCPv6 client is used to obtain various configurations whereas
a DHCPv6 server is used to provide various configurations. If the DHCPv6 client and DHCPv6 server are not on the same
network link (the same network segment), they can interact with each other by using a DHCPv6 relay agent.
The DHCPv6 client usually discovers the DHCPv6 server by reserving multicast addresses within a link; therefore, the
DHCPv6 client and DHCPv6 server must be able to directly communicate with each other, that is, they must be deployedwithin the same link. This may cause management inconvenience, economic waste (a DHCPv6 server is deployed foreach subnet) and upgrade inconvenience. The DHCPv6 relay agent function can solve these problems by enabling a
DHCPv6 client to send packets to a DHCPv6 server on a different link. The DHCP relay agent is often deployed within thelink where a DHCPv6 client resides and is used to relay interaction packets between the DHCPv6 client and DHCPv6
server. The DHCP relay agent is transparent to the DHCPv6 client.
Figure 5-1

Protocols andStandards


RFC 3315: Dynamic Host Configuration Protocol for IPv6



RFC 3633: IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) Version 6



RFC 3646: DNS Configuration Options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)

5-1

Configuration Guide

Configuring DHCPv6



RFC 3736: Stateless DHCP Service for IPv6



RFC 5417: Control And Provisioning of Wireless Access Points (CAPWAP) Access Controller DHCP Option

5.2 Applications
Application
Requesting/Allocating
Addresses and Configuration

Description
A DHCPv6 client requests addresses from a DHCPv6 server. The DHCPv6 server
allocates addresses and configuration parameters to the DHCPv6 client.

Parameters
Requesting/Allocating
Prefixes

The DHCPv6 client requests a prefix from the DHCPv6 server. The DHCPv6 server
allocates a prefix to the DHCPv6 client and then the DHCPv6 client configures IPv6
addresses by using this prefix.

Relay Service

The DHCPv6 relay is used to enable communication between the DHCPv6 client and
DHCPv6 server on different links.

5.2.1 Requesting/Allocating Addresses and Configuration Parameters
Scenario
In a subnet, a DHCPv6 client requests addresses from a DHCPv6 server. The DHCPv6 server allocates addresses andconfiguration parameters to the DHCPv6 client.
As shown in Figure 5-2:

The DHCPv6 server is configured with IPv6 addresses, DNS servers, domain names and other configuration
parameters to be allocated.

A host works as a DHCPv6 client to request an IPv6 address from the DHCPv6 server. After receiving the request,
the DHCPv6 server selects an available address and allocates the address to the host.

The host can also request a DNS server, domain name and other configuration parameters from the DHCPv6
server.

Figure 5-2

Deployment
Run the DHCPv6 client on a host in the subnet to obtain an IPv6 address and other parameters.

5-2

Configuration GuideConfiguring DHCPv6

Run the DHCPv6 server on a device and configure the IPv6 address and other parameters to allocate the IPv6
address and parameters.

5.2.2 Requesting/Allocating Prefixes
Scenario
As shown in Figure 5-3, an uplink device (PE) allocates an IPv6 address prefix for a downlink device (CPE). The CPE
generates a new address prefix for the internal subnet based on the obtained prefix. Hosts in the internal subnet of the
CPE are configured with addresses through Router Advertisement (RA) by using the new address prefix.



The PE provides the prefix delegation service as a DHCPv6 server.

The CPE requests an address prefix from the PE as a DHCPv6 client. After obtaining the address prefix, the CPE
generates a new address prefix for the internal subnet and sends an RA message to hosts in the internal subnet.

The hosts in the internal subnet where CPE resides configure their addresses based on the RA message sent by the
CPE.

Figure 5-3

RemarkThe Provider Edge (PE) works as a DHCPv6 server for providing prefixes and is also called a delegatingsrouter.
The Customer Premises Equipment (CPE) works as a DHCPv6 client for requesting prefixes and is also
called a requesting router.
A, B and C are various hosts.

Deployment
Run the DHCPv6 server on the PE to implement the prefix delegation service.



Run the DHCPv6 client on the CPE to obtain address prefixes.



Deploy IPv6 ND between the CPE and the hosts to configure the host addresses in the subnet through RA.

5.2.3 Relay Service
Scenario
The DHCPv6 relay agent provides the relay service for the DHCPv6 client ad DHCPv6 server on different links to enablecommunication between them.
As shown in Figure 5-4:

Device 1 is enabled with the DHCPv6 relay agent and destined to 3001::2.

5-3

Configuration GuideConfiguring DHCPv6

Device 2 wants to forward packets to other servers through a next-level relay service. Enable the DHCPv6 relay
agent on Device 2, set the destination address to FF02::1:2 (all servers and Relay multicast addresses) and specify
the egress interface as the layer-3 interface gi 0/1.

Figure 5-4

Deployment
Enable the DHCPv6 relay agent on device 1 and specify the address as 3000::1.



Enable the DHCPv6 relay agent on device 2 and specify the address as FF02::1:2.

5.3 Features
Basic Concept



DUID

The DHCP Unique Identifier (DUID) identifies a DHCPv6 device. As defined in RFC 3315, each DHCPv6 device (DHCPv6
client, relay or server) must have a DUID, which is used for mutual authentication during DHCPv6 message exchange.
RFC 3315 defines three types of DUIDs:



DUID Based on Link-Layer address plus Time (DUID-LLT).

DUID Assigned by Vendor Based on Enterprise Number (DUID-EN).



Link-Layer address (DUID-LL).

Ruijie DHCPv6 devices use DUID-LLs. The structure of a DUID-LL is as follows:

5-4Configuration Guide

Configuring DHCPv6

The values of DUID-LL, Hardware type, and Link-layer address are 0x0003, 0x0001 (indicating the Ethernet), and MAC
address of a device respectively.



Identity Association (IA)A DHCPv6 server allocates IAs to DHCPv6 clients. Each IA is uniquely identified by an identity association identifier (IAID).
IAIDs are generated by DHCPv6 clients. A one-to-one mapping is established between IAs and clients. An IA may containseveral addresses, which can be allocated by the client to other interfaces. An IA may contain one of the following types ofaddresses:



Non-temporary Addresses (NAs), namely, globally unique addresses.



Temporary Addresses (TAs), which are hardly used.

Prefix Delegation (PD).

Based on the address type, IAs are classified into IA_NA, IA_TA, and IA_PD (three IA-Types). Ruijie DHCPv6 servers
support only IA_NA and IA_PD.



Binding

A DHCPv6 binding is a manageable address information structure. The address binding data on a DHCPv6 serverrecords the IA and other configurations of every client. A client can request multiple bindings. The address binding data on
a server is present in the form of an address binding table with DUID, IA-Type and IAID as the indexes. A binding
containing configurations uses DUID as the index.



DHCPv6 Conflict

When an address allocated by a DHCPv6 client is in conflict, the client sends a Decline packet to notify the DHCPv6
server that the address is rebound. Then, the server adds the address to the address conflict queue. The server will not
allocate the addresses in the address conflict queue. The server supports viewing and clearing of address information in
the address conflict queue.

Packet Type

RFC 3315 stipulates that DHCPv6 uses UDP ports 546 and 547 for packet exchange. Specifically, a DHCPv6 client uses
port 546 for receiving packets, while a DHCPv6 server and DHCPv6 relay agent use port 547 for receiving packets. RFC
3315 defines the following types of packets that can be exchanged among the DHCPv6 server, client, and relay agent:Packets that may be sent by a DHCPv6 client to a DHCPv6 server include Solicit, Request, Confirm, Renew, Rebind,
Release, Decline, and Information-request.

Packets that may be sent by a DHCPv6 server to a DHCPv6 client include Advertise, Reply, and Reconfigure.

Packets that may be sent by a DHCPv6 relay agent to another DHCPv6 relay agent or a DHCPv6 server include
Relay-forward.

5-5

Configuration GuideConfiguring DHCPv6

Packets that may be sent by a DHCPv6 relay agent to another DHCPv6 relay agent or a DHCPv6 server include
Relay-reply.
Ruijie DHCPv6 servers do not support the Reconfigure packet.
Ruijie DHCPv6 clients do not support the Confirm and Reconfigure packets.

Overview
FeatureDescription

Requesting/Allocating

Dynamically obtains/allocates IPv6 addresses in a network in the client/server mode.

Addresses
Requesting/Allocating Prefixes

Dynamically obtains/allocates IPv6 prefixes in a network in the client/server mode.

Stateless Service

Provides stateless configuration service for hosts in a network.

Relay Service

Provides the DHCPv6 server service for hosts in different networks by using the relay
service.

5.3.1 Requesting/Allocating Addresses
A DHCPv6 client can request IPv6 addresses from a DHCPv6 server.
After being configured with available addresses, a DHCPv6 server can provide IPv6 addresses to hosts in the network,
record the allocated addresses and improve the network manageability.

Working Principle
Network hosts serve as DHCPv6 clients and DHCPv6 servers to implement address allocation, update, confirmation,
release and other operations through message exchange.



Four-Message Exchange

Figure 5-5 shows the four-message exchange process.
Figure 5-5



A DHCPv6 client sends a Solicit message whose destination address is FF02::1:2 and destination port number is
547 within the local link to request address, prefix and configuration parameter allocation. All DHCPv6 servers or
DHCPv6 relay agents within the link will receive the Solicit message.



After receiving the Solicit message, a DHCPv6 server will send an Advertise message in the unicast mode if it can
provide the information requested in the Solicit message. The Advertise message includes the address, prefix andconfiguration parameters.

5-6

Configuration GuideConfiguring DHCPv6

The DHCPv6 client may receive the Advertise message from multiple DHCPv6 servers. After selecting the mostsuitable DHCPv6 server, the DHCPv6 client sends a Request message whose destination address is FF02::1:2 anddestination port number is 547 to request address, prefix and configuration parameter allocation.



After receiving the Request message, the DHCPv6 server creates a binding locally and sends a Reply message inthe unicast mode. The Reply message includes the address, prefix and configuration parameters that the DHCPv6
server will allocate to the DHCPv6 client. The DHCPv6 client obtains address, prefix or configuration parameters
based on the information in the Reply message.



Two-Message Exchange

Two-message exchange can be used to complete address, prefix and parameter configuration for DHCPv6 clients more
quickly.
Figure 5-6



A DHCPv6 client sends a Solicit message whose destination address is FF02::1:2 and destination port number is
547 within the local link to request address, prefix and configuration parameter allocation. The Solicit message
contains Rapid Commit.



If a DHCPv6 server supports the Rapid Commit option, the DHCPv6 server creates a binding locally and sends a
Reply message in the unicast mode. The Reply message includes the address, prefix and configuration parameters
to be allocated to the DHCPv6 client. The DHCPv6 client completes configuration based on the information in the
Reply message.

Update and Rebinding

The DHCPv6 server provides the control address and the updated T1 and T2 in the IA of the message sent to the
DHCPv6 client.
Figure 5-7

5-7

Configuration GuideConfiguring DHCPv6

The DHCPv6 client will send a Renew multicast message to the DHCPv6 server for updating the address and prefix
after T1 seconds. The Renew message contains the DUID of the DHCPv6 server and the IA information to be
updated.



After receiving the Renew message, the DHCPv6 server checks whether the DUID value in the Renew message isequal to the DUID value of the local device. If yes, the DHCPv6 server updates the local binding and sends a Reply
message in the unicast mode. The Reply message contains the new T1 and other parameter s.

Figure 5-8



If no response is received after the DHCPv6 client sends a Renew message to the DHCPv6 server, the DHCPv6
client will send a Rebind multicast message to the DHCPv6 server for rebinding the address and prefix after T2
expires.



After receiving the Rebind message, the DHCPv6 server (perhaps a new DHCPv6 server) sends a Reply message
according to the content of the Rebind message.



ReleaseIf a DHCPv6 client needs to release an address or a prefix, the DHCPv6 client needs to send a Release message to a
DHCPv6 server to notify the DHCPv6 server of the released addresses or prefixes. In this way, the DHCPv6 server can
allocate these addresses and prefixes to other DHCPv6 clients.
Figure 5-9After receiving the Release message, the DHCPv6 server removes the corresponding bindings based on theaddresses or prefixes in the Release message, and sends a Reply message carrying the state option to the DHCPv6
client.



Confirmation

After moving to a new link (for example, after restart), a DHCPv6 client will send a Confirm message to the DHCPv6
server on the new link to check whether the original addresses are still available.

5-8Configuration Guide

Configuring DHCPv6

Figure 5-10

After receiving the Confirm message, the DHCPv6 server performs confirmation based on the address information in
the Confirm message, and sends a Reply message carrying the state option to the DHCPv6 client. If the confirmation
fails, the DHCPv6 client may initiate a new address allocation request.



DHCPv6 Conflict

If the DHCPv6 client finds that the allocated addresses have been used on the link after address allocation is completed,the DHCPv6 client sends a Decline message to notify the DHCPv6 server of the address conflict.
Figure 5-11

The DHCPv6 client includes the IA information of the conflicted addresses in the Decline message.



After receiving the Decline message, the DHCPv6 server marks the addresses in the Decline message as "declined"
and will not allocate these addresses. Then, the DHCPv6 server sends a Reply message carrying the state option to
the DHCPv6 client. You can manually clear addresses marked as "declined" to facilitate re-allocation.

Related Configuration

Enabling the DHCPv6 Client Address Request Function on an Interface

By default, an interface is not enabled with the DHCPv6 client address request function.

You can run the ipv6 dhcp client ia command to enable the DHCPv6 client address request function for theinterface.
The DHCPv6 client address request function is effective only on a layer-3 interface.

5.3.2 Requesting/Allocating Prefixes
Configure available prefixes on the DHCPv6 server. By using the prefix delegation of DHCPv6, uplink network devices
can allocate address prefixes to downlink network devices, which implements flexible station-level automatic configurationand flexible control of station address space.

5-9Configuration Guide

Configuring DHCPv6

Working Principle
Downlink network devices serve as DHCPv6 clients to exchange messages with the DHCPv6 server to implement
address allocation, update, release and other operations. Downlink network devices obtain, update, rebind and releaseprefixes by using the four-/two-message exchange mechanism similar to that for allocating addresses. However, prefix
allocation is different from address allocation in the following aspects:

In message exchange using the prefix delegation, the Confirm and Decline messages are not used.



If a DHCPv6 client moves to a new link and needs to check whether the prefix information is available, it performs
confirmation through Rebind and Reply message exchange.



The IA type in various messages is IA_PD.
For the message exchange using the prefix delegation, refer to the section "Requesting/Allocating Addresses".

Related Configuration

Enabling the DHCPv6 Client Prefix Request Function on an Interface

By default, an interface is not enabled with the DHCPv6 client prefix request function.
You can run the ipv6 dhcp client pd command to enable or disable the DHCPv6 client prefix request function for theinterface.
The DHCPv6 client prefix request function is effective only on a layer-3 interface.

5.3.3 Stateless Service
When a DHCPv6 client needs only configuration parameters, the DHCPv6 stateless service can be used to obtain related
configuration parameters which cannot be obtained through a stateless automatic address configuration protocol, such as
the DNS server address.

Working Principle
Network hosts serve as DHCPv6 clients to exchange messages with the DHCPv6 server to obtain and update
configuration parameters.



Message Exchange Using the Stateless Service

Figure 5-12



A DHCPv6 client sends an Information-request message to a DHCPv6 server to request stateless messages.
Usually, this message does not contain the DUID of the specified DHCPv6 server.



The DHCPv6 server sends a Reply message containing the configuration parameters to the DHCPv6 client.

5-10

Configuration Guide

Configuring DHCPv6

Related Configuration

Stateless Service of a DHCPv6 Client

By default, an interface is not enabled with the stateless service of the DHCPv6 client.



If a host receives an RA message containing the O flag, it will enable the stateless service.

5.3.4 Relay Service
When the DHCPv6 client and DHCPv6 server are on different links, the DHCPv6 client can relay related messages to the
DHCPv6 server through the DHCPv6 relay agent. The DHCPv6 server also relays the response to the DHCPv6 client
through the relay agent.

Working Principle
When receiving a message from the DHCPv6 client, the DHCPv6 relay agent creates a Relay-forward message. Thismessage contains the original message from the DHCPv6 client and some options added by the relay agent. Then, therelay agent sends the Relay-forward message to a specified DHCPv6 server or a specified multicast address FF05::1:3.
After receiving the Relay-forward message, the DHCPv6 server extracts the original message from the DHCPv6 client f
for processing. Then, the DHCPv6 server constructs a response to the original message, encapsulates the response in a
Relay-reply message, and then sends the Relay-reply message to the DHCPv6 relay agent.
After receiving the Relay-reply message, the DHCPv6 relay agent extracts the original message from the DHCPv6 server
for processing, and forwards the message to the DHCPv6 client.
Multi-level relay agents are allowed between the DHCPv6 client and DHCPv6 server.



DHCPv6 Relay Agent

Figure 5-13

The DHCPv6 relay agent performs message encapsulation and decapsulation between the DHCPv6 client and
DHCPv6 server to enable communication between the DHCPv6 client and DHCPv6 server on different links.

5.4 Configuration
Configuration
ConfiguringtheDescription and Command
DHCPv6

Relay
Configuring(Mandatory) It is used to enable the DHCPv6 relay agent service.
ipv6 dhcp relay destination

the

DHCPv6

Configures the DHCPv6 relay agent function.

(Mandatory) It is used to request addresses or prefixes.

5-11Configuration Guide
Configuration

Configuring DHCPv6
Description and Command

ClientEnables the DHCPv6 client and requests IANA

ipv6 dhcp client ia

addresses.
Enables the DHCPv6 client and requests

ipv6 dhcp client pd

address prefixes.

(Optional) It is used to enable a host that receives an RA message to request
stateless service through the DHCPv6 client.
Sets the O flag in the RA message on thedevice that sends the RA message so that theipv6 nd other-config-flag

host that receives the RA message can request
stateless service through the DHCPv6 client.

5.4.1 Configuring the DHCPv6 Relay
Configuration Effect

A DHCPv6 relay agent can be configured for address allocation, prefix delegation and parameter allocation to enablecommunication between the DHCPv6 client and server on different links.

Notes


A destination address must be specified. If the destination address is a multicast address (such as FF05::1:3), youalso need to specify an egress interface.

Configuration Steps

Configuring the DHCPv6 Relay Agent Function

Mandatory.



Unless otherwise specified, you should configure the DHCPv6 relay agent function on all devices that need toprovide the DHCPv6 relay agent service.

Verification
The DHCPv6 client and DHCPv6 server exchange messages through the relay agent.

Check whether the interface is enabled with the DHCPv6 relay.

Check whether the DHCPv6 relay agent can receive and send messages.

Related Commands

Configuring the DHCPv6 Relay Agent Function

CommandParameteripv6 dhcp relay destination ipv6-address [ interface-type interface-number ]ipv6-address: Specifies the destination address of the relay agent.

Description
interface-type: Specifies the type of the destination interface (optional).
interface-number: Specifies the destination interface number (optional).

5-12Configuration Guide
Command

Configuring DHCPv6

Interface configuration mode

Mode
Usage GuideAll DHCPv6 packets from clients received by an interface enabled with the DHCPv6 relay function will be
encapsulated and sent to a specified destination address (or multiple destination addresses) through aspecified interface (optional).

Configuration
Example

Configuring the DHCPv6 Relay

Configuratio

Specify an interface enabled with the relay service to forward received DHCPv6 client packets to an Steps

specified destination address through the specified interface (optional).
Ruijie# configure terminal
Ruijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ipv6 dhcp relay destination 3001::2
Ruijie(config-if-VLAN 1)# ipv6 dhcp relay destination ff02::1:2 vlan 2

Verification

Run the show ipv6 dhcp relay destination all command to display the configured destination
addresses.
Ruijie# show ipv6 dhcp relay destination all
Interface:VLAN 1
Destination address(es)Output Interface

3001::2
ff02::1:2

VLAN 2

Common Errors


The configuration is performed on other interfaces than the Switch Virtual Interface (SVI), routed port and L3 AP port.

5.4.2 Configuring the DHCPv6 Client
Configuration EffectEnable a device to automatically request IPv6 addresses or related parameters from a server.

Notes


The configuration must be performed on layer-3 interfaces.

Configuration Steps

Enabling the DHCPv6 Client and Requesting IANA Addresses

Mandatory.

5-13

Configuration GuideConfiguring DHCPv6

Unless otherwise specified, you should enable the DHCPv6 client address request function on all devices that needto request addresses.

Enabling the DHCPv6 Client and Requesting Address Prefixes

Mandatory.



Unless otherwise specified, you should enable the DHCPv6 client prefix request function on all devices that need torequest prefixes.

Enabling the Stateless Service of the DHCPv6 Client

It is mandatory if the DHCPv6 client needs to obtain configuration parameters.

Verification
Check whether the interface is enabled with the DHCPv6 client and check the addresses, prefixes and other configuration
obtained on the interface.

Related Commands

Enabling the DHCPv6 Address Request Function

Commandipv6 dhcp client ia [ rapid-commit ]Parameter

rapid-commit: Permits the simplified message exchange process.

Description
Command

Interface configuration mode

Mode
Usage Guide

If the DHCPv6 client mode is not enabled, this command will enable the DHCPv6 client mode on theinterface.
After the ipv6 dhcp client ia command is configured, an IANA address request will be sent to the
DHCPv6 server.
The rapid-commit keyword permits the two-message exchange process between the client and server.
If this keyword is configured, the Solicit message sent by the client contains the rapid-commit option.

Enabling the DHCPv6 Client Prefix Request

Commandipv6 dhcp client pd prefix-name [ rapid-commit ]Parameter

prefix-name: Indicates a IPv6 general prefix.

Description
Commandrapid-commit: Permits the simplified message exchange process.
Interface configuration mode

Mode
Usage Guide

If the DHCPv6 client mode is not enabled, this command will enable the DHCPv6 client mode on theinterface.

5-14

Configuration Guide

Configuring DHCPv6

After the ipv6 dhcp client pd command is configured, a prefix request will be sent to the DHCPv6
server. After receiving the prefix, the client will save the prefix in the IPv6 general prefix pool. Then, othercommands and applications can use this prefix.
The rapid-commit keyword permits the two-message exchange process between the client and server.
If this keyword is configured, the Solicit message sent by the client contains the rapid-commit option.

Configuring Stateless Service

Commandipv6 nd other-config-flag

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

Configure this command on a host that sends the RA message. Then, the host that receives the RA
message obtains stateless configurations through the DHCPv6 client.

Configuration
Example

Enabling the DHCPv6 Address Request Function

Configuratio

Configure the DHCPv6 client address request function on an interface.

n StepsRuijie(config)# interface vlan 1
Ruijie(config-if-VLAN 1)# ipv6 dhcp client ia
Verification

Run the show ipv6 dhcp interface command to display whether the interface is enabled with the
DHCPv6 client.
Ruijie# show ipv6 dhcp interface vlan 1
vlan 1 is in client mode
Rapid-Commit: disableEnabling the DHCPv6 Client Prefix Request

Configuratio

Configure the DHCPv6 client prefix request function on an interface.

n StepsRuijie(config)# interface VLAN 1
Ruijie(config-if-VLAN 0/1)# ipv6 dhcp client pd pd_name
Verification

Run the show ipv6 dhcp interface command to display whether the interface is enabled with the
DHCPv6 client.

5-15

Configuration Guide

Configuring DHCPv6

Ruijie# show ipv6 dhcp interface GigabitEthernet 0/1
GigabitEthernet 0/1 is in client mode
Rapid-Commit: disableEnabling the DHCPv6 Stateless Service

Configuratio

Configure this command on an interface that sends the RA message.

n StepsRuijie# configure terminal
Ruijie(config)# interface vlan 0/1
Ruijie(config-if-VLAN 1)# ipv6 nd other-config-flag
Verification

Run the show ipv6 dhcp interface command to display whether an interface of the host obtains
configuration parameters.
Ruijie# show ipv6 dhcp interface vlan 1
VLAN 1 is in client mode
State is SOLICIT
next packet will be send in : 5 seconds
Rapid-Commit: disable

Common Errors


The DHCPv6 client address request is enabled on non-layer-3 interfaces.



The DHCPv6 address request is enabled on interfaces enabled with the DHCPv6 relay or DHCPV6 server.



The DHCPv6 client prefix request is enabled on non-layer-3 interfaces.



The DHCPv6 prefix request is enabled on interfaces enabled with the DHCPv6 relay or DHCPV6 server.

5.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears the statistics on sent andclear ipv6 dhcp relay statistics

received packets after the DHCPv6
relay is enabled on the current
device.
Restarts the DHCPv6 client.

clear ipv6 dhcp client interface-type interface-number

5-16

Configuration Guide

Displaying
Description

Command

Displays the DUID of a device.

show ipv6 dhcp

Displays DHCPv6 interface.

show ipv6 dhcp interface [ interface-name ]Displays the destination address ofshow ipv6 dhcp relay destination { all | interface-type interface-number }the DHCPv6 relay agent.
Displays the statistics on sent andshow ipv6 dhcp relay statistics

received packets after the DHCPv6
relay is enabled on a device.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs DHCPv6.

debug ipv6 dhcp [ detail ]5-17

Configuration Guide

Configuring DNS

6 Configuring DNS
6.1 Overview
A Domain Name System (DNS) is a distributed database containing mappings between domain names and IP addresseson the Internet, which facilitate users to access the Internet without remembering IP strings that can be directly accessedby computers. The process of obtaining an IP address through the corresponding host name is called domain nameresolution (or host name resolution).

Protocols andStandards


RFC 1034: DOMAIN NAMES - CONCEPTS AND FACILITIES

RFC 1035: DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION

6.2 Applications
Application
Static Domain Name Resolution

Description
Performs domain name resolution directly based on the mapping between adomain name and an IP address on a device.

Dynamic Domain Name Resolution

Obtains the IP address mapped to a domain name dynamically from a DNS serveron the network.

6.2.1 Static Domain Name Resolution
ScenarioPreset the mapping between a domain name and an IP address on a device.

When you perform domain name operations (such as Ping and Telnet) through application programs, the system
can resolve the IP address without being connected to a server on the network.

Deployment
Preset the mapping between a domain name and an IP address on a device.

6.2.2 Dynamic Domain Name Resolution
Scenario

DNS Server is deployed on the network to provide the domain name service.

Domain name "host.com" is deployed on the network.



Device-A applies to DNS Server for domain name "host.com".

Figure 6-1 Dynamic Domain Name Resolution

6-1

Configuration Guide

Configuring DNS

Deployment


Deploy DNS Server as the DNS server of Device-A.

6.3 Features
Basic ConceptsDNS

The DNS consists of a resolver and a DNS server. The DNS server stores the mappings between domain names and IP
addresses of all hosts on the network, and implements mutual conversion between the domain names and IP addresses.
Both the TCP and UDP port IDs of DNS are 53, and generally a UDP port is used.

FeaturesFeatureDomain Name Resolution

Description
IP addresses are obtained based on domain names from a DNS server or a local
database.

6.3.1 Domain Name Resolution
Working Principle

Static Domain Name Resolution

Static domain name resolution means that a user presets the mapping between a domain name and an IP address on a
device. When you perform domain name operations (such as Ping and Telnet) through application programs, the system
can resolve the IP address without being connected to a server on the network.

Dynamic Domain Name Resolution

Dynamic domain name resolution means that when a user perform domain name operations through application
programs, the DNS resolver of the system queries an external DNS server for the IP address mapped to the domain
name.
The procedure of dynamic domain name resolution is as follows:

6-2Configuration Guide
1.

Configuring DNS

A user application program (such as Ping or Telnet) requests the IP address mapped to a domain name from the
DNS resolver of the system.

2.

The DNS resolver queries the dynamic cache at first. If the domain name on the dynamic cache does not expire, theDNS resolver returns the domain name to the application program.

3.

If all domain names expire, the DNS resolver initiates a request for domain name-IP address conversion to theexternal DNS server.

4.

After receiving a response from the DNS server, the DNS resolver caches and transfers the response to theapplication program.

Related Configuration

Enabling Domain Name Resolution



By default, domain name resolution is enabled.

Run the ip domain-lookup command to enable domain name resolution.

Configuring the IP Address Mapped to a Static Domain Name

By default, no mapping between a domain name and an IP address is configured.

Run the ip host command to specify the IPv4 address mapped to a domain name.



Run the ipv6 host command to specify the IPv6 address mapped to a domain name.



Configuring a DNS Server

By default, no DNS server is configured.

Run the ip name-server command to configure a DNS server.

6.4 Configuration
Configuration

Description and Command
Optional.
Enables domain name resolution.

ip domain-lookup
Configuring Static Domain
Name Resolution

Configures the IPv4 address mapped to a

ip hostdomain name.
Configures the IPv6 address mapped to a

ipv6 hostdomain name.

Optional.
Configuring Dynamic
Domain Name Resolution

ip domain-lookup

Enables domain name resolution.

ip name-server

Configures a DNS server.

6-3

Configuration Guide

Configuring DNS

6.4.1 Configuring Static Domain Name Resolution
Configuration Effect
The system resolver resolves the IP address mapped to a domain name on a local device.

Configuration Steps

Enabling Domain Name ResolutionThe domain name resolution function is enabled by default.



If this function is disabled, static domain name resolution does not take effect.

Configuring the IP Address Mapped to a Domain Name

(Mandatory) Domain names to be used must be configured with mapped IP addresses.

Verification


Run the show running-config command to check the configuration.

Run the show hosts command to check the mapping between the domain name and the IP address.

Related Commands

Configuring Enable DNS Domain Name Resolution

CommandParameter

ip domain-lookup
N/A

Description
Command

Global configuration mode

Mode
Usage GuideThis command enables the domain name resolution function.

Configuring the IPv4 Address Mapped to a Domain Name

Command

ip host host-name [ telnet-port ] ip-address
host-name: Indicates a domain name.

Parameter
Description

telnet-port: Indicates a Telnet port number, ranging from 0 to 65535. The default value is 0.
ip-address: Indicates a mapped IPv4 address.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring the IPv6 Address Mapped to a Domain Name

Commandipv6 host host-name [ telnet-port ] ipv6-address

6-4

Configuration Guide

Configuring DNS

host-name: Indicates a domain name.
Parameter
Description

telnet-port: Indicates a Telnet port number, ranging from 0 to 65535. The default value is 0.
ipv6-address: Indicates a mapped IPv6 address.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring Static Domain Name Resolution

Configuratio

Set the IP address of static domain name www.test.com to 192.168.1.1 on a device.

n Steps

Set the IP address of static domain name www.testv6.com to 2001::1 on a device.

Ruijie# configure terminal
Ruijie(config)# ip host www.test.com 192.168.1.1
Ruijie(config)# ipv6 host www.testv6.com 2001::1
Ruijie(config)# exit
Verification

Run the show hosts command to check whether the static domain name entry is configured.
Ruijie# show hosts
Name servers are:

Host

type

Address

TTL(sec)

www.test.com

static192.168.1.1---

www.testv6.com

static2001::1---

6.4.2 Configuring Dynamic Domain Name Resolution
Configuration Effect
The system resolver resolves the IP address mapped to a domain name through a DNS server.

Configuration Steps

Enabling Domain Name Resolution

Domain name resolution is enabled by default.



If this function is disabled, dynamic domain name resolution does not take effect.

Configuring a DNS Server(Mandatory) To use dynamic domain name resolution, you must configure an external DNS server.

6-5

Configuration Guide

Configuring DNS

Verification


Run the show running-config command to check the configuration.

Related Commands

Configuring to Enable DNS Domain Name Resolution

CommandParameter

ip domain-lookup
N/A

Description
Command

Global configuration mode

Mode
Usage GuideThis command enables the domain name resolution function.

Configuring a DNS Server

Command

ip name-server { ip-address | ipv6-address }Parameter

ip-address: indicates the IPv4 address of the DNS server.

Description

ipv6-address: indicates the IPv6 address of the DNS server.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring Dynamic Domain Name Resolution

Scenario
Figure 6-2

Device resolves the domain name through the DNS server (192.168.10.1) on the network.
Configuratio

Set the IP address of the DNS server to 192.168.10.1 on the device.

n Steps
DEVICE# configure terminal
DEVICE(config)# ip name-server 192.168.10.1
DEVICE(config)# exit
Verification

Run the show hosts command to check whether the DNS server is specified.

6-6

Configuration Guide

Ruijie(config)# show hosts
Name servers are:192.168.10.1 static

Host

type

Address

TTL(sec)

6.5 Monitoring
Clearing
Running the clear command during device operation may cause data loss or even interrupt services.
Description

CommandClears the dynamic host nameclear host [ * | host-name ]cache table.

Displaying
Description

Command

Displays DNS parameters.

show hosts [ host-name ]Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs the DNS function.

debug ip dns

6-7

Configuration Guide

Configuring FTP Server

7 Configuring FTP Server
7.1 Overview
The File Transfer Protocol (FTP) server function enables a device to serve as an FTP server. In this way, a user canconnect an FTP client to the FTP server and upload files to and download files from the FTP server through FTP.
A user can use the FTP server function to easily obtain files such as syslog files from a device and copy files to the filesystem of the device through FTP.

Protocols andStandards


RFC 959: FILE TRANSFER PROTOCOL (FTP)

RFC 3659: Extensions to FTP

RFC 2228: FTP Security Extensions



RFC 2428: FTP Extensions for IPv6 and NATs



RFC 1635: How to Use Anonymous FTP

7.2 Applications
Application

Description

Providing FTP Services in a LAN

Provides the uploading and downloading services for a user in a Local Area
Network (LAN).

7.2.1 Providing FTP Services in a LAN
Scenario
Provide the uploading and downloading services for a user in a LAN.
As shown in Figure 7-1, enable the FTP server function only in a LAN.



G and S are enabled with the FTP server function and layer-2 transparent transmission function respectively.

A user initiates a request for FTP uploading and downloading services.

Figure 7-1

Remark

G is an egress gateway device.

s
S is an access device.

7-1

Configuration Guide

Configuring FTP Server

Deployment
G is enabled with the FTP server function.



As a Layer-2 switch, S provides the function of Layer-2 transparent transmission.

7.3 Features
Basic Concepts

FTP

FTP is a standard protocol defined by the IETF Network Working Group. It implements file transfer based on theTransmission Control Protocol (TCP). FTP enables a user to transfer files between two networked computers and is themost important approach to transferring files on the Internet. A user can obtain abundant Internet for free throughanonymous FTP. In addition, FTP provides functions such as login, directory query, file operation, and other session
control. Among the TCP/IP protocol family, FTP is an application-layer protocol and uses TCP ports 20 and 21 fortransmission. Port 20 is used to transmit data and port 21 is used to transmit control messages. Basic operations of FTP
are described in RFC 959.

User Authorization

To connect an FTP client to an FTP server, you should have an account authorized by the FTP server. That is, a user canenjoy services provided by the FTP server after logging in to the FTP server with a user name and password. A maximumof 10 accounts can be configured, a maximum of 2 connections are allowed for each account, and a maximum of 10
connections are supported by the server.



FTP File Transmission Modes

FTP provides two file transmission modes:Text transmission mode (ASCII mode): It is used to transfer text files (such as .txt, .bat, and .cfg files). This mode isdifferent from the binary mode in carriage return and line feed processing. In ASCII mode, carriage return and line
feed are changed to local CRC characters, for example, \n in Unix, \r\n in Windows, and \r in Mac. Assume that a file
being copied contains ASCII text. If a remote computer does not run Unix, FTP automatically converts the file format
to suit the remote computer.

Binary transmission mode: It is used to transfer program files (for example, .app, .bin and .btm files), including
executable files, compressed files and image files without processing data. Therefore, Binary mode facilitates fastertransfer of all files and more reliable transfer of ASCII files.



FTP Working Modes

FTP provides two working modes:

7-2Configuration Guide

Configuring FTP Server

Figure 7-2

Figure 7-3

Figure 7-2 shows the active (PORT) mode. The FTP client uses port 1026 to connect to the FTP server through port
21. The client sends commands through this channel. Before receiving data, the client sends the PORT commandon this channel. The PORT command contains information on the channel port (1027) of the client for receiving data.
The server uses port 20 to connect to the client through port 1027 for establishing a data channel to receive andtransmit data. The FTP server must establish a new connection with the client for data transmission.

Figure 7-3 shows the passive (PASV) mode. The process for establishing a control channel is similar to that in the
PORT mode. However, after the connection is established, the client sends the PASV command rather than the
PORT command. After receiving the PASV command, the FTP server enables a high-end port (2024) at random andnotifies the client that data will be transmitted on this port. The client uses port 1027 to connect the FTP server
through port 2024. Then, the client and server can transmit and receive data on this channel. In this case, the FTP
server does not need to establish a new connection with the client.

Supported FTP Commands

After receiving an FTP connection request, the FTP server requires the client to provide the user name and password forauthentication.
If the client passes the authentication, the FTP client commands can be executed for operations. The available FTP clientcommands are listed as follows:
ascii

deletemdelete

mput

7-3

quit

send

Configuration Guide

Configuring FTP Server

bin

dir

bye

mdir

nlist

mget

cd

get

cdup
close

mkdir

passive

mls

put

ls

recv

size

renamesystem
type

rmdir

user

pwd

For usage of these FTP client commands, please refer to your FTP client software document. In addition, many FTP client
tools (such as CuteFTP and FlashFXP) provide the graphic user interface. These tools facilitate operations by freeing
users from configuring FTP commands.

Overview
FeatureDescription

Enabling the FTP

Provides the functions of uploading, downloading, displaying, creating and deleting files for an

Server Function

FTP client.

7.3.1 Enabling the FTP Server Function
Working Principle
The basic working principle is described in the previous chapter. Ruijie devices provide FTP services after the user name,password, and top-level directory are configured.

Related Configuration

Enabling the FTP Server Function Globally

The FTP server function is disabled by default.
Run the ftp-server enable command to enable the FTP server function.
You must enable the FTP server function globally before using it.

Configuring a User Name, Password, and Top-Level Directory

There is no authorized user or top-level directory by default.
Run the ftp-server username password and ftp-server topdir commands to set an authorized user and top-level
directory.
The three configurations above are mandatory; otherwise, the FTP server function cannot be enabled.

7.4 Monitoring
Displaying
Description

Command7-4

Configuration Guide

Displays the FTP server configuration.

show ftp-server

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs the FTP server error events.

debug ftp-server err

Debugs the FTP server message events.

debug ftp-server pro

7-5

Configuration Guide

Configuring FTP Client

8 Configuring FTP Client
8.1 Overview
The File Transfer Protocol (FTP) is an application of TCP/IP. By establishing a connection-oriented and reliable TCP
connection between the FTP client and server, a user can access a remote computer that runs the FTP server program.
An FTP client enables file transfer between a device and the FTP server over the FTP protocol. A user uses the client tosend a command to the server. The server responds to the command and sends the execution result to the client. Bymeans of command interaction, the user can view files in the server directory, copy files from a remote computer to a local
computer, or transfer local files to a remote computer.
FTP is intended to facilitate sharing of program/data files and encourage remote operation (by using programs). Users do
not need to be concerned with differences of different files systems on different hosts. Data is transmitted in an efficientand reliable manner. FTP enables remote file operation securely.
Ruijie FTP clients are different from standard FTP clients that run interactive commands. Instead, you enter the copy
command in CLI to perform control-connection instructions such as open, user, and pass. After a control connection isestablished, the file transfer process starts, and then a data connection is established to upload or download files.
Old devices support TFTP. However, TFTP is used to transfer small files whereas FTP is used to transfer large files.
Implementing FTP on a device enables the file transfer between the local device and other clients or servers.

Protocols andStandards


RFC 959: FILE TRANSFER PROTOCOL (FTP)

8.2 Applications
Application

Description

Uploading a Local File to a Remote

Local and remote files need to be shared, for example, uploading a local file to aServerremote server.

Downloading a File from a Remote

Local and remote files need to be shared, for example, downloading a file from a

Server to a Local Device

remote server to a local device.

8.2.1 Uploading a Local File to a Remote Server
Scenario
Local and remote files need to be shared, for example, uploading a local file to a remote server.
As shown in Figure 8-1, resources are shared only on the Intranet.
Figure 8-1

8-1

Configuration Guide

Configuring FTP Client

Deployment
Implement only communication on the Intranet.

Enable file uploading on the FTP client.

Enable file uploading on the FTP server.

8.2.2 Downloading a File from a Remote Server to a Local Device
Scenario
Local and remote files need to be shared, for example, downloading a file from a remote server to a local device.
As shown in Figure 8-2, resources are shared only on the Intranet.
Figure 8-2

Deployment
Implement only communication on the Intranet.

Enable file downloading on the FTP client.

Enable file downloading on the FTP server.

8.3 Features
Basic Concepts

Uploading FTP Files

Upload files from an FTP client to an FTP server.



Downloading FTP Files

Download files from an FTP server to an FTP client.



FTP Connection ModeAn FTP client and an FTP server can be connected in the active or passive mode.



FTP Transmission Mode

The transmission between an FTP client and an FTP server is available in two modes, namely, text (ASCII) and binary(Binary).
8-2

Configuration GuideConfiguring FTP Client

Specifying the Source Interface IP Address for FTP Transmission

An FTP client is configured with a source IP address for communication with an FTP server.

Overview
FeatureDescription

Uploading FTP Files

Uploads files from an FTP client to an FTP server.

Downloading FTP Files

Downloads files from an FTP server to an FTP client.

FTP Connection Mode

Specifies the connection mode between an FTP client and an FTP server.

FTP Transmission Mode

Specifies the transmission mode between an FTP client and an FTP server.

Specifying the Source

Configures a source IP address of an FTP client for communication with an FTP server.

Interface IP Address for
FTP Transmission

8.3.1 Uploading FTP Files
FTP enables file uploading. Start the FTP client and FTP server simultaneously, and upload files from the FTP client to the
FTP server.

8.3.2 Downloading FTP Files
FTP enables file downloading. Start the FTP client and FTP server simultaneously, and download files from the FTP
server to the FTP client.

8.3.3 FTP Connection ModeFTP needs to use two TCP connections: one is a control link (command link) that is used to transfer commands between
the FTP client and server; the other one is a data link that is used to upload or download data.
1.

Control connection: Some simple sessions are enabled with the control connection only. A client sends a command
to a server. After receiving the command, the server sends a response. The process is shown in Figure 8-3.

Figure 8-3 Control Connection

8-3

Configuration Guide

2.

Configuring FTP Client

Control connection and data connection: When a client sends a command for uploading or downloading data, boththe control connection and data connection need to be established.

FTP supports two data connection modes: active (PORT) and passive (PASC). The two modes are different inestablishing a data connection.

 Active mode
In this mode, an FTP server connects to an FTP client actively when a data connection is established. This mode
comprises four steps:
1.

The client uses source port 5150 to communicate with the server through port 21 as shown in Figure 8-4 to send aconnection request and tell the server that the port to be used is port 5151.

2.

After receiving the request, the server sends a response OK (ACK). The client and server exchanges control
signaling by console ports.

3.

The server enables port 20 as the source port to send data to port 5151 of the client.

4.

The client sends a response. Data transmission ends.

Figure 8-4 Active (PORT) Mode Passive mode
Figure 8-5 Passive (PASV) Mode

8-4

Configuration Guide

Configuring FTP Client

This mode is often set by the passive command. When a data connection is established, the FTP server is connected to
the FPT client passively. This mode comprises four steps:
1.

In the passive mode, the client initializes the control signaling connection. The client uses source port 5150 toconnect to the server through port 21 as shown in Figure 8-5, and runs the passive command to request the server toenter the PASV mode.

2.

The server agrees to enter the PASV mode, selects a port number greater than 1024 at random, and tells the port
number to the client.

3.

After receiving the message, the client uses port 5151 as shown in Figure 8-5 to communicate with the server throughport 3268. Here, port 5151 is the source port and port 3268 is the destination port.

4.

After receiving the message, the server sends data and responds an ACK (OK) response.

After the data connection is established, you can perform file uploading and downloading. Besides, you can perform some
operations on the server file from the client.
The control connection for command and feedback transmission is always present whereas the data connection isestablished as required. Only an FTP client has the right to select and set the PASV or PORT mode. The FTP client
sends a command to establish a data connection. Ruijie FTP clients use the PASV mode by default.

8.3.4 FTP Transmission ModeFTP provides two transmission modes: text (ASCII) and binary (Binary). At present, Ruijie FTP clients support both the
ASCII and Binary modes and use the BINARY mode by default.



ASCII mode

The difference between the ASCII and Binary modes lies in carriage return and line feed processing. In ASCII mode,
carriage return and line feed are changed to a local Carriage Return Character (CRC), for example, \n in Unix, \r\n inWindows, and \r in Mac.



Binary mode

The Binary mode can be used to transfer executable files, compressed files and image files without processing data. For
example, a text file needs to be transferred from Unix to Windows. When the Binary mode is used, the line breaks in Unix
will not be converted from \r to \r\n; therefore in Windows, this file has no line feeds and displays many black squares.
Therefore, Binary mode facilitates faster transfer of all files and more reliable transfer of ASCII files.

8.3.5 Specifying the Source Interface IP Address for FTP Transmission
An FTP client is configured with a source IP address for communication with an FTP server. In this way, the FTP client
connects to the server and shares files with the server through the specified source IP address.

8.4 Configuration
Configuration

Description and Command(Mandatory) It is used to configure the functions of an FTP client.

Configuring Basic Functions
Uploads a file.

copy flash

8-5Configuration Guide

Configuring FTP Client

Downloads a file.

copy ftp(Optional) It is used to configure the working mode of the FTP client.
ftp-client port

Sets the connection mode to active (port).

ftp-client ascii

Sets the transmission mode to ASCII.

Configuring Optional

Configures the source IP address of the

ftp-client source-address

Functions

FTP client.
Restores the default settings, namely,
connection mode set to passive (PASV),

default ftp-clienttransmission mode to Binary and source IP
address removed.

8.4.1 Configuring Basic Functions
Configuration EffectImplement file uploading and downloading.

Notes


Pay attention to the command formats for uploading and downloading.

Configuration Steps

Uploading a FileThis configuration is mandatory when a file needs to be uploaded.

Configure the FTP URL as the destination address of copy in Privileged EXEC mode.

Downloading a FileThis configuration is mandatory when a file needs to be downloaded.

Configure the FTP URL as the source address of copy in Privileged EXEC mode.

Verification


Check whether the uploaded file exists on the FTP server.

Check whether the downloaded file exists at the destination address.

Related Commands

Uploading a File

Commandcopy flash:[ local-directory/ ]local-file
ftp: //username:password@dest-address[ /remote-directory ]/remote-fileParameter

local-directory: Specifies a directory on the local device. If it is not specified, it indicates the current

8-6

Configuration Guide

Description

Configuring FTP Client

directory.
local-file: Specifies a local file to be uploaded.
username: Specifies a user name for accessing the FTP server, consisting of no more than 32 bytes andexcluding delimiters such as /, :, @ and space. This parameter is mandatory.
password: Specifies a password for accessing the FTP server, consisting of no more than 32 bytes andexcluding delimiters such as /, :, @ and space. This parameter is mandatory.
dest-address: Specifies an IP address for the FTP server.
remote-directory: Specifies a directory on the server.
remote-file: Renames the file on the server.
The directory specified by the local-directory field must have been created on the device. This
command will not automatically create a directory.

CommandPrivileged EXEC mode

Mode
Usage GuideRun this command to upload a file from the flash of a local device to an FTP server.

Downloading an FTP File

Commandcopy ftp://username:password@dest-address[ /remote-directory ]/remote-file
flash:[ local-directory/ ]local-fileParameter

username: Specifies a user name for accessing the FTP server, consisting of no more than 32 bytes and

Description

excluding delimiters such as /, :, @ and space. This parameter is mandatory.
password: Specifies a password for accessing the FTP server, consisting of no more than 32 bytes andexcluding delimiters such as /, :, @ and space. This parameter is mandatory.
dest-address: Specifies an IP address for the FTP server.
remote-directory: Specifies a directory on the server.
remote-file: Specifies a file to be downloaded.
local-directory: Specifies a directory on the local device. If it is not specified, it indicates the current
directory.
local-file: Renames the file in the local flash.
The directory specified by the local-directory field must have been created on the device. This
command will not automatically create a directory.

CommandPrivileged EXEC mode

Mode
Usage Guide

Run this command to download a file from an FTP server to the flash of a local device.

8-7Configuration Guide

Configuring FTP Client

Configuration
Example

Uploading a File

Configuratio

Upload the local-file file in the home directory of a device to the root directory of an FTP server whosen Stepsuser name is user, password is pass and IP address is 192.168.23.69 and name the file as remote-file.
Ruijie# copy flash:home/local-file ftp://user:pass@192.168.23.69/root/remote-file

Verification



Check whether the remote-file file exists on the FTP server.

Downloading a File

Configuratio

Download the remote-file file from the root directory of an FTP server whose user name is user,n Steps

password is pass and IP address is 192.168.23.69 to the home directory of a device and save the file aslocal-file.
Ruijie# copy ftp://user:pass@192.168.23.69/root/remote-file flash:home/local-file

Verification

Check whether the remote-file file exists in the home directory of the flash.

Common Errors


The command formats for uploading and downloading are incorrect.



The user name or password is incorrect.

8.4.2 Configuring Optional Functions
Configuration Effect

Set the connection and transmission modes and configure a source IP address of the client for file uploading anddownload.

Notes


N/A

Configuration Steps

Setting the Connection Mode to Active (Port)

Optional.

Configure the connection mode of FTP.



Setting the Transmission Mode to ASCII

Optional.

Configure the transmission mode of FTP.

8-8

Configuration Guide

Configuring FTP ClientConfiguring the Source IP Address of the FTP Client

Optional.

Configure the source IP address of the FTP client.

Restoring the Default Settings

Optional.



Restore the default settings of the FTP client.

Verification
Run the show run command to check whether the configuration takes effect.

Related Commands



Setting the Connection Mode to Active (Port)

Commandftp-client port

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Run this command to set the connection mode to active (port). The default connection mode is passive(PASV).

Configuring the Source IP Address of the FTP Client

Commandftp-client source-address { ip-address | ipv6-address }Parameter

ip-address: Specifies the IPv4 address of a local interface.

Description

ipv6-address: Specifies the IPv6 address of a local interface.

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure an interface IP address of the client for connection to the server. By
default, the client is not configured with a local IP address. Instead, the route selects an IP address forthe client.

Setting the Transmission Mode to ASCII

Commandftp-client ascii

Parameter

N/A

Description

8-9Configuration Guide

Command

Configuring FTP Client

Global configuration mode

Mode
Usage GuideRun this command to set the transmission mode to ASCII. The default transmission mode is Binary.

Restoring the Default Settings

Commanddefault ftp-client [ ascii | port | source ]Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Run this command to restore the default settings, namely, connection mode set to passive (PASV),
transmission mode to Binary and source IP address removed.

Configuration
Example

Configuring Optional Functions

Configuratio

Set the connection mode of FTP to port.



Set the transmission mode to ASCII.



Set the source IP address to 192.168.23.167.

n StepsRuijie# configure terminal
Ruijie(config)# ftp-client ascii
Ruijie(config)# ftp-client port
Ruijie(config)# ftp-client source 192.168.23.167
Ruijie(config)# end
Verification

Run the show run command on the device to check whether the configuration takes effect.
Ruijie# show run!
ftp-client ascii
ftp-client port
ftp-client source 192.168.23.167!

8-10

Configuration Guide

Common Errors


The source IP address is not a local IP address.

8.5 Monitoring
Displaying
Description

Command

Displays the FTP client

show running-config

configuration.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs the FTP Client.

debug ftp-client

8-11Configuration Guide

Configuring Network Communication Test Tools

9 Configuring Network Communication Test Tools
9.1 Overview
Network communication test tools can be used to check the connectivity of a network and helps you analyze and locate
network faults. Network communication test tools include Packet Internet Groper (PING) and Traceroute. Ping is used tocheck the connectivity and delay of a network. A greater delay indicates a slower network speed. Traceroute helps you
learn about the topology of physical and logical links and transmission rate. On a network device, you can run the ping
and traceroute commands to use the two tools respectively.

Protocols andStandards


RFC 792: Internet Control Message Protocol

RFC 4443: Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification

9.2 Applications
Application

Description

End-to-End Connectivity Test

Both the network device and the destination host are connected to the IP networkand configured with IP addresses.

Host Route Test

Both the network device and the destination host are connected to the IP networkand configured with IP addresses.

9.2.1 End-to-End Connectivity Test
Scenario
As shown in Figure 9-1, Network Device A and Target Host B are connected to the IP network.
If both the network device and the target host are connected to the IP network, the end-to-end connectivity test aims tocheck whether IP packets can be transmitted between the two ends. The target host can be the network device itself. In
this case, the connectivity test aims to check the network interface and TCP/IP configurations on the device.
Figure 9-1

Deployment
Execute the ping function on the network device.

9-1

Configuration Guide

Configuring Network Communication Test Tools

9.2.2 Host Route Test
Scenario
As shown in Figure 9-2, Network Device A and Target Host B are connected to the IP network.
If both the network device and the target host are connected to the IP network, the host route test aims to check gateways(or routers) that IP packets pass through between the two ends. Generally, the target host is not within the same IP
network segment as the network device.
Figure 9-2

Deployment
Execute the traceroute function on the network device.

9.3 Features
Overview
FeatureDescription

Ping Test

Test whether the specified IPv4 or IPv6 address is reachable and display the related
information.

Traceroute Test

Display the gateways that IPv4 or IPv6 packets pass through when transmitted from thesource to the destination.

9.3.1 Ping Test
Working Principle
The ping tool sends an Internet Control Message Protocol (ICMP) Request message to the destination host to request thefor an ICMP Echo Reply message. In this way, the ping tool determines the delay and the connectivity between the two
network devices.

Related Configuration


Run the ping command.

9.3.2 Traceroute Test
Working Principle
The traceroute tool uses the Time to Live (TTL) field in the headers of the ICMP and IP messages for the test First, thetraceroute tool on the network device sends an ICMP Request message with TTL 1 to the destination host. After receiving
the message, the first router on the path decreases the TTL by 1. As the TTL becomes 0, the router drops the packets and9-2

Configuration Guide

Configuring Network Communication Test Tools

returns an ICMP time exceeded message to the network device. After receiving this message, the traceroute tool learns
that this router exists on this path, and then sends an ICMP Request packet with TTL 2 to the destination host to discover
the second router. Each time the traceroute tool increases the TTL in the ICMP Request message by 1 to discover one
more router. This process is repeated until a data packet reaches the destination host. After the packet reaches thedestination host, the host returns an ICMP Echo message instead of an ICMP time exceeded message to the network
device. Then, the traceroute tool finishes the test and displays the path from the network device to the destination host.

Related Configuration


Run the traceroute command.

9.4 Configuration
Configuration

Description and Command(Optional) It is used to check whether an IPv4 or IPv6 address is reachable.

Ping Test
Executes the Ping function.

ping(Optional) It is used to display the gateways that IPv4 or IPv6 packets pass throughwhen transmitted from the source to the destination.

Traceroute Test

Executes the traceroute function.

traceroute

9.4.1 Ping Test
Configuration Effect
After conducting a ping test on a network device, you can learn whether the network device is connected to the destination
host and whether packets can be transmitted between the network device and the destination host.

Notes
The network device must be configured with an IP address.

Configuration Steps

To check whether an IPv4 address is reachable, use the ping IPv4 command.



To check whether an IPv6 address is reachable, use the ping IPv6 command.

Verification
Run the ping command to display related information on the command line interface (CLI) window.

Related Commands

Ping IPv4

Commandping [ ip ] { address [ length length ] [ ntimes times ] [ timeout seconds ] [ data data ] [ source

9-3Configuration Guide

Configuring Network Communication Test Tools

source ] [ df-bit ] [ validate ] [ detail ] [ out-interface interface [next-hop next-hop]] }Parameter

address: Specifies the destination IPv4 address or domain name.

Description

length: Specifies the length of the data packet. The value ranges from 36 to 18,024. The default lengthis 100.
times: Specifies the number of probes. The value ranges from 1 to 4,294,967,295
seconds: Specifies the timeout. The value ranges from 1s to 10s.
data: Specifies the data in the packet. The data is a string of 1 to 255 bytes. By default, the string is"abcd".
source: Specifies the source IPv4 address or source port of the packet. The loopback interface
address, for example, 127.0.0.1, cannot be used as the source address.
df-bit: Configures the DF bit of the IP address. When the DF bit is set to 1, the packet is not
fragmented. By default, the DF bit is 0.
validate: Configures whether to verify the response packet.
detail: Configures whether to display the Echo Reply message in detail. By default, only theexclamation mark (!) and dot (.) are displayed.
interface: Specifies the interface for sending the data packets.
next-hop: Specifies the next hop IPv4 address.

Command

In User EXEC mode, you can execute only the basic ping function. In Privileged EXEC mode, you canModeexecute the extended ping function.
In other configuration modes, you can run the do command to execute the extended ping function. For
details about the configuration, see the description about the do command.

Configuration

When the ping function is executed, information about the response (if any) will be displayed, and thenUsage

related statistics will be output. Using the extended ping function, you can specify the number, lengthand timeout of packets to be sent. Like the basic ping function, related statistics will be output.
To use the domain name, you must first configure the domain name server (DNS). For details about
the configuration, see Configuring DNS.

Ping IPv6

Commandping [ ipv6] { address [ length length ] [ ntimes times ] [ timeout seconds ] [ data data ] [ source
source ] [ detail ] [ out-interface interface [next-hop next-hop]] }Parameter
Description

address: Specifies the destination IPv6 address or domain name.
length: Specifies the length of data packet. The value ranges from 16 to 18,024. The default length is100.
times: Specifies the number of probes. The value ranges from 1 to 4,294,967,295.
seconds: Specifies the timeout. The value ranges from 1s to 10s.
data: Specifies the data in the packet. The data is a string of 1 to 255 bytes.

9-4Configuration Guide

Configuring Network Communication Test Tools

source: Specifies the source IPv6 address or source port of the packet. The loopback interface
address, for example, ::1, cannot be used as the source address.
detail: Configures whether to display the Echo Reply message in detail. By default, only theexclamation mark (!) and dot (.) are displayed.
interface: Specifies the interface for sending the data packets.
next-hop: Specifies the next hop IPv6 address.
Command

In User EXEC mode, you can execute only the basic ping IPv6 function. In Privileged EXEC mode, youModecan execute the extended ping IPv6 function.
In other configuration modes, you can run the do command to execute the extended ping function. For
details about the configuration, see the description about the do command.

Configuration

When the ping IPv6 function is executed, information about the response (if any) will be displayed, andUsagethen related statistics will be output.
Using the extended ping IPv6 function, you can specify the number, length and timeout of packets tobe sent. Like the basic ping IPv6 function, related statistics will be output.
To use the domain name, you must first configure the DNS. For details about the configuration, see
Configuring DNS.

Configuration
Example

Executing the Common Ping Function

Configuration

In Privileged EXEC mode, run the ping 192.168.21.26 command.

Steps
Common ping command:
Ruijie# ping 192.168.21.26
Sending 5, 100-byte ICMP Echoes to 192.168.21.26, timeout is 2 seconds:< press Ctrl+C to break >!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
Detailed ping command:
Ruijie#ping 192.168.21.26 detail
Sending 5, 100-byte ICMP Echoes to 192.168.21.26, timeout is 2 seconds:< press Ctrl+C to break >Reply from 192.168.21.26: bytes=100 time=4ms TTL=64
Reply from 192.168.21.26: bytes=100 time=3ms TTL=64
Reply from 192.168.21.26: bytes=100 time=1ms TTL=64

9-5

Configuration Guide

Configuring Network Communication Test Tools

Reply from 192.168.21.26: bytes=100 time=1ms TTL=64
Reply from 192.168.21.26: bytes=100 time=1ms TTL=64

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms.
Verification

Send five 100-byte packets to the specified IP address, and the response information will be displayedin the specified time (2s by default). Finally the statistics is output.



Executing the Extended Ping Function

Configuration

In Privileged EXEC mode, run the ping 192.168.21.26 command. In addition, specify the length,

Steps

number, and timeout of the packets.
Common ping command:
Ruijie# ping 192.168.21.26 length 1500 ntimes 100 data ffff source 192.168.21.99 timeout 3
Sending 100, 1500-byte ICMP Echoes to 192.168.21.26, timeout is 3 seconds:< press Ctrl+C to break >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 2/2/3 ms
Detailed ping command:ping 192.168.21.26 length 1500 ntimes 20 data ffff source 192.168.21.99 timeout 3 detail
Sending 20, 1500-byte ICMP Echoes to 192.168.21.26, timeout is 3 seconds:< press Ctrl+C to break >Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=2ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64

9-6

Configuration Guide

Configuring Network Communication Test Tools

Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=3ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64
Reply from 192.168.21.26: bytes=1500 time=1ms TTL=64

Success rate is 100 percent (20/20), round-trip min/avg/max = 1/1/3 ms.

Verification

Send twenty 1500-byte packets to the specified IP address, and the response information (if any) will
be displayed in the specified time (3s by default). Finally the statistics is output.



Executing the Common Ping IPv6 Function

Configuration

In Privileged EXEC mode, run the ping ipv6 2001::1 command.

Steps
Common ping command:
Ruijie# ping ipv6 2001::1
Sending 5, 100-byte ICMP Echoes to 2001::1, timeout is 2 seconds:< press Ctrl+C to break >!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

Detailed ping command:
Ruijie#ping 2001::1 detail
Sending 5, 100-byte ICMP Echoes to 2001::1, timeout is 2 seconds:< press Ctrl+C to break >Reply from 2001::1: bytes=100 time=1ms
Reply from 2001::1: bytes=100 time=1ms
Reply from 2001::1: bytes=100 time=1ms
Reply from 2001::1: bytes=100 time=1ms
Reply from 2001::1: bytes=100 time=1ms

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms.

9-7

Configuration Guide

Verification

Configuring Network Communication Test Tools

Send five 100-byte packets to the specified IP address, and the response information will be displayedin the specified time (2s by default). Finally the statistics is output.



Executing the Extended Ping IPv6 Function

Configuration

In Privileged EXEC mode, run the ping ipv6 2001::5 command. In addition, specify the length,

Steps

number, and timeout of the packets.
Common ping command:
Ruijie# ping ipv6 2001::5 length 1500 ntimes 100 data ffff source 2001::9 timeout 3
Sending 100, 1500-byte ICMP Echoes to 2000::1, timeout is 3 seconds:< press Ctrl+C to break >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 2/2/3 ms
Detailed ping command:
Ruijie#ping 2001::5 length 1500 ntimes 10 data ffff source 2001::9 timeout 3
Sending 10, 1500-byte ICMP Echoes to 2001::5, timeout is 3 seconds:< press Ctrl+C to break >Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms
Reply from 2001::5: bytes=1500 time=1ms

Success rate is 100 percent (10/10), round-trip min/avg/max = 1/1/1 ms.
Verification

Send one hundred 1500-byte packets to the specified IPv6 address, and the response information (ifany) will be displayed in the specified time (3s by default). Finally the statistics is output.

9-8

Configuration Guide

Configuring Network Communication Test Tools

9.4.2 Traceroute Test
Configuration Effect
After conducting a traceroute test on a network device, you can learn about the routing topology between the network
device and the destination host, and the gateways through which packets are sent from the network device to thedestination host.

Notes
The network device must be configured with an IP address.

Configuration Steps

To trace the route an IPv4 packet would follow to the destination host, run the traceroute IPv4 command.



To trace the route an IPv6 packet would follow to the destination host, run the traceroute IPv6 command.

Verification
Run the traceroute command to display related information on the CLI window.

Related Commands

Traceroute IPv4

Commandtraceroute [ ip ] { address [ probe number ] [ source source ] [ timeout seconds ] [ ttl minimum
maximum ] [out-interface interface [next-hop next-hop] ] }Parameter

address: Specifies the destination IPv4 address or domain name.

Description

number: Specifies the number of probes. The value ranges from 1 to 255.
source: Specifies the source IPv4 address or source port of the packet. The loopback interface
address, for example, 127.0.0.1, cannot be used as the source address.
seconds: Specifies the timeout. The value ranges from 1s to 10s.
minimum maximum: Specifies the minimum and maximum TTL values. The value ranges from 1 to255.
interface: Specifies the interface for sending the data packets.
next-hop: Specifies the next hop IPv4 address.

Command

In User EXEC mode, you can execute only the basic traceroute function. In privileged EXEC mode,Mode

you can execute the extended traceroute function.

Configuration

The traceroute command is used to test the network connectivity and accurately locate a fault whenUsage

the fault occurs. To use the domain name, you must first configure the DNS. For details about theconfiguration, see Configuring DNS.



Traceroute IPv6

Commandtraceroute [ ipv6 ] { address [ probe number ] [ source source ] [ timeout seconds ] [ ttl minimum

9-9Configuration Guide

Configuring Network Communication Test Tools

maximum ] [ out-interface interface [next-hop next-hop]] }Parameter

address: Specifies the destination IPv6 address or domain name.

Description

number: Specifies the number of probes. The value ranges from 1 to 255.
source: Specifies the source IPv4 address or source port of the packet. The loopback interface
address, for example, 127.0.0.1, cannot be used as the source address.
seconds: Specifies the timeout. The value ranges from 1s to 10s.
minimum maximum: Specifies the minimum and maximum TTL values. The value ranges from 1 to255.
interface: Specifies the interface for sending the data packets.
next-hop: Specifies the next hop IPv6 address.

Command

In User EXEC mode, you can execute only the basic traceroute IPv6 function. In privileged EXEC

Mode

mode, you can execute the extended traceroute IPv6 function.

Configuration

The traceroute IPv6 command is used to test the network connectivity and accurately locate a fault

Usage

when the fault occurs. To use the domain name, you must first configure the DNS. For details about
the configuration, see Configuring DNS.

Configuration
Example

Executing the Traceroute Function on a Properly Connected Network

Configuration

In Privileged EXEC mode, run the traceroute ipv6 3004::1 command.

Steps
Ruijie#Ruijie# traceroute ipv6 3004::1< press Ctrl+C to break >Tracing the route to 3004::1
1

3000::1

0 msec0 msec0 msec23001::1

4 msec4 msec 4 msec

33002::1

8 msec8 msec4 msecThe preceding test result indicates that the network device accesses host 3004::1 by transmitting
packets through gateways 1–3. In addition, the time required to reach each gateway is displayed.



Executing the Traceroute Function on a Faulty Network

Configuration

In Privileged EXEC mode, run the traceroute 202.108.37.42 command.

Steps

9-10

Configuration Guide

Configuring Network Communication Test Tools

Ruijie# traceroute 202.108.37.42< press Ctrl+C to break >Tracing the route to 202.108.37.421

192.168.12.1

0 msec 0 msec 0 msec

2

192.168.9.2

0 msec 4 msec 4 msec

3

192.168.110.1

16 msec 12 msec

4

*

5

61.154.8.129

12 msec

28 msec 12 msec

661.154.8.17

8 msec

12 msec 16 msec

761.154.8.250

12 msec

12 msec 12 msec

8

218.85.157.222

12 msec

12 msec 12 msec

9218.85.157.130

16 msec

16 msec 16 msec

10

218.85.157.77

16 msec

48 msec 16 msec

11

202.97.40.65

76 msec

24 msec 24 msec

12

202.97.37.65

32 msec

24 msec 24 msec

13

202.97.38.162

52 msec

52 msec 224 msec

14

202.96.12.38

84 msec

52 msec 52 msec

15

202.106.192.226

88 msec

52 msec 52 msec

16

202.106.192.174

52 msec

52 msec 88 msec

17210.74.176.158

100 msec

52 msec 84 msec

18202.108.37.42

16 msec* *48 msec 48 msec

52 msec

The preceding test result indicates that the network device accesses host 202.108.37.42 bytransmitting packets through gateways 1–17, and Gateway 4 is faulty.



Executing the Traceroute IPv6 Function on a Properly Connected Network

Configuration

In Privileged EXEC mode, run the traceroute ipv6 3004::1 command.

Steps
Ruijie# traceroute ipv6 3004::1< press Ctrl+C to break >Tracing the route to 3004::1
1

3000::1

0 msec0 msec23001::1

4 msec4 msec 4 msec

33002::1

8 msec8 msec43004::1

4 msec28 msec 12 msec

9-11

0 msec4 msecConfiguration Guide

The preceding test result indicates that the network device accesses host 3004::1 by transmitting
packets through gateways 1-4. In addition, the time required to reach each gateway is displayed.



Executing the Traceroute IPv6 Function on a Faulty Network

Configuratio

In Privileged EXEC mode, run the traceroute ipv6 3004::1 command.

n StepsRuijie# traceroute ipv6 3004::1< press Ctrl+C to break >Tracing the route to 3004::1
1

3000::1

0 msec0 msec0 msec23001::1

4 msec4 msec 4 msec

33002::1

8 msec8 msec

4

* * *

5

3004::1

4 msec28 msec 12 msec

4 msecThe preceding test result indicates that the network device accesses host 3004::1 by transmitting
packets through gateways 1–5, and Gateway 4 is faulty.

9-12

Configuration Guide

Configuring TCP

10 Configuring TCP
10.1 Overview
The Transmission Control Protocol (TCP) is a transport-layer protocol providing reliable connection-oriented and IP-based
services to for the application layer.
Internetwork data flows in 8-bit bytes are sent from the application layer to the TCP layer, and then fragmented into packet
segments of a proper length via the TCP. The Maximum Segment Size (MSS) is usually limited by the Maximum
Transmission Unit (MTU) of the data link layer. After that, the packets are sent to the IP layer and then to the TCP layer ofa receiver through the network.
To prevent packet loss, every byte is identified by a sequence number via the TCP, and this ensures that packets destinedfor the peer are received in order. Then, the receiver responds with a TCP ACK packet upon receiving a packet. If thesender does not receive ACK packets in a reasonable Round-Trip Time (RTT), the corresponding packets (assumed lost)
will be retransmitted.



TCP uses the checksum function to check data integrity. Besides, MD5-based authentication can be used to verify
data.



Timeout retransmission and piggyback mechanism are adopted to ensure reliability.

The Sliding Window Protocol is adopted to control flows. As documented in the Protocol, unidentified groups in awindow should be retransmitted.

Protocols andStandards


RFC 793: Transmission Control Protocol

RFC 1122: Requirements for Internet Hosts -- Communication Layers



RFC 1191: Path MTU Discovery



RFC 1213: Management Information Base for Network Management of TCP/IP-based Internets: MIB-II

RFC 4022: Management Information Base for the Transmission Control Protocol (TCP)

10.2 Applications
Application

Description

Optimizing TCP Performance

To avoid TCP packet fragmentation on a link with a small MTU, Path
MTU Discovery (PMTUD) is enabled.

Detecting TCP Connection

TCP checks whether the peer works normally.

Exception

10-1

Configuration Guide

Configuring TCP

10.2.1 Optimizing TCP Performance
Scenario
For example, TCP connection is established between A and D, as shown in the following figure. The MTU of the link
between A and B is 1500 bytes, 1300 bytes between B and C, and 1500 bytes between C and D. To optimize TCP
transmission performance, packet fragmentation should be avoided between B and C.
Figure 10-1

Remarks:

A, B, C and D are routers.

Deployment
Enable PMTUD on A and D.

10.2.2 Detecting TCP Connection Exception
Scenario
For example, in the following figure, User logs in to A through telnet but is shut down abnormally, as shown in the following
figure. In case of TCP retransmission timeout, the User's TCP connection remains for a long period. Therefore, TCP
keepalive can be used to rapidly detect TCP connection exception.
Figure 10-2

Remarks:

A is a router.

Deployment
Enable TCP keepalive on A.

10-2

Configuration Guide

Configuring TCP

10.3 Features
Basic Concepts



TCP Header Format
0

1

2

3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|

Source Port|

Destination Port|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|

Sequence Number|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|

Acknowledgment Number|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|

Data ||U|A|P|R|S|F|| Offset| Reserved|R|C|S|S|Y|I|||G|K|H|T|N|N|||
Window||+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|

Checksum|

Urgent Pointer|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|

Options|

Padding|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|

data

|

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+



Source Port is a 16-bit source port number.

Destination Port is a 16-bit destination port number.



Sequence Number is a 32-bit sequence number.

Acknowledgment Number is a 32-bit number that identifies the next sequence number that the receiver is
expecting to receive.

Data Offset is a 4-bit number that indicates the total number of bytes in the TCP header (option included) divided by4.



A flag bit is 6-bit. URG: the urgent pointer field is significant; ACK: the acknowledgment field is significant; PSH:
indicates the push function; RST: resets TCP connection; SYN: synchronizes the sequence number (establishing a
TCP connection); FIN: no more data from the sender (closing a TCP connection).



A 16-bit Window value is used to control flows. It specifies the amount of data that may be transmitted from the peer
between ACK packets.

10-3Configuration Guide

Configuring TCP

Checksum is a 16-bit checksum.

Urgent Pointer is 16-bit and shows the end of the urgent data so that interrupted data flows can continue. When the
URG bit is set, the data is given priority over other data flows.



TCP Three-Way HandshakeThe process of TCP three-way handshake is as follows:1.

A client sends a SYN packet to the server.

2.

The server receives the SYN packet and responds with a SYN ACK packet.

3.

The client receives the SYN packet from the server and responds with an ACK packet.

After the three-way handshake, the client and server are connected successfully and ready for data transmission.

Overview
FeatureDescription

Configuring SYN Timeout

Configures a timeout waiting for a response packet after an SYN or SYN ACK packet issent.

Configuring Window Size

Configures a window size.

Configuring Reset Packet

Configures the sending of TCP reset packets after receiving port unreachable messages.

Sending
Configuring MSS

Configures an MSS for TCP connection.

Path MTU Discovery

Discovers the smallest MTU on TCP transmission path, and adjust the size of TCP packets
based on this MTU to avoid fragmentation.

TCP Keepalive

Checks whether the peer works normally.

10.3.1 Configuring SYN Timeout
Working Principle
A TCP connection is established after three-way handshake: The sender sends an SYN packet, the receiver replies with a
SYN ACK packet, and then the sender replies with an ACK packet.



If the receiver does not reply with a SYN ACK packet after the sender sends an SYN packet, the sender keeps
retransmitting the SYN packet for certain times or until timeout period expires.



If the receiver replies with a SYN ACK packet after the sender sends an SYN packet but the sender does not reply
with an ACK packet, the receiver keeps retransmitting the SYN ACK packet for certain times or until timeout period
expires. (This occurs in the case of SYN flooding.)

Related Configuration

Configuring TCP SYN TimeoutThe default TCP SYN timeout is 20 seconds.

10-4

Configuration GuideConfiguring TCP

Run the ip tcp synwait-time seconds command in global configuration mode to configure an SYN timeout ranging
from 5 to 300 seconds.

In case of SYN flooding, shortening SYN timeout reduces resource consumption. However, it does not work incontinuous SYN flooding. When a device actively makes a request for a connection with an external device, throughtelnet for example, shortening SYN timeout reduces user's wait time. You may prolong SYN timeout properly on apoor network.
The ip tcp syntime-out command in version 10.x is disused but compatible in version 11.0. If this command is
executed, it will be converted to the ip tcp synwait-time command.
In version 10.x, the configuration applies to only IPv4 TCP. In version 11.0 or later, it applies to both IPv4 TCP andIPv6 TCP.

10.3.2 Configuring Window Size
Working Principle
Data from the peer is cached in the TCP receiving buffer and subsequently read by applications. The TCP window size
indicates the size of free space of the receiving buffer. For wide-bandwidth bulk-data connection, enlarging the window
size dramatically promotes TCP transmission performance.

Related Configuration

Configuring Window Size

Run the ip tcp window-size size command in global configuration mode to configure a window size ranging from
128 to (65535<< 14) bytes. The default is 65535 bytes. If the window size is greater than 65535 bytes, window
enlarging will be enabled automatically.



The window size advertised to the peer is the smaller value between the configured window size and the free spaceof the receiving buffer.
In version 10.x, the configuration applies to only IPv4 TCP. In version 11.0 or later, it applies to both IPv4 TCP andIPv6 TCP.

10.3.3 Configuring Reset Packet Sending
Working Principle
When TCP packets are distributed to applications, if the TCP connection a packet belongs to cannot be identified, thelocal end sends a reset packet to the peer to terminate the TCP connection. Attackers may use port unreachable
messages to attack the device.

Related Configuration

Configuring the Sending of TCP Reset Packets After Receiving Port Unreachable Messages

By default, TCP reset packet sending upon receiving port unreachable messages is enabled.
Run the no ip tcp send-reset command in global configuration mode to disable TCP reset packet sending upon receiving
port unreachable messages.

10-5Configuration Guide

Configuring TCP

After this function is enabled, attackers may use port unreachable messages to attack the device.
The ip tcp not-send-rst command in version 10.x is disused but compatible in version 11.0. If this command is
executed, it will be converted to the no ip tcp send-reset command.
In version 10.x, the configuration applies to only IPv4 TCP. In version 11.0 or later, it applies to both IPv4 TCP andIPv6 TCP.

10.3.4 Configuring MSS
Working Principle
The MSS refers to the total amount of data contained in a TCP segment t excluding TCP options.
Three-way handshake is implemented through MSS negotiation. Both parties add the MSS option to SYN packets,
indicating the largest amount of data that the local end can handle, namely, the amount of data allowed from the peer.
Both parties take the smaller MSS between them as the advertised MSS.
The MSS value is calculated as follows:

IPv4 TCP: MSS = Outgoing interface MTU –IP header size (20-byte)–TCP header size (20-byte).

IPv6 TCP: MSS = IPv6 Path MTU –IPv6 header size (40-byte)–TCP header size (20-byte).
In version 10.x, the configuration applies to only IPv4 TCP. In version 11.0 or later, it applies to both IPv4 TCP andIPv6 TCP.
The effective MSS is the smaller one between the calculated MSS and the configured MSS.
If a connection supports certain options, the option length (with data offset taken into consideration) should be
deducted from an MSS value. For example, 20 bytes for MD5 digest (with data offset taken into consideration)
should be subtracted from the MSS.

Related Configuration

Configuring MSS

Run the ip tcp mss max-segment-size command in global configuration mode to set an MSS. It ranges from 68 to1000 bytes. By default, the MSS is calculated based on MTU. If an MSS is configured, the effective MSS is thesmaller one between the calculated MSS and the configured MSS.

An excessively small MSS reduces transmission performance. You can promote TCP transmission by increasing the
MSS. Choose an MSS value by referring to the interface MTU. If the former is bigger, TCP packets will befragmented and transmission performance will be reduced.

10.3.5 Path MTU Discovery
Working Principle
The Path MTU Discovery f stipulated in RFC1191 is used to discover the smallest MTU in a TCP path to avoid
fragmentation, enhancing network bandwidth utilization. The process of TCPv4 Path MTU Discovery is described asfollows:
1.

The source sends TCP packets with the Don’t Fragment (DF) bit set in the outer IP header.

10-6Configuration Guide
2.

Configuring TCP

If the outgoing interface MTU value of a router in the TCP path is smaller than the IP packet length, the packet will bediscarded and an ICMP error packet carrying this MTU will be sent to the source.

3.

Through parsing the ICMP error packet, the source knows the smallest MTU in the path (path MTU) is.

4.

The size of subsequent data segments sent by the source will not surpass the MSS, which is calculated as follows:
TCP MSS = Path MTU – IP header size – TCP header size.

Related Configuration

Enabling Path MTU Discovery

By default, Path MTU Discovery is disabled.
Run the ip tcp path-mtu-discovery command to enable PMTUD in global configuration mode.
In version 10.x, the configuration applies to both IPv4 TCP and IPv6 TCP.

In version 11.0 or later, it applies to only

IPv4 TCP. TCPv6 PMTUD is enabled permanently and cannot be disabled.

10.3.6 TCP Keepalive
Working Principle
You may enable TCP keepalive to check whether the peer works normally. If a TCP end does not send packets to theother end for a period of time (namely idle period), the latter starts sending keepalive packets successively to the former
for several times. If no response packet is received, the TCP connection is considered inactive and then closed.

Related Configuration

Enabling Keepalive

By default, TCP keepalive is disabled.

Run the ip tcp keepalive [ interval num1 ] [ times num2 ] [ idle-period num3 ] command to in global configuration
mode to enable TCP keepalive. See Configuration for parameter description.
In version 10.x, the configuration applies to only IPv4 TCP. In version 11.0 or later, it applies to both IPv4 TCP andIPv6 TCP.
The service tcp-keepalives-in command is used in version 10.x to enable keeplive on the TCP server. It is disused
but compatible in version 11.0. If this command is executed, it will be converted to the ip tcp keepalive [ interval
num1 ] [ times num2 ] [ idle-period num3 ] command.
The service tcp-keepalives-out command is used in version 10.x to enable keeplive on the TCP client. It is disused
but compatible in version 11.0. If this command is executed, it will be converted to the ip tcp keepalive [ interval
num1 ] [ times num2 ] [ idle-period num3 ] command.
This command applies to both TCP server and client.

10.4 Configuration
Configuration

Description and Command

10-7

Configuration Guide

Configuring TCP(Optional) It is used to optimize TCP connection performance.
ip tcp synwait-time

Configures a timeout for TCP connection.

ip tcp window-size

Configures a TCP window size.

Optimizing TCP
Performance

Configures the sending of TCP reset
packets after receiving port unreachable

ip tcp send-reset

messages.
ip tcp mss

Configures an MSS for TCP connection.

ip tcp path-mtu-discovery

Enables Path MTU Discovery.

(Optional) It is used to detect whether the peer works normally.

Detecting TCP Connection
Exception

Enables TCP keepalive.

ip tcp keepalive

10.4.1 Optimizing TCP Performance
Configuration EffectEnsure optimal TCP performance and prevent fragmentation.

Notes
N/A

Configuration Steps

Configuring SYN Timeout

Optional.

Configure this on the both ends of TCP connection.

Configuring TCP Window Size

Optional.

Configure this on the both ends of TCP connection.

Configuring the Sending of TCP Reset Packets After Receiving Port Unreachable Messages.



Optional.

Configure this on the both ends of TCP connection.

Configuring MSS

Optional.

Configure this on the both ends of TCP connection.

Enabling Path MTU Discovery

10-8Configuration Guide

Optional.

Configure this on the both ends of TCP connection.

Configuring TCPVerification
N/A

Related Commands

Configuring SYN Timeout

Commandip tcp synwait-time seconds

Parameterseconds: Indicates SYN packet timeout. It ranges from 5 to 300 seconds. The default is 20 seconds.

Description
Command

Global configuration mode

Mode
Usage Guide

In case of SYN flooding, shortening SYN timeout reduces resource consumption. However, it does notwork in continuous SYN flooding. When a device actively makes a request for a connection with an
external device, through telnet for example, shortening SYN timeout reduces user's wait time. You may
prolong SYN timeout properly on a poor network.

Configuring TCP Window Size

Commandip tcp window-size size

Parameter

size: Indicates a TCP window size. It ranges from 128 to (65535 << 14) bytes. The default is 65535

Description

bytes.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring the Sending of TCP Reset Packets After Receiving Port Unreachable Messages

Commandip tcp send-reset

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

By default, TCP reset packet sending upon receiving port unreachable messages is enabled.

Configuring MSS

10-9

Configuration Guide

Configuring TCP

Commandip tcp mss max-segment-size

Parametermax-segment-size: Indicates the maximum segment size. It ranges from 68 to 10000 bytes. By default,

Description

the MSS is calculated based on MTU.

Command

Global configuration mode

Mode
Usage Guide

This command defines the MSS for a TCP communication to be established. The negotiated MSS for a
new connection should be smaller than this MSS. If you want to reduce the MSS, run this command.
Otherwise, do not perform the configuration.

Configuring Path MTU Discovery

Commandip tcp path-mtu-discovery [ age-timer minutes | age-timer infinite ]Parameter

age-timer minutes: Indicates the interval for a new probe after a path MTU is discovered. It ranges from

Description

10 to 30 minutes. The default is 10 minutes.
age-timer infinite: No probe is implemented after a path MTU is discovered.

Command

Global configuration mode

Mode
Usage Guide

The PMTUD is an algorithm documented in RFC 1191 aimed to improve bandwidth utilization.
When the TCP is applied to bulk data transmission, this function may facilitate transmission
performance.
If the MSS used for the connection is smaller than what the peer connection can handle, a larger MSS is
tried every time the age timer expires. The age timer is a time interval for how often TCP estimates thepath MTU with a larger MSS. The discovery process is stopped when either the send MSS is as large as
the peer negotiated, or the user has disabled the timer on the router. You may turn off the timer by
setting it to infinite.

Configuration
Example

Enabling Path MTU Discovery

Configuratio

Enable PMTUD for a TCP connection. Adopt the default age timer settings.

n StepsRuijie# configure terminal
Ruijie(config)# ip tcp path-mtu-discovery
Verification

Run the show tcp pmtu command to display the IPv4 TCP PMTU.
Ruijie# show tcp pmtu
NumberLocal Address

Foreign Address

10-10

PMTU

Configuration Guide

Configuratio

Configuring TCP

Enable PMTUD for a TCP connection. Adopt the default age timer settings.

n StepsRuijie# configure terminal
Ruijie(config)# ip tcp path-mtu-discovery
Verification

Run the show tcp pmtu command to display the IPv4 TCP PMTU.
1

192.168.195.212.23

192.168.195.112.13560

1440

Run the show ipv6 tcp pmtu command to display the IPv6 TCP PMTU.
Ruijie# show ipv6 tcp pmtu
NumberLocal Address

Foreign Address

PMTU

1

1000::1:23

1000::2.13560

1440

Common Errors
N/A

10.4.2 Detecting TCP Connection Exception
Configuration EffectCheck whether the peer works normally.

Notes
N/A

Configuration Steps

Enabling TCP Keepalive

Optional.

Verification
N/A

Related Commands

Enabling TCP Keepalive

Commandip tcp keepalive [ interval num1 ] [ times num2 ] [ idle-period num3 ]Parameterinterval num1: Indicates the interval to send keepalive packets. Ranging from 1 to120 seconds. The

Description

default is 75 seconds.
times num2: Indicates the maximum times for sending keepalive packets. It ranges from 1 to 10. The
default is 6.
idle-period num3: Indicates the time when the peer sends no packets to the local end, It ranges from 60

10-11Configuration Guide

Configuring TCP

to 1800 seconds. The default is15 minutes.
Command

Global configuration mode

Mode
Usage Guide

You may enable TCP keepalive to check whether the peer works normally. The function is disabled bydefault.
Suppose a user enables TCP keepalive function with the default interval, times and idle period settings.
The user does not receive packets from the other end within 15 minutes and then starts sending
Keepalive packets every 75 seconds for 6 times. If the user receives no TCP packets, the TCP
connection is considered inactive and then closed.

Configuration
Example

Enabling TCP Keepalive

Configuratio

Enable TCP keepalive on a device with interval and idle-period set to 3 minutes and 60 secondsn Stepsrespectively. If the user receives no TCP packets from the other end after sending keepalive packets
four times, the TCP connection is considered inactive.
Ruijie# configure terminal
Ruijie(config)# ip tcp keepalive interval 60 times 4 idle-period 180

Verification

A user logs in to a device through telnet, and then shuts down the local device. Run the show tcp
connect command on the remote device to observe when IPv4 TCP connection is deleted.

Common Errors
N/A

10.5 Monitoring
Displaying
Description

Command

Displays basic information on IPv4

show tcp connect [local-ip a.b.c.d] [ local-port num ] [ peer-ip a.b.c.d ] [TCP connection.

peer-port num ]Displays IPv4 TCP connection

show tcp connect statistics

statistics.

Displays IPv4 TCP PMTU.

Displays IPv4 TCP port information.

show tcp pmtu [ local-ip a.b.c.d ] [ local-port num ] [ peer-ip a.b.c.d ] [peer-port num ]show tcp port [ num ]10-12Configuration Guide

Description

Command

Displays IPv4 TCP parameters.

show tcp parameter

Displays IPv4 TCP statistics.

show tcp statistics

Displays basic information on IPv6

show ipv6 tcp connect [ local-ipv6 X:X:X:X::X ] [ local-port num ] [ peer-i

TCP connection.

pv6 X:X:X:X::X ] [ peer-port num ]Displays IPv6 TCP connection

show ipv6 tcp connect statistics

statistics.

Displays IPv6 TCP PMTU.

Displays IPv6 TCP port information.

show ipv6 tcp pmtu [ local-ipv6 X:X:X:X::X ] [ local-port num ] [ peer-ipv
6 X:X:X:X::X ] [ peer-port num ]show ipv6 tcp port [ num ]Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

Command

Displays the debugging information

debug ip tcp packet [ in | out ] [ local-ip a.b.c.d ] [ peer-ip a.b.c.d ] [ global ]on IPv4 TCP packets.

[ local-port num ] [ peer-port num ] [ deeply ]Displays the debugging information

debug ip tcp transactions [ local-ip a.b.c.d ] [ peer-ip a.b.c.d ] [ local-port num ]on IPv4 TCP connection.

[ peer-port num ]Displays the debugging information

debug ipv6 tcp packet [ in | out ] [ local-ipv6 X:X:X:X::X ] [ peer-ipv6

on IPv6 TCP packets.

X:X:X:X::X ] [ global ] [ local-port num ] [ peer-port num ] [ deeply ]Displays the debugging information

debug ipv6 tcp transactions [ local-ipv6 X:X:X:X::X ] [ peer-ipv6 X:X:X:X::X ]on IPv6 TCP connection.

[ local-port num ] [ peer-port num ]10-13Configuration Guide

Configuring IPv4/IPv6 REF

11 Configuring IPv4/IPv6 REF
11.1 Overview
On products incapable of hardware-based forwarding, IPv4/IPv6 packets are forwarded through the software. To optimize
the software-based forwarding performance, Ruijie introduces IPv4/IPv6 express forwarding through software (Ruijie
Express Forwarding, namely REF).
REF maintains two tables: forwarding table and adjacency table. The forwarding table is used to store route information.
The adjacency table is derived from the ARP table and IPv6 neighbor table, and it contains Layer 2 rewrite (MAC)
information for the next hop.
REF is used to actively resolve next hops and implement load balancing.

Protocols andStandards
N/A

11.2 Applications
Application

Description

Load Balancing

During network routing, when a route prefix is associated with multiple next hops, REF can
implement load balancing among the multiple next hops.

11.2.1 Load Balancing
Scenario
As shown in Figure 11-1, a route prefix is associated with three next hops on router A, namely, link 1, link 2, and link 3. By
default, REF implements load balancing based on the destination IP address. Load balancing can be implemented basedon the source IP address and destination IP address as well.

11-1

Configuration Guide

Configuring IPv4/IPv6 REF

Figure 11-1

Remarks

A is a router that runs REF.
B, C and D are forwarding devices.

Deployment


Run REF on router A.

11.3 Features
Basic Concepts
IPv4/IPv6 REF involves the following basic concepts:

Routing table

An IPv4/IPv6 routing table stores routes to the specific destinations and contains the topology information. During packet
forwarding, IPv4/IPv6 REF selects packet transmission paths based on the routing table.



Adjacent node

An adjacent node contains output interface information about routed packets, for example, the next hop, the nextcomponent to be processed, and the link layer encapsulation. When a packet is matched with an adjacent node, thepacket is directly encapsulated and then forwarded. For the sake of query and update, an adjacent node table is often
organized into a hash table. To support routing load balancing, the next hop information is organized into a load balance
entry. An adjacent node may not contain next hop information. It may contain indexes of next components (such as otherline cards and multi-service cards) to be processed.



Active resolution

REF supports next hop resolution. If the MAC address of the next hop is unknown, REF will actively resolve the next hop.
IPv4 REF requests the ARP module for next hop resolution while IPv6 REF applies the ND module to resolution.

Packet forwarding path11-2

Configuration Guide

Configuring IPv4/IPv6 REF

Packets are forwarded based on their IPv4/IPv6 addresses. If the source and destination IPv4/IPv6 addresses of a packet
are specified, the forwarding path of this packet is determined.

11.3.1 Load Balancing Policies
Load balancing is configured to distribute traffic load among multiple network links.

Working Principle
REF supports two load balancing modes. In the REF model, a route prefix is associated with multiple next hops, in otherwords, it is a multi-path route. The route will be associated with a load balance table and implement weight-based loadbalancing. When an IPv4/IPv6 packet is matched with a load balance entry based on the longest prefix match, REF
performs hash calculation based on the IPv4/IPv6 address of the packet and selects a path to forward the packet.
IPv4/IPv6 REF supports two kinds of load balancing policies: load balancing based on destination IP address, and loadbalancing based on the source and destination IP addresses.

Related Configuration
N/A

11.4 Monitoring
Displaying REF Packet
Statistics
REF packet statistics includes the number of forwarded packets and the number of packets discarded due to various
causes. You can determine whether packets are forwarded as expected by displaying and clearing REF packet statistics.
Description

Command

Displays IPv4 REF packet statistics.

show ip ref packet statistics

Clears IPv4 REF packet statistics.

clear ip ref packet statistics

Displays IPv6 REF packet statistics.

show ipv6 ref packet statistics

Clears IPv6 REF packet statistics.

clear ipv6 ref packet statistics

Displaying Adjacency
Information
You can run the following commands to display adjacency information:
Description

Command

Displays the gleaned adjacencies, local adjacencies,

show ip ref adjacency [ glean | local | ip-address |adjacencies of a specified IP address, adjacencies
associated with a specified interface, and all adjacent nodes
in IPv4 REF.

11-3

interface interface_type interface_number | discard |statistics ]Configuration Guide

Configuring IPv4/IPv6 REF

Displays the gleaned adjacencies, local adjacencies,

show ipv6 ref adjacency [ glean | local | ipv6-address |adjacencies of a specified IPv6 address, adjacencies
associated with a specified interface, and all adjacent nodes
in IPv6 REF.

interface interface_type interface_number | discard |statistics ]Displaying Active
Resolution
Information
You can run the following commands to display next hops to be resolved:
Description

Command

Displays the next hop of a packet to be resolved.

show ip ref resolve-list

Displays the next hop of an IPv6 packet to be resolved.

show ipv6 ref resolve-list

Displaying Packet
Forwarding Path
Information
Packets are forwarded based on their IPv4/IPv6 addresses. If the source and destination IPv4/IPv6 addresses of a packet
are specified, the forwarding path of this packet is determined. Run the following commands and specify the IPv4/IPv6
source and destination addresses of a packet. The forwarding path of the packet is displayed, for example, the packet isdiscarded, submitted to a CPU, or forwarded. Furthermore, the interface that forwards the packet is displayed.
Description

Commandshow ip ref exact-route source-ipaddress

Displays the forwarding path of a packet.

dest_ipaddress
show ipv6 ref exact-route src-ipv6-address

Displays the forwarding path of an IPv6 packet.

dst-ipv6-address

Displaying Route
Information in an REF
TableRun the following commands to display the route information in an REF table:
Description

Command

Displays route information in the IPv4 REF table. The

show ip ref route [ default | ip mask | statistics ]parameter default indicates a default route.
Displays route information in the IPv6 REF table. The

show ipv6 ref route [ default | statistics | prefix/len ]parameter default indicates a default route.

11-4

Configuration Guide

Configuring IPv4/IPv6 REF

11-5

IP Routing Configuration
1. Configuring RIP
2. Configuring RIPng
3. Managing Routes
4. Configuring Routing Policies
5. Configuring Keys

Configuration Guide

Configuring RIP

1 Configuring RIP
1.1 Overview
Routing Information Protocol (RIP) is a unicast routing protocol applied on IPv4 networks. RIP-enabled routers
exchange routing information to obtain routes to remote networks.
As an Interior Gateway Protocol (IGP), RIP can run only within the autonomous system (AS) and is applicable tosmall-sized networks whose longest path involves less than 16 hops.

Protocols andStandards


RFC 1058: Defines RIPv1.



RFC 2453: Defines RIPv2.

1.2 Applications
Application

Description

错误!未找到引用源。

The routing information is automatically maintained through RIP on a small-sizednetwork.

1.2.1 Basic RIP Application
Scenario
On a network with a simple structure, you can configure RIP to implement network interworking. Configuring RIP issimpler than configuring other IGP protocols like Open Shortest Path First (OSPF). Compared with static routes, RIP
can dynamically adapt to the network structure changes and is easier to maintain.
As shown in Figure 1-1, to implement interworking between PC1, PC2, and PC3, you can configure RIP routes on R1,
R2, and R3.

1-1

Configuration Guide

Configuring RIP

Figure 1-1

Deployment
Configure IP addresses and gateways on three PCs.



Configure IP addresses and subnet masks on three routers.



Configure RIP on three routers.

1.3 Features
Basic Concepts

IGP and EGP

IGP runs within an AS. For example, RIP is a type of IGP.
Exterior Gateway Protocol (EGP) runs between ASs.

Classful Routing Protocol and Classless Routing Protocol

Protocols can be classified based on the type of routes supported:Classful routing protocol: It supports classful routes. For example, RIPv1 is a classful routing protocol.

Classless routing protocol: It supports classless routes. For example, RIPv2 is a classless routing protocol.

Overview

FeatureDescription

错误!未找到引用源。

RIP is available in two versions: RIPv1 and RIPv2.

1-2

Configuration Guide

Configuring RIP

FeatureDescription

错误!未找到引用源。

By exchanging routing information, RIP-enabled devices can automatically obtain routes to aremote network and update the routes in real time.

错误!未找到引用源。

RIP is a protocol based on the distance-vector algorithm. It uses the vector addition method tocompute the routing information.

错误!未找到引用源。

RIP uses functions, such as split horizon and poison reverse, to avoid route loops.

错误!未找到引用源。

RIP uses functions, such as authentication and source address verification, to ensure protocol
security.

Reliability Measures

RIP uses graceful restart (GR) to enhance reliability of the protocol.

1.3.1 RIPv1 and RIPv2
Two RIP versions are available: RIPv1 and RIPv2.

Working Principle



RIPv1

RIPv1 packets are broadcast. The broadcast address is 255.255.255.255, and the UDP port ID is 520. RIPv1 cannot
identify the subnet mask, and supports only classful routes.



RIPv2

RIPv2 packets are multicast. The multicast address is 224.0.0.9, and the UDP port ID is 520. RIPv2 can identify thesubnet mask, and supports classless routes, summarized route, and supernetting routes. RIPv2 supports plain text
authentication and message digest 5 (MD5) authentication.

RelatedConfiguration

Enabling the RIP Process

The RIP process is disabled by default.
Run the router rip command to enable the RIP process.
You must enable the RIP process on a device; otherwise, all functions related to RIP cannot take effect.

Running RIP on an Interface

By default, RIP does not run on an interface.
Run the network command to define an address range. RIP runs on interfaces that belong to this address range.
After RIP runs on an interface, RIP packets can be exchanged on the interface and RIP can learn routes to the network
segments directly connected to the device.

Defining the RIP Version

By default, an interface receives RIPv1 and RIPv2 packets, and sends RIPv1 packets.
Run the version command to define the version of RIP packets sent or received on all interfaces.
Run the ip rip send version command to define the version of RIP packets sent on an interface.
1-3

Configuration Guide

Configuring RIP

Run the ip rip receive version command to define the version of RIP packets received on an interface.
If the versions of RIP running on adjacent routers are different, the RIPv1-enabled router will learn incorrectroutes.

Preventing an Interface from Sending or Receiving Packets

By default, a RIP-enabled interface is allowed to send and receive RIP packets.
Run the no ip rip receive enable command to prevent an interface from receiving RIP packets.
Run the no ip rip send enable command to prevent an interface from sending RIP packets.
Run the passive-interface command to prevent an interface from sending broadcast or multicast RIP packets.

Configuring the Mode for Sending RIP Packets

By default, broadcast RIPv1 packets and multicast RIPv2 are sent.
Run the ip rip v2-broadcast command to send broadcast RIPv2 packets on an interface.
Run the neighbor command to send unicast RIP packets to a specified neighbor router.

1.3.2 Exchanging Routing Information
Compared with static routing, the dynamic routing protocol has a significant advantage, that is, by exchanging routing
information, devices can automatically obtain routes to a remote network and update the routes in real time.

Working Principle

Initialization

After RIP is enabled on a router, the router sends a request packet to its neighbor router, requesting for all routing
information, that is, the routing table. After receiving the request message, the neighbor router returns a response
packet containing the local routing table. After receiving the response packet, the router updates the local routing table,
and sends an update packet to the neighbor router, informing the neighbor router of the route update information. After
receiving the update packet, the neighbor router updates the local routing table, and sends the update packet to otheradjacent routers. After a series of updates, all routers can obtain and retain the latest routing information.



Periodical Update

By default, periodical update is enabled for RIP. Adjacent routers exchange complete routing information with eachother every 30s (update timer), that is, the entire routing table is sent to neighbor routers. One update packet contains
at most 25 routes. Therefore, a lot of update packets may be required to send the entire routing table. You can set thesending delay between update packets to avoid loss of routing information.
For every non-local route, if the route is not updated within 180s (invalid timer), the metric of the route is changed
to 16 (unreachable). If the route is still not updated in the next 120s (flush timer), the route is deleted from therouting table.



Triggered Updates

After the triggered updates function is enabled, periodical update is automatically disabled. When routing information
changes on a router, the router immediately sends routes related to the change (instead of the complete routing table)
to the neighbor router, and use the acknowledgment and retransmission mechanisms to ensure that the neighbor router

1-4

Configuration Guide

Configuring RIP

receives the routes successfully. Compared with periodical update, triggered updates help reduce flooding andaccelerates route convergence.
Events that can trigger update include router startup, interface status change, changes in routing information (such as
the metric), and reception of a request packet.

Route Summarization

When sending routing information to a neighbor router, the RIP-enabled router summarizes subnet routes that belong
to the same classful network into a route, and sends the route to the neighbor router. For example, summarize
80.1.1.0/24 (metric=2) and 80.1.2.0/24 (metric=3) into 80.0.0.0/8 (metric=2), and set the metric of the summarizedroute to the optimum metric.
Only RIPv2 supports route summarization. Route summarization can reduce the size of the routing table and improvethe efficiency of routing information exchange.

Supernetting Route

If the subnet mask length of a route is smaller than the natural mask length, this route is called supernetting route. For
example, in the 80.0.0.0/6 route, as 80.0.0.0 is a Class A network address and the natural mask is 8 bits, 80.0.0.0/6
route is a supernetting route.
Only RIPv2 supports supernetting routes.



Default RouteIn the routing table, a route to the destination network 0.0.0.0/1 is called default route.
The default route can be learned from a neighbor router, or sent to a neighbor router.

Route Redistribution

For RIP, other types of routes (such as direct routes, static routes, and routes of other routing protocols) are called
external routes.
External routes (excluding the default route) can be redistributed to RIP and advertised to neighbors.

Route Filtering

Filtering conditions can be configured to limit the routing information exchanged between adjacent routers. Only therouting information that meets filtering conditions can be sent or received.

RelatedConfiguration

Sending Delay Between Update Packets

By default, the update packets are sent continuously without any delay.
Run the output-delay command to set the sending delay between update packets.



RIP Timers

By default, the update timer is 30s, the invalid timer is 180s, and the flush timer is 120s.
Run the timers basic command to modify durations of the RIP timers.

1-5

Configuration Guide

Configuring RIP

Increasing the duration of the flush timer can reduce the route flapping. Decreasing the duration of the flush timer helps
accelerate route convergence.
The durations of RIP timers must be consistent on adjacent routers. Unless otherwise required, you are advised not tomodify the RIP timers.



Triggered Updates

By default, periodical update is enabled.
Run the ip rip triggered command to enable triggered updates on the interface and disable periodical update.
Run the ip rip triggered retransmit-timer command to modify the retransmission interval of update packets. The
default value is 5s.
Run the ip rip triggered retransmit-count command to modify the maximum retransmission times of update packets.
The default value is 36.

Route Summarization

By default, route summarization is automatically enabled if an interface is allowed to send RIPv2 packets.
Run the no auto-summary command to disable route summarization.
Run the ip rip summary-address command to configure route summarization on an interface.

Supernetting RouteBy default, supernetting routes can be sent if an interface is allowed to send RIPv2 packets.
Run the no ip rip send supernet-routes command to prevent the sending of supernetting routes.



Default RouteRun the ip rip default-information command to advertise the default route to neighbors on an interface.
Run the default-information originate command to advertise the default route to neighbors from all interfaces.

Route Redistribution

Run the redistribute command to redistribute external routes (excluding the default route) to RIP and advertise them toneighbors.

Route Filtering

Run the distribute-list out command to set filtering rules to limit the routing information sent by the device.
Run the distribute-list in command to set filtering rules to limit the routing information received by the device.

1.3.3 Routing Algorithm
RIP is a protocol based on the distance-vector algorithm. It uses the vector addition method to compute the routing
information.

Working PrincipleDistance-Vector Algorithm

1-6Configuration Guide

Configuring RIP

RIP is a protocol based on the distance-vector algorithm. The distance-vector algorithm treats a route as a vector thatconsists of the destination network and distance (metric). The router obtains a route from its neighbor and adds the
distance vector from itself to the neighbor to the route to form its own route.
RIP uses the hop count to evaluate the distance (metric) to the destination network. By default, the hop count from arouter to its directly connected network is 0, the hop count from a router to a network that can be reached through therouter is 1, and so on. That is, the metric is equal to the number of routers from the local network to the destination
network. To restrict the convergence time, RIP stipulates that the metric must be an integer between 0 and 15. If themetric is equal to or greater than 16, the destination network or host is unreachable. For this reason, RIP cannot beapplied on a large-scale network.
As shown in Figure 1-2, Router A is connected to the network 10.0.0.0. Router B obtains the route (10.0.0.0,0) fromRouter A and adds the metric 1 to the route to obtain its own route ((10.0.0.0,1), and the next hop points to Router A.
Figure 1-2



Selecting the Optimal RouteRIP selects an optimal route based on the following principle: If multiple routes to the same destination network isavailable, a router preferentially selects the route with the smallest metric.
As shown in Figure 1-3, Router A is connected to the network 10.0.0.0. Router C obtains the route (10.0.0.0,0) fromRouter A and the route (10.0.0.0,1) from Router B. Router C will select the route that is obtained from Router A and add
metric 1 to this route to form its own route (10.0.0.0,1), and the next hop points to Router A.
Figure 1-3

When routes coming from different sources exist on a router, the route with the smallest distance is preferentiallyselected.
Route Source

Default DistanceDirectly-connected network

0

Static route1

OSPF route

110

1-7

Configuration Guide

Configuring RIP

RIP route120

Unreachable route

255

RelatedConfigurationModifying the Distance

By default, the distance of a RIP route is 120.
Run the distance command to modify the distance of a RIP route.

Modifying the Metric

For a RIP route that is proactively discovered by a device, the default metric is equal to the number of hops from thelocal network to the destination network. For a RIP router that is manually configured (default route or redistributed
route), the default metric is 1.
Run the offset-list in command to increase the metric of a received RIP route.
Run the offset-list out command to increase the metric of a sent RIP route.
Run the default-metric command to modify the default metric of a redistributed route.
Run the redistribute command to modify the metric of a route when the route is redistributed.
Run the default-information originate command to modify the metric of a default route when the default route is
introduced.
Run the ip rip default-information command to modify the metric of a default route when the default route is created.

1.3.4 Avoiding Route Loops
RIP uses functions, such as split horizon and poison reverse, to avoid route loops.

Working PrincipleRoute Loop

A RIP route loop occurs due to inherent defects of the distance-vector algorithm.
As shown in Figure 1-4, Router A is connected to the network 10.0.0.0, and sends an update packet every 30s. Router
B receives the route 10.0.0.0 from Router A every 30s. If Router A is disconnected from 10.0.0.0, the route to 10.0.0.0
will be deleted from the routing table on Router A. Next time, the update packet sent by Router A no longer contains thisroute. As Router B does not receive an update packet related to 10.0.0.0, Router B determines that the route to 10.0.0.0
is valid within 180s and uses the Update packet to send this route to Router A. As the route to 10.0.0.0 does not exist on
Router A, the route learned from Router B is added to the routing table. Router B determines that data can reach10.0.0.0 through Router A, and Router A determines that data can reach 10.0.0.0 through Router B. In this way, a route
loop is formed.
Figure 1-4

1-8

Configuration GuideConfiguring RIP

Split Horizon

Split horizon can prevent route loops. After split horizon is enabled on an interface, a route received on this interface will
not be sent out from this interface.
As shown in Figure 1-5, after split horizon is enabled on the interface between Router A and Router B, Router B will not
send the route 10.0.0.0 back to Router A. Router B will learn 180s later that 10.0.0.0 is not reachable.
Figure 1-5

Poison Reverse

Poison reverse can also prevent route loops. Compared with slit horizon, poison reverse is more reliable, but brings
more protocol packets, which makes network congestion more severe.
After poison reverse is enabled on an interface, a route received from this interface will be sent out from this interface
again, but the metric of this router will be changed to 16 (unreachable).
As shown in Figure 1-6, after learning the route 10.0.0.0 from Router A, Router B sets the metric of this route to 16 andsends the route back to Router A. After this route becomes invalid, Router B advertises the route 10.0.0.0 (metric = 16)
to Router A to accelerate the process of deleting the route from the routing table.
Figure 1-6

RelatedConfigurationSplit Horizon

By default, split horizon is enabled.
Run the no ip rip split-horizon command to disable split horizon.



Poison Reverse

By default, poison reverse is disabled.

1-9

Configuration Guide

Configuring RIP

Run the ip rip split-horizon poisoned-reverse command to enable poison reverse. (After poison reverse is enabled,
split horizon is automatically disabled.)

1.3.5 Security Measures
RIP uses functions, such as authentication and source address verification, to ensure protocol security.

Working PrincipleAuthentication

RIPv2 supports authentication, but RIPv1 does not.
After authentication is enabled on an interface, the routing information cannot be exchanged between adjacent devices
if authentication fails. The authentication function is used to prevent unauthorized devices from accessing the RIP
routing domain.
RIPv2 supports plain text authentication and MD5 authentication.

Source Address Verification

When a RIP-enabled device receives an Update packet, it checks whether the source IP address in the packet and theIP address of the inbound interface are in the same network segment. If not, the device drops the packet. Source
address verification is used to ensure that RIP routing information is exchanged only between adjacent routing devices.
On an unnumbered IP interface, source address verification is not performed (not configurable).
If the triggered updates function is enabled, source address verification is automatically enabled (notconfigurable).
If split horizon is disabled, source address verification is automatically enabled (not configurable).

RelatedConfiguration



Authentication

By default, authentication is disabled.
Run the ip rip authentication mode text command to enable plain text authentication on an interface.
Run the ip rip authentication mode md5 command to enable MD5 authentication on an interface.
Run the ip rip authentication text-password command to set the password for plain text authentication on aninterface.
Run the ip rip authentication key-chain command to reference the key in the configured key chain as theauthentication key on an interface.

Source Address Verification

By default, source address verification is enabled.
Run the no validate-update-source command to disable source address verification.

1.3.6 Reliability Measures
RIP uses GR to enhance reliability of the protocol.

1-10Configuration Guide

Configuring RIP

Working PrincipleGR

GR ensures uninterrupted data transmission when the protocol is restarted. If RIP is restarted on a GR-enabled device,
the forwarding table before restart will be retained and a request packet will be sent to the neighbor so that the routecan be learned again. During the GR period, RIP completes re-convergence of the route. After the GR period expires,
RIP updates the forwarding entry and advertises the routing table to the neighbor.

RelatedConfiguration

GR

By default, GR is disabled.
Run the graceful-restart command to enable the GR function.

1.4 Configuration
Configuration
错误!未找到引用源。

Description and Command(Mandatory) It is used to build a RIP routing domain.
router rip

Enables a RIP routing process and entersrouting process configuration mode.

network

Runs RIP on interfaces in the specified
address range.

versionDefines the RIP version.

ip rip split-horizon

Enables split horizon or poison reverse on aninterface.
Configures a passive interface.

passive-interface
错误!未找到引用源。

(Optional) This configuration is required if you wish to change the default mechanism
for sending or receiving RIP packets.
neighbor

Sends unicast RIP packets to a specified
neighbor.

ip rip v2-broadcast

Sends broadcast RIPv2 packets on aninterface.

ip rip receive enable

Allows the interface to receive RIP packets.

ip rip send enable

Allows the interface to send RIP packets.

ip rip send version

Defines the version of RIP packets sent on aninterface.

ip rip receive version

Defines the version of RIP packets received
on an interface.

错误!未找到引用源。

Optional.

1-11

Configuration Guide

Configuration

Configuring RIP

Description and Command
Enables triggered updates on an interface.

ip rip triggered
Enabling Source Address
Verification
Enabling Authentication

Optional.
Enables source address verification.

validate-update-source(Optional) Only RIPv2 supports authentication.
ip rip authentication mode

Enables authentication and sets theauthentication mode on an interface.

ip rip authentication text-password

Configures the password for plain text
authentication on an interface.

ip rip authentication key-chain

Configures the authentication key chain on aninterface.

错误!未找到引用源。

(Optional) Only RIPv2 supports route summarization.
auto-summary

Enables automatic summarization of RIP
routes.

ip rip summary-address

Configures route summarization on aninterface.

Enabling Supernetting
Routes(Optional) Only RIPv2 supports supernetting routes.
ip rip send supernet-routes

Enables advertisement of RIP supernetting
routes on an interface

Advertising the Default
Route or External Routes

Optional.
ip rip default-information

Advertises the default route to neighbors on
an interface.

default-information originate

Advertises the default route to neighbors.

redistribute

Redistributes routes and advertises externalroutes to neighbors.

Setting Route Filtering
Rules

Modifying Route Selection
Parameters

Optional.
distribute-list in

Filters the received RIP routing information.

distribute-list out

Filters the sent RIP routing information.

Optional.
distance

Modifies the administrative distance (AD) of a
RIP route.

offset-list

Increases the metric of a received or sent RIP
route.

default-metric

Configures the default metric of an externalroute redistributed to RIP.

Modifying Timers

Optional.
timers basic

Modifies the update timer, invalid timer, andflush timer.

1-12

Configuration Guide

Configuration

Configuring RIP

Description and Command
output-delay

Sets the sending delay between RIP route
update packets.

Enabling GR

Optional.
Configures the GR restarter capability.

graceful-restart

1.4.1 Configuring RIP Basic Functions
Configuration Effect

Build a RIP routing domain on the network.

Routers in the domain obtain routes to a remote network through RIP.

Notes


IPv4 addresses must be configured.



IPv4 unicast routes must be enabled.

Configuration Steps

Enabling a RIP Routing Process

Mandatory.



Unless otherwise required, this configuration must be performed on every router in the RIP routing domain.

Associating with the Local Network

Mandatory.



Unless otherwise required, this configuration must be performed on every router in the RIP routing domain.



Unless otherwise required, the local network associated with RIP should cover network segments of all L3interfaces.

Defining the RIP Version



If RIPv2 functions (such as the variable length subnet mask and authentication) are required, enable the RIPv2.



Unless otherwise required, you must define the same RIP version on every router.

Enabling Split Horizon or Poison Reverse

By default, split horizon is enabled and poison reverse is disabled.



Unless otherwise required, enable split horizon on every interface connected to the broadcast network, such as
the Ethernet. (Retain the default setting.)

Unless otherwise required, enable split horizon on every interface connected to the point-to-point (P2P) network,
such as the PPP and HDLC. (Retain the default setting.)

It is recommended that split horizon and poison reverse be disabled on an interface connected to a non-broadcast
multi-access (NBMA) network, such as FR and X.25; otherwise, some devices may fail to learn the completerouting information.

1-13

Configuration GuideConfiguring RIP

If the secondary IP address is configured for an interface connected to a non-broadcast, it is recommended thatsplit horizon and poison reverse be disabled.

Configuring a Passive Interface

If you want to suppress Update packets on a RIP interface, configure the interface as a passive interface.

Use the passive interface to set the boundary of the RIP routing domain. The network segment of the passiveinterface belongs to the RIP routing domain, but RIP packets cannot sent over the passive interface.



If RIP routes need to be exchanged on an interface (such as the router interconnect interface) in the RIP routing
domain, this interface cannot be configured as a passive interface.

Verification


Check the routing table on a router to verify that the route to a remote network can be obtained through RIP.

Related Commands

Enabling a RIP Routing Process

Commandrouter rip

Parameter

N/A

Description
Command

Global configuration mode

Mode
Configuratio

This command is used to create a RIP routing process and enter routing process configuration mode.

n Usage

Associating with the Local Network

Commandnetwork network-number [ wildcard ]Parameter

network-number: Indicates the number of a network.

Description

wildcard: Defines the IP address comparison bit. 0 indicates accurate matching, and 1 indicates that nocomparison is performed.

CommandRouting process configuration mode

Mode
Configuratio

RIP can run and learn direct routes and RIP packets can be exchanged only on an interface covered byn Usage

network.
If network 0.0.0.0 255.255.255.255 is configured, all interfaces are covered.
If wildcard is not configured, the classful address range is used by default, that is, the interfaces whose
addresses fall into the classful address range participate in RIP operations.



Defining the RIP Version

Commandversion { 1 | 2 }Parameter

1: Indicates RIPv1.

Description

2: Indicates RIPv2.

1-14

Configuration Guide

Command

Configuring RIP

Global configuration mode

Mode
Configuratio

This command takes effect on the entire router. You can run this command to define the version of RIP

n Usagepackets sent or received on all interfaces.

Enabling Split Horizon

Command

ip rip split-horizon [ poisoned-reverse ]Parameter

poisoned-reverse: Indicates poison reverse.

Description
Command

Interface configuration mode

Mode
Configuratio

After poison reverse is enabled, split horizon is automatically disabled.

n UsageConfiguring a Passive Interface

Commandpassive-interface { default | interface-type interface-num }Parameter

default: Indicates all interfaces.

Description

interface-type interface-num: Specifies an interface.

CommandRouting process configuration mode

Mode
Configuratio

First, run the passive-interface default command to configure all interfaces as passive interfaces.

n UsageThen, run the no passive-interface interface-type interface-num command to cancel the interfaces
used for interconnection between routers in the domain.

Configuration
Example

Building a RIP Routing Domain

Scenario
Figure 1-7

RemarkThe interface IP addresses are as follows:s

A: GE0/1 110.11.2.1/24

GE0/2 155.10.1.1/24

B: GE0/1 110.11.2.2/24

GE0/2 196.38.165.1/24

C: GE0/1 110.11.2.3/24

GE0/2 117.102.0.1/16

1-15

Configuration Guide

Configuring RIP

Configuratio

Configure the interface IP addresses on all routers.

n StepsConfigure the RIP basic functions on all routers.

AA# configure terminalA(config)# interface GigabitEthernet 0/1
A(config-if-GigabitEthernet 0/1)# ip address 110.11.2.1 255.255.255.0
A(config-if-GigabitEthernet 0/1)# exit
A(config)# interface GigabitEthernet 0/2
A(config-if-GigabitEthernet 0/2)# ip address 155.10.1.1 255.255.255.0
A(config)# router ripA(config-router)# version 2A(config-router)# network 0.0.0.0 255.255.255.255
A(config-router)# passive-interface default
A(config-router)# no passive-interface GigabitEthernet 0/1

B

B# configure terminal
B(config)# interface GigabitEthernet 0/1
B(config-if-GigabitEthernet 0/1)# ip address 110.11.2.2 255.255.255.0
B(config-if-GigabitEthernet 0/1)# exit
B(config)# interface GigabitEthernet 0/2
B(config-if-GigabitEthernet 0/2)# ip address 196.38.165.1 255.255.255.0
B(config-if-GigabitEthernet 0/2)# exit
B(config)# router rip
B(config-router)# version 2
B(config-router)# network 0.0.0.0 255.255.255.255
B(config-router)# passive-interface default
B(config-router)# no passive-interface GigabitEthernet 0/1

C

C# configure terminalC(config)# interface GigabitEthernet 0/1
C(config-if-GigabitEthernet 0/1)# ip address 110.11.2.3 255.255.255.0
C(config-if-GigabitEthernet 0/1)# exit
C(config)# interface GigabitEthernet 0/2
C(config-if-GigabitEthernet 0/2)# ip address 117.102.0.1 255.255.0.0
C(config-if-GigabitEthernet 0/2)# exit
C(config)# router ripC(config-router)# version 2

1-16

Configuration Guide

Configuring RIP

C(config-router)#no auto-summaryC(config-router)# network 0.0.0.0 255.255.255.255
C(config-router)# passive-interface default
C(config-router)# no passive-interface GigabitEthernet 0/1
Verification

Check the routing tables on Router A, Router B, and Router C. Verify that RIP learns the routes toremote networks (contents marked in blue).

A

A# show ip route

Codes:

C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default

Gateway of last resort is no set

BC

110.11.2.0/24 is directly connected, GigabitEthernet 0/1

C110.11.2.1/32 is local host.

R

117.0.0.0/8 [120/1] via 110.11.2.2, 00:00:47, GigabitEthernet 0/1

C

155.10.1.0/24 is directly connected, GigabitEthernet 0/2

C

155.10.1.1/32 is local host.

C

192.168.217.0/24 is directly connected, VLAN 1

C

192.168.217.233/32 is local host.

R

196.38.165.0/24 [120/1] via 110.11.2.3, 00:19:18, GigabitEthernet 0/1

B# show ip route

Codes:

C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default

Gateway of last resort is no set

1-17

Configuration Guide

C

Configuring RIP

C110.11.2.0/24 is directly connected, GigabitEthernet 0/1

C110.11.2.2/32 is local host.

R

155.10.0.0/16 [120/1] via 110.11.2.1, 00:15:21, GigabitEthernet 0/1

C

196.38.165.0/24 is directly connected, GigabitEthernet 0/2

C

196.38.165.1/32 is local host.

R

117.0.0.0/8 [120/1] via 110.11.2.2, 00:00:47, GigabitEthernet 0/1

C# show ip route

Codes:

C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default

Gateway of last resort is no set
C

110.11.2.0/24 is directly connected, GigabitEthernet 0/1

C110.11.2.3/32 is local host.

C

117.102.0.0/16 is directly connected, GigabitEthernet 0/2

C

117.102.0.1/32 is local host.

R

155.10.0.0/16 [120/1] via 110.11.2.1, 00:20:55, GigabitEthernet 0/1

R

196.38.165.0/24 [120/1] via 110.11.2.3, 00:19:18, GigabitEthernet 0/1

Common Errors


The IPv4 address is not configured on an interface.



The RIP version is not defined on a device, or the RIP version on the device is different from that on other routers.



The address range configured by the network command does not cover a specific interface.



The wildcard parameter in the network command is not correctly configured. 0 indicates accurate matching, and
1 indicates that no comparison is performed.



The interface used for interconnection between devices is configured as a passive interface.

1.4.2 Controlling Interaction of RIP Packets
Configuration EffectChange the default running mechanism of RIP through configuration and manually control the interaction mode of RIP
packets, including:

1-18

Configuration Guide

Configuring RIPAllowing or prohibiting the sending of unicast RIP packets to a specified neighbor on an interfaceAllowing or prohibiting the sending of unicast RIPv2 packets instead of broadcast packets to a specified neighboron an interfaceAllowing or prohibiting the receiving of RIP packets on an interfaceAllowing or prohibiting the sending of RIP packets on an interfaceAllowing or prohibiting the receiving of RIP packets of a specified version on an interfaceAllowing or prohibiting the sending of RIP packets of a specified version on an interface

Notes


The RIP basic functions must be configured.

On an interface connecting to a neighbor device, the configured version of sent RIP packets must be the same as
the version of received RIP packets.

Configuration Steps

Sending Unicast RIP Route Update Packets to a Specified NeighborConfigure this function if you wish that only some of devices connected to an interface can receive the updated
routing information.



By default, RIPv1 uses the IP broadcast address (255.255.255.255) to advertise the routing information, whereas
RIPv2 uses the multicast address (224.0.0.9) to advertise the routing information. If you do not wish all devices on
the broadcast network or NBMA network to receive routing information, configure the related interface as thepassive interface and specify the neighbors that can receive the routing information. This command does notaffect the receiving of RIP packets. RIPv2 packets are broadcast on an interface.



Unless otherwise required, this function must be enabled on a router that sends the unicast Update packets.

Broadcasting RIPv2 Packets on an Interface

This function must be configured if the neighbor router does not support the receiving of multicast RIPv2 packets.

Unless otherwise required, this function must be configured on every router interface that broadcasts RIPv2
packets.

Allowing an Interface to Receive RIP Packets

This function is enabled by default, and must be disabled if an interface is not allowed to receive RIP packets.

Unless otherwise required, this function must be configured on every router interface that is not allowed to receive
RIP packets.

Allowing an Interface to Send RIP Packets

This function is enabled by default, and must be disabled if an interface is not allowed to send RIP packets.

Unless otherwise required, this function must be configured on every router interface that is not allowed to send
RIP packets.

Allowing an Interface to Send RIP Packets of a Specified Version

1-19

Configuration GuideConfiguring RIP

This function must be configured if the version of RIP packets that can be sent on an interface is required to bedifferent from the global configuration.



Unless otherwise required, this function must be configured on every router interface that is allowed to send RIP
packets of a specified version.

Allowing an Interface to Receive RIP Packets of a Specified Version

This function must be configured if the version of RIP packets that can be received on an interface is required tobe different from the global configuration.



Unless otherwise required, this function must be configured on every router interface that is allowed to receive RIP
packets of a specified version.

Verification
Run the debug ip rip packet command to verify the packet sending result and packet type.

Related Commands



Sending Unicast RIP Route Update Packets to a Specified Neighbor

Commandneighbor ip-address

Parameter

ip-address: Indicates the IP address of the neighbor. It should be the address of the network directly

Description

connected to the local device.

CommandRouting process configuration mode

Mode
Configuratio

Generally, you can first run the passive-interface command in routing process configuration mode ton Usageconfigure the related interface as a passive interface, and then specify the neighbors that can receive
the routing information. This command does not affect the receiving of RIP packets. After an interface isconfigured as a passive interface, the interface does not send the request packets even after the device
is restarted.



Broadcasting RIPv2 Packets on an Interface

Command

ip rip v2-broadcast

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Configuratio

The default behavior is determined by the configuration of the version command. The configurationn Usageresult of this command can overwrite the default configuration of the version command. This command
affects the behavior of sending RIP packets on the current interface, and the interface is allowed to send
RIPv1 and RIPv2 packets simultaneously. If this command does not contain any parameter, thebehavior of receiving RIP packets is determined by the configuration of the version command.



Allowing an Interface to Receive RIP Packets

Command

ip rip receive enable

1-20Configuration Guide

Parameter

Configuring RIP

N/A

Description
Command

Interface configuration mode

Mode
Configuratio

To prohibit the receiving of RIP packets on an interface, use the no form of this command. Thisn Usagecommand takes effect only on the current interface. You can use the default form of the command torestore the default setting, that is, allowing the interface to receive RIP packets.

Allowing an Interface to Send RIP Packets

Command

ip rip send enable

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Configuratio

To prohibit the sending of RIP packets on an interface, use the no form of this command in interface

n Usageconfiguration mode. This command takes effect only on the current interface. You can use the default
form of the command to restore the default setting, allowing the interface to send RIP packets.

Allowing an Interface to Send RIP Packets of a Specified Version

Command

ip rip send version [ 1 | 2 ]Parameter

1: Indicates that only RIPv1 packets are sent.

Description

2: Indicates that only RIPv2 packets are sent.

Command

Interface configuration mode

Mode
Configuratio

The default behavior is determined by the configuration of the version command. The configurationn Usageresult of this command can overwrite the default configuration of the version command. This command
affects the behavior of sending RIP packets on the current interface, and the interface is allowed to send
RIPv1 and RIPv2 packets simultaneously. If this command does not contain any parameter, thebehavior of receiving RIP packets is determined by the configuration of the version command.



Allowing an Interface to Receive RIP Packets of a Specified Version

Command

ip rip receive version [ 1 | 2 ]Parameter

1: Indicates that only RIPv1 packets are received.

Description

2: Indicates that only RIPv2 packets are received.

Command

Interface configuration mode

Mode
Configuratio

The default behavior is determined by the configuration of the version command. The configurationn Usageresult of this command can overwrite the default configuration of the version command. This command
affects the behavior of receiving RIP packets on the current interface, and the interface is allowed toreceive RIPv1 and RIPv2 packets simultaneously. If this command does not contain any parameter, thebehavior of receiving RIP packets is determined by the configuration of the version command.

1-21

Configuration Guide

Configuring RIP

Configuration
Example

Prohibiting an Interface from Sending RIP Packets

Scenario
Figure 1-8

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Prohibit the sending of RIP packets on an interface of Router A.

A

A# configure terminalA(config)# interface GigabitEthernet 0/1
Ruijie(config-if-GigabitEthernet 0/1)# no ip rip send enable

Verification

Run the debug ip rip packet send command on Router A, and verify that packets cannot be sent.

A

A# debug ip rip packet recv
*Nov

4 08:19:31: %RIP-7-DEBUG:[RIP] Prepare to send BROADCAST response...

*Nov

4 08:19:31: %RIP-7-DEBUG:[RIP] Building update entries on GigabitEthernet 0/1*Nov

4 08:19:31: %RIP-7-DEBUG:

117.0.0.0/8 via 0.0.0.0 metric 1 tag 0*Nov

4 08:19:31: %RIP-7-DEBUG:[RIP] Interface GigabitEthernet 0/1 is disabled to send RIP

packet!

Common Errors
A compatibility error occurs because the RIP version configured on the neighbor is different from that configured on thelocal device.

1.4.3 Enabling Triggered Updates
Configuration EffectEnable the RIP triggered updates function, after which RIP does not periodically send the route update packets.

Notes


The RIP basic functions must be configured.



It is recommended that split horizon with poisoned reverse be enabled; otherwise, invalid routing information may
exist.



Ensure that the triggered updates function is enabled on every router on the same link; otherwise, the routing
information cannot be exchanged properly.
1-22Configuration Guide

Configuring RIP

Configuration Steps

Enabling Triggered UpdatesThis function must be enabled if demand circuits are configured on the WAN interface.



The triggered updates function can be enabled in either of the following cases: (1) The interface has only one
neighbor; (2) The interface has multiple neighbors but the device interacts with these neighbors in unicast mode.

It is recommended that triggered updates be enabled on a WAN interface (running the PPP, Frame Relay, or X.25
link layer protocol) to meet the requirements of demand circuits.



If the triggered updates function is enabled on an interface, source address verification is performed no matter
whether the source address verification function is enabled by the validate-update-source command.



Unless otherwise required, triggered updates must be enabled on demand circuits of every router.

Verification
When the RIP triggered updates function is enabled, RIP cannot periodically send the route update packets. RIP sends
the route update packets to the WAN interface only in one of the following cases:A route request packet is received.



The RIP routing information changes.



The interface state changes.



The router is started.

Related Commands

Enabling Triggered Updates

Command

ip rip triggered { retransmit-timer timer | retransmit-count count }Parameter

retransmit-timer timer: Configures the interval at which the update request or update response packet

Description

is retransmitted. The default value is 5s. The value ranges from 1 to 3,600.
retransmit-count count: Configures the maximum retransmission times of the update request or update
response packet. The default value is 36. The value ranges from 1 to 3,600.

Command

Interface configuration mode

Mode
Configuratio

You can run the ip rip triggered command to enable the RIP triggering function.

n Usage

When this function is enabled, the RIP periodical update function is automatically disabled. Therefore,
the acknowledgment and retransmission mechanisms must be used to ensure that the Update packets
are successfully sent or received on the WAN. You can use the retransmit-timer and retransmit-countparameters to specify the retransmission interval and maximum retransmission times of the request andupdate packets.

Configuration
Example

Enabling Triggered Updates

1-23

Configuration Guide

Configuring RIP

Scenario
Figure 1-9

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)



On Router A, enable the RIP triggered updates function, and set the retransmission interval andmaximum retransmission times of the request and update packets to 10s and 18, respectively.

A

A# configure terminalA(config)# interface GigabitEthernet 0/1
A(config-if-GigabitEthernet 0/1)# encapsulation ppp
A(config-if-GigabitEthernet 0/1)# ip rip triggeredA(config-if-GigabitEthernet 0/1)# ip rip triggered retransmit-timer 10A(config-if-GigabitEthernet 0/1)# ip rip triggered retransmit-count 18
A(config-if-GigabitEthernet 0/1)# ip rip split-horizon poisoned-reverse
A(config)# router ripA(config-router)# network 192.168.1.0
A(config-router)# network 200.1.1.0

B

B# configure terminal
B(config)# interface GigabitEthernet 0/1
B(config-if-GigabitEthernet 0/1)# encapsulation ppp
B(config-if-GigabitEthernet 0/1)# ip rip triggered
B(config-if-GigabitEthernet 0/1)# ip rip split-horizon poisoned-reverse
B(config)# router rip
B(config-router)# network 192.168.1.0
B(config-router)# network 201.1.1.0

Verification

On Router A and Router B, check the RIP database and verify that the corresponding routes arepermanent.

A

A# sho ip rip database201.1.1.0/24

auto-summary

201.1.1.0/24[1] via 192.168.12.2 GigabitEthernet 0/1 06:25

1-24

permanentConfiguration Guide

B

Configuring RIP

B# sho ip rip database
200.1.1.0/24

auto-summary

200.1.1.0/24[1] via 192.168.12.1 GigabitEthernet 0/1 06:25

permanent

Common Errors


The triggered updates function is enabled when the RIP configurations at both ends of the link are consistent.

The triggered updates function is not enabled on all routers on the same link.

1.4.4 Enabling Source Address Verification
Configuration Effect

The source address of the received RIP route update packet is verified.

Notes


The RIP basic functions must be configured.

Configuration Steps

Enabling Source Address Verification

This function is enabled by default, and must be disabled when source address verification is not required.



After split horizon is disabled on an interface, the RIP routing process will perform source address verification on
the Update packet no matter whether the validate-update-source command is executed in routing process
configuration mode.

For an IP unnumbered interface, the RIP routing process does not perform source address verification on theUpdate packet no matter whether the validate-update-source command is executed in routing process
configuration mode.



Unless otherwise required, this function must be disabled on every router that does not requires source address
verification.

Verification
Only the route update packets coming from the same IP subnet neighbor are received.

Related Commands
Commandvalidate-update-source

Parameter

N/A

Description
CommandRouting process configuration mode

Mode
Configuratio

Source address verification of the Update packet is enabled by default. After this function is enabled, then Usagesource address of the RIP route update packet is verified. The purpose is to ensure that the RIP routing

1-25

Configuration Guide

Configuring RIP

process receives only the route update packets coming from the same IP subnet neighbor.

Configuration
ExampleScenario
Figure 1-10

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Disable source address verification of Update packets on all routers.

AA# configure terminalA(config)# router ripA(config-router)# no validate-update-source

B

B# configure terminal
B(config)# router rip
B(config-router)# no validate-update-source

VerificationA

On Router A, check the routing table and verify that the entry 201.1.1.0/24 is loaded.

On Router B, check the routing table and verify that the entry 200.1.1.0/24 is loaded.

A# show ip route rip
RB

201.1.1.0/24 [120/1] via 192.168.2.2, 00:06:11, GigabitEthernet 0/1

B# show ip route rip
R

200.1.1.0/24 [120/1] via 192.168.1.1, 00:06:11, GigabitEthernet 0/1

1.4.5 Enabling Authentication
Configuration EffectPrevent learning unauthenticated and invalid routes and advertising valid routes to unauthorized devices, ensuringstability of the system and protecting the system against intrusions.

Notes


The RIP basic functions must be configured.

Only RIPv2 supports authentication of RIP packets, and RIPv1 does not.

1-26

Configuration Guide

Configuring RIP

Configuration Steps

Enabling Authentication and Specifying the Key Chain Used for RIP Authentication

This configuration is mandatory if authentication must be enabled.



If the key chain is already specified in the interface configuration, run the key chain command in global
configuration mode to define the key chain; otherwise, authentication of RIP packets may fail.



Unless otherwise required, this configuration must be performed on every router that requires authentication.

Defining the RIP Authentication ModeThis configuration is mandatory if authentication must be enabled.



The RIP authentication modes configured on all devices that need to directly exchange RIP routing informationmust be the same; otherwise, RIP packets may fail to be exchanged.



If plain text authentication is used, but the key chain for plain text authentication is not configured or associated,authentication is not performed. Similarly, if MD5 authentication is used, but the key chain is not configured or
associated, authentication is not performed.



Unless otherwise required, this configuration must be performed on every router that requires authentication.

Enabling RIP Plain Text Authentication and Configuring the Key ChainThis configuration is mandatory if authentication must be enabled.



If RIP plain text authentication should be enabled, use this command to configure the key chain for plain text
authentication. Alternatively, you can obtain the key chain for plain text authentication by associating the key chain.
The key chain obtained using the second method takes precedence over that obtained using the first method.



Unless otherwise required, this configuration must be performed on every router that requires authentication.

Verification


RIP plain text authentication provides only limited security because the password transferred through the packet isvisible.



RIP MD5 authentication can provide higher security because the password transferred through the packet isencrypted using the MD5 algorithm.

Routes can be learned properly if the correct authentication parameters are configured.

Routes cannot be learned if the incorrect authentication parameters are configured.

Related Commands

Enabling Source Address Verification

Command

ip rip authentication key-chain name-of-keychain

Parametername-of-keychain: Specifies the name of the key chain used for RIP authentication.

Description
Command

Interface configuration mode

Mode
Configuratio

The specified key chain must be defined by the key chain command in global configuration mode in

1-27

Configuration Guiden UsageConfiguring RIP

advance.

Defining the RIP Authentication Mode

Command

ip rip authentication mode { text | md5 }Parameter

text: Indicates that the RIP authentication mode is plain text authentication.

Description

md5: Indicates that the RIP authentication mode is MD5 authentication.

Command

Interface configuration mode

Mode
Configuratio

For all devices that need to directly exchange the RIP routing information, the RIP authentication moden Usageof these devices must be the same.

Enabling RIP Plain Text Authentication and Configuring the Key Chain

Command

ip rip authentication text-password [ 0 | 7 ] password-string

Parameter

0: Indicates that the key is displayed in plain text.

Description

7: Indicates that the key is displayed in cipher text.
password-string: Indicates the key chain used for plain text authentication. The key chain is a string of 1
to 16 bytes.

Command

Interface configuration mode

Mode
Configuratio

This commands takes effect only in plain text authentication mode.

n Usage

Configuration
Example

Configuring RIP Basic Functions and Enabling MD5 Authentication

Scenario
Figure 1-11

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Configure the authentication type and MD5 authentication key on all routers.

AA# configure terminalA(config)# key chain helloA(config-keychain)# key 1
A(config-keychain-key)# key-string world

1-28

Configuration Guide

Configuring RIP

A(config-keychain-key)# exit
A(config-keychain)# exit
A(config)# interface GigabitEthernet 0/1
A(config-if-GigabitEthernet 0/1)# ip rip authentication mode md5
A(config-if-GigabitEthernet 0/1)# ip rip authentication key-chain helloB

B# configure terminal
B(config)# key chain helloB(config-keychain)# key 1
B(config-keychain-key)# key-string world
B(config-keychain-key)# exit
B(config-keychain)# exit
B(config)# interface GigabitEthernet 0/1
B(config-if-GigabitEthernet 0/1)# ip rip authentication mode md5
B(config-if-GigabitEthernet 0/1)# ip rip authentication key-chain hello

VerificationA

On Router A, check the routing table and verify that the entry 201.1.1.0/24 is loaded.

On Router B, check the routing table and verify that the entry 200.1.1.0/24 is loaded.

A# show ip route rip
RB

201.1.1.0/24 [120/1] via 192.168.1.2, 00:06:11, GigabitEthernet 0/1

A# show ip route rip
R

200.1.1.0/24 [120/1] via 192.168.1.1, 00:06:11, GigabitEthernet 0/1

Common Errors


The keys configured on routers that need to exchange RIP routing information are different.



The authentication modes configured on routers that need to exchange RIP routing information are different.

1.4.6 Enabling Route Summarization
Configuration EffectReduce the size of the routing table, improve the routing efficiency, avoid route flapping to some extent, and improvescalability and effectiveness of the network.
If a summarized route exists, subroutes included by the summarized route cannot be seen in the routing table,
which greatly reduces the size of the routing table.
Advertising a summarized route is more efficient than advertising individual routes because: (1) A summarizedroute is processed first when RIP looks through the database; (2) All subroutes are ignored when RIP looks
through the database, which reduces the processing time required.

1-29

Configuration Guide

Configuring RIP

Notes


The RIP basic functions must be configured.



The range of supernetting routes is larger than that of the classful network. Therefore, the automatic routesummarization function is invalid for supernetting routes.



RIPv1 always performs automatic route summarization. If the detailed routes should be advertised, you must set
the RIP version to RIPv2.

Configuration Steps

Enabling Automatic Route Summarization

This function is enabled by default.



To learn specific subnet routes instead of summarized network routes, you must disable automatic routesummarization.

You can disable automatic route summarization only in RIPv2. RIPv1 always performs automatic routesummarization.

Configuring RIP Route Summarization on an Interface

This function must be configured if it is required to summarize classful subnets.

The ip rip summary-address command is used to summarize an address or a subnet under a specified interface.
RIP automatically summarizes to the classful network boundary. Each classful subnet can be configured only in
the ip rip summary-address command.

The summary range configured in this command cannot be supernetting routes, that is, the configured subnet
mask length cannot be smaller than the natural mask length of the network.



Unless otherwise required, this configuration should be performed on a router that requires classful subnet
summarization.

Verification
Verify that the routes are summarized in the routing table of the peer end.

Related Commands

Enabling Automatic Route Summarization

Commandauto-summary

Parameter

N/A

Description
CommandRouting process configuration mode

Mode
Configuratio

Route summarization is enabled by default for RIPv1 and RIPv2.

n Usage

You can disable automatic route summarization only in RIPv2. RIPv1 always performs automatic routesummarization.

Configuring RIP Route Summarization on an Interface

1-30Configuration Guide

Configuring RIP

Command

ip rip summary-address ip-address ip-network-mask

Parameter

ip-address: Indicates the IP address to be summarized.

Description

ip-network-mask: Indicates the subnet mask of the IP address to be summarized.

Command

Interface configuration mode

Mode
Configuratio

This command is used to summarize an address or a subnet under a specified interface.

n Usage

Configuration
Example

Configuring Route Summarization

Scenario
Figure 1-12

RemarkThe interface IP addresses are as follows:s

A: GE0/1 192.168.1.1
B: GE0/1 192.168.1.2 GE0/2 172.16.2.1 GE0/3 172.16.3.1
C: GE0/2 172.16.2.2 GE0/3 172.16.4.2
D: GE0/2 172.16.3.2 GE0/3 172.16.5.2

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Configure route summarization on Router B.

B# configure terminal
B(config)# interface GigabitEthernet 0/1
B(config-if-GigabitEthernet 0/1)# ip rip summary-address 172.16.0.0 255.255.0.0
B(config)# router rip
B(config-router)# version 2
B(config-router)# no auto-summary
Verification

Check the routing table on Router A, and verify that the entry 172.16.0.0/16 is generated.
A# show ip route rip

1-31

Configuration Guide

Configuring RIP

Scenario
Figure 1-12

RemarkThe interface IP addresses are as follows:s

A: GE0/1 192.168.1.1
B: GE0/1 192.168.1.2 GE0/2 172.16.2.1 GE0/3 172.16.3.1
C: GE0/2 172.16.2.2 GE0/3 172.16.4.2
D: GE0/2 172.16.3.2 GE0/3 172.16.5.2

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Configure route summarization on Router B.

B# configure terminal
B(config)# interface GigabitEthernet 0/1
B(config-if-GigabitEthernet 0/1)# ip rip summary-address 172.16.0.0 255.255.0.0
B(config)# router rip
B(config-router)# version 2
B(config-router)# no auto-summary
Verification

Check the routing table on Router A, and verify that the entry 172.16.0.0/16 is generated.
R 172.16.0.0/16 [120/2] via 192.168.1.2, 00:01:04, GigabitEthernet 0/1

Common Errors

RIP basic functions are not configured or fail to be configured.

1.4.7 Enabling Supernetting Routes
Configuration EffectAllow RIP to send RIP supernetting routes on a specified interface.

Notes


The RIP basic functions must be configured.

1-32

Configuration Guide

Configuring RIP

Configuration Steps

Enabling Supernetting Routes



If a supernetting route is detected when a RIPv1-enabled router monitors the RIPv2 route response packets, therouter will learn an incorrect route because RIPv1 ignores the subnet mask in the routing information of the packet.
In this case, the no form of the command must be used on the RIPv2-enabled router to prohibit advertisement ofsupernetting routes on the related interface. This command takes effect only on the current interface.

The command is effective only when RIPv2 packets are sent on the interface, and is used to control the sending ofsupernetting routes.

Verification
Verify that the peer router cannot learn the supernetting route.

Related Commands
Command

ip rip send supernet-routes

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Configuratio

By default, an interface is allowed to send RIP supernetting routes.

n Usage

Configuration
Example

Disabling Supernetting Routes

Scenario
Figure 1-13

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Prohibit the sending of RIP supernetting routes on the GigabitEthernet 0/1 interface of Router B.

1-33

Configuration Guide

Configuring RIP

B# configure terminal
B(config)# ip route 207.0.0.0 255.0.0.0 Null 0
B(config)# ip route 208.1.1.0 255.255.255.0 Null 0
B(config)# router rip
B(config-router)# redistribute static
B(config)# interface GigabitEthernet 0/1
B(config-if-GigabitEthernet 0/1)# no ip rip send supernet-routes
Verification

Check the routing table on Router A, and verify that Router A can learn only the non-supernetting route208.1.1.0/24, but not the supernetting route 207.0.0.0/8.
A#show ip route rip
R

208.1.1.0/24 [120/1] via 192.168.1.2, 00:06:11, GigabitEthernet 0/1

1.4.8 Advertising the Default Route or External Routes
Configuration EffectIn the RIP domain, introduce a unicast route of another AS so that the unicast routing service to this AS can beprovided for users in the RIP domain.

In the RIP domain, inject a default route to another AS so that the unicast routing service to this AS can beprovided for users in the RIP domain.

Notes


The RIP basic functions must be configured.

Route redistribution cannot introduce default routes of other protocols to the RIP routing domain.

Configuration Steps

Advertising the Default Route to Neighbors

This function must be enabled if it is required to advertise the default route to neighbors.
By default, a default route is not generated, and the metric of the default route is 1.
If the RIP process can generate a default route using this command, RIP does not learn the default route advertised by
the neighbor.
Unless otherwise required, this configuration should be performed on a router that needs to advertise the default route.

Advertising the Default Route to Neighbors on an Interface

This function must be enabled if it is required to advertise the default route to neighbors on a specified interface.
By default, a default route is not configured and the metric of the default route is 1.
After this command is configured on an interface, a default route is generated and advertised through this interface.
Unless otherwise required, this configuration should be performed on a router that needs to advertise the default route.

1-34

Configuration GuideConfiguring RIP

Redistributes Routes and Advertises External Routes to Neighbors

This function must be enabled if routes of other protocols need to be redistributed.
By default,

In other cases, redistribute all external routes.



The metric of a redistributed route is 1 by default.



The route map is not associated by default.

During route redistribution, it is not necessary to convert the metric of one routing protocol to the metric of anotherrouting protocol because different routing protocols use completely different metric measurement methods. Therefore,
the computed metrics cannot be compared with each other. During route redistribution, however, it is necessary toconfigure a symbolic metric; otherwise, route redistribution fails.
Unless otherwise required, this configuration should be performed on a router that needs to redistribute routes.

VerificationOn a neighbor device, verify that a default route exists in the RIP routing table.

On the local and neighbor devices, verify that external routes (routes to other ASs) exist in the RIP routing table.

Related Commands

Advertising the Default Route to Neighbors

Commanddefault-information originate [ always | metric metric-value | route-map route-map-name ] *Parameter

always: Enables RIP to generate a default route no matter whether the local router has a default route.

Description

metric metric-value: Indicates the initial metric of the default route. The value ranges from 1 to 15.
route-map map-name: Indicates the associated route map name. By default, no route map is
associated.

CommandRouting process configuration mode

Mode
Configuratio

If a default route exists in the routing table of a router, RIP does not advertise the default route ton Usage

external entities by default. You need to run the default-information originate command in routing
process configuration mode to advertise the default route to neighbors.
If the always parameter is selected, the RIP routing process advertises a default route to neighbors nomatter the default route exists, but this default route is not displayed in the local routing table. To check
whether the default route is generated, run the show ip rip database command to check the RIP routing
information database.
To further control the behavior of advertising the RIP default route, use the route-map parameter. For
example, run the set metric rule to set the metric of the default route.
You can use the metric parameter to set the metric of the advertised default value, but the priority of thisconfiguration is lower than that of the set metric rule of the route-map parameter. If the metricparameter is not configured, the default route uses the default metric configured for RIP.
You still need to run the default-information originate command to introduce the default routegenerated by ip default-network to RIP.

1-35

Configuration GuideConfiguring RIP

Advertising the Default Route to Neighbors on an Interface

Command

ip rip default-information { only | originate } [ metric metric-value ]Parameter

only: Indicates that only the default route is advertised.

Description

originate: Indicates that the default route and other routes are advertised.
metric metric-value: Indicates the metric of the default route. The value ranges from 1 to 15.

Command

Interface configuration mode

Mode
Configuratio

If you configure the ip rip default-information command for the interface, and the default-informationn Usageoriginate command for the RIP process, only the default route configured for the interface is advertised.
So far as ip rip default-information is configured for one interface, RIP does not learn the default route
advertised by the neighbor.

Redistributes Routes and Advertises External Routes to Neighbors

Commandredistribute { connected | static } [ metric metric-value | route-map route-map-name ] *Parameterconnected: Indicates redistribution from direct routes.

Description

static: Indicates redistribution from static routes.
metric metric-value: Sets the metric of the redistributed route. The value ranges from 1 to 16.
route-map route-map-name: Sets the redistribution filtering rules.

CommandRouting process configuration mode

Mode
Configuratio

The configuration rules for the no form of the redistribute command are as follows:n Usage

1. If some parameters are specified in the no form of the command, default values of these parameters
will be restored.
2. If no parameter is specified in the no form of the command, the entire command will be deleted.

Configuration
Example

Redistributing Routes and Advertising External Routes to Neighbors

Scenario
Figure 1-14

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)



On Router B, configure redistribution of static routes.

B

B# configure terminal
B(config)# router rip

1-36

Configuration Guide

Configuring RIP

B(config-router)# redistribute static
Verification

On Router A, check the routing table and verify that the entry 172.10.10.0/24 is loaded.
A# show ip route ripR

172.10.10.0/24 [120/1] via 192.168.1.2, 00:06:11, GigabitEthernet 0/1

1.4.9 Setting Route Filtering Rules
Configuration Effect

Routes that do not meet filtering criteria cannot be loaded to the routing table, or advertised to neighbors. In thisway, users within the network can be prevented from accessing specified destination networks.

Notes


The RIP basic functions must be configured.

In regard to the filtering rules of sent routes, you must configure route redistribution first, and then filter the
redistributed routes.

Configuration Steps

Filtering the Received RIP Routing Information

This function must be configured if it is required to filter received routing information.

To refuse receiving some specified routes, you can configure the route distribution control list to process all thereceived route update packets. If no interface is specified, route update packets received on all interfaces will beprocessed.



Unless otherwise required, this configuration should be performed on a router that requires route filtering.

Filtering the Sent RIP Routing Information

This function must be configured if it is required to filter the redistributed routing information that is sent.



If this command does not contain any optional parameter, route update advertisement control takes effect on all
interfaces. If the command contains the interface parameter, route update advertisement control takes effect only
on the specified interface. If the command contains other routing process parameters, route update advertisement
control takes effect only on the specified routing process.



Unless otherwise required, this configuration should be performed on a router that requires route filtering.

Verification


Run the show ip route rip command to verify that the routes that have been filtered out are not loaded to therouting table.

Related Commands



Filtering the Received RIP Routing Information

Command

distribute-list { [ access-list-number | name ] | [ prefix prefix-list-name ] [ gateway prefix-list-name ] } in

1-37

Configuration Guide

Configuring RIP[ interface-type interface-number ]Parameteraccess-list-number | name: Specifies the access list. Only routes permitted by the access list can be

Description

received.
prefix prefix-list-name: Uses the prefix list to filter routes.
gateway prefix-list-name: Uses the prefix list to filter the route sources.
interface-type interface-number: Indicates that the distribution list is applied to the specified interface.

CommandRouting process configuration mode

Mode
Configuratio

N/An UsageFiltering the Sent RIP Routing Information

Command

distribute-list { [ access-list-number | name ] | prefix prefix-list-name } out [ interface-type
interface-number | connected | rip | static ]Parameteraccess-list-number | name: Specifies the access list. Only routes permitted by the access list can be

Description

sent.
prefix prefix-list-name: Uses the prefix list to filter routes.
Interface: Applies route update advertisement control only on the specified interface.
connected: Applies route update advertisement control only on direct routes introduced throughredistribution.
rip: Applies route update advertisement control only on RIP routes.
static: Applies route update advertisement control only on static routes introduced through redistribution.

CommandRouting process configuration mode

Mode
Configuratio

N/An Usage

Configuration
Example

Filtering the Received RIP Routing Information

Scenario
Figure 1-15

1-38

Configuration Guide

Configuring RIP

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Enable the RIP routing process to control routes received over the GigabitEthernet 0/1 port andreceive only the route 200.1.1.0.

A

A# configure terminalA(config)# router ripA(config-router)# distribute-list 10 in GigabitEthernet 0/1
A(config-router)# no auto-summaryA(config)# access-list 10 permit 200.1.1.0 0.0.0.255

Verification

On Router A, check the routing table and verify that only the entry 200.1.1.0/24 exists.

A

A# show ip route ripR

200.1.1.0/24 [120/1] via 192.168.1.2, 00:06:11, GigabitEthernet 0/1

Filtering the Sent RIP Routing Information

Scenario
Figure 1-16

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Enable the RIP routing process to advertise only the route 200.1.1.0/24.

B

B# configure terminal
B(config)# router rip
B(config-router)# redistribute connected
B(config-router)# distribute-list 10 out
B(config-router)# version 2
B(config)# access-list 10 permit 200.1.1.0 0.0.0.255

Verification

Check the routing table on Router A, and verify that route in the 200.1.1.0 network segment exists.

A

A# show ip route rip
R

200.1.1.0/24 [120/1] via 192.168.1.2, 00:06:11, GigabitEthernet 0/1

Common ErrorsFiltering fails because the filtering rules of the access list are not properly configured.

1-39

Configuration Guide

Configuring RIP

1.4.10 Modifying Route Selection Parameters
Configuration EffectChange the RIP routes to enable the traffic pass through specified nodes or avoid passing through specified
nodes.



Change the sequence that a router selects various types of routes so as to change the priorities of RIP routes.

Notes


The RIP basic functions must be configured.

Configuration Steps

Modifying the Administrative Distance of a RIP Route

Optional.

This configuration is mandatory if you wish to change the priorities of RIP routes on a router that runs multiple
unicast routing protocols.



Increasing the Metric of a Received or Sent RIP Route

Optional.



Unless otherwise required, this configuration should be performed on a router where the metrics of routes need tobe adjusted.

Configuring the Default Metric of an External Route Redistributed to RIP

Optional.



Unless otherwise required, this configuration must be performed on an ASBR to which external routes are
introduced.

Verification
Run the show ip rip command to display the administrative distance currently configured. Run the show ip rip data
command to display the metrics of redistributed routes to verify that the configuration takes effect.

Related Commands



Modifying the Administrative Distance of a RIP RouteCommanddistance distance [ ip-address wildcard ]Parameter

distance: Sets the administrative distance of a RIP route. The value is an integer ranging from 1 to 255.

Description

ip-address: Indicates the prefix of the source IP address of the route.
wildcard: Defines the IP address comparison bit. 0 indicates accurate matching, and 1 indicates that nocomparison is performed.

CommandRouting process configuration mode

Mode
Configuratio

Run this command to configure the administrative distance of a RIP route.

1-40

Configuration Guide

Configuring RIP

n Usage

Increasing the Metric of a Received or Sent RIP RouteCommandoffset-list { access-list-number | name } { in | out } offset [ interface-type interface-number ]Parameteraccess-list-number | name: Specifies the access list.

Description

In: Uses the ACL to modify the metric of a received route.
out: Uses the ACL to modify the metric of a sent route.
offset: Indicates the offset of the modified metric. The value ranges from 0 to 16.
interface-type: Uses the ACL on the specified interface.
interface-number: Specifies the interface number.

CommandRouting process configuration mode

Mode
Configuratio

Run this command to increase the metric of a received or sent RIP route. If the interface is specified, then Usageconfiguration takes effect only on the specified interface; otherwise, the configuration takes effectglobally.

Configuring the Default Metric of an External Route Redistributed to RIP

Commanddefault-metric metric-value

Parameter

metric-value: Indicates the default metric. The valid value ranges from 1 to 16. If the value is equal to or

Description

greater than 16, the RGOS determines that this route is unreachable.

CommandRouting process configuration mode

Mode
Configuratio

This command must be used together with the routing protocol configuration command redistribute.

n Usage

Configuration
Example

Increasing the Metric of a Received or Sent RIP RouteScenario
Figure 1-17

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Increase by 7 the metric of each RIP route in the range specified by ACL 7.



Increase by 7 the metric of each learned RIP route in the range specified by ACL 8.

1-41

Configuration Guide

A

Configuring RIP

A# configure terminalA(config)# access-list 7 permit host 200.1.1.0
A(config)# access-list 8 permit host 201.1.1.0
A(config)# router ripA(config-router)# offset-list 7 out 7A(config-router)# offset-list 8 in 7

Verification

Check the routing table on Router A and Router B to verify that the metrics of RIP routes are 8.

A

A# show ip route rip
RB

201.1.1.0/24 [120/8] via 192.168.1.2, 00:06:11, GigabitEthernet 0/1

B# show ip route rip
R

200.1.1.0/24 [120/8] via 192.168.1.1, 00:06:11, GigabitEthernet 0/1

1.4.11 Modifying Timers
Configuration EffectChange the duration of RIP timers to accelerate or slow down the change of the protocol state or occurrence of anevent.

Notes


The RIP basic functions must be configured.

Modifying the protocol control parameters may result in protocol running failures. Therefore, you are advised not tomodify the timers.

Configuration Steps

Modifying the Update Timer, Invalid Timer, and Flush Timer

This configuration must be performed if you need to adjust the RIP timers.
By adjusting the timers, you can reduce the convergence time and fault rectification time of the routing protocol. For
routers connected to the same network, values of the three RIP timers must be the same. Generally, you are advised
not to modify the RIP timers unless otherwise required.
Setting timers to small values on a low-speed link brings risks because a lot of Update packets consume the bandwidth.
You can set timers to small values generally on the Ethernet or a 2 Mbps (or above) link to reduce the convergence timeof network routes.
Unless otherwise required, this configuration should be performed on a router where RIP timers need to be modified.



Setting the Sending Delay Between RIP Route Update Packets

This configuration must be performed if you need to adjust the sending delay between RIP Update packets.
Run the output-delay command to increase the sending delay between packets on a high-speed device so that a
low-speed device can receive and process all Update packets.

1-42

Configuration Guide

Configuring RIP

Unless otherwise required, this configuration should be performed on a router where the sending delay needs to be
adjusted.

Verification
Run the show ip rip command to display the current settings of RIP timers.

Related Commands



Modifying the Update Timer, Invalid Timer, and Flush Timer

Commandtimers basic update invalid flush

Parameter

update: Indicates the route update time in second. It defines the interval at which the device sends the

Description

route update packet. Each time an Update packet is received, the invalid timer and flush timer are reset.
By default, a routing update packet is sent every 30s.
invalid: Indicates the route invalid time in second, counted from the last time when a valid update packet
is received. It defines the time after which the route in the routing list becomes invalid because the routeis not updated. The duration of the invalid timer must be at least three times the duration of the update
timer. If no Update packet is received before the invalid timer expires, the corresponding route enters theinvalid state. If the Update packet is received before the invalid timer expires, the timer is reset. The
default duration of the invalid timer is 180s.
flush: Indicates the route flushing time in second, counted from the time when the RIP route enters theinvalid state. When the flush timer expires, the route in the invalid state will be deleted from the routing
table. The default duration of the flush timer is 120s.

CommandRouting process configuration mode

Mode
Configuration Usage

By default, the update timer is 30s, the invalid timer is 180s, and the flush timer is 120s.

Setting the Sending Delay Between RIP Route Update Packets

Commandoutput-delay delay

Parameter

delay: Sets the sending delay between packets in ms. The value ranges from 8 to 50.

Description
Command

Interface configuration mode

Mode
Configuratio

Normally, a RIP route update packet is 512 bytes long and can contain 25 routes. If the number of routes

n Usageto be updated exceeds 25, more than one update packet will be sent as fast as possible.
When a high-speed device sends a lot of update packets to a low-speed device, the low-speed device
may not be able to process all update packets in time, causing a loss of routing information. In this case,you need to run the output-delay command to increase the sending delay between packets on ahigh-speed device so that a low-speed device can receive and process all update packets.

1-43

Configuration Guide

Configuring RIP

Configuration
Example

Setting the Sending Delay Between RIP Route Update Packets

Scenario
Figure 1-18

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)

Configure the sending delay of update packets on Router A.

A

A# configure terminalA(config)# router ripA(config-router)# output-delay 30

Verification

Capture packets on Router A and compare the sending time of update packets before and after theconfiguration, and verify that a delay of 30 ms is introduced.

Common Errors
For routers connected to the same network, values of the three RIP timers are not the same.

1.4.12 Enabling GR
Configuration EffectWhen a distributed route switches services from the active board to the standby board, traffic forwarding continues
and is not interrupted.

When the RIP process is being restarted, traffic forwarding continues and is not interrupted.

Notes


The RIP basic functions must be configured.



The GR period is at least twice the RIP route update period.



During the RIP GR process, ensure that the network environment is stable.

Configuration Steps

Configuring the GR Restarter Capability

This configuration must be performed if RIP needs to be gracefully restarted to ensure data forwarding during hot
standby switchover.

1-44

Configuration Guide

Configuring RIP

The GR function is configured based on the RIP process. You can configure different parameters for different RIP
processes based on the actual conditions.
The GR period is the maximum time from restart of the RIP process to completion of GR. During this period, theforwarding table before the restart is retained, and the RIP route is restored so as to restore the RIP state before therestart. After the restart period expires, RIP exits from the GR state and performs common RIP operations.
Unless otherwise required, this configuration should be performed on every router that needs to be gracefully restarted.

Verification


Run the show ip rip command to display the GR state and configured time.



Trigger a hot standby switchover, and verify that data forwarding is not interrupted.

Related Commands

Configuring the GR Restarter Capability

Commandgraceful-restart [ grace-period grace-period ]Parameter

grace-period: Explicitly configures the grace period.

Description

grace-period: Indicates the GR period. The value ranges from 1s to 1800s.The default value is twice theupdate time or 60s, whichever is the smaller.

CommandRouting process configuration mode

Mode
Configuratio

This command allows you to explicitly modify the GR period. Note that GR must be completed after then Usageupdate timer of the RIP route expires and before the invalid timer of the RIP route expires. An
inappropriate GR period cannot ensure uninterrupted data forwarding during the GR process. A typicalcase is as follows: If the GR period is longer than the duration of the invalid timer, GR is not completed
when the invalid timer expires. The route is not re-advertised to the neighbor, and forwarding of the routeof the neighbor stops after the invalid timer expires, causing interruption of data forwarding on the
network. Unless otherwise required, you are advised not to adjust the GR period. If it is necessary toadjust the GR period, ensure that the GR period is longer than the duration of the update timer but
shorter than the duration of the invalid timer based on the configuration of the timers basic command.

Configuration
Example

Configuring the GR Restarter Capability

1-45

Configuration Guide

Configuring RIP

Scenario
Figure 1-19

RemarkThe interface IP addresses are as follows:s

A: GE 0/1 192.168.1.1
B: GE 0/1 192.168.1.1

GE 0/2 192.168.2.1

C: GE 0/1 192.168.4.2

GE 0/3 192.168.3.2

D: GE 0/1 192.168.5.2

GE 0/2 192.168.2.2

GE 0/3 192.168.3.1

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIP basic functions on all routers. (Omitted)



On Router B, enable the GR function.

B# configure terminal
B(config)# router rip
B(config-router)# graceful-restart grace-period 90
Verification

Trigger a hot standby switchover on Router B, and verify that the routing tables of destination
Network 1 and Network 2 remain unchanged on Router A during the switchover.



Trigger a hot standby switchover on Router B, ping destination Network 1 from Router A, and verify
that traffic forwarding is not interrupted during the switchover.

1.5 Monitoring
Displaying
Description

Command

Displays the basic information aboutshow ip rip

a RIP process.
Displays the RIP routing table.
Displays information about externalroutes redistributed by RIP.
Displays the RIP interface
information.
Displays the RIP neighbor
information.

show ip rip database [ network-number network-mask | count ]show ip rip external [ connected | static ]show ip rip interface [ interface-type interface-number ]show ip rip peer [ ip-address ]1-46

Configuration Guide

Configuring RIP

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs events that occur when the

debug ip rip event

RIP process is running.
Debugs interaction with the NSM

debug ip rip nsm

process.
Debugs the sent and received

debug ip rip packet [ interface interface-type interface-number | recv | send ]packets.
Debugs the RIP GR process.

debug ip rip restart

Debugs the route changes of the

debug ip rip route

RIP process.

1-47

Configuration Guide

Configuring RIPng

2 Configuring RIPng
2.1 Overview
RIP next generation (RIPng) is a unicast routing protocol that applies to IPv6 networks. RIPng-enabled routers
exchange routing information to obtain routes to remote networks.
As an Interior Gateway Protocol (IGP), RIPng can run only within the autonomous system (AS) and is applicable tosmall-sized networks with routes no more than 16 hops.

Protocols andStandards


RFC 2080: Defines the RIPng.

2.2 Application
RIPng is generally used on some small-sized networks, such as office networks of small companies.
As shown in the following figure, the company builds an IPv6 network, on which all routers support IPv6. The network issmall in size, but the workload is still heavy if the network is maintained manually. In this case, RIPng can be configured
to adapt to topological changes of the small-sized network, which reduces the workload.
Figure 2-1

2.3 Features
Basic Concepts

IGP and EGP

IGP runs within an AS. For example, RIPng is a type of IGP.
Exterior Gateway Protocol (EGP) runs between ASs. For example, BGP is a type of EGP.

2-1

Configuration Guide

Configuring RIPng

FeatureFeatureDescription

RIPng and RIP

RIPng is an extension of RIPv2 on the basis of IPv6. Both are similar in functions andconfigurations.

Exchanging Routing

By exchanging routing information, RIPng-enabled devices can automatically obtain routes to a

Information

remote network and update routes in real time.

Routing Algorithm

RIPng is a protocol based on the distance-vector algorithm. It uses the vector addition method tocompute the routing information.

Avoiding Route

RIPng uses functions, such as split horizon and poison reverse, to avoid route loops.

Loops
Reliability Measures

RIP uses graceful restart (GR) to enhance reliability of the protocol.

2.3.1 RIPng and RIP
RIP applies to IPv4 networks. Two RIP versions are available, including RIPv1 and RIPv2.
RIPng is an extension of RIPv2 on the basis of IPv6. Both are similar in functions and configurations.

Working Principle



RIPv2

RIPv2 packets are multicast. The multicast address is 224.0.0.9, and the UDP port ID is 520. RIPv2 can identify thesubnet mask.



RIPng

RIPng packets are multicast. The multicast address is FF02::9, the source address is FE80::/10, and the UDP port ID is521. RIPng can identify the subnet mask.
This chapter describes functions and configurations of RIPng. For details about RIPv2, see "Configuring RIP".

RelatedConfiguration

Enabling the RIPng Process

By default, the RIPng process is disabled.
Run the ipv6 router rip command to enable the RIPng process.
You must enable the RIPng process on a device; otherwise, all functions related to RIPng cannot take effect.

Running RIPng on an Interface

By default, RIPng does not run on an interface.
Run the ipv6 rip enable command to run RIPng on an interface.
After RIPng runs on an interface, RIPng packets can be exchanged on the interface and RIPng can learn routes to the
network segments directly connected to the device.

Prohibiting an Interface from Sending or Receiving Packets

2-2

Configuration Guide

Configuring RIPng

By default, a RIPng-enabled interface is allowed to send and receive RIPng packets.
Run the passive-interface command to prohibit an interface from sending RIPng packets.

2.3.2 Exchanging Routing Information
Compared with static routing, the dynamic routing protocol has a significant advantage, that is, by exchanging routing
information, devices can automatically obtain routes to a remote network and update the routes in real time.

Working Principle

Initialization

After RIPng is enabled on a router, the router sends a request packet to its neighbor router, requesting for all routing
information, that is, the routing table. After receiving the request message, the neighbor router returns a response
packet containing the local routing table. After receiving the response packet, the router updates the local routing table,
and sends an update packet to the neighbor router, informing the neighbor router of the route update information. After
receiving the update packet, the neighbor router updates the local routing table, and sends the update packet to otheradjacent routers. After a series of updates, all routers can obtain and retain the latest routing information.



Periodical Update

By default, periodical update is enabled for RIPng. Adjacent routers exchange complete routing information with eachother every 30s (update timer), that is, the entire routing table is sent to neighbor routers.
For every non-local route, if the route is not updated within 180s (invalid timer), the metric of the route is changed
to 16 (unreachable). If the route is still not updated in the next 120s (flush timer), the route is deleted from therouting table.



Default RouteIn the routing table, a route to the destination network ::/0 is called default route.
The default route can be learned from a neighbor router, or sent to a neighbor router.

Route Redistribution

For RIPng, other types of routes (such as direct routes, static routes, and routes of other routing protocols) are called
external routes.
External routes (excluding the default route) can be redistributed to RIPng and advertised to neighbors.

Route Filtering

Filtering conditions can be configured to limit the routing information exchanged between adjacent routers. Only therouting information that meets filtering conditions can be sent or received.

RelatedConfiguration



RIPng Timers

By default, the update timer is 30s, the invalid timer is 180s, and the flush timer is 120s.
Run the timers basic command to modify durations of RIPng timers.

2-3Configuration Guide

Configuring RIPng

Increasing the duration of the flush timer can reduce the route flapping. Decreasing the duration of the flush timer helps
accelerate route convergence.
The durations of RIPng timers must be consistent on adjacent routers. Unless otherwise required, you are advised not
to modify the RIPng timers.



Default RouteRun the ipv6 rip default-information command to advertise the default route to neighbors on an interface.

Route Redistribution

Run the redistribute command to redistribute external routes (excluding the default route) to RIPng and advertise themto neighbors.

Route Filtering

Run the distribute-list out command to set filtering rules to limit the routing information sent by the device.
Run the distribute-list in command to set filtering rules to limit the routing information received by the device.

2.3.3 Routing Algorithm
RIPng is a protocol based on the distance-vector algorithm. It uses the vector addition method to compute the routing
information.

Working PrincipleDistance-Vector Algorithm

RIPng is a protocol based on the distance-vector algorithm. The distance-vector algorithm treats a route as a vector thatconsists of the destination network and distance (metric). The router obtains a route from its neighbor and adds the
distance vector from itself to the neighbor to the route to form its own route.
RIPng uses the hop count to evaluate the distance (metric) to the destination network. By default, the hop count from arouter to its directly connected network is 0, the hop count from a router to a network that can be reached through arouter is 1, and so on. That is, the metric is equal to the number of routers from the local network to the destination
network. To restrict the convergence time, RIPng stipulates that the metric must be an integer between 0 and 15. If themetric is equal to or greater than 16, the destination network or host is unreachable. For this reason, RIPng cannot beapplied to a large-scale network.
As shown in the following figure, Router A is connected to the network 2::/64. Router B obtains the route (2::/64, 0) fromRouter A and adds the metric 1 to the route to obtain its own route (2::/64, 1), and the next hop points to Router A.

Figure 2-2

2-4

Configuration GuideConfiguring RIPng

Selecting the Optimum Route

RIPng selects an optimum route based on the following principle: If multiple routes to the same destination network isavailable, a router preferentially selects the route with the smallest metric.
As shown in the following figure, Router A is connected to the network 2::/64. Router C obtains the route (2::/64, 0) fromRouter A and the route (2::/64, 1) from Router B. Router C will select the route that is obtained from Router A and add
metric 1 to this route to form its own route (2::/64, 1), and the next hop points to Router A.

Figure 2-3

When routes coming from different sources exist on a router, the route with the smaller distance is preferentiallyselected.
Route Source

Default DistanceDirectly-connected network

0

Static route1

OSPF route

110

RIPng route120

Unreachable route

255

RelatedConfigurationModifying the Distance

2-5Configuration Guide

Configuring RIPng

By default, the distance of a RIPng route is 120.
Run the distance command to modify the distance of a RIPng route.

Modifying the Metric

For a RIPng route that is proactively discovered by a device, the default metric is equal to the number of hops from thelocal network to the destination network. The metric offset of the interface is 1.
For a RIPng router that is manually configured (default route or redistributed route), the default metric is 1.
Run the ipv6 rip metric-offset command to modify the metric offset of the interface.
Run the default-metric command to modify the default metric of an external route (redistributed route).
Run the redistribute command to modify the metric of an external route (redistributed route) when advertising thisroute.
Run the ipv6 rip default-information command to modify the metric of a default route when advertising the default
route.

2.3.4 Avoiding Route Loops
RIPng uses functions, such as split horizon and poison reverse, to avoid route loops.

Working PrincipleRoute Loop

A RIPng route loop occurs due to inherent defects of the distance-vector algorithm.
As shown in the following figure, Router A is connected to the network 2::/64, and sends an update packet every 30s.
Router B receives the route to 2::/64 from Router A every 30s. If Router A is disconnected from 2::/64, the route to
2::/64 will be deleted from the routing table on Router A. Next time, the update packet sent by Router A no longer
contains this route. As Router B does not receive an update packet related to 2::/64, Router B determines that the routeto 2::/64 is valid within 180s and uses the update packet to send this route to Router A. As the route to 2::/64 does notexist on Router A, the route learned from Router B is added to the routing table. Router B determines that data canreach 2::/64 through Router A, and Router A determines that data can reach 2::/64 through Router B. In this way, aroute loop is formed.
Figure 2-4

Split Horizon

Split horizon can prevent route loops. After split horizon is enabled, a route received on this interface will not be sent out
from this interface.

2-6

Configuration Guide

Configuring RIPng

As shown in the following figure, after split horizon is enabled on Router B, Router B will not send the route to 2::/64
back to Router A. Router B will learn 180s later that 2::/64 is not reachable.
Figure 2-5

Poison Reverse

Poison reverse can also prevent route loops. Compared with slit horizon, poison reverse is more reliable, but brings
more protocol packets, which makes network congestion more severe.
After poison reverse is enabled on an interface, a route received from this interface will be sent out from this interface
again, but the metric of this router will be changed to 16 (unreachable).
As shown in the following figure, after poison reverse is enabled on Router A, if Route A detects a disconnection from
2::/64, Router A will not delete the route to 2::/64. Instead, Router A changes the number of hops to 16, and advertises
the route through the update packet. On receiving the update packet, Router B learns that 2::/64 is not reachable.
Figure 2-6

RelatedConfigurationSplit Horizon

By default, split horizon is enabled.
Run the no split-horizon command to disable split horizon.



Poison Reverse

By default, poison reverse is disabled.
Run the split-horizon poisoned-reverse command to enable poison reverse. (After poison reverse is enabled, split
horizon is automatically disabled.)

2.3.5 Reliability Measures
RIPng uses GR to enhance reliability of the protocol.
2-7Configuration Guide

Configuring RIPng

Working PrincipleGR

GR ensures uninterrupted data transmission when the protocol is restarted. If RIPng is restarted on a GR-enabled
device, the forwarding table before restart will be retained and a request packet will be sent to the neighbor so that theroute can be learned again. During the GR period, RIPng completes re-convergence of the route. After the GR period
expires, RIPng updates the forwarding entry and advertises the routing table to the neighbor.

RelatedConfiguration

GR

By default, GR is disabled.
Run the graceful-restart command to enable the GR function.

2.4 Configuration
Configuration
Configuring RIPng Basic
Functions

Related Commands(Mandatory) It is used to build a RIPng routing domain.
ipv6 router rip

Enables a RIPng routing process and entersrouting process configuration mode.

错误!未找到引用源。

ipv6 rip enable

Runs RIPng on an interface.

split-horizon

Enables split horizon or poison reverse.

passive-interface

Configures a passive interface.

Optional.
ipv6 rip default-information

Advertise the default route to neighbors on aninterface.

redistribute

Redistributes routes and advertising externalroutes to neighbors.

Setting Route Filtering
Rules

Optional.
distribute-list in

Filters the received RIPng routing
information.
Filters the sent RIPng routing information.

distribute-list out
Modifying Route Selection
Parameters

Optional.
distance

Modifies the administrative distance of a
RIPng route.

ipv6 rip metric-offset

Modifies the metric offset on an interface.

default-metric

Configure the default metric for route
redistribution.

Modifying Timers

Optional.

2-8Configuration Guide

Configuration

Configuring RIPng

Related Commands
timersModifies the update timer, invalid timer, andflush timer of RIPng.

Enabling GR

Optional.
Configures the GR restarter capability.

graceful-restart

2.4.1 Configuring RIPng Basic Functions
Configuration Effect

Build a RIPng routing domain on the network.
Routers in the domain obtain routes to a remote network through RIPng.

Notes



IPv6 addresses must be configured.
IPv6 unicast routes must be enabled.

Configuration Steps

Enabling a RIPng Routing Process

Mandatory.

Running RIPng on an Interface

Mandatory.

Unless otherwise required, perform this configuration on every router in the RIPng routing domain.

Unless otherwise required, perform this configuration on every interconnected interface of routers in the RIPng
routing domain.

Enabling Split Horizon or Poison Reverse

By default, split horizon is enabled and poison reverse is disabled.
Unless otherwise required, enable split horizon on every interface connected to the broadcast network, such as
the Ethernet. (Retain the default setting.)

Unless otherwise required, enable split horizon on every interface connected to the point-to-point (P2P) network,
such as the PPP and HDLC. (Retain the default setting.)

It is recommended that split horizon and poison reverse be disabled on an interface connected to a non-broadcast
multi-access network, such as FR and X.25; otherwise, some devices cannot learn the complete routing
information.



If the secondary IP address is configured for an interface connected to a non-broadcast, it is recommended thatsplit horizon and poison reverse be disabled.

Configuring a Passive InterfaceThis configuration is recommended.
Use the passive interface to set the boundary of the RIPng routing domain. The network segment of the passiveinterface belongs to the RIPng routing domain, but RIPng packets cannot be sent over the passive interface.

2-9Configuration GuideConfiguring RIPng

If RIPng routes need to be exchanged on an interface (such as the router interconnect interface) in the RIPng
routing domain, this interface cannot be configured as a passive interface.

Verification


Check the routing table on a router to verify that the route to a remote network can be obtained through RIPng.

Related Commands

Enabling a RIPng Routing Process

Commandipv6 router rip

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage GuideThis command is used to create a RIPng routing process and enter routing process configuration mode.

Running RIPng on an Interface

Commandipv6 rip enable

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

The configuration for running the RIPng on an interface is different from that of RIPv2. In RIPv2, thenetwork command is configured in routing process configuration mode to define an IP address range. If
the IP address of an interface belongs to this IP address range, RIPng automatically runs on thisinterface.

Enabling Split Horizon

Commandsplit-horizon [ poisoned-reverse ]Parameter

poisoned-reverse: Indicates that the split horizon function contains the poison reverse function.

Description
CommandRouting process configuration mode

Mode
Usage Guide

Run the show ipv6 rip command to check whether split horizon is enabled.
The configuration is different from that of RIPv2. In RIPv2, the split horizon function is configured ininterface configuration mode.

Configuring a Passive Interface

Commandpassive-interface { default | interface-type interface-num }Parameter

default: Indicates all interfaces.

Description

interface-type interface-num: Specifies an interface.

2-10Configuration Guide

Command

Configuring RIPng

Routing process configuration mode

Mode
Usage Guide

First, run the passive-interface default command to configure all interfaces as passive interfaces.
Then, run the no passive-interface interface-type interface-num command so that the interfaces used
for interconnection between routers in the domain are not passive interface.

Configuration
Example

Building a RIPng Routing Domain

Scenario
Figure 2-7

Configuratio

Configure IPv6 addresses on all routers.

n Steps

Enable RIPng on all routers.

AA# configure terminal
Enter configuration commands, one per line.

End with CNTL/Z.

A(config)# ipv6 router ripA(config-router)# exit
A(config)# interface GigabitEthernet 0/1
A(config-if-GigabitEthernet 0/1)# ipv6 address 2001:db8::1/32
A(config-if-GigabitEthernet 0/1)# ipv6 rip enable
B

B# configure terminal
Enter configuration commands, one per line.

End with CNTL/Z.

B(config)# ipv6 router rip
B(config-router)# exit
B(config)# interface GigabitEthernet 0/1
B(config-if-GigabitEthernet 0/1)# ipv6 address 2001:db8::2/32
B(config-if-GigabitEthernet 0/1)# ipv6 rip enableC

C# configure terminal
Enter configuration commands, one per line.

2-11

End with CNTL/Z.

Configuration Guide

Configuring RIPng

C(config)# ipv6 router ripC(config-router)# exit
C(config)# interface GigabitEthernet 0/2
C(config-if-GigabitEthernet 0/2)#
C(config-if-GigabitEthernet 0/2)# ipv6 address 2001:db8::3/32
C(config-if-GigabitEthernet 0/2)# ipv6 rip enableC(config)# interface GigabitEthernet 0/1
C(config-if-GigabitEthernet 0/1)# ipv6 address 2::1/64
C(config-if-GigabitEthernet 0/1)# ipv6 rip enable
Verification

Check the routing tables on Router A, Router B, and Router C. The routing tables should contain routes
to a remote network that are learned through RIPng.

A

A# show ipv6 routeIPv6 routing table name - Default - 6 entries
Codes:C - Connected, L - Local, S - Static

R - RIP, O - OSPF, B - BGP, I - IS-IS, V - Overflow routeN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter areaBR

2::/64 [120/2] via FE80::2D0:F8FF:FEFB:D521, GigabitEthernet 0/1

C

2001:DB8::/32 via GigabitEthernet 0/1, directly connectedL

2001:DB8::1/128 via GigabitEthernet 0/1, local hostB# show ipv6 routeIPv6 routing table name - Default - 6 entries
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS, V - Overflow routeN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter area

2-12

Configuration Guide

C

Configuring RIPng

R

2::/64 [120/2] via FE80::2D0:F8FF:FEFB:D521, GigabitEthernet 0/1

C

2001:DB8::/32 via GigabitEthernet 0/1, directly connectedL

2001:DB8::2/128 via GigabitEthernet 0/1, local host

Ruijie# show ipv6 routeIPv6 routing table name - Default - 9 entries
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS, V - Overflow routeN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter areaC

2::/64 via GigabitEthernet 0/1, directly connectedL

2::2/128 via GigabitEthernet 0/1, local hostC

2001:DB8::/32 via GigabitEthernet 0/2, directly connectedL

2001:DB8::3/128 via GigabitEthernet 0/2, local host

Common Errors


The IPv6 address is not configured on an interface.



The interface used for interconnection between devices is configured as a passive interface.

2.4.2 Advertising the Default Route or External Routes
Configuration EffectIn the RIPng domain, introduce a unicast route of another AS so that the unicast routing service to this AS can beprovided for users in the RIPng domain.

In the RIPng domain, inject a default route to another AS so that the unicast routing service to this AS can beprovided for users in the RIPng domain.

Notes


The RIPng basic functions must be configured.

Configuration Steps

Configuring External Route Redistribution



Optional.

2-13Configuration GuideConfiguring RIPng

Perform this configuration if external routes of the RIPng domain should be introduced to the AS border router(ASBR).



Generating a Default Route

Optional.
Perform this configuration if the default route should be introduced to an ASBR so that other routers in the RIPng
domain access other AS domains through this ASBR by default.

Verification


Run the show ipv6 route rip command on a non-ASBR to check whether the external routes of the domain anddefault route have been loaded.

Related Commands

Advertising the Default Route to Neighbors on an Interface

Commandipv6 rip default-information { only|originate } [ metric metric-value ]Parameter

only: Advertises only IPv6 default route.

Description

originate: Advertises the IPv6 default route and other routes.
metric metric-value: Indicates the metric of the default route. The value ranges from 1 to 15. The default
value is 1.

Command

Interface configuration mode

Mode
Usage Guide

After this command is configured on the interface, an IPv6 default route is advertised to the external
devices through this interface, but the route itself is not added to the route forwarding table or the device
and the RIPng route database.
To prevent occurrence of a route loop, once this command is configured on an interface, RIPng refuses
to receive the default route updates advertised by neighbors.

Redistributing Routes and Advertising External Routes to Neighbors

Commandredistribute { connected | static} [ metric metric-value | route-map route-map-name ] *Parameterconnected: Indicates redistribution from direct routes.

Description

static: Indicates redistribution from static routes.
metric metric-value: Sets the metric of the route redistributed to the RIPng domain.
route-map route-map-name: Sets the redistribution filtering rules.

CommandRouting process configuration mode

Mode
Usage Guide

During route redistribution, it is not necessary to convert the metric of one routing protocol to the metricof another routing protocol because different routing protocols use completely different metricmeasurement methods.

2-14Configuration Guide

Configuring RIPng

Configuration
ExampleScenario
Figure 2-8

Configuratio

Configure the interface IPv6 addresses on all routers. (Omitted)

n StepsConfigure the RIPng basic functions on all routers. (Omitted)



On Router B, configure redistribution of static routes.

On the GE0/1 interface of Router A, configure advertisement of the default route.

A

A# configure terminalA(config)# interface GigabitEthernet 0/1
A(config-if-GigabitEthernet 0/1)# ipv6 rip default-information originate

B

B# configure terminal
B(config)# ipv6 router rip
B(config-router)# redistribute static

Verification



Check the routing tables on Router A and Router B, and confirm that Router A can learn the route3001:10:10::/64, and Router B can learn the default route ::/0.

A

A# show ipv6 route rip

IPv6 routing table name - Default - 17 entries
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter areaR

3001:10:10::/64 [120/2] via FE80::2D0:F8FF:FE22:334A, GigabitEthernet 0/1

2-15

Configuration Guide

B

Configuring RIPng

B# show ipv6 route rip

IPv6 routing table name - Default - 17 entries
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter areaR::/0 [120/2] via FE80::21A:A9FF:FE41:5B06, GigabitEthernet 0/1

The S2300 series products do not support OSPF, ISIS and BGP.

2.4.3 Setting Route Filtering Rules
Configuration Effect

Routes that do not meet filtering criteria cannot be loaded to the routing table, or advertised to neighbors. In thisway, users within the network can be prevented from accessing specified destination networks.

Notes


The RIPng basic functions must be configured.

Configuration Steps

Filtering the Received RIPng Routing InformationTo refuse receiving some specified routes, you can configure the route distribution control list to process all thereceived route update packets. If no interface is specified, route update packets received on all interfaces will beprocessed.



Filtering the Sent RIPng Routing Information



If this command does not contain any optional parameter, route update advertisement control takes effect on all
interfaces. If the command contains the interface parameter, route update advertisement control takes effect only
on the specified interface. If the command contains other routing process parameters, route update advertisement
control takes effect only on the specified routing process.

Verification


Run the show ipv6 route rip command to check that the routes that have been filtered out are not loaded to therouting table.

Related Commands
Command

distribute-list prefix-list prefix-list-name { in | out } [ interface-type interface-name ]2-16

Configuration Guide

Configuring RIPng

Parameter

prefix-list prefix-list-name: Indicates the name of the prefix list, which is used to filter routes.

Descriptionin | out: Specifies update routes (received or sent routes) that are filtered.
interface-type interface-name: Indicates that the distribution list is applied to the specified interface.

CommandRouting process configuration mode

Mode
Usage Guide

N/A

Configuration
ExampleScenario
Figure 2-9

Configuratio

Configure the interface IPv6 addresses on all routers. (Omitted)

n StepsConfigure the RIPng basic functions on all routers. (Omitted)On router A, configure route filtering.

A

A# configure terminalA(config)# ipv6 prefix-list hello permit 4001::/64
A(config)# ipv6 router ripA(config-router)# distribute-list prefix-list hello in

Verification

Check that Router A can learn only the route to 4001::/64.

A

A# show ipv6 route rip
IPv6 routing table name - Default - 17 entries
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter areaR

4001::/64 [120/2] via FE80::2D0:F8FF:FE22:334A, GigabitEthernet 0/1

The S2300 series products do not support OSPF, ISIS and BGP.

2-17

Configuration Guide

Configuring RIPng

2.4.4 Modifying Route Selection Parameters
Configuration EffectChange the RIPng routes to enable the traffic pass through specified nodes or avoid passing through specified
nodes.



Change the sequence that a router selects various types of routes so as to change the priorities of RIPng routes.

Notes


The RIPng basic functions must be configured.

Configuration Steps

Modifying the Administrative Distance of a RIPng Route

Optional.
Perform this configuration if you wish to change the priorities of RIPng routes on a router that runs multiple unicast
routing protocols.

Modifying the Metric Offset on an Interface

Optional.

Configuring the Default Metric of an External Route Redistributed to RIPng



Optional.



Unless otherwise required, perform this configuration on an ASBR to which external routes are introduced.

Unless otherwise required, perform this configuration on a router where the metrics of routes need to be adjusted.

Verification


Run the show ipv6 rip command to display the administrative distance of RIPng routes.

Run the show ipv6 rip data command to display the metrics of external routes redistributed to RIPng.

Related Commands



Modifying the Administrative Distance of a RIPng RouteCommanddistance distanceParameter

distance: Sets the administrative distance of a RIPng route. The value is an integer ranging from 1 to

Description

254.

CommandRouting process configuration mode

Mode
Usage GuideRun this command to set the administrative distance of a RIPng route.

Modifying the Metric Offset on an Interface

Commandipv6 rip metric-offset value

Parameter

value: Indicates the interface metric offset. The value ranges from 1 to 16.

Description

2-18

Configuration Guide

Command

Configuring RIPng

Routing process configuration mode

Mode
Usage Guide

Before a route is added to the routing table, the metric of the route must be added with the metric offset
set on the interface. You can control the use of a route by setting the interface metric offset.



Configuring the Default Metric of an External Route Redistributed to RIPng

Commanddefault-metric metricParameter

metric: Indicates the default metric. The valid value ranges from 1 to 16. If the value is equal to or greater

Description

than 16, the RGOS determines that this route is unreachable.

Command

Global configuration mode

Mode
Usage Guide

If the metric is not specified during redistribution of a routing protocol process, RIPng uses the metricdefined by the default-metric command. If the metric is specified, the metric defined by thedefault-metric command is overwritten by the specified metric. If this command is not configured, thevalue of default-metric is 1.

Configuration
Example

Modifying the Administrative Distance of a RIPng RouteScenario
Figure 2-10

Configuratio

Configure the interface IPv6 addresses on all routers. (Omitted)

n StepsConfigure the RIPng basic functions on all routers. (Omitted)



On Router A, set the administrative distance of a RIPng route to 160.

A# configure terminalA(config)# ipv6 router ripA(config-router)# distance 160
Verification

On Router A, check whether the administrative distance of a RIPng route is 160.

A# show ipv6 route rip | in 3001::/64
R

3001::/64 [160/2] via FE80::2D0:F8FF:FE22:334A, GigabitEthernet 0/1

2-19

Configuration Guide

Configuring RIPng

2.4.5 Modifying Timers
Configuration EffectChange the duration of RIPng timers to accelerate or slow down the change of the protocol state or occurrence ofan event.

Notes


The RIPng basic functions must be configured.

Modifying the protocol control parameters may result in protocol running failures. Therefore, you are advised not tomodify the timers.

Configuration Steps

Modifying the Update Timer, Invalid Timer, and Flush Timer

Mandatory.



Unless otherwise required, perform this configuration on a router where RIPng timers need to be modified.

Verification


Run the show ipv6 rip command to display settings of timers.

Related Commands
Commandtimers update invalid flush

Parameter

Update: Indicates the route update time in second. It defines the interval at which the device sends the

Description

route update packet. Each time an update packet is received, the invalid timer and flush timer are reset.
By default, a route update packet is sent every 30s.
Invalid: Indicates the route invalid time in second, counted from the last time when a valid update packet
is received. It defines the time after which the route in the routing list becomes invalid because the routeis not updated. The duration of the invalid timer must be at least three times the duration of the update
timer. If no update packet is received before the invalid timer expires, the corresponding route enters theinvalid state. If the update packet is received before the invalid timer expires, the timer is reset. The
default duration of the invalid timer is 180s.
Flush: Indicates the route flushing time in second, counted from the time when the RIPng route enters
the invalid state. When the flush timer expires, the route in the invalid state will be deleted from therouting table. The default duration of the flush timer is 120s.

CommandRouting process configuration mode

Mode
Usage Guide

By default, the update timer is 30s, the invalid timer is 180s, and the flush timer is 120s.

2-20

Configuration Guide

Configuring RIPng

Configuration
ExampleScenario
Figure 2-11

Configuratio

Configure the interface IPv6 addresses on all routers. (Omitted)

n StepsConfigure the RIPng basic functions on all routers. (Omitted)



On Router A, configure the update timer, invalid timer, and flush timer.

B

B# configure terminal
B(config)# ipv6 router rip
B(config-router)# timers 10 30 90

Verification

On Router B, check the settings of RIPng timers.

B

B# show ipv6 rip
Routing Protocol is "RIPng"
Sending updates every 10 seconds with +/-50%, next due in 12 seconds
Timeout after 30 seconds, garbage collect after 90 seconds
Outgoing update filter list for all interface is: not set
Incoming update filter list for all interface is: not set
Default redistribution metric is 1
Default distance is 120
Redistribution:
Redistributing protocol connected
Default version control:

send version 1, receive version 1

Interface

Send

Recv

1

1

GigabitEthernet 0/1

Routing Information Sources:
Gateway: fe80::2d0:f8ff:fe22:334a
Last Update: 00:00:02

Distance: 120

Bad Packets: 0

Bad Routes: 0

Common Errors


Settings of RIPng timers on devices connected to the same network are inconsistent. Consequently, routes cannot
be learned properly.

2-21Configuration Guide

Configuring RIPng

2.4.6 Enabling GR
Configuration EffectWhen a distributed route switches services from the active board to the standby board, traffic forwarding continues
and is not interrupted.

When the RIPng process is being restarted, traffic forwarding continues and is not interrupted.

Notes


The RIPng basic functions must be configured.



The GR period is at least twice the RIPng route update period.



During the RIPng GR process, ensure that the network environment is stable.

Configuration Steps

Configuring the GR Restarter Capability

This configuration must be performed if RIPng needs to be gracefully restarted to ensure data forwarding during hot
standby switchover.
The GR function is configured based on the RIPng process. You can configure different parameters for different RIPng
processes based on the actual conditions.
The GR period is the maximum time from restart of the RIPng process to completion of GR. During this period, theforwarding table before the restart is retained, and the RIPng route is restored so as to restore the RIPng state before
the restart. After the restart period expires, RIPng exits from the GR state and performs common RIPng operations.
Unless otherwise required, this configuration should be performed on every router that needs to be gracefully restarted.

Verification


Run the show ip rip command to display the GR state and configured time.



Trigger a hot standby switchover, and verify that data forwarding is not interrupted.

Related Commands

Configuring the GR Restarter Capability

Commandgraceful-restart [ grace-period grace-period ]Parameter

grace-period: Explicitly configures the grace period.

Description

grace-period: Indicates the GR period. The value ranges from 1s to 1800s.The default value is twice theupdate time or 60s, whichever is the smaller.

CommandRouting process configuration mode

Mode
Configuratio

This command allows you to explicitly modify the GR period. Note that GR must be completed after then Usageupdate timer of the RIPng route expires and before the invalid timer of the RIPng route expires. An
inappropriate GR period cannot ensure uninterrupted data forwarding during the GR process. A typicalcase is as follows: If the GR period is longer than the duration of the invalid timer, GR is not completed
when the invalid timer expires. The route is not re-advertised to the neighbor, and forwarding of the route2-22

Configuration Guide

Configuring RIPngof the neighbor stops after the invalid timer expires, causing interruption of data forwarding on the
network. Unless otherwise required, you are advised not to adjust the GR period. If it is necessary toadjust the GR period, ensure that the GR period is longer than the duration of the update timer but
shorter than the duration of the invalid timer based on the configuration of the timers basic command.

Configuration
Example

Configuring the GR Restarter Capability

Scenario
Figure 2-12

RemarkThe interface IP addresses are as follows:s

A: GE 0/1 1001::1/64
B: GE 0/1 1001::2/64

GE 0/2 2001::1/64

C: GE 0/1 4001::1/64

GE 0/3 3001::2/64

D: GE 0/1 4002::2/64

GE 0/2 2001::2/64

GE 0/3 3001::1/64

Configuratio

Configure the interface IP addresses on all routers. (Omitted)

n StepsConfigure the RIPng basic functions on all routers. (Omitted)



On Router B, enable the GR function.

B# configure terminal
B(config)# ipv6 router rip
B(config-router)# graceful-restart grace-period 90
Verification

Trigger a hot standby switchover on Router B, and verify that the routing tables of destination
Network 1 and Network 2 remain unchanged on Router A during the switchover.



Trigger a hot standby switchover on Router B, ping destination Network 1 from Router A, and verify
that traffic forwarding is not interrupted during the switchover.

2.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

Command2-23

Configuration Guide

Clears the RIPng routes.

Configuring RIPng

clear ipv6 rip

Displaying
Description

Command

Displays information about theshow ipv6 rip

RIPng process.
Displays the RIPng routing table.

show ipv6 rip database

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs RIPng.

debug ipv6 rip [ interface interface-type interface-num | nsm | restart ]2-24

Configuration Guide

Managing Routes

3 Managing Routes
3.1 Overview
The network service module (NSM) manages the routing table, consolidates routes sent by various routing protocols,and selects and sends preferred routes to the routing table. Routes discovered by various routing protocols are stored
in the routing table. These routes are generally classified by source into three types:



Direct route: It is the route discovered by a link-layer protocol and is also called interface route.

Static route: It is manually configured by the network administrator. A static route is easy to configure and lessdemanding on the system, and therefore applicable to a small-sized network that is stable and has a simple
topology. However, when the network topology changes, the static route must be manually reconfigured andcannot automatically adapt to the topological changes.

Dynamic route: It is the route discovered by a dynamic routing protocol.

3.2 Applications
Application

Description

Basic Functions of the Static RouteManually configure a route.

Floating Static Route

Configure a standby route in the multipath scenario.

Load Balancing Static Route

Configure load balancing static routes in the multipath scenario.

3.2.1 Basic Functions of the Static RouteScenario
On a network with a simple topology, you can configure only static routes to implement network interworking.
Appropriate configuration and use of static routes can improve the network performance and guarantee the bandwidth
for important network applications.
As shown in Figure 3-1, to implement interworking between PC 1, PC 2, and PC 3, you can configure static routes on R
1, R 2, and R 3.



On R 1, configure a route to the network segment of PC 2 through R 2, and a route to the network segment of PC
3 through R 3.



On R 2, configure a route to the network segment of PC 1 through R 1, and a route to the network segment of PC
3 through R 3.



On R 3, configure a route to the network segment of PC 1 through R 1, and a route to the network segment of PC
2 through R 2.

Figure 3-1

3-1

Configuration Guide

Managing Routes

Deployment
Configure the address and subnet mask of each interface.

Configure static routes on R 1, R 2, and R 3.

3.2.2 Floating Static RouteScenario
If no dynamic routing protocol is configured, you can configure floating static routes to implement dynamic switching ofroutes to prevent communication interruption caused by the network connection failures.
As shown in Figure 3-2, to prevent communication interruption caused by a line failure between R 1 and R 3, you canconfigure a floating static route respectively on R 1 and R 3. Normally, packets are forwarded on a path with a small
administrative distance. If a link on this path is down, the route is automatically switched to the path with a large
administrative distance.



On R1, configure two routes to the network segment of PC 3, including a route through R 3 (default distance = 1)
and a route through R 2 (default distance = 2).

On R 3, configure two routes to the network segment of PC 1, including a route through R 1 (default distance = 1)
and a route through R 2 (default distance = 2).

Figure 3-2

3-2

Configuration Guide

Managing Routes

Deployment
Configure the address and subnet mask of each interface.

Configure static routes on R 1, R 2, and R 3.

3.2.3 Load Balancing Static RouteScenario
If there are multiple paths to the same destination, you can configure load balancing routes. Unlike floating routes, theadministrative distances of load balancingroutes are the same. Packets are distributed among these routes based on
the balanced forwarding policy.
As shown in Figure 3-3, load balancing routes are configured respectively on R 1 and R 3 so that packets sent to the
network segment of PC 3 or PC 1 are balanced between two routes, including a route through R 2 and a route throughR 4.

On R 1, configure two routes to the network segment of PC 3, including a route through R 2 and a route through R
4.

On R 3, configure two routes to the network segment of PC 1, including a route through R 2 and a route through R
4.

Figure 3-3

Remarks

On the switch, the load is balanced based on the source IP address by default. Run the aggregateport3-3Configuration Guide

Managing Routes

load-balance command to configure the load balancing mode of ECMP route.

Deployment
Configure the address and subnet mask of each interface.

Configure static routes on R 1, R 2, R 3, and R 4.



Configure the load balancing policy on R 1 and R 3.

3.3 Features
FeatureDescription

Route Computation

Generate a valid route on a device.

Optimal Route

Select an optimal route to forward packets.

Selection
Default RouteForward all packets and help reduce the size of a routing table.

错误!未找到引用源。

Quickly detect a route failure and recover communication.

3.3.1 Route Computation
Routing Function
Routing functions are classified into IPv4 and IPv6 routing functions. If the routing functions are disabled, a device isequivalent to a host and cannot forward routes.

Dynamic Route
A dynamic routing protocol learns remote routes and dynamically updates routes by exchanging routes with neighbors.
If a neighbor is the next hop of a route and this neighbor fails, the route fails as well.

Static RouteOn a network with a simple topology, you can configure only static routes to implement network interworking.
Appropriate configuration and use of static routes can improve the network performance and guarantee the bandwidth
for important network applications.
Whether a static route is active is computed based on the status of the local interface. When the exit interface of a static
route is located at layer 3 (L3) and is in Up status (the link status is Up and the IP address is configured), this route is
active and can be used for packet forwarding.

3.3.2 Optimal Route Selection
Administrative
Distance
When multiple routing protocols generate routes to the same destination, the priorities of these routes can be
determined based on the administrative distance. A smaller administrative distance indicates a higher priority.

3-4

Configuration Guide

Managing Routes

Equal-Cost RouteIf multiple routes to the same destination have different next hops but the same administrative distance, these routes
are mutually equal-cost routes. Packets are distributed among these routes to implement load balancing based on thebalanced forwarding policy.
On a specific device, the total number of equal-cost routes is limited. Routes beyond the limit do not participate inpacket forwarding.

Floating RouteIf multiple routes to the same destination have different next hops and different administrative distances, these routes
are mutually floating routes. The route with the smallest administrative distance will be first selected for packet
forwarding. If this route fails, a route with a larger administrative distance is further selected for forwarding, thus
preventing communication interruption caused by a network line failure.

3.3.3 Default RouteIn the forwarding routing table, the route with the destination network segment 0.0.0.0 and the subnet mask 0.0.0.0 is
the default route. Packets that cannot be forwarded by other routes will be forwarded by the default route. The default
route can be statically configured or generated by a dynamic routing protocol.

Default Gateway
When IP routing is disabled on a device, the ip default gateway command is configured to generate a default route.

Static Default RouteOn a L3 device, a static route with the network segment 0.0.0.0 and the subnet mask 0.0.0.0 is configured to generate
the default route.

Default Network
The default network is configured to generate a default route. If the ip default-network command is configured to
specify a network (a classful network, such as a Class A, B, or C network), and this network exists in the routing table,
the router will use this network as the default network and the next hop of this network is the default gateway. As the
network specified by the ip default-network command is a classful one, if this command is used to identify a subnet ina classful network, the router automatically generates a static route of the classful network instead of any default route.

3.4 Configuration
Configuration Item

Description and Command(Mandatory) It is used to configure a static route entry.

Configuring a Static Route

Configuring a Default Routeip route

Configures an IPv4 static route.

ipv6 route

Configures an IPv6 static route.

(Optional) It is used to configure the default gateway.
Configures an IPv4 default gateway.

ip default-gateway

3-5

Configuration Guide

Configuration Item

Managing Routes

Description and Command
Configures an IPv6 default gateway.

ipv6 default-gateway

Configures IPv4 default gateway with static

ip route 0.0.0.0 0.0.0.0

route.
Configures IPv6 default gateway with static

ipv6 route ::/0

route.
Configures an IPv4 default network.

ip default network(Optional) It is used to limit the number of equal-cost routes and number of static routes,
or disable routing.

Configuring Route

Configures the maximum number of IPv4

ip static route-limit

static routes.

Limitations

Configures the maximum number of IPv6

ipv6 static route-limit

static routes.

no ip routing

Disables IPv4 routing.

no ipv6 unicast-routing

Disables IPv6 routing.

3.4.1 Configuring a Static Route
Configuration EffectGenerate a static route in the routing table. Use the static route to forward packets to a remote network.

Notes


If the no ip routing command is configured on device, you cannot configure IPv4 static routes on this device, andexisting IPv4 static routes will also be deleted. Before the device is restarted, reconfiguring the ip routing
command can recover the deleted IPv4 static routes. After the device is restarted, deleted IPv4 static routes
cannot be recovered.



If the no ipv6 unicast- routing command is configured on device, you cannot configure IPv6 static routes on thisdevice, and existing IPv6 static routes will also be deleted. Before the device is restarted, reconfiguring the ipv6
unicast- routing command can recover the deleted IPv6 static routes. After the device is restarted, deleted IPv6
static routes cannot be recovered.

Configuration Steps

Configuring a Static IPv4 Route

Configure the following command on an IPv4-enabled router.
Commandip route network mask { ipv4-address [ global ] | interface [ ipv4-address [ global ] ] } [ distance |description description-text | [ disabled | enabled ] | [ permanent ] | tag tag | weight number ] *Parameter

network

Indicates the address of the destination network.

Description

net-mask

Indicates the mask of the destination network.

ipv4-address(Optional) Indicates the next-hop address of the static route. You must specify at least

3-6

Configuration Guide

Managing Routes

one of ipv4-address and interface, or both of them. If ipv4-address is not specified, astatic direct route is configured.
global

(Optional) Indicates next hop address is global

interface(Optional) Indicates the next-hop exit interface of the static route. You must specify atleast one of ip-address and interface, or both of them. If interface is not specified, arecursive static direct route is configured. The exit interface is obtained by the next hop
in the routing table.

distance(Optional) Indicates the administrative distance of the static route. The administrative
distance is 1 by default.

description(Optional) Indicates the description of the static route. By default, no description is

description-text

configured. description-text is a string of one to 60 characters.

disabled |(Optional) Indicates the enable flag of the static route. The flag is enabled by default.

enabledpermanent(Optional) Indicates the flag of the permanent route. The static route is not a permanent
route by default.

tag tag(Optional) The tag of the static routeweight number(Optional) Indicates the weight of the static route. The weight is 1 by default.

Defaults

By default, no static route is configured.

Command

Global configuration mode

Mode
Usage GuideThe simplest configuration of this command is ip route networknet-maskip-address.

Configuring an IPv6 Static Route

Configure the following command on an IPv6-enabled router.
Commandipv6 route ipv6-prefix / prefix-length { ipv6-address | interface [ ipv6-address ] } [ distance | description
description-text | tag tag | weight number ] *Parameteripv6-prefix

Description

Indicates the IPv6 prefix, which must comply with the address expression specified in
RFC4291.

prefix-length

Indicates the length of the IPv6 prefix. Note that a slash (/) must be added in front of thelength.

ipv6-address(Optional) Indicates the next-hop address of the static route. You must specify at least
one of ipv6-address and interface, or both of them. If ipv6-address is not specified, astatic direct route is configured.

interface(Optional) Indicates the next-hop exit interface of the static route. You must specify atleast one of ipv6-address and interface, or both of them. If interface is not specified, arecursive static direct route is configured. The exit interface is obtained by the next hop
in the routing table.

distance(Optional) Indicates the administrative distance of the static route. The administrative
distance is 1 by default.

3-7Configuration Guide

Managing Routes

description(Optional) Indicates the description of the static route. By default, no description is

description-text

configured. description-text is a string of one to 60 characters.

tag tag(Optional) The tag value of the static route. The default is 0.

weight number(Optional) Indicates the weight of the static route, which must be specified when you
configure equal-cost routes. The weight ranges from 1 to 8. When the weights of all
equal-cost routes of a route are summed up, the sum cannot exceed the maximum
number of equal-cost routes that can be configured for the route. Weighting ofequal-cost routes of a route indicates the traffic ratio of these routes. The weight is 1 bydefault.

Defaults

By default, no static route is configured.

Command

Global configuration mode

Mode
Usage Guide

The simplest configuration of this command is ipv6 route ipv6-prefix / prefix-length ipv6-address.

Verification


Run the show ip route command to display the IPv4 routing table and check whether the configured IPv4 static
route takes effect.

Run the show ipv6 route command to display the IPv6 routing table and check whether the configured IPv6 static
route takes effect.

Configuration
Example

Configuring Static Routes to Implement Interworking of the IPv4 Network

Scenario
Figure 3-4

Configuration

Configure interface addresses on each device.

Steps
R1

R1#configure terminal
R1(config)#interface gigabitEthernet 0/1
R1(config-if-GigabitEthernet 0/1)# ip address 1.1.1.1 255.255.255.0
R1(config-if-GigabitEthernet 0/1)# exit

3-8

Configuration Guide

Managing Routes

R1(config)#interface gigabitEthernet 0/2
R1(config-if-GigabitEthernet 0/2)# ip address 1.1.12.1 255.255.255.0
R1(config-if-GigabitEthernet 0/2)# exit
R1(config)#interface gigabitEthernet 0/3
R1(config-if-GigabitEthernet 0/3)# ip address 1.1.13.1 255.255.255.0
R2

R2#configure terminal
R2(config)#interface gigabitEthernet 0/2
R2(config-if-GigabitEthernet 0/2)# ip address 1.1.2.1 255.255.255.0
R2(config-if-GigabitEthernet 0/2)# exit
R2(config)#interface gigabitEthernet 0/1
R2(config-if-GigabitEthernet 0/1)# ip address 1.1.12.2 255.255.255.0
R2(config-if-GigabitEthernet 0/1)# exit
R2(config)#interface gigabitEthernet 0/3
R2(config-if-GigabitEthernet 0/3)# ip address 1.1.23.2 255.255.255.0

R3

R3#configure terminal
R3(config)#interface gigabitEthernet 0/3
R3(config-if-GigabitEthernet 0/3)# ip address 1.1.3.1 255.255.255.0
R3(config-if-GigabitEthernet 0/3)# exit
R3(config)#interface gigabitEthernet 0/1
R3(config-if-GigabitEthernet 0/1)# ip address 1.1.13.3 255.255.255.0
R3(config-if-GigabitEthernet 0/1)# exit
R3(config)#interface gigabitEthernet 0/2
R3(config-if-GigabitEthernet 0/2)# ip address 1.1.23.3 255.255.255.0
Configure static routes on each device.

R1

R1#configure terminal
R1(config)#ip route 1.1.2.0 255.255.255.0 GigabitEthernet 0/2 1.1.12.2
R1(config)# ip route 1.1.3.0 255.255.255.0 GigabitEthernet 0/3 1.1.13.3

R2

R2#configure terminal
R2(config)#ip route 1.1.1.0 255.255.255.0 GigabitEthernet 0/1 1.1.12.1
R2(config)# ip route 1.1.3.0 255.255.255.0 GigabitEthernet 0/3 1.1.23.3

R3

R3#configure terminal
R3(config)#ip route 1.1.2.0 255.255.255.0 GigabitEthernet 0/2 1.1.23.2
R3(config)# ip route 1.1.1.0 255.255.255.0 GigabitEthernet 0/1 1.1.13.1

3-9

Configuration Guide

Managing Routes

Verification

Display the routing table.

R1

R1# show ip route
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter area, * - candidate default

Gateway of last resort is no set

R2C

1.1.1.0/24 is directly connected, GigabitEthernet 0/1

C

1.1.1.1/32 is local host.

S

1.1.2.0/24 [1/0] via 1.1.12.2, GigabitEthernet 0/2

S

1.1.3.0/24 [1/0] via 1.1.13.3, GigabitEthernet 0/2

C

1.1.12.0/24 is directly connected, GigabitEthernet 0/2

C

1.1.12.1/32 is local host.

C

1.1.13.0/24 is directly connected, GigabitEthernet 0/3

C

1.1.13.1/32 is local host.

R2# show ip route
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter area, * - candidate default

Gateway of last resort is no set
S

1.1.1.0/24 [1/0] via 1.1.12.1, GigabitEthernet 0/2

C

1.1.2.0/24 is directly connected, GigabitEthernet 0/2

C

1.1.2.1/32 is local host.

S

1.1.3.0/24 [1/0] via 1.1.23.3, GigabitEthernet 0/3

C

1.1.12.0/24 is directly connected, GigabitEthernet 0/1

C

1.1.12.2/32 is local host.

3-10Configuration Guide

R3

Managing Routes

C1.1.23.0/24 is directly connected, GigabitEthernet 0/3

C

1.1.23.2/32 is local host.

R3# show ip route
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter area, * - candidate default

Gateway of last resort is no set
S

1.1.1.0/24 [1/0] via 1.1.13.1, GigabitEthernet 0/2

S

1.1.2.0/24 [1/0] via 1.1.23.2, GigabitEthernet 0/2

C

1.1.3.0/24 is directly connected, GigabitEthernet 0/3

C

1.1.3.1/32 is local host.

C

1.1.13.0/24 is directly connected, GigabitEthernet 0/1

C

1.1.13.3/32 is local host.

C

1.1.23.0/24 is directly connected, GigabitEthernet 0/2

C

1.1.23.3/32 is local host.

The S2300 series products do not support OSPF, ISIS and BGP.



Configuring Static Routes to Implement Interworking of the IPv6 Network

Scenario
Figure 3-5

Configuration

Configure interface addresses on each device.

Steps
R1

R1#configure terminal
R1(config)#interface gigabitEthernet 0/2
R1(config-if-GigabitEthernet 0/2)# ipv6 address 1111:1111::1/64
R1(config-if-GigabitEthernet 0/2)# exit

3-11

Configuration Guide

Managing Routes

R1(config)#interface gigabitEthernet 0/1
R1(config-if-GigabitEthernet 0/1)# ipv6 address 1111:1212::1/64
R2

R2#configure terminal
R2(config)#interface gigabitEthernet 0/2
R2(config-if-GigabitEthernet 0/2)#ipv6 address 1111:2323::1/64
R2(config-if-GigabitEthernet 0/2)# exit
R2(config)#interface gigabitEthernet 0/1
R2(config-if-GigabitEthernet 0/1)# ipv6 address 1111:1212::2/64
Configure static routes on each device.

R1

R1#configure terminal
R1(config)# ipv6 route 1111:2323::0/64 gigabitEthernet 0/1

R2

R2#configure terminal
R2(config)#ipv6 route 1111:1111::0/64 gigabitEthernet 0/1

Verification

Display the routing table.

R1

R1# show ipv6 routeIPv6 routing table name - Default - 10 entries
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter areaC

1111:1111::/64 via GigabitEthernet 0/2, directly connectedL1111:1111::1/128 via GigabitEthernet 0/2, local hostC1111:1212::/64 via GigabitEthernet 0/1, directly connectedL1111:1212::1/128 via GigabitEthernet 0/1, local hostS1111:2323::/64 [1/0] via GigabitEthernet 0/1, directly connected

C

FE80::/10 via ::1, Null0C

FE80::/64 via GigabitEthernet 0/2, directly connected

L

FE80::2D0:F8FF:FEFB:C092/128 via GigabitEthernet 0/2, local hostC

FE80::/64 via GigabitEthernet 0/1, directly connected3-12Configuration Guide

L
R2

Managing Routes

FE80::2D0:F8FF:FEFB:C092/128 via GigabitEthernet 0/1, local hostR2# show ipv6 routeIPv6 routing table name - Default - 10 entries
Codes:C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter areaC

1111:2323::/64 via GigabitEthernet 0/2, directly connectedL1111:2323::1/128 via GigabitEthernet 0/2, local hostC1111:1212::/64 via GigabitEthernet 0/1, directly connectedL1111:1212::1/128 via GigabitEthernet 0/1, local hostS1111:1111::/64 [1/0] via GigabitEthernet 0/1, directly connected

C

FE80::/10 via ::1, Null0C

FE80::/64 via GigabitEthernet 0/2, directly connected

L

FE80::2D0:F8FF:FEFB:C092/128 via GigabitEthernet 0/2, local hostC

FE80::/64 via GigabitEthernet 0/1, directly connected

L

FE80::2D0:F8FF:FEFB:C092/128 via GigabitEthernet 0/1, local host

The S2300 series products do not support OSPF, ISIS and BGP.

Common Errors


The link on the interface is not up.



No IP address is configured for the interface.

3.4.2 Configuring a Default Route
Configuration EffectGenerate a default route in the routing table. The default route is used to forward packets that cannot be forwarded
by other routes.

Notes


On the device, run the ip route 0.0.0.0 0.0.0.0 gateway or ipv6 route ::/0 ipv6-gateway command to configure thedefault gateway.

3-13

Configuration Guide

Managing Routes

If the no ip routing or no ipv6 unicast- routing command is configured on the device, you can run the ip default
gateway or ipv6 default gateway command to configure the default gateway.

Configuration Steps

Configuring the IPv4 Gateway

Command

ip default-gateway ipv4-address

Parameteripv4-address

indicates the IPv4 gateway address.

Description
Defaults

By default, no static default route is configured.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring the IPv6 Gateway

Commandipv6 default-gateway ipv6-address

Parameteripv6-address

indicates the IPv6 gateway address.

Description
Defaults

By default, no static default route is configured.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring the IPv4 Default Gateway with Static RouteCommandip route 0.0.0.00.0.0.0{ip-address | interface [ip-address]} [distance] [tag tag] [permanent ] [weightnumber] [descriptiondescription-text] [disabled | enabled]
ip route 0.0.0.0 0.0.0.0 { ipv4-address [ global ] | interface [ ipv4-address [ global ] ] } [ distance |description description-text | [ disabled | enabled ] | [ permanent ] | tag tag | weight number ] *Parameter

0.0.0.0

Indicates the address of the destination network.

Description

0.0.0.0

Indicates the mask of the destination network.

ipv4-address(Optional) Indicates the next-hop address of the static route. You must specify at least
one of ip-address and interface, or both of them. If ip-address is not specified, a static
direct route is configured.

global

(Optional) Indicates next hop address is global

interface(Optional) The next hop egress of the static routedistance(Optional) The administrative distance of the static routedescription(Optional) Indicates the description of the static route. By default, no description is

description-text

configured. description-text is a string of one to 60 characters.

disabled | enabled(Optional) Indicates the enable flag of the static route. The flag is enabled by default.

permanent(Optional) Permanent route ID

3-14

Configuration Guide

Managing Routes

tag tag(Optional) The tag of the static routeweight number(Optional) Indicates the weight of the static route. The weight is 1 by default.

Defaults

By default, no static default route is configured.

Command

Global configuration mode

Mode
Usage GuideThe simplest configuration of this command is ip route 0.0.0.0 0.0.0.0 ipv4-address.

Configuring the IPv6 Default Gateway with Static RouteCommandipv6 route ::/0 { ipv6-address | interface [ ipv6-address ] } [ distance | description description-text | tag tag |weight number ] *Parameter
Description

Indicates the IPv6 prefix, which must comply with the address expression specified in::

RFC4291.
Indicates the length of the IPv6 prefix. Note that a slash (/) must be added in front of0

the length.
(Optional) Indicates the next-hop address of the static route. You must specify at leastIpv6-address

one of ipv6-address and interface, or both of them. If ipv6-address is not specified, astatic direct route is configured.
(Optional) Indicates the next-hop exit interface of the static route. You must specify atleast one of ipv6-address and interface, or both of them. If interface is not specified, ainterfacerecursive static direct route is configured. The exit interface is obtained by the next
hop in the routing table.
(Optional) Indicates the administrative distance of the static route. The administrative

distance

distance is 1 by default.

description(Optional) Indicates the description of the static route. By default, no description is

description-text

configured. description-text is a string of one to 60 characters.

tag tag(Optional) The tag value of the static route. The default is 0.

weight number(Optional) Indicates the weight of the static route, which must be specified when you
configure equal-cost routes. The weight ranges from 1 to 8. When the weights of all
equal-cost routes of a route are summed up, the sum cannot exceed the maximum
number of equal-cost routes that can be configured for the route. Weighting ofequal-cost routes of a route indicates the traffic ratio of these routes. The weight is 1
by default.

Defaults

By default, no static default route is configured.

Command

Global configuration mode

Mode
Usage GuideThe simplest configuration of this command is ipv6 route ::/0 ipv6-gateway.

Configuring the IPv4 Default Network

Command

ip default-network network

Parameter

network

Indicates the address of the network. (The network must be a Class A, B, or C network.)

3-15

Configuration Guide

Managing Routes

Description
Defaults

By default, no default network is configured.

Command

Global configuration mode

Mode
Usage Guide

If the network specified by the ip default-network command exists, a default route is generated and thenext hop to this network is the default gateway. If the network specified by the ip default-network command
does not exist, the default route is not generated.

VerificationOn a device where routing is disabled, run the show ip redirects or show ipv6 redirects command to display thedefault gateway.



On a device where routing is enabled, run the show ip route or show ipv6 route command to display the default
route.

Configuration
Example

Configuring IPv4 Default Routes on Devices to Implement Network Interworking

Scenario
Figure 5-6

Configuration

Configure IP addresses on Layer 3 devices.

Steps
R1

R1#configure terminal
R1(config)#interface gigabitEthernet 0/2
R1(config-if-GigabitEthernet 0/2)# ip address 1.1.1.1 255.255.255.0
R1(config-if-GigabitEthernet 0/2)# exit
R1(config)#interface gigabitEthernet 0/1
R1(config-if-GigabitEthernet 0/1)# ip address 1.1.12.1 255.255.255.0
R1(config-if-GigabitEthernet 0/1)# exit

R2

R2#configure terminal
R2(config)#interface gigabitEthernet 0/2
R2(config-if-GigabitEthernet 0/2)# ip address 1.1.2.1 255.255.255.0
R2(config-if-GigabitEthernet 0/2)# exit
R2(config)#interface gigabitEthernet 0/1
R2(config-if-GigabitEthernet 0/1)# ip address 1.1.12.2 255.255.255.0

3-16

Configuration Guide

Managing Routes

R2(config-if-GigabitEthernet 0/1)# exit
Configure an IPv6 default gateway on R1.

R1

R1#configure terminal
R1(config)#ip route 0.0.0.0 0.0.0.0

GigabitEthernet 0/1 1.1.12.2

R2#configure terminal
R2

R2(config)#ip route 0.0.0.0 0.0.0.0

Verification

Display the routing table.

R1

R1# show ip route
Codes:

GigabitEthernet 0/1 1.1.12.1

C - Connected, L - Local, S - Static
R - RIP, O - OSPF, B - BGP, I - IS-IS
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
IA - Inter area, * - candidate default

Gateway of last resort is 1.1.12.2
S*

0.0.0.0/0 [1/0] via 1.1.12.2, GigabitEthernet 0/1

C

1.1.1.0/24 is directly connected, GigabitEthernet 0/2

C

1.1.1.1/32 is local host.

C

1.1.12.0/24 is directly connected, GigabitEthernet 0/1

C

1.1.12.1/32 is local host.

3.4.3 Configuring Route Limitations
Configuration EffectLimit the number of equal-cost routes and number of static routes, or disable routing.

Configuration Steps

Configuring the Maximum Number of IPv4 Static Routes

Command

ip static route-limit number

Parameter

numberIndicates the upper limit of routes. The value ranges from 1 to 10,000.

Description
Defaults

By default, a maximum of 1,024 IP static routes can be configured.

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure the maximum number of IPv4 static routes. If the maximum number of IPv4

3-17

Configuration Guide

Managing Routes

static routes is reached, no more IPv4 static route can be configured.

Configuring the Maximum Number of IPv6 Static Routes

Commandipv6 static route-limit number

Parameter

numberIndicates the upper limit of routes. The value ranges from 1 to 10,000.

Description
Defaults

By default, a maximum of 1,000 IPv6 static routes can be configured.

Command

Global configuration mode

Mode
Usage Guide

Run this command to configure the maximum number of IPv6 static routes. If the maximum number of IPv6
static routes is reached, no more IPv6 static route can be configured.



Disabling IPv4 Routing

Commandno ip routing

Parameter

N/A

Description
Defaults

By default, IPv4 routing is enabled.

Command

Global configuration mode

Mode
Usage Guide

Run this command to disable IPv4 routing. If the device functions only as a bridge or a voice over IP (VoIP)
gateway, the device does not need to use the IPv4 routing function of the RGOS software. In this case, you
can disable the IPv4 routing function of the RGOS software.



Disabling IPv6 Routing

Commandno ipv6 unicast-routing

Parameter

N/A

Description
Defaults

By default, IPv6 routing is enabled.

Command

Global configuration mode

Mode
Usage Guide

Run this command to disable IPv6 routing. If the device functions only as a bridge or a VoIP gateway, thedevice does not need to use the IPv6 routing function of the RGOS software. In this case, you can disable
the IPv6 routing function of the RGOS software.

3.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

Command3-18

Configuration Guide

Clears the route cacheManaging Routes

clear ip route { * | network [ netmask ] }Displaying
Description

Command

Displays the IPv4 routing table.

show ip route [ network [ mask [ longer-prefix ] ] | count | [ ecmp | normal ][ network [ mask ] ] | protocol | weight ]Displays the statistical information

show ip route summary [ all ]about IPv4 routing table.
Displays the IPv4 default gateway IP

show ip redirects

address.
Displays the IPv6 routing table.

show ipv6 route [ [ ipv6-prefix / prefix-length [ longer-prefixes ] | local | protocol |weight ] ]Displays the statistical information

show ipv6 route summary [ all ]about IPv6 routing table.
Displays the IPv6 default gateway IP

show ipv6 redirects

address.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs IPv4 route management.

debug nsm kernel ucast- v4

Debugs IPv6 route management.

debug nsm kernel ucast-v6

Debugs default network

debug nsm kernel default-network

management.
Debugs internal events of routedebug nsm events

management.
Debugs sending of routedebug nsm packet send

management and routing protocol
messages.
Debugs receiving of routedebug nsm packet recv

management and routing protocol
messages.

3-19

Configuration Guide

Configuring Keys

4 Configuring Keys
4.1 Overview
Keys are a kind of parameters that are used in algorithms for conversion from plain text to cipher text or from cipher text
to plain text.
Plain text and cipher text authentication are supported for packet authentication in a routing protocol, during which keys
need to be used.
At present, keys are used only for RIP packet authentication.

4.2 Applications
Application

Description

RIP Authentication

RIP uses keys for packet authentication.

4.2.1 RIP Authentication
Scenario
Network devices run RIP and use the MD5 authentication mode to increase the protocol security.
Figure 6-1

Deployment
Configure a key chain on A. Configure RIP to enable packet authentication and use the key chain.
Configure a key chain on B. Configure RIP to enable packet authentication and use the key chain.

4.3 Features
Overview
FeatureDescription

Key Chain

Provide a tool for authentication in a routing protocol.

4-1Configuration Guide

Configuring Keys

4.3.1 Key Chain
Working Principle
A key chain may contain multiple different keys. Each key contains the following attributes:

Key ID: Identifies a key. In the current key chain, keys and IDs are mapped in the one-to-one manner.



Authentication string: Indicates a set of key characters used for verifying the consistency of authentication strings
in a routing protocol.

Lifetime: Specifies the lifetime of the current key for sending or receiving packets. Different authentication keys
can be used in different periods.

RelatedConfigurationCreating a Key Chain and a Key

In the global configuration mode, run the key chain key-chain-name command to define a key chain and enter the key
chain configuration mode.
In the key chain configuration mode, run the key key-id command to define a key and enter the key chain key
configuration mode.

Configuring an Authentication String

In the key chain key configuration mode, run the key-string [0|7] text command to specify an authentication string.



A plain text authentication string is configured by default. The value 0 indicates that a plain text authentication key
is configured.



The value 7 indicates that a cipher text authentication string is configured.

The encryption authentication service is disabled by default. You can run the service password-encryptioncommand to enable the encryption service to forcibly convert plain text authentication into cipher text.

Configuring Lifetime

In the key chain key configuration mode, you can configure the lifetime of a key chain in the receiving and sending
directions.



accept-lifetime start-time { infinite | end-time | duration seconds }: Configures the lifetime of a key chain in thereceiving direction.

send-lifetime start-time { infinite | end-time | duration seconds }: Configures the lifetime of a key chain in thesending direction.

4.4 Configuration
Configuration

Description and Command(Mandatory) It is used to create a key.

Configuring a Key Chain

key chain

Creates a key chain.

key

Configures a key ID.

4-2

Configuration Guide

Configuring Keys

Configures a key string.

key-string

Configures the lifetime in the receiving

accept-lifetime

direction.
Configures the lifetime in the sending

send-lifetime

direction.

4.4.1 Configuring a Key Chain
Configuration EffectDefine a key chain to be used by a routing protocol.

Notes


A key chain can take effect only after it is associated with a routing protocol.

Configuration Steps

Creating a Key ChainThis configuration is mandatory if a key chain needs to be used.



If there is no special requirement, you should perform this configuration on all routers for which routing protocol
authentication needs to be performed.

Configuring a Key ID

This configuration is mandatory if a key chain needs to be used.



If there is no special requirement, you should perform this configuration on all routers for which routing protocol
authentication needs to be performed.

Configuring a Key StringThis configuration is mandatory if a key chain needs to be used.



If there is no special requirement, you should perform this configuration on all routers for which routing protocol
authentication needs to be performed.

Configure the Lifetime in the Receiving Direction



Optional.



If the lifetime in the sending direction is not configured, the key chain will be always effective.

Configure the Lifetime in the Sending Direction



Optional.



If the lifetime in the sending direction is not configured, the key chain will be always effective.

Verification
Use keys in a routing protocol and observe the neighborship established by the routing protocol. If the keys areinconsistent, the neighborship fails to be established.

4-3

Configuration Guide

Configuring Keys

Related Commands

Configuring a Key Chain

Commandkey chain key-chain-nameParameter

key-chain-name: Indicates the name of a key chain.

Description
Command

Global configuration mode

Mode
Usage GuideTo make a key chain take effect, you must configure at least one key.

Configuring a Key ID

Commandkey key-id

Parameter

key-id: Indicates the authentication key ID in a key chain, ranging from 0 to 2,147,483,647.

Description
Command

Key chain configuration mode.

Mode
Usage Guide-Configuring a Key Authentication String

Commandkey-string [0|7] text

Parameter

0: Specifies that the key is displayed in plain text.

Description

7: Specifies that the key is displayed in cipher text.
text: Specifies the authentication string characters.

Command

Key chain key configuration mode.

Mode
Usage Guide-Configuring the Lifetime in the Sending Direction

Commandsend-lifetime start-time {infinite | end-time | duration seconds}

Parameter

start-time: Indicates the start time of the lifetime.

Description

infinite: Indicates that the key is always effective.
end-time: Indicates the end time of the lifetime, which must be later than start-time.
duration seconds: Specifies the duration from the start time to the end time, ranging from 1 to
2,147,483,646.

Command

Key chain key configuration mode.

Mode
Usage GuideRun this command to define the lifetime of the key in the sending direction.

Configuring the Lifetime in the Receiving Direction

Commandaccept-lifetime start-time {infinite | end-time | duration seconds}

4-4Configuration Guide

Configuring Keys

Parameter

start-time: Indicates the start time of the lifetime.

Description

infinite: Indicates that the key is always effective.
end-time: Indicates the end time of the lifetime, which must be later than start-time.
duration seconds: Specifies the duration from the start time to the end time, ranging from 1 to
2,147,483,646.

Command

Key chain key configuration mode.

Mode
Usage Guide

Run this command to define the lifetime of the key in the receiving direction.

Configuration
Example

Configuring a Key Chain and Using the Key Chain in RIP Packet Authentication

Scenario
Figure 6-2

Configuratio

Configure a key on all routers.

n StepsConfigure RIP on all routers.

Enable RIP authentication on all routers.

A

A>enableA#configure terminalA(config)#key chain ripchain
A(config-keychain)#key 1
A(config-keychain-key)#key-string Hello
A(config-keychain-key)#accept-lifetime 16:30:00 Oct 1 2013 duration 43200
A(config-keychain-key)#send-lifetime 16:30:00 Oct 1 2013 duration 43200
A(config-keychain-key)#exit
A(config-keychain)#key 2
A(config-keychain-key)#key-string World
A(config-keychain-key)#accept-lifetime 04:00:00 Oct 2 2013 infinite
A(config-keychain-key)#send-lifetime 04:00:00 Oct 2 2013 infinite
A(config-keychain-key)#exit
A(config)#interface gigabitEthernet 0/1
A(config-if)#ip address 192.168.27.1 255.255.255.0

4-5

Configuration Guide

Configuring Keys

A(config-if)#ip rip authentication key-chain ripchain
A(config-if)#ip rip authentication mode md5
A(config-if)#exit
A(config)#router ripA(config-router)#version 2A(config-router)#network 192.168.27.0
BB>enable
B#configure terminal
B(config)#key chain ripchain
B(config-keychain)#key 1
B(config-keychain-key)#key-string Hello
B(config-keychain-key)#accept-lifetime 16:30:00 Oct 1 2013 duration 43200
B(config-keychain-key)#send-lifetime 16:30:00 Oct 1 2013 duration 43200
B(config-keychain-key)#exit
B(config-keychain)#key 2
B(config-keychain-key)#key-string World
B(config-keychain-key)#accept-lifetime 04:00:00 Oct 2 2013 infinite
B(config-keychain-key)#send-lifetime 04:00:00 Oct 2 2013 infinite
B(config-keychain-key)#exit
B(config)#interface gigabitEthernet 0/1
B(config-if)#ip address 192.168.27.2 255.255.255.0
B(config-if)#ip rip authentication key-chain ripchain
B(config-if)#ip rip authentication mode md5
B(config-if)#exit
B(config)#router rip
B(config-router)#version 2
B(config-router)#network 192.168.27.0
B(config-router)#redistribute static

Verification

Run the show ip route rip command to check whether router A can receive an RIP route from router B.

A

A(config)#show ip route ripR

172.168.0.0/16 [120/1] via 192.168.27.2, 00:05:16, GigabitEthernet 0/1

Common Errors


A key is not correctly associated with a routing protocol, which causes that authentication does not take effect.

4-6

Configuration GuideConfiguring Keys

The keys configured on multiple routers are not consistent, which causes authentication failure.

4.5 Monitoring
Displaying
Description

Command

Displays the configurations of a key

show key chain [ key-chain-name ]chain.

4-7

Configuration Guide

Configuring Routing Policies

5 Configuring Routing Policies
5.1 Overview
Routing policies are a policy set for changing the packet forwarding path or routing information and are often
implemented by a filtering list and a route map. Routing policies are flexibly and widely applied in the following methods:

Use a filtering list in a routing protocol to filter or modify routing information.

Use a route map in a routing protocol to filter or modify routing information. Where, the route map can further use afiltering list.



Use a route map in policy-based routing (PBR) to control packet forwarding or modify packet fields.

5.2 Applications
Application

Description

Route Filtering

Use a filtering list in a routing protocol to filter the routing information sent or received by
the protocol.

Route Re-distribution

Use a route map in a routing protocol to filter or modify routing information and re-distributestatic routes to RIP.

5.2.1 Route Filtering
By default, a routing protocol advertises and learns all routing information. When a filtering list is used, the routing
protocol advertises only required routes or receives only required routing information.

Scenario
Figure 7-1

As shown in Figure 7-1, router A has routes to 3 networks: 10.0.0.0, 20.0.0.0 and 30.0.0.0.
Configure a filtering list on the routers to achieve the following purposes:

Filter the sent routing information on router A to filter routes that router A does not need to send.

Filter the received routing information on router B to filter routes that router B does not need to learn.

Deployment


Filter the sent routing information 30.0.0.0 on router A.
5-1

Configuration GuideConfiguring Routing Policies

Filter the received routing information 20.0.0.0 on router B to ensure that router B learns only routing information
10.0.0.0.

5.2.2 Route Re-distribution
By default, route re-distribution will re-distribute all routing information in a routing protocol to another routing protocol.
All routing attributes will also be inherited. You can use a route map to perform conditional control for re-distribution
between two routing protocols, including:Specify the range for re-distributing routes and re-distribute only routing information that meets certain rules.



Set the attributes of routes generated by re-distribution.

5.3 Features
Overview
FeatureDescription

Filtering List

Define a group of lists based on a route attribute, which can be used by a routing protocol forroute filtering.

Route Map

A policy defines "if certain conditions are matched, you can perform certain processing
actions".

5.3.1 Filtering List
Filtering lists are a group of lists defined based on a routing attribute and are a tool for filtering routing policies.
Independent filtering lists are meaningless and can be used to filter routes only when they are applied in a routing
protocol.

Working Principle
Based on different routing attributes, filtering lists are classified into the following types:

Access Control List (ACL)

ACLs comprise IPv4 and IPv6 ACLs. When defining ACLs, you can specify IPv4/IPv6 addresses and masks to matchthe destination network segment or next-hop addresses of routing information.
For description about ACLs, see the ACL Configuration Guide.

Address Prefix List (prefix-list)

Similar to ACLs, prefix-lists, including IPv4 prefix-lists and IPv6 prefix-lists, are used to match destination network
segments of routing information during route filtering.

RelatedConfigurationCreating an ACL

5-2

Configuration Guide

Configuring Routing Policies

By default, no ACL is configured and no policy is set.
In the global configuration mode, run the ip access-list { extended | standard } { id | name } command to create an
IPv4 ACL.
You can set multiple policies in an ACL, sorted by their sequence numbers. Policies have two working modes: permit
and deny.

Creating a Prefix-List

By default, no prefix-list is configured and no entry is set.
In the global configuration mode, run the ip prefix-list prefix-list-name [ seq seq-number ] { deny | permit } ip-prefix[ ge minimum-prefix-length ] [ le maximum-prefix-length ] command to create an IPv4 prefix-list and add a prefix entry to
the list.
You can set multiple entries in the prefix-list, sorted by their sequence numbers. Entries have two working modes:
permit and deny.
Run the ip prefix-list prefix-list-name description descripton-text command to add description to the prefix-list.
Run the ip prefix-list sequence-number command to enable the sorting function for the prefix-list.

5.3.2 Route Map
A policy is a "match …, set…" statement, which indicates that "if certain conditions are matched, you can perform someprocessing actions".

Working Principle



Executing policies

A route map may contain multiple policies. Each policy has a corresponding sequence number. A smaller sequencenumber means a higher priority. Policies are executed based on their sequence numbers. Once the matching conditionof a policy is met, the processing action for this policy needs to be performed and the route map exits. If no matchingcondition of any policy is met, no processing action will be performed.

Working Modes Of Policies

Policies have two working modes:

permit: When the matching condition of a policy is met, the processing action for this policy will be performed andthe route map will exit.



deny: When the matching condition of a policy is met, the processing action for this policy will not be performed
and the route map will exit.

Matching Conditions Of Policies

The matching condition of a policy may contain 0, 1 or more match rules.



If the matching condition contains 0 match rule, no packet will be matched.



If the matching condition contains one or more match rules, all rules must be matched.

Processing Action for a Policy

5-3Configuration Guide

Configuring Routing Policies

The processing action of a policy may contain 0, 1 or more set rules.



If the processing action contains 0 set rule, no processing action will be performed and the route map will directly
exit.



If the processing action contains one or more set rules, all processing actions will be performed and then the route
map will exit.
If set rules have different priorities, the set rule with the highest priority will take effect.

RelatedConfigurationCreating a Route Map (Policy)

By default, no route map is configured and no policy is set.
In the global configuration mode, you can run the route-map route-map-name [ permit | deny ] [ sequence-number ]command to create a route map and add a policy to the route map.
You can set multiple policies in a route map. Each policy uses different sequence numbers.



Setting Matching Conditions of a Policy

By default, no match rule is set (that is, the matching condition of a policy contains 0 match rule).
In the route map mode, run the match command to set match rules. One match command is mapped to one match
rule.
RGOS provides abundant match commands for setting flexible matching conditions.
Command

Description

match interface

Uses the output interface of a route as the matching condition.

match ip address

Uses the destination IPv4 address of a route as the matching condition.

match ip next-hop

Uses the next-hop IPv4 address of a route as the matching condition.

match ip route-source

Uses the source IPv4 address of a route as the matching condition.

match ipv6 address

Uses the destination IPv6 address of a route as the matching condition.

match ipv6 next-hop

Uses the next-hop IPv6 address of a route as the matching condition.

match ipv6 route-source

Uses the source IPv6 address of a route as the matching condition.

match metric

Uses the metric of a route as the matching condition.

match tag

Uses the tag value of a route as the matching condition.

Setting the Processing Actions of a Policy

By default, no set rule is configured (that is, the processing action of a policy contains 0 set rule).
In the route map mode, run the set command to configure set rules. One set command is mapped to one set rule.
RGOS provides abundant set commands for setting flexible processing actions.
Command

Description

set ip default nexthop

Specifies the default next hop of a route. This command has a lower priority
than a common route and a higher priority than set default interface.

5-4

Configuration Guide

Configuring Routing Policies

Command

Description

set metric

Modifies the metric value of a route.

set next-hop

Sets the next-hop IP address of a route.

set tag

Sets the tag value of a route.

5.4 Configuration
Configuration

Description and Command(Optional) It is used to define a policy.

Configuring a Route Maproute-map

Creates a policy (route map).

match

Sets the matching conditions of the policy.

set

Sets the processing actions of the policy.
(Optional) It is used to define a filtering list.

Configuring a Filtering List

ip prefix-list

Creates a prefix-list.

ip prefix-list description

Adds description to a prefix-list.

ip prefix-list sequence-number

Creates an IPv6 prefix-list.

ipv6 prefix-list description

Adds description to an IPv6 prefix-list.

Configuring a Policy to Exit

Memory Reaches Lower

prefix-list.

Ipv6 prefix-list

ipv6 prefix-list sequence-number

Routing Protocol when

Enables the sorting function for a

Enables the sorting function for an IPv6
prefix-list.
Configure a policy to preferentially exit arouting protocol when the memory reaches

memory-lack exit-policy

the lower limit.

Limit

5.4.1 Configuring a Route Map
Configuration EffectDefine a set of routing policies to be used by routing protocols or PBR.

Notes


If a match command uses an ACL to define packet matching conditions, the ACL must be configured.



The following match commands cannot be configured at the same time:

The Following match

Cannot Be Configured with the Following match Commands At the Same Time

Commands
match ip address

match ip prefix-list

5-5Configuration Guide

The Following match

Configuring Routing Policies

Cannot Be Configured with the Following match Commands At the Same Time

Commands
match ipv6 address

match ipv6 prefix-list

match ip next-hop

match ip next-hop prefix-list

match ipv6 next-hop

match ipv6 next-hop prefix-list

match ip route-source

match ip route-source prefix-list

match ipv6 route-source

match ipv6 route-source prefix-list

Configuration Steps

Creating a Policy (Route Map)

Mandatory.



Perform this configuration on a device to which a policy needs to be applied.



Setting Matching Conditions of a PolicyOptional.



If no match rule is configured, no packet will be matched.

If multiple match rules are configured, all the match rules must be matched.

Perform this configuration on a device to which a policy needs to be applied.



Setting the Processing Actions of a PolicyOptional.



If no set rule is configured, no processing action will be performed.



If multiple set rules are configured, all set rules must be executed (if the set rules have different priorities, the setrule with the highest priority takes effect).

Perform this configuration on a device to which a policy needs to be applied.

Verification


Check the configurations of the route map.

Related Commands



Creating a Policy (Route Map)

Commandroute-map route-map-name [ { permit | deny } sequence ]Parameterroute-map-name: Indicates the name of a route map, comprising not more than 32 characters.

Description

permit: Specifies the working mode of this policy as permit, which is the default mode.
deny: Specifies the working mode of this policy as deny. The default mode is permit.
sequence: Specifies the sequence number of this policy. A smaller value means a higher priority. The
default value is 10.

Command

Global configuration mode

Mode

5-6

Configuration Guide

Usage Guide

Configuring Routing Policies

If this route map is unavailable, this command will create a route map and add a policy to the route map.
If this route map is available, this command will add a policy to the route map.

Commandmatch interface interface-type interface-number [ …interface-type interface-number ]Parameterinterface-type interface-number: Indicates the interface type and interface number.

Description
CommandRoute map configuration mode

Mode
Usage Guide

This match rule is used to match the next-hop output interface of a route or a packet.

Commandmatch ip address { access-list-number [ access-list-number | access-list-name ] | access-list-name[ access-list-number | access-list-name ] | prefix-list prefix-list-name [ prefix-list-name ] }Parameteraccess-list-number: Indicates the access list number. For a standard access list, the value ranges are 1

Description

to 99 and 1300 to 1999. For an extended access list, the value ranges are 100 to 199 and 2000 to 2699.
access-list-name: Indicates the access list name.
prefix-list prefix-list-name: Indicates the name of a prefix-list to be matched.

CommandRoute map configuration mode

Mode
Usage Guide

This match rule matches the destination IPv4 address of a packet or route by using an ACL or aprefix-list.
An ACL and a prefix-list cannot be configured at the same time.

Commandmatch ip next-hop { access-list-number [ access-list-number | access-list-name ] | access-list-name[ access-list-number | access-list-name ] | prefix-list prefix-list-name [ prefix-list-name ] }Parameteraccess-list-number: Indicates the access list number. For a standard access list, the value ranges are 1

Description

to 99 and 1300 to 1999. For an extended access list, the value ranges are 100 to 199 and 2000 to 2699.
access-list-name: Indicates the access list name.
prefix-list prefix-list-name: Indicates the name of a prefix-list to be matched.

CommandRoute map configuration mode

Mode
Usage Guide

This match rule matches the next-hop IPv4 address of a route by using an ACL or a prefix-list. An ACL
and a prefix-list cannot be configured at the same time.

Commandmatch ip route-source { access-list-number [ access-list-number | access-list-name ] | access-list-name[ access-list-number | access-list-name ] | prefix-list prefix-list-name [ prefix-list-name ] }Parameteraccess-list-number: Indicates the access list number. For a standard access list, the value ranges are 1

Description

to 99 and 1300 to 1999. For an extended access list, the value ranges are 100 to 199 and 2000 to 2699.
access-list-name: Indicates the access list name.

5-7Configuration Guide

Configuring Routing Policies

prefix-list prefix-list-name: Indicates the name of a prefix-list to be matched.
CommandRoute map configuration mode

Mode
Usage Guide

This match rule matches the source IPv4 address of a route by using an ACL or a prefix-list. An ACL anda prefix-list cannot be configured at the same time.

Commandmatch ipv6 address { access-list-name | prefix-list prefix-list-name }Parameteraccess-list-name: Indicates the access list name.

Description

prefix-list prefix-list-name: Indicates the name of an IPv6 prefix-list to be matched.

CommandRoute map configuration mode

Mode
Usage Guide

This match rule matches the destination IPv6 address of a packet or route by using an ACL or aprefix-list. An ACL and a prefix list cannot be configured at the same time.

Commandmatch ipv6 next-hop { access-list-name | prefix-list prefix-list-name }Parameteraccess-list-name: Indicates the access list name.

Description

prefix-list prefix-list-name: Indicates the name of an IPv6 prefix-list to be matched.

CommandRoute map configuration mode

Mode
Usage Guide

This match rule matches the next-hop IPv6 address of a route by using an ACL or a prefix-list. An ACL
and a prefix-list cannot be configured at the same time.

Commandmatch ipv6 route-source { access-list-name | prefix-list prefix-list-name }Parameteraccess-list-name: Indicates the access list name.

Description

prefix-list prefix-list-name: Indicates the name of an IPv6 prefix-list to be matched.

CommandRoute map configuration mode

Mode
Usage Guide

This match rule matches the source IPv6 address of a route by using an ACL or a prefix-list. An ACL anda prefix-list cannot be configured at the same time.

Commandmatch metric metricParameter

metric: Indicates the metric value of a route, ranging from 0 to 4,294,967,295.

Description
CommandRoute map configuration mode

Mode
Usage Guide

This match rule is used to match the metric value of a route.

5-8Configuration Guide

Commandmatch tag tag [ …tag ]Parameter

tag: Indicates the tag value of a route.

Configuring Routing Policies

Description
CommandRoute map configuration mode

Mode
Usage GuideThis match rule is used to match the tag value of a route.

Setting the Processing Actions of a Policy

Command

set ip default next-hop ip-address [ weight ] [ …ip-address [ weight ] ]Parameter

ip-address: Indicates the next-hop IP address.

Description

weight: Indicates the weight of this next hop.

CommandRoute map configuration mode

Mode
Usage Guide

This set rule is used to specify the default next hop of a route.

Command

set ip next-hop ip-address [ weight ] [ …ip-address [ weight ] ]Parameter

ip-address: Indicates the next-hop IP address.

Description

weight: Indicates the weight of this next hop.

CommandRoute map configuration mode

Mode
Usage Guide

This set rule is used to specify the next hop of a route.

Command

set ipv6 default next-hop global-ipv6-address [ weight ] [ global-ipv6-address [ weight ] ]Parameterglobal-ipv6-address: Indicates the next-hop IPv6 address for packet forwarding. The next-hop router

Description

must be a neighbor router.
weight: Indicates the weight in the load balancing mode, ranging from 1 to 8. A larger value means larger
packet traffic to be shared by the next hop.

CommandRoute map configuration mode

Mode
Usage Guide

This set rule is used to specify the default next hop IPv6 address of a route.

Command

set ipv6 next-hop global-ipv6-address [ weight ] [ global-ipv6-address [ weight ] ]Parameterglobal-ipv6-address: Indicates the next-hop IPv6 address for packet forwarding. The next-hop router

Description

must be a neighbor router.
weight: Indicates the weight in the load balancing mode, ranging from 1 to 8. A larger value means larger
packet traffic to be shared by the next hop.

CommandRoute map configuration mode

Mode

5-9

Configuration Guide

Configuring Routing Policies

Usage Guide

This set rule is used to specify the next hop IPv6 address of a route.

Commandset metric [ + metric-value | - metric-value | metric-value ]Parameter+: Increases (based on the metric value of the original route).

Description-: Decreases (based on the metric value of the original route).
metric-value: Sets the metric value of a re-distribution route. A larger value means a lower priority.

CommandRoute map configuration mode

Mode
Usage Guide

This set rule is used to modify the metric value of a route.

Command

set next-hop ip-address

Parameter

ip-address: Indicates the next-hop IP address.

Description
CommandRoute map configuration mode

Mode
Usage Guide

This set rule is used to set the next-hop IP address.

Command

set tag tag

Parameter

tag: Sets the tag of a re-distribution route.

Description
CommandRoute map configuration mode

Mode
Usage GuideThis set rule is used to set the tag value of a route.

Displaying the Configurations of a Route Map

Commandshow route-map [ name ]Parameter

name: Specifies a route map.

Description
CommandPrivilege, global and interface configuration modes

Mode
Usage Guide

Run the show route-map command to display the configurations of a route map.
If an ACL is used when a route map is configured, you can run the show access-list command to
display the configurations of the ACL.

5.4.2 Configuring a Filtering List
Configuration EffectDefine a set of route filtering rules to be used by routing protocols.

5-10Configuration Guide

Configuring Routing Policies

Notes


A configured filtering list can take effect only after it is associated with a routing protocol.

Configuration Steps

Configuring a Prefix-List

To filter address prefixes, you should perform this configuration.



If there is no special requirement, you should perform this configuration on a route for which filtering based on aprefix-list needs to be performed.

Verification


Check whether the filtering list is correctly configured.



Check the routing table to verify that routes can be correctly filtered.

Related Commands



Creating a Prefix-List

Commandip prefix-list prefix-list-name [ seq seq-number ] { deny | permit } ip-prefix [ ge minimum-prefix-length ][ le maximum-prefix-length ]Parameter

prefix-list-name: Indicates the prefix-list name.

Description

seq-number: Assigns a sequence number to an prefix-list entry, ranging from 1 to 2,147,483,647. If thiscommand does not contain the sequence number, the system will assign a default sequence number tothe prefix-list entry. The default sequence number of the first entry is 5. Subsequently, the default
sequence number of each entry not assigned with a value is the first multiple of 5 greater than theprevious sequence number.
deny: Denies access when certain conditions are matched.
permit: Permits access when certain conditions are matched.
ip-prefix: Configures the IP address and mask, ranging from 0 to 32 digits.
minimum-prefix-length: Specifies the minimum range (namely, the start length of a range).
maximum-prefix-length: Specifies the maximum range (namely, the end length of a range).

Command

Global configuration mode

Mode
Usage Guide

-Adding Description to a Prefix-List

Commandip prefix-list prefix-list-name description description-text

Parameter

prefix-list-name: Indicates the prefix-list name.

Description

description-text: Describes the prefix-list.

Command

Global configuration mode

Mode
Usage Guide

-

5-11

Configuration GuideConfiguring Routing Policies

Enabling the Sorting Function for a Prefix-List

Commandip prefix-list sequence-number

Parameter-

Description
Command

Global configuration mode

Mode
Usage Guide-Creating an IPv6 Prefix-List

Commandipv6 prefix-list prefix-list-name [ seq seq-number ] { deny | permit } ipv6-prefix [ geminimum-prefix-length ] [ le maximum-prefix-length ]Parameter

prefix-list-name: Indicates the prefix-list name.

Description

seq-number: Assigns a sequence number to an prefix-list entry, ranging from 1 to 2,147,483,647. If thiscommand does not contain the sequence number, the system will assign a default sequence number tothe prefix-list entry. The default sequence number of the first entry is 5. Subsequently, the default
sequence number of each entry not assigned with a value is the first multiple of 5 greater than theprevious sequence number.
deny: Denies access when certain conditions are matched.
permit: Permits access when certain conditions are matched.
ipv6-prefix: Configures the IP address and mask, ranging from 0 to 128 digits.
minimum-prefix-length: Specifies the minimum range (namely, the start length of a range).
maximum-prefix-length: Specifies the maximum range (namely, the end length of a range).

Command

Global configuration mode

Mode
Usage Guide

-Adding Description to an IPv6 Prefix List

Commandipv6 prefix-list prefix-list-name description description-text

Parameter

prefix-list-name: Indicates the prefix list name.

Description

description-text: Describes the prefix list.

Command

Global configuration mode

Mode
Usage Guide-Enabling the Sorting Function for an IPv6 Prefix-List

Commandipv6 prefix-list sequence-number

Parameter-

Description
Command

Global configuration mode

Mode

5-12

Configuration Guide

Usage Guide

Configuring Routing Policies-

Common Errors


A filtering list is configured but is not correctly applied in a routing protocol, which causes that the filtering list
cannot take effect.

5.4.1 Configuring a Policy to Exit Routing Protocol when Memory Reaches Lower
Limit
Configuration Effect
When the memory reaches the lower limit, you can disable a routing protocol to release the memory to ensure thenormal running of other protocols.
When the system runs out of memory, disable a routing protocol which has the minimal impact on the system to ensure
the operation of main services.
Configuring the policy to preferentially exit the routing protocols which are disabled cannot help the system releasememory.
This command ensures the operation of main services to some extent when the memory is insufficient. If the memory isfurther consumed, all routing protocols will exit and stop running.

Related Commands

Configuring a Policy to Exit Routing Protocol when Memory Reaches Lower Limit

Commandmemory-lack exit-policy { pim-sm | rip }Parameterpim-sm: Preferentially exits PIM-SM when the memory is insufficient.

Description
Command

rip: Preferentially exits RIP when the memory is insufficient.
Global configuration mode

Mode

5.5 Monitoring
Displaying
Description

Command

Displays the configurations of ashow route-map [ route-map-name ]route map.
Displays the configurations of anshow access-lists [ id | name ]ACL.
Displays the configurations of anshow ip prefix-list [ prefix-name ]IPv4 prefix-list.

5-13

Configuration Guide

Displays the configurations of an

Configuring Routing Policies

show ipv6 prefix-list [ prefix-name ]IPv6 prefix-list.
Displays information about theshow ip protocols [ rip ]status of the currently running IPv4
routing protocol.

5-14Multicast Configuration
1. Configuring IP Multicasting
2. Configuring IGMP SnoopingConfiguration Guide

Configuring IP Multicasting

1 Configuring IP Multicasting
1.1 Overview
IP multicasting is abstracted hardware multicasting and an extended multicast routing protocol on the standard IP
network layer.
In traditional IP transmission, only one host can send packets to a single host (unicast communication) or all hosts(broadcast communication). However, the multicast technology provides the third choice: a host can send packets tocertain specified hosts.
IP multicasting is applicable to one-to-many multimedia applications.

1.2 Features
Overview
FeatureDescription

Configuring Multicast

During normal running, SSP synchronizes the hardware multicast forwarding table to the

Non-Stop

management board in real time. After the management board is switched, the command for

Forwarding

configuring the multicast control plane of the original slave management board is loaded, and theParameters

multicast protocol (such as PIM-SM or IGMP Snooping) re-converges. The multicast non-stop
forwarding function ensures continuous forwarding of multicast data streams during
re-convergence of the multicast protocol.

Configuring an
Overwriting
Mechanism Upon

Deletes the earliest hardware entries and adds new entries if the hardware forwarding table

Overflow of Multicast

overflows when you create multicast forwarding entries.

Hardware
Forwarding Entries

1.2.1 Configuring Multicast Non-Stop Forwarding Parameters
The non-stop forwarding function ensures continuous forwarding of multicast data streams during the re-convergenceof multicast protocols.

Working Principle
During normal running, SSP synchronizes the hardware multicast forwarding table to the management board in realtime. After the management board is switched, the command for configuring the multicast control plane of the originalslave management board is loaded, and the multicast protocol (such as PIM-SM or IGMP Snooping) re-converges. The
multicast non-stop forwarding function ensures continuous forwarding of multicast data streams during re-convergenceof multicast protocols.
After the configured protocol convergence period times out, all multicast forwarding table entries that are not updated
during the convergence period are deleted.
1-1Configuration Guide

Configuring IP Multicasting

RelatedConfiguration

Configuring the Maximum Period for Multicast Protocol Convergence

By default, the maximum period for multicast protocol convergence is 20s.
Run msf nsf convergence-time time to configure the maximum period for multicast protocol convergence. The value
ranges from 0 to 3600s.
A larger value of time means a longer maximum period for multicast protocol convergence.

Configuring the Multicast Packet Leakage Period

By default, the multicast packet leakage period is 30s.
Run msf nsf leak interval to configure the multicast packet leakage period. The value ranges from 0 to 3600s.
A larger value of interval means a longer leakage period.

1.2.2 Configuring an Overwriting Mechanism Upon Overflow of Multicast
Hardware Forwarding Entries
Delete the earliest hardware entries and adds new entries if the hardware forwarding table overflows when you create
multicast forwarding entries.

Working Principle
Delete the earliest hardware entries and adds new entries if the hardware forwarding table overflows when you create
multicast forwarding entries.

RelatedConfiguration

Configuring an Overwriting Mechanism Upon Overflow of Multicast Hardware Forwarding Entries

By default, the overwriting mechanism upon the overflow of multicast hardware forwarding entries is disabled.
Run msf ipmc-overflow override to configure the overwriting mechanism upon overflow of multicast hardware
forwarding entries.

1.3 Configuration
Configuration

Configuring Multicast Non-Stop
Forwarding Parameters

Description and Command
msf nsf convergence-time timeMulticast Hardware Forwarding

multicast protocol convergence.
Configures the multicast packet leakage

msf nsf leak interval

period.

Configuring an Overwriting
Mechanism Upon Overflow ofConfigures the maximum period for

Configures the overwriting mechanism
msf ipmc-overflow override

upon overflow of multicast hardware
forwarding entries.

Entries

1-2

Configuration Guide

Configuring IP Multicasting

1.3.1 Configuring Multicast Non-Stop Forwarding Parameters
Configuration EffectThe non-stop forwarding function ensures continuous forwarding of multicast data streams during re-convergenceof multicast protocols.

Notes


The basic functions of IP multicasting must be configured.

Configuration Steps

Configuring the Maximum Period for Multicast Protocol ConvergenceThe maximum period for multicast protocol convergence can be specified on each device unless otherwise
specified.

Configuring the Multicast Packet Leakage PeriodThe multicast leakage period can be configured on each device unless otherwise specified.

Verification
Run show msf nsf to check the configured multicast non-stop forwarding parameters.

Related Commands

Configuring the Maximum Period for Multicast Protocol Convergence

Commandmsf nsf convergence-time time

Parameterconvergence-time time: Specifies the maximum period for multicast protocol convergence. The value

Description

ranges from 0 to 3600s. The default value is 20s.

Command

Global configuration mode

Mode
Usage Guide-Configuring the Multicast Packet Leakage Period

Commandmsf nsf leak intervalParameter

leak intervald: Specifies the multicast packet leakage period. The value ranges from 0 to 3600s. The

Description

default value is 30s.

Command

Global configuration mode

Mode
Usage Guide-Displaying Multicast Non-Stop Forwarding Configurations

Commandshow msf nsf

Parameter-

Description
CommandPrivilege, global and interface configuration modes

Mode
1-3

Configuration Guide
Usage Guide

Configuring IP Multicasting-

Configuration
Example

Creating the IP Multicast Service on the IPv4 Network and Supporting PIM-DM

Scenario

Basic environment of the IP multicast service (Omitted)

Configuratio

Configure the basic functions of IP multicasting. (Omitted)

n StepsConfigure the maximum period for multicast protocol convergence.

Configure the multicast packet leakage period.

AA# configure terminalA(config)# msf nsf convergence-time 200A(config)# msf nsf leak 300

Verification

Run show msf nsf to display multicast non-stop forwarding configurations.

A

A# show msf nsf
Multicast HA Parameters---------------------------------------------------+------+
protocol convergence timeout

200 secs

flow leak interval

300 secs

1.3.2 Configuring an Overwriting Mechanism Upon Overflow of Multicast
Hardware Forwarding Entries
Configuration EffectDelete the earliest hardware entries and adds new entries if the hardware forwarding table overflows when you
create multicast forwarding entries.

Notes


The basic functions of IP multicasting must be configured.

Configuration StepsThe overwriting mechanism upon overflow of multicast hardware forwarding entries can be configured on eachdevice unless otherwise specified.

Verification
Run show running-config to check whether the overwriting mechanism upon overflow of multicast hardware
forwarding entries is configured.

Related Commands
1-4Configuration GuideConfiguring IP Multicasting

Configuring an Overwriting Mechanism Upon Overflow of Multicast Hardware Forwarding Entries

Commandmsf ipmc-overflow override

Parameter-

Description
Command

Global configuration mode

Mode
Usage Guide-

Configuration
Example

Creating the IP Multicast Service on the IPv4 Network and Configuring an Overwriting Mechanism Upon
Overflow of Multicast Hardware Forwarding Entries

Scenario

Basic environment of the IP multicasting service (Omitted)

Configuratio

Configure the basic functions of IP multicasting. (Omitted)

n StepsConfigure the overwriting mechanism upon overflow of multicast hardware forwarding entries.

A

A# configure terminalA(config)# msf ipmc-overflow override

Verification

Run show running-config to check whether the overwriting mechanism upon overflow of multicast
hardware forwarding entries is configured.

A

A# show running-config…
msf ipmc-overflow override…

1.4 Monitoring
Clearing
Running the clear commands may lose vital information and interrupt services.

Displaying
Description

Command

Displays the IPv4 multi-layer

show msf msc

multicast forwarding table.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.

1-5

Configuration Guide

Configuring IP Multicasting

Description

CommandDebugs the processing of IPv4

debug msf forwarding

multi-layer multicast packet
forwarding.
Debugs the operation on multi-layer

debug msf msc

multicast forwarding entries on an
IPv4 network.
Debugs the bottom-layer hardware

debug msf ssp

processing of IPv4 multi-layer
multicast packet forwarding.
Debugs the invocation of API

debug msf api

interfaces provided by IPv4
multi-layer multicast forwarding.
Debugs the processing of

debug msf events

multi-layer multicast forwarding
events on an IPv4 network.

1-6

Configuration Guide

Configuring IGMP Snooping

2 Configuring IGMP Snooping
2.1 Overview
Internet Group Management Protocol (IGMP) snooping is a mechanism of listening to IP multicast. It is used to manage
and control the forwarding of IP multicast traffic within VLANs, realizing Layer-2 multicasting.
As shown in the following figure, when a Layer-2 device is not running IGMP snooping, IP multicast packets arebroadcasted within the VLAN; when the Layer-2 device is running IGMP snooping, IP multicast packets are transmitted
only to profile members.
Figure 2-1 Networking Topology of IP Multicast Forwarding within the VLAN Before and After IGMP Snooping Is Run on
the Layer-2 Device

Protocols andStandards


RFC4541: Considerations for Internet Group Management Protocol (IGMP) and Multicast Listener Discovery(MLD) Snooping Switches

2.2 Applications
Application

Description

Layer-2 Multicast Control

Enables precise forwarding of Layer-2 multicast packets to avoid flooding at thislayer.

2-1

Configuration Guide
Shared Multicast Services

Configuring IGMP Snooping
Multiple users can share the multicast traffic of the same VLAN.

(Multicast VLAN)
Premium Channels and Preview

Controls the range of multicast addresses that allow user demanding and allows
preview for profiles who are inhibited from demanding.

2.2.1 Layer-2 Multicast Control
Scenario

As shown in the following figure, multicast packets are transmitted to users through a Layer-2 switch. When
Layer-2 multicast control is not performed, namely, when IGMP snooping is not implemented, multicast packets
are flooded to all the users including those who are not expected to receive these packets. After IGMP snooping is
implemented, the multicast packets from an IP multicast profile will no longer be broadcast within the VLAN but
transmitted to designated receivers.



Figure 2-2 Networking Topology of Implementing Layer-2 Multicast Control (Multicast VLAN)

Deployment
Configure basic IGMP snooping functions.

2.2.2 Shared Multicast Services (Multicast VLAN)
Scenario

In Shared VLAN Group Learning (SVGL) mode or IVGL-SVGL mode (IVGL: Independent VLAN Group Learning),
a device running IGMP snooping can provide shared multicast services (or multicast VLAN services) to the VLAN
users. Typically, this function is used to provide the same video-on-demand (VOD) services to multiple VLAN
users.
2-2

Configuration GuideConfiguring IGMP Snooping

The following figure shows the operation of a Layer-2 multicast device in SVGL mode of IGMP snooping. The
multicast router sends a multicast packet to VLAN 1, and the Layer-2 multicast device automatically transfers thepacket to VLAN 1, VLAN 2, and VLAN 3. In this way, the multicast services of VLAN 1 are shared by VLAN 2 andVLAN 3.

Figure 2-3 Networking Topology of Shared Multicast Services (Multicast VLAN)

If the Layer-2 multicast device operates in IVGL mode, the router must send a packet to each VLAN, which wastes
bandwidth and burdens the Layer-2 multicast device.

Deployment
Configure basic IGMP snooping functions (in SVGL mode or IVGL-SVG mode).

2.2.3 Premium Channels and Preview
Scenario

In VOD application, by limiting the range of the multicast addresses that a user host can access, unpaid users will
not be able to watch the premium channels. Thereafter, the preview service is offered to unpaid users before theydecide whether to pay for it.



The users can preview a premium channel for a certain period of time (for example 1 minute) after demanding it.

Deployment
Configure basic IGMP snooping functions (in any working mode).

Configure the range of multicast addresses that a user can access.

Enable the preview function for VOD profiles that are denied access.

2.3 Features
Basic Concepts

Multicast Router Ports and Member Ports
IGMP snooping is VLAN-based. The ports involved refer to the member ports within the VLAN.

The device running IGMP snooping identifies the ports within the VLAN as a multicast router port or member port so as
to manage and control the forwarding of IP multicast traffic within the VLAN. As shown in the following figure, when

2-3Configuration Guide

Configuring IGMP Snooping

IGMP snooping is run on a Layer-2 device, multicast traffic enters the multicast router port and exits from the member
ports.
Figure 2-4 Networking Topology of Two IGMP Snooping Ports

Multicast router port: The location of the multicast source is directed by the port on the Layer-2 multicast(GAM)
device which is connected to the multicast router (Layer-3 multicast device): By listening to IGMP packets, theLayer-2 multicast device can automatically detect the multicast router port and maintain the port dynamically. It
also allows users to configure a static router port.

Member port: The port is on a Layer-2 multicast device and is connected to member hosts. It directs the profile
members. It is also called the Listener Port. By listening to IGMP packets, the Layer-2 multicast device can
automatically detect the member port and maintain the port dynamically. It also allows users to configure a static
member port.

Overview
FeatureDescription

Listening to IGMP Packets

Discovers and identifies the router port and member port to establish and maintain the
IGMP snooping forwarding entries. :IGMP Snooping Working

Provides independent or shared multicast services to the user VLAN.

Modes
Multicast Security Control

Controls the multicast service scope and load to prevent illegal multicast traffic.

ProfileDefines the range of multicast addresses that permit or deny user requests for reference ofother functions.

Handling QinQ

Sets the forwarding mode of multicast packets on the QinQ interface.

IGMP Querier

On a network without a Layer-3 multicast device, the Layer-2 multicast device acts as an
IGMP querier.

2.3.1 Listening to IGMP Packets
A device running IGMP snooping analyzes IGMP packets received, and finds and identifies the router port and member
port using these packets, thereby creating and maintaining an IGMP snooping entry.

2-4Configuration Guide

Configuring IGMP Snooping

Working Principle
A device running IGMP snooping can identify and handle the following types of IGMP packets:Query Packets
An IGMP querier periodically sends General Query packets. When the IGMP querier receives Leave packets, it
sends Group-Specific Query packets.

When the device running IGMP snooping receives the Query packets, it performs the following operations within the
VLAN:



Forward the IGMP Query packets to all the ports (except the receiving port of these packets).



If the receiving port is a dynamic router port, reset the aging timer. If the timer expires, the port will no longer beused as the dynamic router port.



If the receiving port is not a dynamic router port, use it as a dynamic router port and enable the aging timer. If thetimer expires, the port will no longer be used as the dynamic router port.



For general queries, reset the aging timer for all the dynamic member ports. If the timer expires, the port will nolonger be used as the dynamic member port for the general group. By default, the maximum response time carriedby the IGMP query packets is used as the timeout time of the aging timer. If ip igmp snooping
query-max-response-time is run, the time displayed is used as the timeout time of the aging timer.

For designated query packets, reset the aging timer for all the dynamic member ports of the designated profile. If
the timer expires, the port will no longer be used as the dynamic member port of the designated profile. By default,
the maximum response time carried by the IGMP query packets is used as the timeout time of the aging timer. If ip
igmp snooping query-max-response-time is run, the time displayed is used as the timeout time of the aging
timer.

If dynamic router port learning is disabled, IGMP snooping will not learn the dynamic router port.

Report Packets
When a member host receives a query, it responds to the query with a Report packet. If a host requests to join a
profile, it will also send a report.
By default, IGMP Snooping is capable of processing IGMPv1 and IGMPv2 packets. For IGMPv3 Report packets, it
processes profile information but does not process carried source information. IGMP Snooping v3 can be
configured to process all information in IGMPv1, IGMPv2, and IGMPv3 packets.

When the device running IGMP snooping receives the Report packets, it performs the following operations within the
VLAN:



Forward the Report packets from all the router ports. After the ip igmp snooping suppression enable commandis run in one IGMP query cycle, only the first report received by each profile will be forwarded.



If the port on which Report packets are received is a dynamic member port, reset the aging timer. If the timer
expires, the port will no longer be used as the dynamic member port of the designated profile.



If the port on which Report packets are received is not a dynamic member port, use it as a dynamic member port
and enable the aging timer. If the timer expires, the port will no longer be used as the dynamic member port of thedesignated profile.

2-5Configuration GuideConfiguring IGMP Snooping

Leave Packets
If a host requests to leave a profile, it will send a Leave packet.

When the device running IGMP snooping receives the Leave packets, it performs the following operations within the
VLAN:



Forward the leave packets from all the router ports.



If the port on which leave packets are received is a dynamic member port and the Leave function is enabled, theport will be immediately deleted from the IGMP snooping forwarding entry of the designated profile and will nolonger be used as the dynamic member port.



If the port on which the leave packets are received is a dynamic member port and the Leave function is disabled,
the port state should be maintained.

RelatedConfiguration

Configuring a Static Router Port

Run the ip igmp snooping vlan mrouter interface command to configure a static router port.



Configuring a Static Member Port

Run the ip igmp snooping vlan static interface command to configure a static member port.

Enabling Report Suppression

Report suppression is disabled by default.
Run the ip igmp snooping suppression enable command to enable report suppression.
After report suppression is enabled, in one IGMP query cycle, only the first Report packet received by each profile will
be forwarded. The source media access control (MAC) address of the forwarded report will be changed to the MAC
address of the device.

Enabling Immediate Leave

Immediate leave is disabled by default.
Run the ip igmp snooping fast-leave enable command to enable immediate leave.

Enabling Dynamic Router Port Learning

Dynamic router port learning is enabled by default.
Run the no ip igmp snooping mrouter learn pim-dvmrp command to disable dynamic router port learning.
Run the no ip igmp snooping vlan vid mrouter learn pim-dvmrp command to disable dynamic router port learningfor designated VLANs.



Configuring the Aging Time of a Dynamic Router PortThe default aging time is 300s.
When a dynamic router port receives a query packet, the aging timer of the port is enabled or reset; if the aging time is
not configured, the maximum response time carried by the query packet is used as the aging time.

2-6

Configuration Guide

Configuring IGMP Snooping

Run ip igmp snooping dyn-mr-aging-time to configure the aging time of the dynamic router port.



Configuring the Aging Time of a Dynamic Member PortThe default aging time is 260s.
When a dynamic member port receives a query packet, the aging timer of the port is enabled or reset, and the aging
time is the maximum response time carried by the query packet.
When a dynamic member port receives a Report packet, the aging timer of the port is enabled or reset, and the aging
time is the maximum response time of the dynamic member port.
Run ip igmp snooping host-aging-time to configure the aging time of the dynamic member port.



Configuring the Maximum Response Time of a Query Packet

The maximum response time of a query packet is not configured by default and the maximum response time carries by
the query packet is used.
Run ip igmp snooping query-max-response-time to configure the maximum response time of a query packet.

Disabling Layer-2 Multicast on Layer-2 Interface

By default, layer-2 multicast is enabled on a layer-2 interface.
Run ip igmp snooping disabled command to disable layer-2 multicast on layer-2 interface.

2.3.2 IGMP Snooping Working Modes
A device running in the three modes (IVGL, SVGL, and IVGL-SVGL) of IGMP snooping can provide independent
multicast services or shared multicast services to the user VLAN.

Working Principle



IVGL

In IVGL mode, a device running IGMP snooping can provide independent multicast services to each user VLAN.
Independent multicast services indicate that multicast traffic can be forwarded only within the VLAN it belongs to, and auser host can subscribe to the multicast traffic within the VLAN that the host belongs to.



SVGL

In SVGL mode, a device running IGMP snooping can provide shared multicast services to the user VLAN.
Shared multicast services can be provided only on shared VLANs and sub VLANs and SVGL multicast addresses areused. In a shared VLAN, the multicast traffic within the range of SVGL multicast addresses is forwarded to a sub VLAN,
and the user hosts within the sub VLAN subscribe to such multicast traffic from the shared VLAN.



In a shared VLAN and sub VLAN, shared multicast services will be provided to the multicast traffic within the rangeof SVGL multicast addresses. Other multicast traffic will be discarded.



Other VLANs (except shared VLANs and sub VLANs) apply to independent multicast services.
When the user VLAN is set to a shared VLAN or sub VLAN, shared multicast services are provided; when a user
VLAN is set to other VLANs, independent multicast services are provided.



IVGL-SVGL

2-7

Configuration Guide

Configuring IGMP Snooping

IVGL-SVGL mode is also called the hybrid mode. In this mode, a device running IGMP snooping can provide bothshared and independent multicast services to the user VLAN.



In a shared VLAN and sub VLAN, multicast services will be provided to the multicast traffic within an SVGL profile.
For other multicast traffic, independent multicast services will be provided.



Other VLANs (except shared VLANs and sub VLANs) apply to independent multicast services.
When a user VLAN is configured as a shared VLAN or sub VLAN, both public multicast services and independent
multicast services available. When a user VLAN is configured as a VLAN other than shared VLAN and sub VLAN,
only the independent multicast services are available.

RelatedConfiguration

Enabling IGMP Snooping and Selecting a Working Mode

IGMP snooping is disabled by default.
Run the ip igmp snooping ivgl command to enable IGMP snooping in IVGL mode.
Run the ip igmp snooping svgl command to enable IGMP snooping in SVGL mode.
Run the ip igmp snooping ivgl-svgl command to enable IGMP snooping in IVGL-SVGL mode.
A working mode must be designated when enabling IGMP snooping, namely, one of the preceding working modes must
be selected.

Configuring Shared VLAN

The shared VLAN is VLAN 1 by default.
Run the ip igmp snooping svgl vlan command to designate a VLAN as the shared VLAN.
In SVGL mode and IVGL-SVGL mode, only one VLAN can be configured as the shared VLAN.



Configuring Sub VLAN

By default, a sub VLAN is any VLAN except the shared VLAN.
Run the ip igmp snooping svgl subvlan command to designate a VLAN as the sub VLAN.
In SVGL mode and IVGL-SVGL mode, the number of sub VLANs is not limited.

Configuring an SVGL Profile

No default setting.
Run the ip igmp snooping svgl profile profile_num command to configure the address range of an SVGL profile.
In SVGL mode and IVGL-SVGL mode, the SVGL profile range must be configured; otherwise, shared multicast
services cannot be provided.

2.3.3 IGMP Security Control
A device running IGMP snooping can control the multicast service scope and load, and effectively prevents illegal
multicast traffic.

Working Principle

2-8Configuration GuideConfiguring IGMP Snooping

Configuring the Profile Filtering for User Demanding

By configuring the profile list that a user can access, you can customize the multicast service scope to guarantee theinterest of operators and prevent illegal multicast traffic.
To enable this function, you should use a profile to define the range of multicast addresses that a use is allowed toaccess.

When the profile is applied on a VLAN, you can define the multicast addresses that a user is allowed to accesswithin the VLAN.

When the profile is applied on an interface, you can define the multicast addresses that a user is allowed to accessunder the port.



Multicast Preview

If the service provider wants to allow the users to preview some multicast video traffic that denies the users' access, andstop the multicast video traffic after the preview duration is reached, the user-based multicast preview function should
be provided.
The multicast preview function is used together with multicast permission control. For example, in the application ofvideos, the administrator controls some premium channels by running the ip igmp profile command on a port or VLAN.
In this way, unsubscribed users will not be able to watch these channels on demand. If users want to preview thechannels before they decide whether to pay for watching or not, the multicast preview function can be enabled, allowing
the premium channels to be previewed by unpaid users for a certain period of time (for example 1 minute).

Controlling the Maximum Number of Profiles Allowed for Concurrent Request

If there is too much multicast traffic requested at the same time, the device will be severely burdened. Configuring the
maximum number of profiles allowed for concurrent request can guarantee the bandwidth.



You can limit the number of profiles allowed for concurrent request globally.



You can also limit the number of profiles allowed for concurrent request on a port.

RelatedConfiguration

Configuring the Profile Filtering

By default, profiles are not filtered and allow user access.
To filter multicast profiles, run the ip igmp snooping filter command in interface configuration mode or global
configuration mode.

Enabling Preview

Preview is not enabled by default.
Run the ip igmp snooping preview command to enable preview and restrict the range of the profiles permitted for
multicast preview.
Run the ip igmp snooping preview interval to set the multicast preview duration.

Configuring the Maximum Number of Profiles Allowed for Concurrent Request on a Port

By default, the number of profiles allowed for concurrent request is not limited.

2-9Configuration Guide

Configuring IGMP Snooping

Run the ip igmp snooping max-groups command to configure the maximum number of profiles allowed for
concurrent request.

Configuring the Maximum Number of Multicast Profiles Allowed Globally

By default, the maximum number of multicast profiles allowed globally is 65,536.
Run the ip igmp snooping l2-entry-limit command to configure the maximum number of multicast profiles allowed
globally.

2.3.4 IGMP Profile
A multicast profile is used to define the range of multicast addresses that permit or deny user demanding request forreference of other functions.

Working Principle
The profile is used to define the range of multicast addresses.
When SVGL mode is enabled, an SVGL profile is used to define the range of SVGL multicast addresses.
When the multicast filter is configured on an interface, a profile is used to define the range of multicast addresses that
permit or deny user request under the interface.
When a VLAN filter is configured, a profile is used to define the range of multicast addresses that permit or deny user
request under within the VLAN.
When the preview function is enabled, a profile is used to define the range of multicast address allowed for preview.

RelatedConfiguration

Configuring a Profile

Default configuration:Create a profile, which is deny by default.

Configuration steps:

Run the ip igmp profile profile-number command to create a profile.



Run the range low-address high_address command to define the range of multicast addresses. Multiple address
ranges are configured for each profile.

(Optional) Run the permit or deny command to permit or deny user request (deny by default). Only one permit ordeny command can be configured for each profile.

2.3.5 IGMP QinQ
Working Principle
On a device with IGMP snooping enabled and dot1q-tunnel (QinQ) port configured, IGMP snooping will handle the
IGMP packets received by the QinQ port using the following two approaches:Approach 1: Create a multicast entry on the VLAN where IGMP packets are located. The forwarding of IGMP
packets on the VLAN where these packets are located is called transparent transmission. For example, presume

2-10Configuration Guide

Configuring IGMP Snoopingthat IGMP snooping is enabled for a device, Port A is designated as the QinQ port, the default VLAN of this port is
VLAN 1, and it allows the passage of VLAN 1 and VLAN 10 packets. When a multicast Query packet is sent by
VLAN 10 to Port A, IGMP snooping establishes a multicast entry for VLAN 10 and forwards the multicast Query
packet to the router port of VLAN 10.

Approach 2: Create a multicast entry on the default VLAN of the QinQ port. Encapsulate the multicast packet with
the VLAN tag of the default VLAN where the QinQ port is located and forward the packet within the default VLAN.
For example, presume that IGMP snooping is enabled for a device, Port A is designated as the QinQ port, thedefault VLAN of this port is VLAN 1, and it allows the passage of VLAN 1 and VLAN 10 packets. When a multicast
Query packet is sent by VLAN 10 to Port A, IGMP snooping establishes a multicast entry for VLAN 1,
encapsulates the multicast query packet with the tag of VLAN 1, and forward the packet to VLAN 1 router port.

RelatedConfiguration

Configuring QinQ

By default, IGMP snooping works in the mode specified in Approach 2.
Run the ip igmp snooping tunnel command to implement Approach 1.

2.3.6 IGMP Querier
On a network with a Layer-3 multicast device, the Layer-3 multicast device acts as an IGMP querier. In this case, aLayer-2 device needs only to listen to IGMP packets to establish and maintain the forwarding entry, realizing Layer-2
multicast.
On a network without a Layer-3 multicast device, the Layer-2 multicast device must be configured with the IGMP
querier function so that the device can listen to IGMP packets. In this case, a Layer-2 device needs to act as an IGMP
querier as well as listen to IGMP packets to establish and maintain the forwarding entry to realize Layer-2 multicast.

Working Principle
A Layer-2 device acts as an IGMP querier to periodically send IGMP Query packets, listen to and maintain the IGMP
Report packets replied by a user, and create a Layer-2 multicast forwarding entry. You can adjust relevant parametersof the Query packets sent by the IGMP querier through configuration.
When the device receives a Protocol-Independent Multicast (PIM) or Distance Vector Multicast Routing Protocol(DVMRP) packet, it considers that a multicast router, which will act as an IGMP querier, exists on the network anddisables the querier function. In this way, IGMP routing will not be affected.
When the device receives the IGMP Query packets from other devices, it will compete with other devices for the IGMP
querier.

Enabling the Querier Function

You can enable the querier for a specific VLAN or all VLANs.
Only when the global querier function is enabled can the queriers for specific VLANs take effect.

Specifying the IGMP Version for a Querier

The version of IGMP used for sending Query packets can be configured as IGMPv1, IGMPv2, or IGMPv3.

2-11

Configuration GuideConfiguring IGMP Snooping

Configuring the Source IP Address of a Querier

You can configure the source IP address of a query packet sent by the querier based on VLANs.
When the source IP address of the querier is not configured, the querier will not take effect.

Configuring the Query Interval of a Querier

You can configure the intervals for sending global Query packets based on different queriers on different VLANs.



Configuring the Maximum Response Time of a Query Packet

You can configure the maximum response time carried by a Query packet that is sent by a querier. As IGMPv1 does notsupport the carrying of maximum response time by a Query packet, this configuration does not take effect when thequerier is running IGMPv1. You can configure different maximum response time for queriers on different VLANs.



Configuring the Aging Time of a Querier

When other IGMP queriers exist on a network, the existing device will compete with other queriers. If the existing device
fails to be elected and is in the non-querier state, the aging timer of a querier will be enabled. After the timer expires,
other queriers on the network are considered as expired and the existing device will be resumed as the querier.

RelatedConfiguration

Enabling the Querier Function

By default, the querier function of a device is disabled.
Run the ip igmp snooping querier command to enable the global querier function.
Run the ip igmp snooping vlan num querier command to enable the querier function for specific VLANs.



Specifying the IGMP Version for a Querier

By default, a querier runs IGMPv2.
Run the ip igmp snooping querier version command to configure the global querier version.
Run the ip igmp snooping vlan querier version command to specify the querier version for specific VLANs.



Configuring the Source IP Address of a Querier

By default, the source IP address of a querier is 0.
Run the ip igmp snooping querier address command to enable global source IP addresses of queriers.
Run the ip igmp snooping vlan querier address command to specify the source IP addresses of the queriers on specific
VLANs.

Configuring the Query Interval of a Querier

By default, the query interval of a querier is 60s.
Run the ip igmp snooping querier query-interval command to enable the global query interval of queriers.
Run ip igmp snooping vlan querier query-interval to specify the global query interval of the queriers on specific
VLANs.

2-12

Configuration GuideConfiguring IGMP Snooping

Configuring the Maximum Response Time of a Query Packet

By default, the maximum response time of a query packet is 10s.
Run the ip igmp snooping querier max-response-time command to configure the maximum response time of thequery packets sent by global queriers.
Run the ip igmp snooping vlan querier max-response-time command to specify the maximum response time of thequery packets sent by the queriers on specific VLANs.



Configuring the Aging Time of a Querier

By default, the aging time of a querier is 125s.
Run the ip igmp snooping querier timer expiry command to configure the aging time of global queriers.
Run the ip igmp snooping vlan querier timer expiry command to configure the aging time of queriers on specific
VLANs.

2.4 Configuration
Configuration

Description and Command
Any of IVGL mode, SVGL mode, and IVGL-SVGL mode must be selected.

Configuring Basic IGMP

It is used to enable IGMP snooping in IVGL mode.

Snooping Functions (IVGL
Mode)

Enables global IGMP snooping in IVGL

ip igmp snooping ivgl

mode.

no ip igmp snooping vlan num

Disables IGMP snooping for a VLAN.

Any of IVGL mode, SVGL mode, and IVGL-SVGL mode must be selected.
It is used to enable IGMP snooping in SVGL mode.
Configuring Basic IGMP

Enables global IGMP snooping in IVGL

ip igmp snooping svgl

mode.

Snooping Functions (SVGL
Mode)

no ip igmp snooping vlan num

Disables IGMP snooping for a VLAN.

ip igmp snooping svgl profile profile_num

Configures the SVGL profile.

ip igmp snooping svgl vlan

Specifies the SVGL shared VLAN.

ip igmp snooping svgl subvlan

Specifies the SVGL sub VLAN.

Any of IVGL mode, SVGL mode, and IVGL-SVGL mode must be selected.
It is used to enable IGMP snooping in IVGL-SVGL mode.
Configuring Basic IGMP

ip igmp snooping ivgl-svgl

Snooping Functions(IVGL-SVGL Mode)

Configuring the Packet

Enables global IGMP snooping in
IVGL-SVGL mode.

no ip igmp snooping vlan num

Disables IGMP snooping for a VLAN.

ip igmp snooping svgl profile profile_num

Configures the SVGL profile.

ip igmp snooping svgl vlan

Specifies the SVGL shared VLAN.

ip igmp snooping svgl subvlan

Specifies the SVGL sub VLAN.

(Optional) It is used to adjust relevant configurations for processing protocol packets.

2-13

Configuration Guide
Processing

Configuring IGMP Snooping
ip igmp snooping vlan vid mrouter interface
interface-id
p igmp snooping vlan vid static ip-addressinterface interface-type interface-number
ip igmp snooping [ vlan vid ] mrouter learn
pim-dvmrp
ip igmp snooping dyn-mr-aging-time time

ip igmp snooping host-aging-time time

ip igmp snooping fast-leave enable

Configures a static router port.

Configures a static member port.

Enables dynamic router port learning.
Configures the aging time of a dynamic
router port.
Configures the aging time of a dynamic
member port.
Enables the immediate-leave function
for a dynamic member port.

ip igmp snooping port-fast-leave enable

Configures fast-leave in a port

ip igmp snooping

Configures the maximum response time

query-max-response-time timeof an IGMP query packet.

ip igmp snooping suppression enable

Enables IGMP Report packet
suppression.

ip igmp snooping suppression svgl vlan

Enables IGMP Report packet

enablesuppression on SVGL shared VLAN.

ip igmp snooping suppression vlan vid sip

Configures source IP in IGMP Reportaddress

packet(Optional) It used to guarantee the security when a user requests a multicast profile.
ip igmp snooping filter profile-number

access.

ip igmp snooping vlan num filter

Configures the per-VLAN profile filteringprofile-number

for user access.

Configuring IGMP Security
Control

Configures the profile filtering for user

ip igmp snooping l2-entry-limit number

ip igmp snooping max-groups number

ip igmp snooping preview profile-number
ip igmp snooping preview interval num

Configures the maximum number of
profiles globally for user access.
Configures the maximum number ofdynamic profiles for user access.
Enables the preview function for a
specified profile.
Configures the preview duration.

(Optional) It is used to define the range of multicast addresses that permits or denies
the access of a user host.
Configuring an IGMP Profile

Configuring IGMP QinQ

ip igmp profile profile-number

Creates a profile.

range low-address high_address

Configures the profile range.

permitPermits the access of a user host.

deny

Denies the access of a user host.

(Optional) It is used to configure QinQ interface to forward multicast packets using
the VLAN identifier (VID) carried by packets.

2-14

Configuration Guide

Configuring IGMP Snooping
Configures QinQ to transmit IGMP

ip igmp snooping tunnel

packets transparently.

(Optional) It is used to enable IGMP querier function on a network without a Layer-3
multicast device.
ip igmp snooping querier

Enables global querier function.

ip igmp snooping vlan num querier

Enables the querier for a VLAN.

ip igmp snooping querier version num

Configuring an IGMP
Querier

Specifies the IGMP version for queriers
globally.

ip igmp snooping vlan num querier version

Specifies the IGMP version for a querier

numof a VLAN.

ip igmp snooping [ vlan vid ] querier

Configures the source IP address ofaddress ip-address

queriers globally.

ip igmp snooping vlan num querier address

Configures the source IP address for aa.b.c.dquerier of a VLAN.

ip igmp snooping querier query-interval

Configures the query interval of queriers

num

globally.

ip igmp snooping vlan num querier

Configures the query interval for aquery-interval num

querier of a VLAN.

ip igmp snooping querier

Configures the maximum response time

max-response-time num

for query packets globally.

ip igmp snooping vlan num querier

Configures the maximum response time

max-response-time numof query packets for a VLAN.

ip igmp snooping querier timer expiry num

Configures the aging timer for queriers
globally.

ip igmp snooping vlan num querier timer

Configures the aging timer for a querier

expiry numof a VLAN.

2.4.1 Configuring Basic IGMP Snooping Functions (IVGL Mode)
Configuration EffectEnable IGMP snooping to realize Layer-2 multicast.

Provide independent multicast services to each VLAN.

Notes


IP multicast cannot be realized in SVGL mode. If IP multicast must be used, select the IVGL mode.

Configuration Steps

Enabling Global IGMP Snooping in IVGL Mode

Mandatory.
After IGMP snooping is enabled globally, this function will be enabled for all VLANs.
If not specified, it is advised to run global IGMP snooping on all the devices connected user hosts.

2-15

Configuration GuideConfiguring IGMP Snooping

Disabling IGMP Snooping for a VLAN

(Optional) You can use this function if you wish to disable IGMP snooping on specified VLANs.
Only when global IGMP snooping is enabled can it be disabled on specified VLANs.
In IVGL mode, each VLAN can enjoy independent multicast services. Disabling any VLAN multicast services will notinterfere in the services provided to the others.

Verification


Run the show ip igmp snooping gda-table command to display the IGMP snooping forwarding table and verify
that the member ports include only those connecting member hosts.

Run the show ip igmp snooping command to display the basic IGMP snooping information and verify that IGMP
snooping is working in IVGL mode.

Related Commands

Enabling Global IGMP Snooping in IVGL Mode

Commandip igmp snooping ivgl

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

After this command is executed, IGMP snooping will be run on all VLANs.
By default, IGMP snooping is disabled.

Disabling IGMP Snooping for a VLAN

Commandno ip igmp snooping vlan num

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Only when global IGMP snooping is enabled can it be disabled on specified VLANs.
In IVGL mode, you can disable IGMP snooping on any VLAN.

Displaying the IGMP Snooping Entry

Commandshow ip igmp snooping gda-table

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage GuideThis command is used to verify that the ports include only those connecting member hosts.

Displaying the IGMP Snooping Working Mode

Commandshow ip igmp snooping

Parameter

N/A

2-16

Configuration Guide

Configuring IGMP Snooping

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If a device is running in IVGL mode, the following information is displayed:
IGMP Snooping running mode: IVGL

Configuration
Example

Providing Layer-2 Multicast Services for the Subnet Hosts

Scenario
Figure 2-5

A is the multicast router and is connected directly to the multicast source.
B is the Layer-2 device and is connected directly to the user host.
Receiver 1, Receiver 2, and Receiver 3 belong to VLAN 1.
Configuratio

Configure the IP address and VLAN.

n Steps

Enable multicast routing on A and enable the multicast routing protocol on Layer-3 interface (Gi0/1
and VLAN 1).

A

Enable IGMP snooping on B and select IVGL mode.

A# configure terminalA(config)# ip multicast-routing
A(config)# interface gigabitethernet 0/1
A(config-if-GigabitEthernet 0/1)# ip pim sparse-modeA(config-if-GigabitEthernet 0/1)# exit
A(config)# interface vlan 1A(config-if-VLAN 1)# ip pim sparse-mode

2-17

Configuration Guide

Configuring IGMP Snooping

A(config-if-VLAN 1)# exit
B

B# configure terminal
B(config)# ip igmp snooping ivgl

Verification

Send packets from the source (10.1.1.1) to G (229.1.1.1) to add Receiver 1 to G.
Confirm that the packets (10.1.1.1 and 229.1.1.1) are received by Receiver 1.

Display the IGMP snooping forwarding entry on B and ensure that the port (10.1.1.1, 229.1.1.1, 1)
includes only Gi0/17.


B

Check whether the IGMP snooping working mode is IVGL.

B# show ip igmp snooping gda-table
Multicast Switching Cache Table
D: DYNAMIC
S: STATIC
M: MROUTE(*,224.1.1.1, 1):
VLAN(1) 2 OPORTS:
GigabitEthernet 0/17(M)GigabitEthernet 0/18(D)B# show ip igmp snooping
IGMP Snooping running mode: IVGLIGMP Snooping L2-entry-limit: 65536
Source port check: Disable
Source ip check: Disable
IGMP Fast-Leave: Disable
IGMP Report suppress: Disable
IGMP Global Querier: Disable
IGMP Preview: Disable
IGMP Tunnel: Disable
IGMP Preview group aging time : 60(Seconds)
Dynamic Mroute Aging Time : 300(Seconds)
Dynamic Host Aging Time : 260(Seconds)

vlan 1------------IGMP Snooping state: Enable

2-18Configuration Guide

Configuring IGMP Snooping

Multicast router learning mode: pim-dvmrp
IGMP Fast-Leave: Disabled
IGMP VLAN querier: Disable
IGMP VLAN Mode: STATIC

Common Errors


The working mode of IGMP snooping is improper.

2.4.2 Configuring Basic IGMP Snooping Functions (SVGL Mode)
Configuration EffectEnable IGMP snooping and select SVGL mode to realize Layer-2 multicast.



Share the VLAN multicast services.

Configuration Steps

Enabling Global IGMP Snooping in SVGL Mode

Mandatory.
Enable global IGMP snooping in SVGL mode.
Configure the range of associated SVGL profiles.

Specifying the SVGL Shared VLAN

(Optional) By default, VLAN 1 is used as the shared VLAN. You can adjust this configuration for other options.

Specifying the SVGL Sub VLAN

(Optional) By default, all the VLANs are used as the sub VLANs of SVGL and can share the multicast services of theshared VLAN. You can adjust this configuration for other options.

Verification


Run the show ip igmp snooping command to display the basic IGMP snooping information and verify that IGMP
snooping is working in SVGL mode.

Run the show ip igmp snooping gda-table command to check whether inter-VLAN multicast entries are properly
formed.

Related Commands

Enabling Global IGMP Snooping in SVGL Mode

Commandip igmp snooping svgl

Parameter

N/A

Description
Command

Global configuration mode

Mode

2-19

Configuration Guide
Usage Guide

Configuring IGMP Snooping

By default, IGMP snooping is disabled.
After the SVGL mode is selected, the range of profiles within SVGL multicast addresses needs to be
associated.

Configuring the SVGL profile

Commandip igmp snooping svgl profile profile_num

Parameter

profile_num: Configures SVGL to associate a profile.

Description
Command

Global configuration mode

Mode
Usage Guide

By default, no profile is associated with SVGL.

Specifying the SVGL Shared VLAN

Commandip igmp snooping svgl vlan vid

Parameter

vid: Indicates a VLAN.

Description
Command

Interface configuration mode

Mode
Usage Guide

By default, VLAN 1 is used as the shared VLAN.

Specifying the SVGL Sub VLAN

Commandip igmp snooping svgl subvlan vid-range

Parameter

vid-range: Indicates VLAN ID or the range of VLAN IDs.

Description
Command

Interface configuration mode

Mode
Usage Guide

By default, all the VLANs except the shared VLAN are used as sub VLANs.

Displaying the IGMP Snooping Working Mode

Commandshow ip igmp snooping

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If a device is running in SVGL mode, the following information is displayed:
IGMP Snooping running mode: SVGL

Configuration
Example

Enabling SVGL on the Access Device

2-20Configuration Guide

Configuring IGMP Snooping

Scenario
Figure 2-6

A is the multicast router and is connected directly to the multicast source.
B is the Layer-2 device and is connected directly to the user host.
Receiver 1 is connected to VLAN 2, Receiver 2 is connected to VLAN 3, and Receiver 3 is connected to
VLAN 4.
Configuratio

Configure the IP address and VLAN. (Omitted)

n Steps

Enable multicast routing on A and enable the multicast routing protocol on Layer-3 interface (Gi0/1
and VLAN 1).

A

Enable IGMP snooping on B and select SVGL mode.

Configure the range of associated SVGL multicast addresses on B.

A# configure terminalA(config)# ip multicast-routing
A(config)# interface gigabitethernet 0/1
A(config-if-GigabitEthernet 0/1)# ip pim sparse-modeA(config-if-GigabitEthernet 0/1)# exit
A(config)# interface vlan 1A(config-if-VLAN 1)# ip pim sparse-modeA(config-if-VLAN 1)# exit

B

B# configure terminal
B(config)# ip igmp profile 1
B(config-profile)# permit
B(config-profile)# range 224.1.1.1 238.1.1.1
B(config-profile)# exit
B(config)# ip igmp snooping svgl
B(config)# ip igmp snooping svgl profile 1

Verification

Send packets from the source (10.1.1.1) to G (229.1.1.1) and add Receiver 1, Receiver 2 and Receiver

2-21

Configuration Guide

Configuring IGMP Snooping

3 to G.


Confirm that the packets (10.1.1.1 and 224.1.1.1) are received by Receiver 1, Receiver 2, andReceiver 3.

Display the IGMP snooping forwarding entry on B and ensure that the ports (*, 224.1.1.1, 1) include
Gi0/17, Gi0/18, and Te0/19.


B

Check whether the IGMP snooping working mode is SVGL.

B# show ip igmp snooping gda-table
Multicast Switching Cache Table
D: DYNAMIC
S: STATIC
M: MROUTE(*,224.1.1.1, 1):
VLAN(2) 1 OPORTS:
GigabitEthernet 0/17(D)VLAN(3) 1 OPORTS:
GigabitEthernet 0/18(D)VLAN(4) 1 OPORTS:
TenGigabitEthernet 0/19(D)B# show ip igmp snooping
IGMP Snooping running mode: SVGL
IGMP Snooping L2-entry-limit: 65536
SVGL vlan: 1
SVGL profile number: 1
Source port check: Disable
Source ip check: Disable
IGMP Fast-Leave: Disable
IGMP Report suppress: Disable
IGMP Globle Querier: Disable
IGMP Preview: Disable
IGMP Tunnel: Disable
IGMP Preview group aging time : 60(Seconds)
Dynamic Mroute Aging Time : 300(Seconds)
Dynamic Host Aging Time : 260(Seconds)

Common Errors

2-22

Configuration Guide

Configuring IGMP SnoopingThe SVGL profile is not configured.



The sent multicast traffic is not within the SVGL profile.

2.4.3 Configuring Basic IGMP Snooping Functions (IVGL-SVGL Mode)
Configuration EffectEnable IGMP snooping and select IVGL-SVGL mode to realize Layer-2 multicast.

The SVGL profiles can share the multicast services.



The non-SVGL profiles run in IVGL mode.

Configuration Steps

Enabling Global IGMP Snooping in IVGL-SVGL Mode

Mandatory.
Enable global IGMP snooping in IVGL-SVGL mode.
Configure the range of associated SVGL profiles.

Specifying the SVGL Shared VLAN

(Optional) By default, VLAN 1 is used as the shared VLAN. You can adjust this configuration for other options.

Specifying the SVGL Sub VLAN

(Optional) By default, all the VLANs are used as the sub VLANs of SVGL and can share the multicast services of theshared VLAN. You can adjust this configuration for other options.

Verification


Run the show ip igmp snooping command to display the basic IGMP snooping information and verify that IGMP
snooping is working in IVGL-SVGL mode.

Run the show ip igmp snooping gda-table command to check whether inter-VLAN multicast entries are properly
formed for the SVGL profiles.

Run the show ip igmp snooping gda-table command to check whether intra-VLAN multicast entries are properly
formed for the SVGL profiles.

Related Commands

Enabling Global IGMP Snooping in IVGL-SVGL Mode

Commandip igmp snooping ivgl-svgl

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

By default, IGMP snooping is disabled.
After the IVGL-SVGL mode is selected, the SVGL profiles needs to be associated.

2-23

Configuration GuideConfiguring IGMP Snooping

Configuring the SVGL Profile

Commandip igmp snooping svgl profile profile_num

Parameter

profile_num: Configures SVGL to associate a profile.

Description
Command

Global configuration mode

Mode
Usage Guide

By default, no profile is associated with SVGL.

Specifying the SVGL Shared VLAN

Commandip igmp snooping svgl vlan vid

Parameter

vid: Indicates a VLAN.

Description
Command

Interface configuration mode

Mode
Usage Guide

By default, VLAN 1 is used as the shared VLAN.

Specifying the SVGL Sub VLAN

Commandip igmp snooping svgl subvlan vid-range

Parameter

vid-range: Indicates VLAN ID or the range of VLAN IDs.

Description
Command

Interface configuration mode

Mode
Usage Guide

By default, all the VLANs except the shared VLAN are used as sub VLANs.

Displaying the IGMP Snooping Working Mode

Commandshow ip igmp snooping

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If a device is running in SVGL mode, the following information is displayed:
IGMP Snooping running mode: SVGL

Displaying the IGMP Snooping Working Mode

2-24

Configuration Guide

Configuring IGMP Snooping

Commandshow ip igmp snooping

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If a device is running in IVGL-SVGL mode, the following information is displayed:
IGMP Snooping running mode: IVGL-SVGL

Configuration
Example

Enabling IVGL-SVGL on the Access Device

Scenario
Figure 2-7

A is the multicast router and is connected directly to multicast Source 1.
B is a Layer-2 device and is connected directly to the user host and multicast Source 2.
Receiver 1 is connected to VLAN 2, Receiver 2 is connected to VLAN 3, and Receiver 3 is connected to
VLAN 4.
Configuratio

Configure the IP address and VLAN.

n Steps

Enable multicast routing on A and enable the multicast routing protocol on Layer-3 interface (Gi0/1
and VLAN 1).

A

Enable IGMP snooping on B and select IVGL-SVGL mode.

Configure the range of associated SVGL multicast addresses on B.

A# configure terminal

2-25

Configuration Guide

Configuring IGMP Snooping

A(config)# ip multicast-routing
A(config)# interface gigabitethernet 0/1
A(config-if-GigabitEthernet 0/1)# ip pim sparse-modeA(config-if-GigabitEthernet 0/1)# exit
A(config)# interface vlan 1A(config-if-VLAN 1)# ip pim sparse-modeA(config-if-VLAN 1)# exit
B

B# configure terminal
B(config)# ip igmp profile 1
B(config-profile)# permit
B(config-profile)# range 224.1.1.1 238.1.1.1
B(config-profile)# exit
B(config)# ip igmp snooping ivgl-svgl
B(config)# ip igmp snooping svgl profile 1

Verification

Send packets from Source 1 (10.1.1.1) to G (224.1.1.1) and add Receiver 1, Receiver 2 and Receiver 3
to G.
Send packets from Source 2 (192.168.2.1) to the destination (239.1.1.1) and add Receiver 1 239.1.1.1.
Confirm that the packets (10.1.1.1 and 224.1.1.1) are received by Receiver 1, Receiver 2, andReceiver 3.

Check that packets (192.168.2.1 and 239.1.1.1) can be received by Receiver 1.

Display the IGMP snooping forwarding entry on B and ensure that the ports (*, 224.1.1.1, 1) include
Gi0/17, Gi0/18 and Te0/19, and the port (*, 239.1.1.1, 1) is Gi0/18.


B

Check whether the IGMP snooping working mode is IVGL-SVGL.

B# show ip igmp snooping gda-table
Multicast Switching Cache Table
D: DYNAMIC
S: STATIC
M: MROUTE(*,224.1.1.1, 1):
VLAN(2) 1 OPORTS:
GigabitEthernet 0/17(D)VLAN(3) 1 OPORTS:
GigabitEthernet 0/18(D)VLAN(4) 1 OPORTS:
TenGigabitEthernet 0/19(D)(*,239.1.1.1, 2):

2-26

Configuration Guide

Configuring IGMP Snooping

VLAN(2) 1 OPORTS:
GigabitEthernet 0/18(D)B# show ip igmp snooping
IGMP Snooping running mode: IVGL-SVGL
IGMP Snooping L2-entry-limit: 65536
SVGL vlan: 1
SVGL profile number: 0
Source port check: Disable
Source ip check: Disable
IGMP Fast-Leave: Disable
IGMP Report suppress: Disable
IGMP Globle Querier: Disable
IGMP Preview: Disable
IGMP Tunnel: Disable
IGMP Preview group aging time : 60(Seconds)
Dynamic Mroute Aging Time : 300(Seconds)
Dynamic Host Aging Time : 260(Seconds)

Common Errors


The SVGL profile is not configured.



The sent multicast traffic is not within the SVGL profile.



The IVGL multicast traffic cannot be forwarded within the SVGL profile.

2.4.4 Configuring the Packet Processing
Configuration EffectConfigure specified ports as the static router ports to receive the multicast traffic from all profiles.

Configure specified ports as the static member ports to receive the multicast traffic from specified profiles

Enable Report packets suppression to forward only the first Report packet from a specified VLAN or profile to therouter port within a query interval, and the following Report packets will not be forwarded to the router port, thereby
reducing the quantity of packets on the network.

2-27

Configuration GuideConfiguring IGMP Snooping

Configure the immediate-leave function to delete a port from the entry of member ports when a leave packet isreceived by the port.



Disable dynamic router port learning to disable the learning of any router port.



Based on network load and configuration of a multicast device, you can adjust the aging time of a router port andmember port as well as the maximum response time of a query packet.

Disable L2 multicast on a specific L 2 interface. After the Layer 2 multicast function is disabled, the interface
cannot process IGMP packets, which means that it cannot generate the corresponding Layer 2 multicast entry to
guide the multicast flow forwarding at Layer 2, and cannot be configured as a static member interface.

Notes


Only when basic IGMP snooping is configured can relevant configurations take effect.

Configuration Steps

Configuring a Static Router Port

Optional.

You can perform this configuration if you want to specify a static port to receive all the multicast traffic within the
VLAN.



Configuring a Static Member Port

Optional.

You can perform this configuration if you want to specify a static port to receive specific multicast traffic within the
VLAN.



Enabling Report Packet Suppression

Optional.

When there are numerous receivers to receive the packets from the same multicast profile, you can enable Reportpackets suppression to suppress the number of Report packets to be sent.

Enabling the Immediate-Leave Function



Optional.

When there is only one receiver on a port, you can enable Leave to speed up the convergence of protocol uponleave.

Disabling Dynamic Router Port Learning

Optional.

This function is used when multicast traffic needs to be forwarded only within the Layer-2 topology but not to a
Layer-3 router.

Configuring the Aging Time of a Dynamic Router Port

Optional.

You can configure the aging time based on network load.

2-28

Configuration Guide

Configuring IGMP SnoopingConfiguring the Aging Time of a Dynamic Member Port

Optional.

You can configure the aging time based on the interval for sending IGMP query packets by the connected
multicast router. Typically, the aging time is calculated as follows: Interval for sending IGMP query packets x 2 +Maximum response time of IGMP packets

Configuring the Maximum Response Time of a Query Packet

Optional.

You can configure the aging time based on network load.

Disabling L2 Multicast on L2 Interfaces

Optional.

Run this command to disable Layer 2 multicast on an interface.

Verification


Run the show ip igmp snooping mrouter command to check whether the configured static router port has an "S"in the displayed configuration information.

Run the show ip igmp snooping gda command to check whether the configured static member port is marked with
an S.



Run the show ip igmp snooping command to check whether Report packets suppression, immediate leave,
router port learning, router port aging time, member port aging time, and the maximum response time of the Query
packet take effect.

Related Commands

Configuring a Static Router Port

Commandip igmp snooping vlan vid mrouter interface interface-type interface-number

Parameter

vid: Indicates a VLAN. The value ranges from 1 to 4,094.

Description

interface-type interface-number: Indicates an interface name.

Command

Global configuration mode

Mode
Usage Guide

In SVGL mode, if a sub VLAN is not configured, only the configurations for the static router port within
the shared VLAN can take effect, and the others can be configured but cannot take effect. If a sub VLAN
is configured, only the configurations for the static router port within the shared VLAN or a non-sub VLAN
can take effect, and the others can be configured but cannot take effect.
In IVGL-SVGL mode, if a sub VLAN is not configured, the configurations for the static router ports within
all the VLANs can take effect; if a sub VLAN is configured, only the configurations for the static router
port within the shared VLAN or a non-sub VLAN can take effect, and the others can be configured but
cannot take effect.
In IVGL mode, the configurations for the static router ports within all the VLANs can take effect.

Configuring a Static Member Port

2-29

Configuration Guide

Configuring IGMP Snooping

Commandip igmp snooping vlan vid static ip-address interface interface-type interface-number

Parameter

vid: Indicates a VLAN. The value ranges from 1 to 4,094.

Description

ip-address: Indicates a profile address.
interface-type interface-number: Indicates an interface name.

Command

Global configuration mode

Mode
Usage Guide

By default, no static member port is configured.

Enabling Report Packet Suppression

Commandip igmp snooping suppression enable

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

When Report packets suppression is enabled, only the first Report packet from VLAN or profile isforwarded to the router port within a Query interval, and the following Report packets will not be
forwarded to the router port, thereby reducing the quantity of packets on the network.
Only the IGMPv1 and IGMPv2 Report packets can be suppressed, and the IGMPv3 Report packets
cannot be suppressed.

Enabling Report Packet Suppression on SVGL

Commandip igmp snooping suppression svgl vlan enable

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

When Report packets suppression svgl vlan is enabled, only the first Report packet from shared VLAN
or profile is forwarded to the router port within a Query interval, and the following Report packets will not
be forwarded to the router port, thereby reducing the quantity of packets on the network.
Only the IGMPv1 and IGMPv2 Report packets can be suppressed, and the IGMPv3 Report packets
cannot be suppressed.



Configures Source IP in IGMP Report packet

Commandip igmp snooping suppression vlan vid sip address

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

When Report packets suppression is enabled, the device can customize the source IP address of areport packet globally or based on a VLAN.
Only the IGMPv1 and IGMPv2 Report packets can be suppressed, and the IGMPv3 Report packets
cannot be suppressed.

Enabling the Immediate-Leave Function

2-30

Configuration Guide
Commandip igmp snooping fast-leave enable

Parameter

N/A

Configuring IGMP Snooping

Description
Command

Global configuration mode

Mode
Usage Guide

When this function is enabled, a port will be deleted from the entry of the member port when the port
receives a leave packet. After that, the packets will no longer be forwarded to this port when it receives
the query packets of specified profiles. Leave packets include the IGMPv2 Leave packets as well as the
IGMPv3 Report packets that include types but carry no source address.
The immediate-leave function applies only to the scenario where only one host is connected to a device
port. It is used to conserve bandwidth and resources.



Enabling the Immediate-Leave Function on port

Commandip igmp snooping port-fast-leave enable

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

When this function is enabled, a port will be deleted from the entry of the member port when the port
receives a leave packet. After that, the packets will no longer be forwarded to this port when it receives
the query packets of specified profiles. Leave packets include the IGMPv2 Leave packets as well as the
IGMPv3 Report packets that include types but carry no source address.
The immediate-leave function applies only to the scenario where only one host is connected to a device
port. It is used to conserve bandwidth and resources.



Enabling Dynamic Router Port Learning

Commandip igmp snooping [ vlan vid ] mrouter learn pim-dvmrp

Parametervlan vid: Specifies a VLAN. This configuration applies to all VLANs by default.

Description
Command

Global configuration mode

Mode
Usage Guide

A router port is the port that is connected directly to a multicast device running IGMP snooping and amulticast neighbor device running multicast routing protocol. By default, dynamic router port learning isenabled and the device automatically listens to IGMP Query packets, DVMRP packets, and PIM Hellopackets.

Configuring the Aging Time of a Dynamic Router Port

Commandip igmp snooping dyn-mr-aging-time seconds

Parameterseconds: Indicates the aging time of a dynamic router port in the unit of seconds. The value ranges from

Description

1 to 3,600.

Command

Global configuration mode

Mode
Usage Guide

If a dynamic router port does not receive an IGMP general query packet or a PIM Hello packet before theaging timer expires, the device will delete this port from the router port entry.

2-31Configuration Guide

Configuring IGMP Snooping

When dynamic router port learning is enabled, you can run this command to adjust the aging time of the
dynamic router port. If the aging time is too short, the multicast device may frequently add or delete arouter port.



Configuring the Aging Time of a Dynamic Member Port

Commandip igmp snooping host-aging-time seconds

Parameterseconds: Indicates the aging time.

Description
Command

Global configuration mode

Mode
Usage Guide

The aging time of a dynamic member port indicates the time when a device port receives the IGMP join
packet sent from host for subscribing to an IP multicast profile.
When the IGMP join packet is received, the aging time of the dynamic member port will be reset. The
value of the timer time is host-aging-time. If the timer expires, the multicast device deems that no userhost for receiving the multicast packet exists under the port, and will delete the port from the entry of
IGMP snooping member port. After the aging time is configured, the aging time of following received
IGMP join packets will be host-aging-time. This configuration takes effect after the next IGMP join packet
is received, and the timer of the port in use will not be refreshed.

Configuring the Maximum Response Time of a Query Packet

Commandip igmp snooping query-max-response-time seconds

Parameterseconds: Indicates the maximum response time.

Description
Command

Global configuration mode

Mode
Usage Guide

When an IGMP general Query packet is received, the multicast device will reset the aging time of all the
dynamic member ports, which is query-max-response-time. If the timer expires, the multicast device
deems that no user host for receiving the multicast packet exists under the port, and will delete the port
from the entry of IGMP snooping member port.
When an IGMP profile-specific Query packet is received, the multicast device will reset the aging time of
all the dynamic member ports of the specific profile, which is query-max-response-time. If the timer
expires, the multicast device deems that no user host for receiving the multicast packet exists under theport, and will delete the port from the entry of IGMP snooping member port.
This configuration takes effect after the next Query packet is received, and the timer in use will not berefreshed. The timer of an IGMPv3 profile-specific Query packet is not refreshed.

Disable Layer-2 Multicast on Layer-2 Interface

Commandip igmp snooping disable

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

When this command is run on a layer-2 interface, it will not process the IGMP packet, namely, it cannot
generate layer-2 multicast entry to forward the multicast traffic on layer-2 and this port cannot be

2-32

Configuration Guide

Configuring IGMP Snooping

configured as a static member port.



Displaying Router Ports

Commandshow ip igmp snooping mrouter

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If the router port is successfully configured, an "S" will be displayed in the port information.
Ruijie(config)# show ip igmp snooping mrouter
Multicast Switching Mroute Port
D: DYNAMIC
S: STATIC(*, *, 1):
VLAN(1) 1 MROUTES:
GigabitEthernet 0/17(S)

Displaying the Information of Dynamic Router Port Learning

Commandshow ip igmp snooping

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

Run the show ip igmp snooping command to display the aging time and learning status of the dynamic
router port.
Dynamic Mroute Aging Time : 300(Seconds)
Multicast router learning mode: pim-dvmrp

Displaying the Information of a Member Port

Commandshow ip igmp snooping gda-table

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If the member port is successfully configured, an "S" will be displayed in the port information.
Ruijie(config)# show ip igmp snooping gda-table
Multicast Switching Cache Table
D: DYNAMIC
S: STATIC

2-33

Configuration Guide

Configuring IGMP Snooping

M: MROUTE(*, 224.1.1.1, 1):
VLAN(1) 1 OPORTS:
GigabitEthernet 0/17(S)

Displaying Other Parameters

Commandshow ip igmp snooping

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

Run the show ip igmp snooping command to display the aging time of the router port, aging time of the
dynamic member port, response time of the query packet, and Report packets suppression, andimmediate leave.
IGMP Fast-Leave: Enable
IGMP Report suppress: Enable
Query Max Response Time: 20(Seconds)
Dynamic Mroute Aging Time : 300(Seconds)
Dynamic Host Aging Time : 260(Seconds)

Configuration
Example

Configuring a Static Router Port and Static Member Port

Configuratio

Configure basic IGMP snooping functions.

n StepsConfigure a static router port and static member port.

Ruijie# configure terminal
Ruijie(config)# ip igmp snooping vlan 1 mrouter interface gigabitethernet 0/17
Ruijie(config)# ip igmp snooping vlan 1 static 224.1.1.1 interface gigabitethernet 0/17
Ruijie(config)# end
Verification

Run the show ip igmp snooping mrouter and show ip igmp snooping gda-table commands to check
whether the configuration takes effect.
Ruijie# show ip igmp snooping mrouter
Multicast Switching Mroute Port
D: DYNAMIC
S: STATIC(*, *, 1):
VLAN(1) 1 MROUTES:

2-34

Configuration Guide

Configuring IGMP Snooping

Configuratio

Configure basic IGMP snooping functions.

n StepsConfigure a static router port and static member port.

Ruijie# configure terminal
Ruijie(config)# ip igmp snooping vlan 1 mrouter interface gigabitethernet 0/17
Ruijie(config)# ip igmp snooping vlan 1 static 224.1.1.1 interface gigabitethernet 0/17
Ruijie(config)# end
Verification

Run the show ip igmp snooping mrouter and show ip igmp snooping gda-table commands to check
whether the configuration takes effect.
GigabitEthernet 0/17(S)Ruijie#show ip igmp snooping gda-table
Multicast Switching Cache Table
D: DYNAMIC
S: STATIC
M: MROUTE(*, 224.1.1.1, 1):
VLAN(1) 1 OPORTS:
GigabitEthernet 0/17(SM)Enabling Report Packet Suppression

Scenario
Figure 2-8

A is the multicast router and is connected directly to multicast Source 1.
B is a Layer-2 device and is connected directly to the user host and multicast Source 2.
Receiver 1, Receiver 2, and Receiver 3 are connected to VLAN 1.
Configuratio

Configure the IP address and VLAN. (Omitted)

n Steps

Enable multicast routing on A and enable the multicast routing protocol on Layer-3 interface (Gi0/1

2-35

Configuration Guide

Configuring IGMP Snooping
and VLAN 1).

A

Enable IGMP snooping on B and select IVGL mode.

Enable Report packets suppression on B.

A# configure terminalA(config)# ip multicast-routing
A(config)# interface gigabitethernet 0/1
A(config-if-GigabitEthernet 0/1)# ip pim sparse-modeA(config-if-GigabitEthernet 0/1)# exit
A(config)# interface vlan 1A(config-if-VLAN 1)# ip pim sparse-modeA(config-if-VLAN 1)# exit

B

B# configure terminal
B(config)#ip igmp snooping ivgl
B(config)# ip igmp snooping suppression enable

Verification

Check whether Receiver 1 and Receiver 2 are added to profile 239.1.1.1, and only the IGMP Reportpackets of profile 239.1.1.1 are forwarded from interface Gi0/1 of B.

B

B# show ip igmp snooping
IGMP Snooping running mode: IVGLIGMP Snooping L2-entry-limit: 65536
Source port check: Disable
Source ip check: Disable
IGMP Fast-Leave: Disable
IGMP Report suppress: Enable
IGMP Globle Querier: Disable
IGMP Preview: Disable
IGMP Tunnel: Disable
IGMP Snooping version: 2IGMP Preview group aging time : 60(Seconds)
Dynamic Mroute Aging Time : 300(Seconds)
Dynamic Host Aging Time : 260(Seconds)

Configuring Other Parameters

Configuratio

Configure basic IGMP snooping functions.

n Steps

Enable Immediate-leave function.

Disable router port learning.

Configure the aging time of a router port.



Configuring the aging time of a member port.

2-36

Configuration GuideConfiguring IGMP Snooping
Configure the response time of a Query packet.

Ruijie# configure terminal
Ruijie(config)# ip igmp snooping fast-leave enable
Ruijie(config)# no ip igmp snooping mrouter learn pim-dvmrp
Ruijie(config)#ip igmp snooping dyn-mr-aging-time 200
Ruijie(config)#ip igmp snooping host-aging-time 100
Ruijie(config)#ip igmp snooping query-max-response-time 60
Ruijie(config)# end
Verification

Run the show ip igmp snooping command to check whether the configuration is successful.
Ruijie#show ip igmp snooping
IGMP Snooping running mode: IVGLIGMP Snooping L2-entry-limit: 65536
Source port check: Disable
Source ip check: Disable
IGMP Fast-Leave: Enable
IGMP Report suppress: Enable
IGMP Globle Querier: Disable
IGMP Preview: Disable
IGMP Tunnel: Disable
IGMP Snooping version: 2Query Max Response Time: 60(Seconds)
IGMP Preview group aging time : 60(Seconds)
Dynamic Mroute Aging Time : 200(Seconds)
Dynamic Host Aging Time : 100(Seconds)

Common ErrorsBasic IGMP snooping functions are not configured or the configuration is not successful.

2.4.5 Configuring IGMP Security Control
Configuration EffectConfigure the range of multicast addresses that a user can access.

Configure to allow a user from an unauthorized profile to preview a multicast channel.

Configure the number of multicast addresses that a user can access.

Configure to limit a user to receive only the multicast traffic from a router port to prevent illegal multicast traffic sentby the end user.

2-37

Configuration GuideConfiguring IGMP Snooping

Configure to limit a user to receive only the multicast traffic from designated source IP addresses to prevent illegal
multicast traffic.

Notes


Basic IGMP snooping functions must be configured.

Configuration Steps

Configuring the Profile FilteringOptional.



If you want to limit the profile packets to be received by a port, you can configure the profile filtering on the port.



If you want to limit the multicast packets to be received by a VLAN, you can configure the per-VLAN profile
filtering.

Enabling Multicast Preview



Optional.

You can enable multicast preview for a user from an unauthorized profile.

Configuring the Maximum Number of Profiles



Optional.



If you want to limit the number of multicast profiles that a port is allowed to receive, you can configure themaximum number of multicast profiles allowed for this port.



If you want to limit the number of multicast profiles that global ports are allowed to receive, you can configure themaximum number of multicast profiles allowed for these ports.

Verification


Run the show ip igmp snooping interfaces command to display the profile filtering and the maximum number ofmulticast profiles for a port.

Run the show ip igmp snooping vlan command to display the per-VLAN profile filtering.

Run the show ip igmp snooping command to check whether the maximum number of global multicast profiles,
preview function, source port inspection, and source IP address inspection take effect.

Related Commands

Configuring the Profile Filtering

Commandip igmp snooping filter profile-number

Parameter

profile-number: Indicates a profile number.

Description
Command

Interface configuration mode

Mode
Usage Guide

N/A

Configuring the Per-VLAN Profile Filtering

2-38

Configuration Guide

Configuring IGMP Snooping

Commandip igmp snooping vlan vid filter profile-number

Parameter

vid: Indicates a VLAN. The value ranges from 1 to 4,094.

Description

profile-number: Indicates a profile number.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring the Maximum Number of Profiles on a Port

Commandip igmp snooping max-groups number

Parameter

number: Indicates the maximum number of multicast profiles.

Description
Command

Interface configuration mode

Mode
Usage Guide

This value indicates only the number of dynamic multicast profiles, and the number of static profiles is
not included. The counter of multicast profiles is based on the VLAN that the port belongs to. For
example, if a port belongs to three VLANs, and all three of them receive a request packet from multicast
profile 224.1.1.1 simultaneously, then the counter of multicast profiles will be 3 but not 1.

Configuring the Maximum Number of Global Profiles

Commandip igmp snooping l2-entry-limit number

Parameter

number: Indicates the maximum number of multicast profiles.

Description
Command

Global configuration mode

Mode
Usage GuideThis value includes the number of both dynamic profiles as well as static profiles.

Enabling Preview

Commandip igmp snooping preview profile-number

Parameter

profile number: Indicates the range of multicast addresses allowed for preview. The value ranges from 1

Description

to 1,024.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring the Preview Duration

Commandip igmp snooping preview interval num

Parameternum: Specifies the preview duration which ranges from 1s to 300s (60s by default).

Description
Command

Global configuration mode

Mode
Usage Guide

This configuration allows unauthorized users to receive multicast traffic within the preview duration. Afterthe duration is met, the preview will be stopped; the preview can be resumed in 300s.

Displaying the Per-Port Profile Filtering

2-39Configuration Guide

Configuring IGMP Snooping

Commandshow ip igmp snooping interface

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If the function is configured, the profile will be displayed, for example:
Ruijie#show ip igmp snooping interfaces gigabitEthernet 0/17

Interface

Filter profile number

max-group-------------------------------------------------------

GigabitEthernet 0/17

1

Displaying the Per-VLAN Profile Filtering

Commandshow ip igmp snooping vlan

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If the function is configured, the profile will be displayed, for example:
IGMP VLAN filter: 1

Displaying the Maximum Number of Interface Profiles

Commandshow ip igmp snooping interface

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If the maximum number of multicast addresses for a port is configures, the value will be displayed, forexample:Ruijie#show ip igmp snooping interfaces gigabitEthernet 0/17

Interface

Filter profile number

max-group-------------------------------------------------------

GigabitEthernet 0/17

1200

Displaying the Maximum Number of Global Profiles

Commandshow ip igmp snooping vlan

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If the function is configured, the profile will be displayed, for example:

2-40

Configuration Guide

Configuring IGMP Snooping

IGMP Snooping L2-entry-limit: 65536



Displaying the Information of the Preview Function

Commandshow ip igmp snooping

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If the range of multicast addresses for a port is configured, preview will be enabled, for example:
IGMP Preview: Enable
IGMP Preview group aging time : 60(Seconds)

Configuration
Example

Configuring the Profile Filtering and the Maximum Number of Demanded Profiles

Scenario
Figure 2-9

A is the multicast router and is connected directly to multicast Source 1.
B is a Layer-2 device and is connected directly to the user host and multicast Source 2.
Receiver 1, Receiver 2, and Receiver 3 are connected to VLAN 1.
By configuring VLAN 1, you can configure to allow the users within VLAN 1 to receive only the profiles
whose addresses range from 225.1.1.1 to 225.1.255.255.
You can configure Receiver 1 to receive only the profiles whose addresses range from 225.1.1.1 to225.1.1.255, Receiver 2 to receive only the profiles whose addresses range from 225.1.2.1 to255.1.2.255, and Receiver 3 to receive only the profiles whose addresses range from 225.1.3.1 to225.1.3.255.
At most 10 profiles can be added to a port and at most 100 profiles can be added globally.
Configuratio

Configure the IP address and VLAN. (Omitted)

n Steps

Enable multicast routing on A and enable the multicast routing protocol on Layer-3 interface (Gi0/1

2-41

Configuration Guide

Configuring IGMP Snooping
and VLAN 1).

A

Enable IGMP snooping on B and select IVGL mode.

Configure the range and maximum number of multicast addresses on B.

A# configure terminalA(config)# ip multicast-routing
A(config)# interface gigabitethernet 0/1
A(config-if-GigabitEthernet 0/1)# ip pim sparse-modeA(config-if-GigabitEthernet 0/1)# exit
A(config)# interface vlan 1A(config-if-VLAN 1)# ip pim sparse-modeA(config-if-VLAN 1)# exit

B

B# configure terminal
B(config)# ip igmp snooping ivgl
B(config)# ip igmp profile 1
B(config-profile)# permit
B(config-profile)# rang
B(config-profile)# range 225.1.1.1 225.1.255.255
B(config-profile)# exit
B(config)# ip igmp profile 2
B(config-profile)# permit
B(config-profile)# range 225.1.1.1 225.1.1.255
B(config-profile)# exit
B(config)# ip igmp profile 3
B(config-profile)# permit
B(config-profile)# range 225.1.2.1 225.1.2.255
B(config-profile)# exit
B(config)# ip igmp profile 4B(config-profile)# permit
B(config-profile)# range
B(config-profile)# range 225.1.3.1 225.1.3.255
B(config-profile)# exit
B(config)# ip igmp snooping l2-entry-limit 100
B(config)# ip igmp snooping vlan 1 filter 1
B(config)# interface gigabitethernet 0/17

2-42

Configuration Guide

Configuring IGMP Snooping

B (config-if-GigabitEthernet 0/17)# ip igmp snooping filter 2
B (config-if-GigabitEthernet 0/17)# ip igmp snooping max-groups 10
B(config)# interface gigabitethernet 0/18
B (config-if-GigabitEthernet 0/18)# ip igmp snooping filter 3
B (config-if-GigabitEthernet 0/18)# ip igmp snooping max-groups 10
B(config)# interface TenGigabitEthernet 0/19
B (config-if-TenGigabitEthernet 0/19)# ip igmp snooping filter 4
B (config-if-TenGigabitEthernet 0/19)# ip igmp snooping max-groups 10
Verification



Run the show ip igmp snooping interfaces command to display the profile filtering and the
maximum number of multicast profiles for a port.

Run the show ip igmp snooping command to display the maximum number of global multicast
groups.

B

B# show ip igmp snooping interfaces
Interface

Filter profile number

max-group-------------------------------------------------------

GigabitEthernet 0/17

2

10

GigabitEthernet 0/18

310

TenGigabitEthernet 0/19

4

10

B#show ip igmp snooping
IGMP Snooping running mode: IVGLIGMP Snooping L2-entry-limit: 100
Source port check: Disable
Source ip check: Disable
IGMP Fast-Leave: Disable
IGMP Report suppress: Disable
IGMP Globle Querier: Disable
IGMP Preview: Disable
IGMP Tunnel: Disable
IGMP Preview group aging time : 60(Seconds)
Dynamic Mroute Aging Time : 300(Seconds)
Dynamic Host Aging Time : 260(Seconds)

Common ErrorsBasic IGMP snooping functions are not configured or the configuration is not successful.

2-43Configuration GuideConfiguring IGMP Snooping

The multicast router port is not learned, leading to failure to receive the multicast traffic.

2.4.6 Configuring an IGMP Profile
Configuration EffectCreate an IGMP filtering profile.

Configuration Steps

Creating a Profile

(Optional) Create an IGMP filtering profile.

Configuring the Profile Range(Optional) Configure the range of multicast profile addresses.



Configuring the Profile Filtering(Optional) Configure the filtering mode of profile to permit or deny.

Verification


Run the show running-config command to check whether the preceding configurations take effect.

Related Commands



Creating a Profile

Commandip igmp profile profile-number

Parameter

profile-number: Indicates the number of a profile.

Description
Command

Global configuration mode

Mode
Usage GuideConfiguring the Profile Range

Commandrange low-ip-address [ high-ip-address ]Parameter

low-ip-address: Specifies the start address.

Description

low-ip-address: Specifies the end address. Only one address is configured by default.

Command

Profile configuration mode

Mode
Usage Guide

You can configure multiple addresses. If the IP addresses of different ranges are consecutive, theaddresses will be combined.

Configuring the Profile Filtering

Commanddeny

Parameter

N/A

Description
Command

Profile configuration mode

2-44

Configuration Guide

Configuring IGMP Snooping

Mode
Usage Guide

If the filtering mode of profile is set to deny while the range of multicast profiles is not specified, no profile
is to be denied, which means to permit all profiles.

Configuring the Profile Filtering

CommandpermitParameter

N/A

Description
Command

Profile configuration mode

Mode
Usage Guide

If the filtering mode of profile is set to permit while the range of multicast profiles is not specified, no
profile is to be permitted, which means to deny all profiles.

Configuration
Example

Creating a Filtering Profile

Configuratio

Create a filtering profile.

n StepsB(config)# ip igmp profile 1
B(config-profile)# permit
B(config-profile)# range
B(config-profile)# range 224.1.1.1 235.1.1.1
Verification

Run the show running-config command to check whether the configuration is successful.
ip igmp profile 1
permitrange 224.1.1.1 235.1.1.1!

Common ErrorsBasic IGMP snooping functions are not configured or the configuration is not successful.

The mode of profile is set to permit while the range of multicast profiles is not specified, leading to the denial of all
profiles.

2.4.7 Configuring IGMP QinQ
Configuration EffectCreate a multicast entry on the VLAN where IGMP packets are located. Forward IGMP packets on the VLAN
where these packets are located, realizing transparent transmission.

Notes

2-45

Configuration GuideConfiguring IGMP Snooping

Basic IGMP snooping functions must be configured.

Configuration Steps

Configuring QinQ Transparent Transmission

If the QinQ interface needs to forward multicast packets on the VLANs where the VIDs of the packets specify,
enable QinQ to realize transparent transmission.

Verification


Run the show ip igmp snooping command to check whether the configuration takes effect.

Related Commands

Configuring QinQ Transparent Transmission

Commandip igmp snooping tunnel

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage GuideEnable QinQ to realize transparent transmission of IGMP packets.

Displaying QinQ Configuration

Commandshow ip igmp snooping

Parameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If QinQ is enabled, the following content is displayed.
IGMP Tunnel: Enable

Configuration
Example

Configuring QinQ Transparent Transmission

Configuratio

Configure basic IGMP snooping functions.

n StepsConfigure QinQ transparent transmission.

Ruijie# configure terminal
Ruijie(config)# ip igmp snooping tunnel
Ruijie(config)# end
Verification

Run the show ip igmp snooping command to check whether the configuration is successful.
IGMP Tunnel: Enable

Common Errors

2-46Configuration GuideConfiguring IGMP Snooping

Basic IGMP snooping functions are not configured or the configuration is not successful.

2.4.8 Configuring an IGMP Querier
Configuration EffectConfigure the device as an IGMP querier, which will send IGMP Query packets periodically and collect user
demanding information.

Notes


Basic IGMP snooping functions must be configured.

Configuration Steps

Enabling the Querier Function

(Optional) Enable IGMP querier function globally or for a specified VLAN.

(Optional) Disable the IGMP querier function for a specified VLAN.



Configuring the Source IP Address of a Querier(Optional) You can configure the source IP address of a Query packet sent by the querier based on VLANs.



After a querier is enabled, a source IP address must be specified for the querier; otherwise, the configuration will
not take effect.

Configuring the Maximum Response Time of a Query Packet

(Optional) Adjust the maximum response time carried by an IGMP Query packet. As IGMPv1 does not support thecarrying of maximum response time by a Query packet, this configuration does not take effect when the querier isrunning IGMPv1.

Configuring the Query Interval of a Querier(Optional) Adjust the interval of the IGMP querier for sending query packets.

Configuring the Aging Timer of a Querier(Optional) Configure the aging timer of other IGMP queriers on the network.

Specifying the IGMP Version for a Querier(Optional) Specify the IGMP version for a querier (IGMPv2 by default).

Verification


Run the show ip igmp snooping querier detail command to check whether the configuration takes effect.

Related Commands

Enabling the IGMP Querier Function

Commandip igmp snooping [ vlan vid ] querier

Parametervlan vid: Specifies a VLAN. This configuration applies to all VLANs by default.

2-47Configuration Guide

Configuring IGMP Snooping

Description
Command

Global configuration mode

Mode
Usage Guide

IGMP querier for a specified VLAN will take effect only after global IGMP querier is enabled.
If global IGMP querier is disabled, IGMP querier for all the VLANs will be disabled.

Configuring the Source IP Address of a Querier

Commandip igmp snooping [ vlan vid ] querier address ip-address

Parametervlan vid: Specifies a VLAN. This configuration applies to all VLANs by default.

Description

ip-address: Indicates the source IP address.

Command

Global configuration mode

Mode
Usage Guide

After a querier is enabled, a source IP address must be specified for the querier; otherwise, theconfiguration will not take effect.
If the source IP address is specified by a VLAN, the address will be used preferentially.

Configuring the Maximum Response Time of a Querier

Commandip igmp snooping [ vlan vid ] querier max-response-time seconds

Parametervlan vid: Specifies a VLAN. This configuration applies to all VLANs by default.

Description

seconds: Indicates the maximum response time in the unit of seconds. The value ranges from 1 to 25.

Command

Global configuration mode

Mode
Usage Guide

If the query interval is specified by a VLAN, the value will be used preferentially.

Configuring the Query Interval of a Querier

Commandip igmp snooping [ vlan vid ] querier query-interval seconds

Parametervlan vid: Specifies a VLAN. This configuration applies to all VLANs by default.

Description

seconds: Indicates the query interval in the unit of seconds. The value ranges from 1 to 18,000.

Command

Global configuration mode

Mode
Usage Guide

If the query interval is specified by a VLAN, the value will be used preferentially.

Configuring the Aging Timer of a Querier

Commandip igmp snooping [ vlan vid ] querier timer expiry seconds

Parametervlan vid: Specifies a VLAN. This configuration applies to all VLANs by default.

Description

seconds: Indicates the timeout time in the unit of seconds. The value ranges from 60 to 300.

Command

Global configuration mode

Mode
Usage Guide

A device may fail to be elected as the querier even when its querier function is enabled. If a device thatfails to be elected does not receive the Query packet sent by the querier in the aging time, the querier in
use is considered as expired, and a new round of election will be raised.
If the aging time is specified by a VLAN, the value will be used preferentially.

Specifying the IGMP Version for a Querier

2-48Configuration Guide

Configuring IGMP Snooping

Commandip igmp snooping [ vlan vid ] querier version 1

Parametervlan vid: Specifies a VLAN. This configuration applies to all VLANs by default.

Description
Command

Global configuration mode

Mode
Usage Guide

A querier can be run in IGMPv1 and IGMPv2 (IGMPv2 by default). You can also run a command to
configure the version to IGMPv1.
If the IGMP version for a querier is specified by a VLAN, the version will be used preferentially.

Displaying the IGMP Querier Configuration

Commandshow ip igmp snooping querier detailParameter

N/A

Description
CommandPrivileged EXEC mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

If QinQ is enabled, the following content is displayed.
Ruijie(config)# show ip igmp snooping querier detail
Vlan

IP Address

IGMP Version

Port-----------------------------------------------------------

Global IGMP switch querier status-------------------------------------------------------admin state: Enableadmin version: 2

source IP address: 1.1.1.1

query-interval (sec): 60

max-response-time (sec): 10querier-timeout (sec): 125

Vlan 1:

IGMP switch querier status-------------------------------------------------------admin state: Disable

admin version: 2

source IP address: 1.1.1.1

query-interval (sec): 60

max-response-time (sec): 10querier-timeout (sec)

: 125

2-49

Configuration Guide

Configuring IGMP Snooping

operational state: Disable

operational version: 2

Configuration
Example

Enabling the IGMP Querier Function

Scenario
Figure 2-10

In the scenario without Layer-3 multicast equipment, the multicast traffic can be forwarded only on theLayer-2 network.
A acts as a Layer-2 device to connect to the multicast source and receiver.
ConfiguratioEnable global IGMP snooping on A in IVGL mode.

n Steps

Enable IGMP querier for VLAN 1 on A.

A

A(config)# ip igmp snooping ivgl
A(config)# ip igmp snooping querierA(config)# ip igmp snooping querier address 10.1.1.1
A(config)# ip igmp snooping vlan 1 querier

Verification

Run the show ip igmp snooping querier command to check whether the querier of VLAN 1 takes
effect.

A

A(config)# show ip igmp snooping querier
Vlan

IP Address

IGMP Version

Port----------------------------------------------------------1

10.1.1.1

2

switchA(config)# show ip igmp snooping querier vlan 1

Vlan 1:

IGMP switch querier status--------------------------------------------------------

2-50

Configuration Guide

Configuring IGMP Snooping

elected querier is 10.1.1.1(this switch querier)-------------------------------------------------------admin state: Enableadmin version: 2

source IP address: 10.1.1.1

query-interval (sec): 60

max-response-time (sec): 10querier-timeout (sec): 125

operational state: Querieroperational version: 2

Common Errors


The source IP address is not configured for the querier and the querier does not take effect.

2.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears the statistics on IGMP snooping.

clear ip igmp snooping statistics

Clears the dynamic router ports and member

clear ip igmp snooping gda-table

ports.

Displaying
Description

Command

Displays basic IGMP snoopingshow ip igmp snooping [ vlan vid ]

configurations.
Displays the statistics on IGMP snooping.

show ip igmp snooping statistics [ vlan vid ]Displays the router ports.

show ip igmp snooping mrouter

Displays the IGMP snooping entries.

show ip igmp snooping gda-table

Displays the profile.

show ip igmp profile [ profile-number ]Displays the IGMP snooping configurations

show ip igmp snooping interface interface-type interface-number

on an interface.
Displays the IGMP querier.

show ip igmp snooping querier [ detail | vlan vid ] ]Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

Command2-51

Configuration Guide

Configuring IGMP Snooping

Debugs all IGMP snooping functions.

debug igmp-snp

Debugs the IGMP snooping events.

debug igmp-snp event

Debugs the IGMP snooping gda config.

debug igmp-snp gda

Debugs the IGMP snooping packets.

debug igmp-snp packet

Debugs the communications between IGMP

debug igmp-snp msf

snooping and MSF.
Debugs the IGMP snooping alarms.

debug igmp-snp warning

2-52

Reliability Configuration
1. Configuring REUP
2. Configuring RLDP
3. Configuring IP Event DampeningConfiguration Guide

Configuring REUP

1 Configuring REUP
1.1 Overview
The Rapid Ethernet Uplink Protection Protocol (REUP) provides a rapid uplink protection function.
In the dual uplink networking, REUP is used to ensure normal communication between links, block redundant links,
avoid link loops, and implement fast backup.
The upstream interfaces of REUP are configured in pairs. If both interfaces are normal, an interface works in the backup
state. The interface in the backup state does not forward data packets. When the interface in the forward state is faulty,
the backup interface switches to the forward state immediately, and provides data transmission. In addition, REUP also
sends address update packets to upstream devices so that the upstream devices can update their MAC addresses
immediately. This function of REUP ensures that layer-2 data streams can be restored within 50 ms after a link is faulty.
REUP is mutually exclusive with the Spanning Tree Protocol (STP) based on interfaces. In this case, a device runs STP
downward and runs REUP upward to implement backup and fault protection for the upstream link. REUP ensures thatbasic link redundancy is provided when STP is disabled and that millisecond-level fault recovery faster than STP is also
provided.

Protocols andStandards


REUP is a proprietary protocol of Ruijie Network, and there is no standard and protocol for reference.

1.2 Applications
Application

Description

Communication in Dual Uplink

Forward packets in the dual-uplink networking.

Networking

1.2.1 Communication in Dual Uplink Networking
Scenario
For communication in dual uplink networking, the access switch has two uplink paths, as shown in Figure 1-1.

1-1

Configuration Guide

Configuring REUP

Figure 1-1 Dual uplink networking

Deployment
Enable REUP on interface1 and interface2 of the access switch D/E to implement fast switching when a link is
faulty.



Enable MAC address update message receiving of REUP on the interfaces connected to switches A/B/C to rapidly
clear the MAC addresses on the interfaces when a link is faulty.

1.3 Features
Basic Concepts



REUP Pair

Specify an interface as the backup interface of another interface to configure an REUP pair. One interface is the active
interface and the other interface is the backup interface. When the two interfaces are normal, an interface is configured
as the forward interface whereas the other interface is configured as the backup interface. You can determine theinterface to be configured as the backup interface. See the related information in the section "Configuring thePreemption Mode and Delay Time of REUP".



MAC Address Update Message

1-2

Configuration Guide

Configuring REUP

MAC address update messages refer to FLUSH packets sent by Ruijie Network to uplink devices through private
multicast. When an uplink device of Ruijie Network enables the function for receiving MAC address update messages
and receives MAC address update messages, the device updates the MAC addresses of corresponding interfaces.



MAC Address Update GroupMultiple interfaces are added to a group. If one interface in the group receives a MAC address update message, theMAC addresses of other interfaces in the group will be updated. In this case, the group is called MAC address update
group.



MAC Address Update Packet

Packets sent to update MAC addresses in order to support uplink devices are called MAC address update packets.



Link Tracking GroupThe uplink and downstream interfaces of a device are added to a group. If all upstream interfaces in the group are down,
all downstream interfaces in this group are forced down. In this case, this group is called a link tracing group.

Overview
FeatureDescription

Dual Link Backup of REUP

When a link is faulty, the other link can rapidly switch to the forward state.

Preemption Mode and Delay

When both links are normal, the preemption mode can be used to determine the link that

Time of REUP

is used for forwarding data and the delay time that is used to determine the waiting time
before switching.

MAC Address Update

During link switching, the MAC address of an interface is updated to make packet
convergence faster.

VLAN Load Balance

When the two links are normal, the utilization of link bandwidth can be maximized.

Link State Tracking

When the upstream link is faulty, the downstream link is switched.

1.3.1 Dual Link Backup of REUP
When an active link is faulty, the link in the backup state will rapidly switch to the forward state and start forwarding data,
minimizing the service interruption caused by link failure.

Working Principle
Specify an interface as the backup interface of another interface to configure an REUP pair. When the two interfaces
are normal, a link is in the forward state (forwarding data packets) and the other link is in the backup state (notforwarding data). When the active link is faulty, the link in the backup state rapidly switches to the forward state andstarts forwarding data. When the faulty link is recovered, the link enters the backup state and does not forward data
packets. Of course, you can configure the preemption mode to specify whether a link recovered from failure preempts
the link that is in the forward state currently.

1-3Configuration Guide

Configuring REUP

Figure 1-2 A topology with two normal links

As shown in Figure 1-2, connect interfaces 1 and 2 of switch D (E) to the uplink switches B and C (C and B) andconfigure REUP on interfaces 1 and 2. When the links are normal, interface 1 is in the forward state and forwards data
packets and interface 2 is in the backup state and does not forward data packets.

1-4

Configuration Guide

Configuring REUP

Figure 1-3 A topology with interface 1 of switch D (E) faulty

Once interface 1 is faulty, interface 2 immediately starts forwarding data packets and recovers the uplink transmissionof the switch. In the non-preemption mode, when the link of interface 1 is recovered, interface 1 is in the backup stateand does not forward data packets whereas interface 2 continues forwarding data packets.

RelatedConfiguration

Enabling Dual Link Backup on an interface

By default, dual link backup on an interface is disabled.
You can run the switchport backup interface command to configure a layer-2 physical interface (or layer-2 AP
interface) as a backup interface and enable the dual link backup function of REUP.
You must enable the dual link backup function of REUP on an interface. The function involves the link switching of
REUP only when an interface is faulty.
REUP, ERPS, and RERP do not share interfaces.
Devices enabled with REUP must disable the storm control function of all layer-2 interfaces.

1.3.2 Preemption Mode and Delay Time of REUP
Working Principle

1-5Configuration Guide

Configuring REUP

You can determine which link should be used first by configuring the preemption mode of REUP. If the preemption
mode is set to bandwidth first, REUP selects a link with a high bandwidth first. You can also set the preemption mode toforced to select a stable and reliable link first forcibly.
To avoid frequent active/backup link switching caused by abnormal faults, REUP provides a preemption delay function.
When the two links are recovered, link switching is performed when the faulty link becomes stable after a delay (35s by
default).

RelatedConfiguration

Configuring the Preemption Mode and Delay Time of REUP

By default, the preemption mode is disabled and the delay time is 35s.
You can run the switchport backup interface preemption mode command to configure the preemption mode.
You can run the switchport backup interface preemption delay command to configure the delay time.
A smaller delay means more frequent preemption switching after the faulty link is recovered.
REUP uses the value of the Bandwidth attribute for an AP interface as the actual bandwidth of the AP interface,which is equal to the value of the Speed attribute (the number of link up member interfaces x the number ofmember interfaces).
When an uplink enables STP, the preemption delay time of REUP is greater than 35s.

1.3.3 MAC Address Update
During link switching, the MAC address of an interface is updated to make packet convergence faster.

Working Principle
As shown in Figure 1-2, interface 1 and interface 2 of switch D (E) are enabled with dual link backup of REUP. Interface
1 works as the active interface. During normal communication, switch A learns the MAC addresses of users 1 and 2(users 3 and 4) from the interfaces connecting to switch B (C).
When interface 1 of switch D (E) is faulty, interface 2 rapidly switches to the forward state and starts forwarding data
packets. In this case, switch A does not learn the MAC addresses of users 1 and 2 (users 3 and 4) on the interfaces
connecting to switch B (C). The data packets sent by the server to users 1 and 2 (users 3 and 4) are forwarded to switch
C (B) by switch A, causing that the packets from the server to users 1 and 2 (users 3 and 4) are lost.
To avoid the preceding problems, you can enable the MAC address update function on switch D (E). When interface 2
starts forwarding packets, switch D (E) sends a MAC address update message to interface 2. After receiving the MAC
address update message, switch A updates the MAC address on the interface of switch A. In this way, switch A
forwards the packets sent by the server to the users to the interfaces of switch B (C) to make packet convergence
faster.
In addition, import the setting of a MAC address update group, that is, classify multiple interfaces into the same group.
When an interface in this group receives a MAC address update message, the MAC addresses on other interfaces in
the group are updated to reduce the side effect of flooding caused by MAC address update.
To be compatible with upstream devices not supporting MAC address update messages, switch D (E) will send MAC
address update packets for users 1 and 2 (users 3 and 4) upward when interface 2 switches to the forward state. In this1-6

Configuration Guide

Configuring REUP

way, switch A can update the MAC addresses of users 1 and 2 (users 3 and 4) to the corresponding interfaces andrecover the downlink data transmission of switch A.

RelatedConfiguration

Enabling Sending of MAC Address Update Messages on an interface

By default, sending of MAC address update messages is disabled on an interface.
You can run the mac-address-table move update transit command to enable sending of MAC address updates on all
interfaces of a device.
If sending of MAC address update messages is not enabled, MAC address update messages will not be sent when duallink backup switching of REUP is performed.

Enabling Receiving of MAC Address Update Messages on an interface

By default, receiving of MAC address update messages is disabled on an interface.
You can run the mac-address-table move update receive command to enable receiving of MAC address updates on
all interfaces of a device.
If receiving of MAC address update messages is not enabled, a device cannot receive MAC address update messages
from downlink devices during dual link backup switching of REUP and will not update the MAC addresses.



Configuring a VLAN for Sending MAC Address Update Messages

By default, a VLAN for sending MAC address update messages is the default VLAN to which an interface belongs.
You can run the mac-address-table move update transit vlan command to configure the VLAN in which interfaces
send MAC address update messages.
If the VLAN in which interfaces send MAC address update messages is configured, the messages are sent in theconfigured VLAN; otherwise, the messages are sent in the default VLAN to which the interface belongs.

Configuring a VLAN for Receiving MAC Address Update Messages

By default, MAC address update messages are received in all VLANs.
You can run the no mac-address-table move update receive vlan command to configure a VLAN in which interfaces
do not receive MAC address update messages. MAC address update messages are received in remaining VLANs.
If no VLAN in which interfaces receive MAC address update messages is configured, MAC address update messages
are received in all the configured VLANs; otherwise, MAC address update messages are received in the remaining
VLANs.

Configuring a MAC Address Update GroupBy default, there is no MAC address update group.
You can run the mac-address-table update group command to add an interface to the MAC address update group.
The interface is added to the first update group by default.
If no MAC address update group is configured, MAC address update will not be performed when MAC address update
packets are received.

1-7Configuration GuideConfiguring REUP

Configuring the Maximum Number of MAC Address Update Packets Sent Per Second

By default, the maximum number of MAC address update packets sent per second is 150.
You can run the mac-address-table move updatemax-update-rate command to configure the maximum number of
MAC address update packets sent per second.
The larger the number of packets, the more CPU time used for sending the packets, and the fewer downlink packets
are lost.

1.3.4 VLAN Load Balance
Working Principle
The VLAN load balance function allows REUP to forward data packets of mutually exclusive VLANs for two interfaces
to make full use of the link bandwidth.
As shown in Figure 1-4, configure dual link backup of REUP and enable VLAN load balance of REUP on interface 1 andinterface 2 of switch D, and map VLAN 1 to instance 1 and VLAN 2 to instance 2. Data of VLAN 1 (instance 1) istransmitted through interface 1 and all the other data of VLAN 2 (instance 2) is transmitted through interface 2. Performthe same processing on switch E.
When an interface is faulty, the other interface takes over the transmission of all VALNs. When the faulty interface isrecovered and does not become faulty within the preemption delay, the transmission of VLANs is switched back to therecovered interface.
Figure 1-4 A topology with two normal links of load balance

1-8Configuration Guide

Configuring REUP

RelatedConfiguration

Enabling VLAN Load Balance on an interface

By default, the VLAN load balance function on an interface is disabled.
You can run the switchport backup interface prefer instance command to enable the VLAN load balance function.
If this function is not enabled, the link bandwidth cannot be fully used when packets are forwarded when the two links
are normal. You must enable the VLAN load balance function on a port so that the interface can be involved in VLAN
load balance.
The instance mapping of REUP VLAN load balance is controlled by the MSTP module in a unified manner. For
details about how to configure the instances, see the description in the Configuring MSTP.
The VLAN load balance function can be configured only on trunk, uplink or hybrid interfaces.

1.3.5 Link State Tracking
Link tracking means that when the upstream link is faulty, services are switched to the downstream link so that the
backup interface can continue forwarding packets.

Working Principle
Link state tracking provides the function of notifying downlink devices for link switching when the upstream link is faulty.
You can configure the uplink and downstream interfaces of a link state tracking group and bind the link status of multiple
downstream interfaces to the interfaces of multiple upstream links to implement link status synchronization. When all
upstream links in a tracking group are faulty, the interfaces of the downstream links are shut down forcibly to ensurethat the transmission of the downstream links is switched from the active link to the backup link.
As shown in Figure 1-5, when the upstream link of switch B is faulty, link state tracking rapidly shuts down thedownstream interface of switch B so that the uplink transmission of switch D is switched to switch C.
Figure 1-5 A topology where the upstream link of the active link is faulty

1-9Configuration Guide

Configuring REUP

RelatedConfiguration

Enabling Link Tracking

Link tracking is disabled by default.
You can run the link state track [number] command to enable a link tracking group. The value of number ranges from
1 to 2. The first link tracking group is enabled by default (the default value of number is 1).
If link tracking is not enabled, the status of a corresponding upstream interface cannot be detected and packet
forwarding switching cannot be implemented in time.

Enabling the Downlink Delay Up Function for a Link Tracking GroupBy default, the downlink delay for link tracking is 0s.
You can run the link state track number up-delay timer command to enable a link tracking group. The value of
number ranges from 1 to 2. The first link tracking group is enabled by default (the default value of number is 1). The
value of timer ranges from 0 to 300s, which is 0s by default.
By enabling the downlink delay up function, you can avoid frequent downlink switching caused by uplink flapping in alink tracking group. That is, when the upstream link becomes up, the downstream link becomes up after a delay.

Adding an interface to a Link Tracking GroupBy default, an interface is not added to a link tracking group.

1-10

Configuration Guide

Configuring REUP

You can run the link state group [number] {upstream | downstream} command to set upstream interfaces anddownstream interfaces of the link tracking group. The value of number ranges from 1 to 2. An interface is added to thefirst link tracking group by default (the default value of number is 1).
If an interface is not added to a tracking group, the status of a corresponding upstream interface cannot be detected
and packet forwarding switching cannot be implemented in time.

1.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enable dual link backup of REUP.

Configuring Basic Functionsof REUPswitchport backup interface

Enables dual link backup of REUP.

(Optional) It is used to determine the preemption mode and delay time. The default
values are used if they are not configured.

Configuring the Preemption
Mode and Delay Function ofswitchport backup interface preemption

REUP

mode
switchport backup interface preemption
delay

Sets the preemption mode.

Sets the delay time for preemption.

(Optional) It is used to enable rapid update of MAC addresses.
mac-address-table update group

mac-address-table move update transit

Configuring MAC Address

Sets the MAC address update group ID ofa switch.
Enables sending of MAC address update
messages.

mac-address-table move update transit

Enables sending of the VLAN ID of MAC

vlan

address update messages.
Configures the maximum number of MAC

Updatemac-address-table move update

address update packets sent per second.
The value ranges from 0 to 32000. The
default value is 150.

mac-address-table move update receive

Configuring VLAN Load
Balance

Configuring Link Tracking

Enables receiving of MAC address update
messages.

mac-address-table move update receive

Configures the VLAN range for processingvlan

MAC address update messages.
(Optional) It is used to enable VLAN load balance.

switchport backup interface prefer

Configures the link VLAN load balance ofinstance

REUP.

(Optional) It is used to enable link tracking.

1-11

Configuration Guide

Configuration

Configuring REUP

Description and Command
Enables the downlink delay up for a link

link state track up-delay

state tracking group.
Enables a link state tracking group.

link state track

Add an interface as an upstream interface
or a downstream interface of a specified

link state grouplink state tracking group.

1.4.1 Configuring Basic Functions of REUP
Configuration EffectWhen a link is faulty, the other normal link is switched to the forward state immediately for forwarding packets.

Notes


An interface belongs to only one REUP pair. Each active link has only one backup link. A backup link can be usedas the backup link of only one active link. The active and backup links must use different interfaces.



REUP supports layer-2 physical interfaces and AP interfaces, but does not support AP member interfaces.

The active and backup interfaces may be of different types and have different rates. For example, an AP interface
can be used as the active interface whereas a physical interface is configured as the backup interface.

Interfaces configured with REUP are not involved in STP calculation.

Each device can be configured with a maximum of 16 REUP pairs.

Interfaces successfully configured with REUP cannot change interfaces to layer-3 interfaces or be added to anAP.

Configuration Steps

Enabling Dual Link Backup of REUP



Mandatory.



If there is no special requirement, dual link backup of REUP should be enabled on an interface of the receiving
switch.

Verification
Run the show interfaces switchport backup [detail] command to check whether dual link backup of REUP is
configured.

Related Commands

Enabling Dual Link Backup of REUP

Commandswitchport backup interface interface-id

Parameterinterface-id: Indicates the backup interface ID.

Description
Command

Interface configuration mode

Mode

1-12

Configuration Guide

Usage Guide

Configuring REUP

If the interface where the mode resides is the active interface, the interface corresponding to theinterface-id parameter is the backup interface. When the active link is faulty, rapidly recover thetransmission of the backup link.

Configuration
Example

Enabling Dual Link Backup of REUP

Scenario

As shown in Figure 1-6, there are two upstream links from switch D to switch A, which are switch D >Figure 1-6

switch B > switch A and switch D > switch C > switch A. There are two upstream links from switch E to

Dual uplinkswitch A, which are switch E > switch B > switch A and switch E > switch C > switch A.

networking

Configuration StepsD

Configure dual link backup (the interface Gi0/1 is the active interface and Gi0/2 is the backup
interface) of REUP on the access switch D (E).

SwitchD> enable
SwitchD# configure terminal
SwitchD(config)# interface GigabitEthernet 0/1
SwitchD(config-if-GigabitEthernet 0/1)# switchport mode trunk
SwitchD(config-if-GigabitEthernet 0/1)#switchport backup interface GigabitEthernet 0/2
SwitchD(config-if-GigabitEthernet 0/1)# exit

E

SwitchE> enable
SwitchE# configure terminal
SwitchE(config)# interface GigabitEthernet 0/1
SwitchE(config-if-GigabitEthernet 0/1)# switchport mode trunk
SwitchE(config-if-GigabitEthernet 0/1)#switchport backup interface GigabitEthernet 0/2

1-13

Configuration Guide

Configuring REUP

SwitchD(config-if-GigabitEthernet 0/1)# exit

Verification

D

SwitchD#show interfaces switchport backup detail

Check the dual link backup information configured for switch D (E).

Switch Backup Interface Pairs:
Active Interface

Backup InterfaceState-------------------------------------------------------------------------Gi0/1

Gi0/2

Active Up/Backup Standby

Interface Pair : Gi0/1, Gi0/2
Preemption Mode : off
Preemption Delay : 35 seconds
Bandwidth : Gi0/1(100000 Mbits), Gi0/2(100000 Mbits)
E

SwitchE#show interfaces switchport backup detail
Switch Backup Interface Pairs:
Active Interface

Backup InterfaceState-------------------------------------------------------------------------Gi0/1

Gi0/2

Active Up/Backup Standby

Interface Pair : Gi0/1, Gi0/2
Preemption Mode : off
Preemption Delay : 35 seconds
Bandwidth : Gi0/1(100000 Mbits), Gi0/2(100000 Mbits)

Common Errors


Other REUP pairs are configured on a configured interface.

A configured interface is not a layer-2 physical interface or AP interface.

1.4.2 Configuring the Preemption Mode and Delay Function of REUP
Configuration Effect

Restrict the preemption mode and preemption delay time for REUP link switching.

Notes


Dual link backup of REUP must be configured.

1-14

Configuration Guide

Configuring REUP

Configuration Steps

Optional.



If the active link needs to always forward packets or the link bandwidth needs to be used to determine the link forforwarding packets, the corresponding preemption mode and delay time must be configured.

Verification
Run the show interfaces switchport backup [detail] command to check whether the preemption mode and delay
time are consistent with the configurations.

Related Commands

Configuring the Preemption Mode of REUP

Commandswitchport backup interface interface-id preemption mode { forced | bandwidth | off }Parameterinterface-id: Indicates the backup interface ID.

Description

mode: Sets the preemption mode:
forced: Indicates the forced mode.
bandwidth: Indicates the bandwidth mode.
off: Indicates that the preemption mode is off.

Command

Interface configuration mode

Mode
Usage Guide

The preemption modes include forced, bandwidth and off. In the bandwidth mode, an interface with ahigh bandwidth is selected first to transmit data; in the forced mode, the active interface is selected firstto transmit data; in the off mode, no preemption is performed. The default mode is off.

Configuring the Delay Time of REUP

Commandswitchport backup interface interface-id preemption delay delay-timeParameterinterface-id: Indicates the backup interface ID.

Description

delay-time: Indicates the delay time.

Command

Interface configuration mode

Mode
Usage Guide

Preemption delay indicates the delay time after a faulty link is recovered to the time when link switchingis performed again.

Configuration
Example

Configuring the Preemption Mode and Delay Time of REUP

Scenario

As shown in Figure 1-6, there are two upstream links from switch D to switch A, which are switch D >switch B > switch A and switch D > switch C > switch A. There are two upstream links from switch E toswitch A, which are switch E > switch B > switch A and switch E > switch C > switch A.

Configuratio

Configure the preemption mode to bandwidth on the access switch D (E) and the delay time to 40s.

n StepsD

SwitchD> enable

1-15

Configuration Guide

Configuring REUP

SwitchD# configure terminal
SwitchD(config)# interface GigabitEthernet 0/1
SwitchD(config-if-GigabitEthernet 0/1)#switchport backup interface gi 0/2 preemption mode
bandwidth
SwitchD(config-if-GigabitEthernet 0/1)#switchport backup interface gi 0/2 preemption delay 40
SwitchD(config-if-GigabitEthernet 0/1)# exit

E

SwitchE> enable
SwitchE# configure terminal
SwitchD(config)# interface GigabitEthernet 0/1
SwitchD(config-if-GigabitEthernet 0/1)#switchport backup interface gi 0/2 preemption mode
bandwidth
SwitchD(config-if-GigabitEthernet 0/1)#switchport backup interface gi 0/2 preemption delay 40
SwitchD(config-if-GigabitEthernet 0/1)# exit

Verification

D

SwitchD#show interfaces switchport backup detail

Check the dual link backup information configured for switch D (E).

Switch Backup Interface Pairs:
Active Interface

Backup InterfaceState-------------------------------------------------------------------------Gi0/1

Gi0/2

Active Up/Backup Standby

Interface Pair : Gi0/1, Gi0/2
Preemption Mode : bandwidth
Preemption Delay : 40 seconds
Bandwidth : Gi0/1(100000 Mbits), Gi0/2(100000 Mbits)
E

SwitchE#show interfaces switchport backup detail
Switch Backup Interface Pairs:
Active Interface

Backup InterfaceState-------------------------------------------------------------------------Gi0/1

Gi0/2

Active Up/Backup Standby

Interface Pair : Gi0/1, Gi0/2

1-16

Configuration Guide

Configuring REUP

Preemption Mode : bandwidth
Preemption Delay : 40 seconds
Bandwidth : Gi0/1(100000 Mbits), Gi0/2(100000 Mbits)

Common Errors

A configured interface is not a layer-2 physical interface or AP interface.

1.4.3 Configuring MAC Address Update
Configuration Effect

Rapidly delete and update MAC addresses of an interface during link switching to make packet convergence
faster.

Notes
Dual link backup of REUP must be configured.

Each device can be configured with a maximum of 8 address update groups. Each address update group canhave a maximum of 8 member interfaces and an interface can belong to multiple address update groups.

Configuration Steps

Mandatory.



If there is no special requirement, the MAC address update function should be configured.

Verification
Run the show mac-address-table update group [detail] command to view the update group configuration.

Related Commands

Configuring the MAC Address Update Group ID of a Switch

Commandmac-address-table update group [ group-num ]Parametergroup-num: Indicates the MAC address update group ID.

Description
Command

Interface configuration mode

Mode
Usage Guide

In order to reduce large flooding caused by MAC address update which may affect normal datatransmission of the switch, we add a setting of a MAC address update group. Only after all interfaces ona switching path are added to the same MAC address update group, transmission of downlink data canbe rapidly recovered.

Enabling Sending of MAC Address Update Messages

Commandmac-address-table move update transit

Parameter-

1-17Configuration Guide

Configuring REUP

Description
CommandCommand Mode

Mode
Usage Guide

To reduce link switching and loss of downlink data streams, you need to enable sending of MAC address
update messages on a switch that performs switching.

Enabling Sending of the VLAN ID of MAC Address Update Messages

Commandmac-address-table move update transit vlan vid

Parameter

vid: Indicates the VLAN ID for sending MAC address update messages.

Description
Command

Interface configuration mode

Mode
Usage Guide

After sending of MAC address update messages is enabled, MAC address update messages can besent to uplink devices during link switching.

Configure the maximum number of MAC address update packets sent per second.



Configuring the Maximum Number of MAC Address Update Packets Sent Per Second

Commandmac-address-table move update max-update-rate pkts-per-second

Parameterpkts-per-second: Indicates the maximum number of MAC address update packets sent per second. The

Description

value ranges from 0 to 32000. The default value is 150.

Command

Configuration mode

Mode
Usage Guide

During link switching, REUP sends MAC address update packets of a specified quantity to uplink
devices per second to recover the downlink data transmission of the uplink device.

Enabling Receiving of MAC Address Update Messages

Commandmac-address-table move update receive

Parameter-

Description
Command

Configuration mode

Mode
Usage Guide

During switching of dual link backup, downlink data streams may be lost since the MAC address table ofthe uplink switch is not updated in real time. In order to reduce loss of layer-2 data streams, you need to
update the MAC address table of the uplink switch. In this case, you need to enable receiving of MAC
address update messages on the uplink switch.

Configuring the VLAN Range for Processing MAC Address Update Messages

Commandmac-address-table move update receive vlan vlan-range

Parametervlan-range: Indicates the VLAN range for processing MAC address update messages.

Description
Command

Configuration mode

Mode
Usage Guide

This command is used to disable the function for processing MAC address update messages on certain
VLANs. For a VLAN disabled with the function for processing MAC address update messages, MAC

1-18

Configuration Guide

Configuring REUP

address update packets can be used to recover the downlink transmission of uplink devices; however,the convergence performance for link faults will be decreased.

Configuration
Example

Configuring MAC Address Update

Scenario

As shown in Figure 1-6, there are two upstream links from switch D to switch A, which are switch D >switch B > switch A and switch D > switch C > switch A. There are two upstream links from switch E toswitch A, which are switch E > switch B > switch A and switch E > switch C > switch A.

Configuration Steps

Enable sending of MAC address update messages on the access switch D (E).



Enable receiving of MAC address update packets on switch B (C).



Add all interfaces on the REUP switching path to the same MAC address update group.

In the environment, Gi0/1 and Gi0/3 of switch B are the interfaces on the switching path of switch
D's uplink, and Gi0/3 and Gi0/2 are the interfaces on the switching path of switch E's uplink. You
can add interfaces Gi0/1, Gi0/2 and Gi0/3 to the same address update group. Similarly, you canobtain the configuration of switch C.

DEnable receiving of MAC address update packets on switch A.



Add all interfaces on the REUP switching path of switch A to the same MAC address update group.

SwitchD> enable
SwitchD# configure terminal
SwitchD(config)# mac-address-table move update transit
SwitchD(config)# exit

E

SwitchE> enable
SwitchE# configure terminal
SwitchE((config)# mac-address-table move update transit
SwitchE(config)# exit

B

SwitchB# configure terminal
SwitchB(config)# mac-address-table move update receive
SwitchB(config)# interface range gigabitEthernet 0/1 -3
SwitchB(config-if-range)#switchport mode trunk
SwitchB(config-if-range)# mac-address-table update group 1
SwitchB(config-if-range)# end

1-19

Configuration Guide

C

Configuring REUP

SwitchB# configure terminal
SwitchB(config)# mac-address-table move update receive
SwitchB(config)# interface range gigabitEthernet 0/1 -3
SwitchB(config-if-range)#switchport mode trunk
SwitchB(config-if-range)# mac-address-table update group 1
SwitchB(config-if-range)# end

A

SwitchA# configure terminal
SwitchA(config)# mac-address-table move update receive
SwitchA(config)# interface range gigabitEthernet 0/1 -2
SwitchA(config-if-range)# switchport mode trunk
SwitchA(config-if-range)# mac-address-table update group 1
SwitchA(config-if-range)# end

Verification

Check the information about the address update groups on switches D, E, C, B and A.

D

SwitchD# show run | incl mac-ad
mac-address-table move update transit

E

SwitchE# show run | incl mac-ad
mac-address-table move update transit

B

SwitchB# show mac-address-table update group detailshow mac-address-table update group detailMac-address-table Update Group:1
Received mac-address-table update message count:0
Group member

Receive Count

Last Receive Switch-ID

Receive Time-------------------------------------------------------------------------------------------

C

Gi0/1

0

0000.0000.0000

Gi0/2

0

0000.0000.0000

Gi0/3

0

0000.0000.0000

SwitchC# show mac-address-table update group detailMac-address-table Update Group:1
Received mac-address-table update message count:0
Group member

Receive Count

Last Receive Switch-ID

1-20

Receive Time

Configuration Guide

Configuring REUP-------------------------------------------------------------------------------------------

A

Gi0/1

0

0000.0000.0000

Gi0/2

0

0000.0000.0000

Gi0/3

0

0000.0000.0000

SwitchA# show mac-address-table update group detailMac-address-table Update Group:1
Received mac-address-table update message count:0
Group member

Receive Count

Last Receive Switch-ID

Receive Time------------------------------------------------------------------------------------------Gi0/1

00000.0000.0000

Gi0/2

0

0000.0000.0000

Common Errors

A configured interface is not a layer-2 physical interface or AP interface.

1.4.4 Configuring VLAN Load Balance
Configuration EffectMaximize the utilization of link bandwidth.

Notes


Dual link backup of REUP must be configured.



The Access interface cannot be shared by VLAN load balance and STP.



For interfaces successfully configured with VLAN load balance, you cannot modify the attributes of the interfaces
but can modify the VLAN attributes of the interfaces.

Configuration Steps

If maximizing bandwidth utilization is not required, this configuration is optional.



If there is a requirement for VLAN load balance, corresponding configuration must be performed.

Verification
Run the show interfaces switchport backup [detail] command to check whether VLAN load balance is configured.

Related Commands

Configuring VLAN Load Balance

Commandswitchport backup interface interface-id prefer instance instance-range

1-21

Configuration Guide

Configuring REUP

Parameterinterface-id: Indicates the backup interface ID.

Description

instance-range: Indicates the load instance range of the backup interface.

Command

Interface configuration mode

Mode
Usage Guide

You can modify the mapping between instances and VLANs by using the instance mapping function of
MSTP.

Configuration
Example

Configuring VLAN Load Balance

Scenario

As shown in Figure 1-6, there are two upstream links from switch D to switch A, which are switch D >switch B > switch A and switch D > switch C > switch A. There are two upstream links from switch E toswitch A, which are switch E > switch B > switch A and switch E > switch C > switch A.

Configuratio

VLAN 3 to instance 3, and VLAN 4 to instance 4. For details, see the MSTP Configuration Guide.

n Steps
D

Configure instance mappings on switch D (E) to map VLAN 1 to instance 1, VLAN 2 to instance 2,

Configure the VLAN load balance function on switch D (E).

SwitchD> enable
SwitchD# configure terminal
SwitchD(config)# interface GigabitEthernet 0/1
SwitchD(config-if-GigabitEthernet 0/1)# switchport mode trunk
SwitchD(config-if-GigabitEthernet 0/1)#switchport backup interface gi0/2 prefer instance 2
SwitchD(config-if-GigabitEthernet 0/1)# exit

E

SwitchE> enable
SwitchE# configure terminal
SwitchE(config)# interface GigabitEthernet 0/1
SwitchE(config-if-GigabitEthernet 0/1)# switchport mode trunk
SwitchD(config-if-GigabitEthernet 0/1)#switchport backup interface gi0/2 prefer instance 4
SwitchD(config-if-GigabitEthernet 0/1)# exit

Verification

D

SwitchD#show interfaces switchport backup detail

Check the dual link backup information configured for switch D (E).

Switch Backup Interface Pairs:
Active Interface

Backup InterfaceState-------------------------------------------------------------------------Gi0/1

Gi0/2

Active Up/Backup Up

1-22

Configuration Guide

Configuring REUP

Instances Preferred on Active Interface: Instance 0-1,3-64
Mapping VLAN 1,3-4094

Instances Preferred on Backup Interface: Instance 2
Mapping VLAN 2

Interface Pair : Gi0/1, Gi0/2
Preemption Mode : balance
Preemption Delay : 35 seconds
Bandwidth : Gi0/1(800 kbits), Gi0/2(100000 kbits)

E

SwitchE#show interfaces switchport backup detail
Switch Backup Interface Pairs:
Active Interface

Backup InterfaceState-------------------------------------------------------------------------Gi0/1

Gi0/2

Active Up/Backup Up

Instances Preferred on Active Interface: Instance 0-3,5-64
Mapping VLAN 1-3,5-4094

Instances Preferred on Backup Interface: Instance 4
Mapping VLAN 4

Interface Pair : Gi0/1, Gi0/2
Preemption Mode : balance
Preemption Delay : 35 seconds
Bandwidth : Gi0/1(800 kbits), Gi0/2(100000 kbits)

Common Errors


The mappings between VLAN IDs and instances are not configured.

1.4.5 Configuring Link Tracking
Configuration Effect
1-23

Configuration GuideConfiguring REUP

After detecting that the upstream link is disconnected, forcibly disconnect the downstream link so that linkswitching can be performed.

Notes


Dual link backup of REUP must be configured.



For the link state tracking function, each interface belongs to only one link state tracking group and each device
can be configured with up to 2 link state tracking groups. Each link state tracking group can have 8 upstream
interfaces and 256 downstream interfaces.

Configuration Steps

Mandatory.



If there is no special requirement, the uplink tracking function should be configured.

Verification
Run the show link state group command to view the configured link tracking information.

Related Commands

Enabling a Link State Tracking Group

Commandlink state track [ num ]Parameternum: Indicates the ID of a link state tracking group.

Description
Command

Configuration mode

Mode
Usage GuideYou can create a link tracking group and then add an interface to the specified tracking group.

Enabling the Downlink Delay Up for a Link State Tracking Group

Commandlink state track num up-delay delay-timer

Parameternum: Indicates the ID of a link state tracking group.

Description

Timer: Indicates the downlink delay up time, which is 0s by default.

Command

Configuration mode

Mode
Usage GuideYou must enable the delay function so that the downstream link can be up after the delay.

Adding an interface to a Link Tracking Group

Commandlink stategroup num { upstream | downstream }Parameternum: Indicates the ID of a link state tracking group.

Description

upstream: Adds the interface as an upstream interface of the tracking group.
downstream: Adds the interface as a downstream interface of the tracking group.

Command

Interface configuration mode

Mode
Usage Guide

You can create a link tracking group and then add an interface to the specified tracking group.

1-24

Configuration Guide

Configuring REUP

Configuration
Example

Configuring a Link Tracking GroupScenario

As shown in Figure 1-6, there are two upstream links from switch D to switch A, which are switch D >switch B > switch A and switch D > switch C > switch A. There are two upstream links from switch E toswitch A, which are switch E > switch B > switch A and switch E > switch C > switch A.

Configuratio

Create link tracking group 1 on switch B (C).

n StepsOn switch B (C), add the interfaces Gi0/1 and Gi0/2 as downstream interfaces of the link tracking
group and add the interface Gi0/3 as an upstream interface of the link tracking group.

B

SwitchB> enable
SwitchB# configure terminal
SwitchB(config)# link state track 1
SwitchB(config)# interface GigabitEthernet 0/1
SwitchB(config-if-GigabitEthernet 0/1)#link state group 1
downstreamSwitchB(config-if-GigabitEthernet 0/1)#exit
SwitchB(config)# interface GigabitEthernet 0/2
SwitchB(config-if-GigabitEthernet 0/2)# link state group 1 downstream
SwitchB(config-if-GigabitEthernet 0/2)#exit
SwitchB(config)# interface GigabitEthernet 0/3
SwitchB(config-if-GigabitEthernet 0/3)#link state group 1 upstream
SwitchB(config-if-GigabitEthernet 0/3)#exit

C

SwitchC> enable
SwitchC# configure terminal
SwitchC(config)# link state track 1
SwitchC(config)# interface GigabitEthernet 0/1
SwitchC(config-if-GigabitEthernet 0/1)#link state group 1
downstreamSwitchC(config-if-GigabitEthernet 0/1)#exit
SwitchC(config)# interface GigabitEthernet 0/2
SwitchC(config-if-GigabitEthernet 0/2)# link state group 1 downstream
SwitchC(config-if-GigabitEthernet 0/2)#exit
SwitchC(config)# interface GigabitEthernet 0/3
SwitchC(config-if-GigabitEthernet 0/3)#link state group 1 upstream
SwitchC(config-if-GigabitEthernet 0/3)#exit

1-25

Configuration Guide

Verification
B

Configuring REUP

Check the link tracking group information configured for switch B (C).
SwitchB#show link state group
Link State Group:1

Status: enabled, Down

Upstream Interfaces :Gi0/3(Down)
Downstream Interfaces : Gi0/2(Down)

Common Errors
Interfaces are added to a link tracking group when the link tracking group is not enabled.

1.5 Monitoring
Displaying
Description

Command

Displays the dual link backup information ofshow interfaces [ interface-id ] switchport backup [ detail ]REUP.
Displays the configurations of an MAC

show mac-address-table update group [ detail ]address update group.
Displays the REUP statistics about sentshow mac-address-table move update

MAC address update messages.
Displays the information about a link stateshow link state grouptracking group.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

Command

Enables all REUP debugging.

debug reup all

Debugs the normal running process ofdebug reup process

REUP.
Debugs MAC address update messages ofdebug reup packet

REUP.
Debugs MAC address update packets ofdebug reup macupdt

REUP.
Debugs hot backup.

debug reup ha

Debugs errors occurring in REUP running.

debug reup error

Debugs received events.

debug reup evnet

Debugs statistics when show operations

debug reup status

are performed.

1-26

Configuration Guide

Configuring REUP

1-27

Configuration Guide

Configuring RLDP

2 Configuring RLDP
2.1 Overview
The Rapid Link Detection Protocol (RLDP) achieves rapid detection of unidirectional link failures, directional forwarding
failures and downlink loop failures of an Ethernet. When a failure is found, relevant ports will be closed automaticallyaccording to failure treatment configuration or the user will be notified to manually close the ports to avoid wrong flow
forwarding or an Ethernet layer-2 loop.

2.2 Applications
Application

Description

Unidirectional Link Detection

Detect a unidirectional link failure.

Bidirectional Forwarding Detection

Detect a bidirectional link failure.

Downlink Loop Detection

Detect a link loop.

2.2.1 Unidirectional Link Detection
Scenario
As shown in the following figure, A is connected to B via optical fiber. The two lines are the Tx and Rx lines of opticalfiber. Unidirectional link detection is enabled on A and B. If any of the Tx of Port A, Rx of Port B, Tx of Port B and Rx of
Port A fails, a unidirectional failure will be detected and treated under the RLDP. If the failure is eliminated, theadministrator may manually restore the RLDP on A and B and resume detection.
Figure 2-1

RemarkA and B are layer-2 or layer-3 switches.

s

The Tx of Port A of A is connected to the Rx of Port B of B.
The Rx of Port A of A is connected to the Tx of Port B of B.

Deployment
Global RLDP is enabled.

Configure unidirectional link detection under Port A and Port B and define a method for failure treatment.

2-1

Configuration Guide

Configuring RLDP

2.2.2 Bidirectional Forwarding Detection
Scenario
As shown in the following figure, A is connected to B via optical fiber, and the two lines are Tx and Rx lines of opticalfiber. Unidirectional link detection is enabled on A and B. If the Tx of Port A, Rx of Port B, Rx of Port A and Tx of Port B
all fail, a bidirectional failure will be detected and treated under the RLDP. If the failure is eliminated, the administrator
may manually restore the RLDP on A and B and resume detection.
Figure 2-2

RemarkA and B are layer-2 or layer-3 switches.

s

The Tx of Port A of A is connected to the Rx of Port B of B.
The Rx of Port A of A is connected to the Tx of Port B of B.

Deployment
Global RLDP is enabled.

Configure BFD under Port A and Port B and define a method for failure treatment.

2.2.3 Downlink Loop Detection
Scenario
As shown in the following figure, A, B and C are connect into a loop. Downlink loop detection is enabled on A, and aloop is detected and treated.
Figure 2-3

RemarkA, B and C are layer-2 or layer-3 switches.

sA, B and C are interconnected via exchange ports.

Deployment
Global RLDP is enabled on A.

2-2

Configuration GuideConfiguring RLDP

Configure downlink loop detection on the Gi 2/0/1 and Gi 2/0/9 ports of A, and define a method for failure
treatment.

2.3 Features
Most Ethernet link detection mechanisms detect link connectivity through automatic physical-layer negotiation.
However, in some cases devices are connected on the physical layer and operate normally but layer-2 linkcommunication is disabled or abnormal. The RLDP recognizes a neighbor device and detects a link failure throughexchanging Prob packets, Echo packets or Loop packets with the device.

Basic Concepts

Unidirectional Link Failure

A unidirectional link failure occurs in case of a cross-connected optical fiber, a disconnected optical fiber, an
open-circuit optical fiber, one open-circuit line in a twisted-pair cable, or unidirectional open circuit of an intermediatedevice between two devices. In such cases, one end of a link is connected and the other disconnected so that flow is
forwarded wrongly or a loop guard protocol (for example, the STP) fails.



Bidirectional Link Failure

A bidirectional link failure occurs in case of two optical fibers, two open-circuit lines in a twisted-pair cable, orbidirectional open circuit of an intermediate device between two devices. In such cases, the both ends of a link are
disconnected so that flow is forwarded wrongly.



Loop Failure

A downlink device is wrongly connected to form a loop, resulting in a broadcast storm.



RLDP Packet

The RLDP defines three types of packets: Prob packets, Echo packets and Loop packets.

Prob packets are layer-2 multicast packets for neighbor negotiation, and unidirectional or bidirectional linkdetection. The default encapsulation format is SNAP, which changes automatically to EthernetII if a neighborsends EthernetII packets.

Echo packets are layer-2 unicast packets as response to Prob packets and used for unidirectional or bidirectional
link detection. The default encapsulation format is SNAP, which changes automatically to EthernetII if a neighborsends EthernetII packets.



Loop packets are layer-2 multicast packets for downlink loop detection. They can only be received. The default
encapsulation format is SNAP.

RLDP Detection Interval and Maximum Detection Times

A detection interval and the maximum detection times can be configured for the RLDP. A detection interval determines
the period of sending Prob packets and Loop packets. When a device receives a Prob packet, it replies with an Echo
packet immediately. A detection interval and the maximum detection times determine the maximum detection time(equal to a detection interval × the maximum detection times + 1) for unidirectional or bidirectional link detection. If

2-3Configuration Guide

Configuring RLDP

neither Prob nor Echo packet from a neighbor can be received within the maximum detection time, the treatment of
unidirectional or bidirectional failure will be triggered.



RLDP Neighbor Negotiation

When configured with unidirectional or bidirectional link detection, a port can learn a peer-end device as its neighbor.
One port may learn one neighbor, which is variable. If negotiation is enabled, unidirectional or bidirectional linkdetection starts after a port finds a neighbor through negotiation, which succeeds when a port receives a Prob packet
from the neighbor. However, if the RLDP is enabled under a failure, the port cannot learn a neighbor so that detection
cannot start. In this case, recover the link state before enabling the RLDP.

Treatment for Failed Port under RLDP

Warning: Only print Syslog to indicate a failed port and a failure type.



Shutdown SVI: Print Syslog, and then inquire an SVI according to the Access VLAN or Native VLAN of a port andshut down the SVI if the port is a physical exchange port or layer-2 AP member port.

Port violation: Print Syslog, and configure a failed port as in violation state, and the port will enter Linkdown statephysically.



Block: Print Syslog, and configure the forward state of a port as Block, and the port will not forward packets.



Recovery of Failed Port under RLDPManual reset: Manually reset all failed ports to initialized state and restart link detection.



Manual or automatic errdisable recovery: Recover all failed ports to initialized state manually or regularly (30s by
default and configurable) and restart link detection.



Automatic recovery: Under unidirectional or bidirectional link detection, if the treatment for failed ports is not
specified as port violation, recover ports to initialized state based on Prob packets and restart link detection.

Port State under RLDP

normal: Indicates the state of a port after link detection is enabled.

error: Indicates the state of a port after a unidirectional or bidirectional link failure or a loop failure is detected.

Overview

FeatureDescription

Deploying RLDP

Enable unidirectional or bidirectional link detection or downlink loop detection for failures andDetection

implement treatment.

2.3.1 Deploying RLDP Detection
The RLDP provides unidirectional link detection, bidirectional forwarding detection and downlink loop detection.

Working Principle



Unidirectional Link Detection

2-4

Configuration Guide

Configuring RLDP

When this function is enabled, a port sends Prob packets and receives Echo packets from a neighbor regularly as well
as receiving Prob packets from a neighbor and replying with Echo packets. Within the maximum detection time, if theport receives Prob packets but no Echo packets, or none of them, treatment for a unidirectional failure will be triggered
and detection will stop.

Bidirectional Forwarding Detection

When this function is enabled, a port sends Prob packets and receives Echo packets from a neighbor regularly as well
as receiving Prob packets from a neighbor and replying with Echo packets. Within the maximum detection time, if theport receives neither Prob packets nor Echo packets from a neighbor, treatment for a bidirectional failure will be
triggered and detection will stop.



Downlink Loop Detection

When this function is enabled, a port sends Loop packets regularly. In the following cases, a loop failure will be
triggered after the same port or a different port receives the packets: in one case, the egress and ingress ports are thesame routed port or layer-3 AP member port; in another case, the egress and ingress ports are exchange ports orlayer-2 AP member ports in a same default VLAN and in Forward state. Treatment for the failure will be implemented
and detection will stop.

RelatedConfiguration
Configuring RLDP Detection

By default, RLDP detection is disabled.
You may run the global command rldp enable or the interface command rldp port to enable RLDP detection andspecify a detection type and treatment.
You may run the rldp neighbor-negotiation command to neighbor negotiation, the rldp detect-interval to specify adetection interval, the rldp detect-max to specify detection times, or the rldp reset to recover a failed port.

2.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enable RLDP detection under global configuration mode.
Enables global RLDP detection on all

rldp enable

ports.

(Mandatory)It is used to specify under interface configuration mode a detection type
Configuring Basic RLDP

and failure treatment for an interface.

Functions

Enables RLDP detection on a port andspecifies a detection type and failure

rldp port

treatment.
(Optional)It is used to configure a detection interval, detection times and neighbornegotiation under global configuration mode.

2-5

Configuration Guide

Configuring RLDP

rldp detect-interval

Modifies global RLDP parameters on all

rldp detect-max

ports, such as the detection interval,
maximum detection times and neighbornegotiation.

rldp neighbor-negotiation(Optional) It is used under privileged mode.
Recovers all ports.

rldp reset

2.4.1 Configuring Basic RLDP Functions
Configuration EffectEnable RLDP unidirectional link detection, bidirectional forwarding detection, or downlink loop detection to
discover failures.

Notes


Loop detection is effective to all member ports of an AP when configured on one of the ports. Unidirectional linkdetection and bidirectional forwarding detection are effective only on an AP member port.



The loop detection on a physical port added to an AP shall be configured the same as that of the other member
ports. There are three cases. First, if loop detection is not configured on a newly-added port but on the existing
member ports, the new port adopts the configuration and detection results of the existing ports. Second, if loop
detection is configured on a newly-added port but not on the existing member ports, the new port clears loop
detection and joins the AP. Third, if a newly-added port and the existing member ports have different loop
detection configuration, the new port adopts the configuration and detection results of the existing ports.

When configuring the RLDP on an AP port, you may configure failure treatment only as "shutdown-port", to which
other configurations will be modified.

When "shutdown-port" is configured on a port, RLDP detection cannot be restored in case of a failure. After
troubleshooting, you may run the rldp reset or errdisable recovery command to restore the port and resume
detection. For configuration of the errdisable recovery command, please refer to the SWITCH-INTF-SCG.doc.

Configuration Steps

Enabling RLDP

Mandatory.



Enable RLDP detection on all ports under global configuration mode.

Enabling Neighbor Negotiation



Optional.

Enable the function under global configuration mode, and port detection will be started under successful neighbornegotiation.

Configuring Detection Interval

2-6Configuration Guide

Configuring RLDP

Optional.

Specify a detection interval under global configuration mode.

Configuring Maximum Detection Times

Optional.

Specify the maximum detection times under global configuration mode.

Configuring Detection under Port

Mandatory.

Configure unidirectional RLDP detection, bidirectional RLDP detection or downlink loop detection under interface
configuration mode, and specify failure treatment.

Restoring All Failed Ports

Optional.

Enable this function under privileged mode to restore all failed ports and resume detection.

VerificationDisplay the information of global RLDP, port and neighbor.

Related Commands

Enabling Global RLDP Detection

Commandrldp enable

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage GuideEnable global RLDP detection.

Enabling RLDP Detection on Interface

Commandrldp port { unidirection-detect | bidirection-detect | loop-detect } { warning | shutdown-svi |shutdown-port | block }Parameter

unidirection-detect: Indicates unidirectional link detection.

Description

bidirection-detect: Indicates bidirectional forwarding detection.
loop-detect: Indicates downlink loop detection.
warning: Indicate the failure treatment is warning.
shutdown-svi: Indicate the failure treatment is closing the SVI that the interface is on.
shutdown-port: Indicates the failure treatment is port violation.
block: Indicates the failure treatment is disabling learning and forwarding of a port.

Command

Interface configuration mode

Mode

2-7

Configuration Guide

Usage Guide

Configuring RLDPThe interfaces include layer-2 switch ports, layer-3 routed ports, layer-2 AP member ports, and layer-3
AP member ports.

Modifying Global RLDP Detection Parameters

Commandrldp { detect-interval interval | detect-max num | neighbor-negotiation }Parameter

detect-interval interval: Indicates a detection interval.

Description

detect-max num: Indicates detection times.
neighbor-negotiation: Indicates neighbor negotiation.

Command

Global configuration mode

Mode
Usage GuideModify all RLDP parameters on all ports when necessary.

Recovering Failed Port

Commandrldp reset

Parameter

N/A

Description
CommandPrivileged mode

Mode
Usage Guide

Recover all failed ports to initialized state and resume detection.

Displaying RLDP State Information

Commandshow rldp [ interface interface-id ]Parameterinterface-id: Indicates the interface to display information of.

Description
CommandPrivileged mode, global configuration mode, or interface configuration mode

Mode
Usage Guide

Display RLDP state information.

Configuration
Example

Enabling RLDP Detection in Ring Topology

Scenario

As shown in the following figure, the aggregation and access sections are in a ring topology. The STP isenabled on all devices to prevent loop and provide redundancy protection. To avoid a unidirectional or

Figure 2-4

bidirectional link failure resulting in STP failure, RLDP unidirectional and bidirectional link detection isenabled between aggregation devices as well as between an aggregation device and the access device.
To avoid loop due to wrong downlink connection of the aggregation devices, enable RLDP downlink loop
detection on the downlink ports of the aggregation devices and of the access device. To avoid loop due
to wrong downlink connection of the access device, enable RLDP downlink loop detection on thedownlink ports of the access device.

2-8Configuration Guide

Configuring RLDPSW A and SW B are aggregation devices, and SW C is an access device. Users connected to SW

Configuratio

C. SW A, SW B and SW C are structured in a ring topology, and the STP is enabled on each ofn Stepsthem. For STP configuration, refer to relevant configuration guide.
Enable the RLDP on SW A, enable unidirectional and bidirectional link detection on the two ports,
and enable loop detection on the downlink port.

Enable the RLDP on SW B, enable unidirectional and bidirectional link detection on the two ports,
and enable loop detection on the downlink port.

Enable the RLDP on SW C, enable unidirectional and bidirectional link detection on the two uplink
ports, and enable loop detection on the two downlink ports.

A

A#configure terminalA(config)#rldp enable
A(config)#interface GigabitEthernet 2/0/1
A(config-if-GigabitEthernet 2/0/1)#rldp port unidirection-detect shutdown-port
A(config-if-GigabitEthernet 2/0/1)#rldp port bidirection-detect shutdown-port
A(config-if-GigabitEthernet 2/0/1)# exit
A(config)#interface GigabitEthernet 2/0/9
A(config-if-GigabitEthernet 2/0/1)#rldp port unidirection-detect shutdown-port
A(config-if-GigabitEthernet 2/0/1)#rldp port bidirection-detect shutdown-port
A(config-if-GigabitEthernet 2/0/1)#rldp port loop-detect shutdown-port
A(config-if-GigabitEthernet 2/0/1)#exit

B

Apply the configuration on SW A.

C

C#configure terminalC(config)#rldp enableC(config)#interface GigabitEthernet 0/49
C(config-if-GigabitEthernet 0/49)#rldp port unidirection-detect shutdown-port
C(config-if-GigabitEthernet 0/49)#rldp port bidirection-detect shutdown-port
C(config-if-GigabitEthernet 0/49)# exit
C(config)#interface GigabitEthernet 0/50

2-9Configuration Guide

Configuring RLDP

C(config-if-GigabitEthernet 0/50)#rldp port unidirection-detect shutdown-port
C(config-if-GigabitEthernet 0/50)#rldp port bidirection-detect shutdown-port
C(config-if-GigabitEthernet 0/50)#exit
C(config)#interface GigabitEthernet 0/1
C(config-if-GigabitEthernet 0/1)# rldp port loop-detect shutdown-port
C(config-if-GigabitEthernet 0/1)#exit
C(config)#interface GigabitEthernet 0/2
C(config-if-GigabitEthernet 0/2)# rldp port loop-detect shutdown-port
C(config-if-GigabitEthernet 0/2)#exit
Verification

A

A#show rldp

Check the RLDP information on SW A, SW B and SW C. Take SW A for example.

rldp state: enable

rldp hello interval: 3
rldp max hello: 2

rldp local bridge : 00d0.f822.33aa----------------------------------Interface GigabitEthernet 2/0/1
port state: normalneighbor bridge : 00d0.f800.51b1
neighbor port

: GigabitEthernet 2/0/1

unidirection detect information:action: shutdown-port
state : normal
bidirection detect information:action: shutdown-port
state : normal

Interface GigabitEthernet 2/0/9
port state: normalneighbor bridge : 00d0.f800.41b0
neighbor port

: GigabitEthernet 0/49

unidirection detect information:action: shutdown-port
state : normal

2-10Configuration Guide

Configuring RLDP

bidirection detect information:action: shutdown-port
state : normalloop detect information:action: shutdown-port
state : normal

Common Errors


RLDP functions and private multicast address authentication or TPP are enabled at the same time.



Neighbor negotiation is not enabled when configuring unidirectional or bidirectional link detection. The RLDP
should be enabled on a neighbor device, or otherwise a unidirectional or bidirectional failure will be detected.



If RLDP detection is configured to be implemented after neighbor negotiation while configuring unidirectional orbidirectional link detection, detection cannot be implemented as no neighbor can be learned due to a link failure. In
this situation, you are suggested to recover the link state first.



You are suggested not to specify the failure treatment as Shutdown SVI under a routed port.



You are suggested not to specify the failure treatment as Block for a port, on which a loop protection protocol isenabled, for example, the STP.

Common Errors
When the exec-cmd command is executed for interface configuration, the input of the corresponding AP wired
port is incorrect.

When the RLDP loop detection configurations are modified, the no exec-cmd command is not executed to delete
the original configurations or the exec-cmd command is not re-executed to cancel the configurations.

2.5 Monitoring
Displaying
Description

Command

Displays RLDP state.

show rldp [ interface interface-id ]2-11

Configuration Guide

Configuring IP Event Dampening

3 Configuring IP Event Dampening
3.1 Overview
When the Layer-3 port on a Layer-3 device frequently goes Up and Down due to manual enabling/disabling or otherexternal causes, the routing table on the device will flap repeatedly. If a routing protocol is configured, the protocol may
propagate the flap to the entire network, causing repeated updates and recalculation of neighboring routes, whichwastes network bandwidths and destabilizes the network. Repeated route updates and recalculation on devices
consume many CPU resources, which affects the normal running of customer networks.
IP Event Dampening detects abnormal Up/Down flapping and automatically suppresses frequent port state changes,
which prevents the propagation of single-point link failures by a routing protocol. When the port is restored, it will be
automatically unsuppressed, thus reducing network flaps and CPU resource consumption while improving network
stability.

Protocols andStandards


RFC2439: BGP Route Flap Dampening
At its core, the suppression algorithm used by IP Event Dampening is the same as that used by BGP Route Flap
Dampening.

3.2 Applications
Application

Description

Routed Port Flap

Monitors the state change of the Layer-3 port on a router, and suppresses frequent port

Dampening

flapping.

3.2.1 Routed Port Flap Dampening
Scenario
In a network that runs a routing protocol, when a port on a router connected to another router frequently goes Up andDown, neighboring routes will be repeatedly updated and recalculated. The routing protocol may propagate the flap tothe entire network, causing a network flap. IP Event Dampening can be enabled on the connected routers to monitor
port state changes and suppress frequent port flapping, thus reducing network flaps and CPU resource consumption
while improving network stability.
Figure 6-1

3-1

Configuration Guide

RemarkConfiguring IP Event Dampening

A and B are routers.

s

Deployment
Configure IP Event Dampening on portGE0/1 on Router A and portGE0/1 on Router B respectively.
The subinterfaces and the virtual templates of interfaces on routers do not support the dampening feature.

3.3 Features
Basic Concepts

Penalty

A port that goes Up or Down gets a penalty for each state change, but the penalty decays exponentially when the port isstable. In this way, port behaviors can be sensed and controlled intelligently.

Suppress Threshold

When the cumulative penalty of a port exceeds a suppress threshold, the port is considered to flap and will be
suppressed.

Half-Life Period

The half-life period is the period required for the penalty to decrease to half of the original value when the port is stable.
It defines the speed at which the penalty decays exponentially. The shorter the half-life period, the faster the penalty
decays, and the faster the port is detected to be stable, but the flap detection sensitivity is reduced.



Reuse Threshold

When the port no long flaps and its penalty decays to a certain degree (below the suppress threshold), the port isconsidered to be stable and is unsuppressed.

Maximum Suppress Time

When a port keeps flapping and reaches a very large penalty, the port will not be usable for a long time. To avoid thisproblem, the maximum suppress time is defined to always maintain the port suppression duration below a certain value
no matter how long the port has flapped.

Overview
FeatureDescription

Port Flap

Configure the criteria and parameters of flap suppression on ports to enable switches or routers to

Suppression

identify and suppress frequently flapping ports, which ensures route stability and avoids route flap
propagation.

3.3.1 Port Flap Suppression
Working Principle

3-2Configuration Guide

Configuring IP Event Dampening

A port configured with IP Event Dampening is assigned a penalty. The port gets a penalty of 1,000 each time when it
goes Down, but the penalty decreases with time. If the port goes Down again, the penalty increases accordingly. Whenthe cumulative penalty exceeds the suppress threshold, the port will be suppressed. For the affected upper-layer
protocol, the suppressed port is always Down no matter what the actual port state is. When the penalty decreases tothe reuse threshold, the port will be unsuppressed, and the upper-layer protocol can sense the actual port state.
If a Layer-3 port is not configured with IP Event Dampening, or is not suppressed by it, the routing protocol or otherprotocol concerned about the port status still work normally. When the port is suppressed, the upper-layer protocol
considers the port to be Down. Any state change of the port before the port is unsuppressed does not affect the routing
table and the route calculation and advertisement performed by the upper-layer routing protocol.

RelatedConfiguration

Configuring IP Event Dampening

By default, IP Event Dampening is disabled on Layer-3 ports.

Run the dampening [ half-life-period [ reuse-threshold suppress-threshold max-suppress [ restart[ restart-penalty ] ] ] ] command to enable or disable IP Event Dampening on Layer-3 ports.

3.4 Configuration
Configuration
Enabling IP Event
Dampening

Description and Command(Mandatory)It is used to suppress Layer-3 port flapping.
Configures IP Event Dampening.

dampening

3.4.1 Enabling IP Event Dampening
Configuration Effect
When a port configured with IP Event Dampening keeps flapping until the predefined threshold is exceeded, the port isset to Down.

Notes


When a Layer-3 port on a switch is converted to a Layer-2 port (for example, from a routed port to a switch port),
the IP Event Dampening configuration on the port will be deleted.

Only the main interface on a router can be configured with IP Event Dampening. The configuration takes effect for
all subinterfaces of the main interface, but you cannot run the dampening command directly on subinterfaces andvirtual templates.

Configuration Steps

Configuring IP Event Dampening

Mandatory.



Perform the configuration in Layer-3 interface configuration mode.

3-3Configuration GuideConfiguring IP Event Dampening

You can specify the half-life period, reuse threshold, suppress threshold, maximum suppress time, and initialpenalty. If you do not set these parameters, their default values will be used.

Verification
Use any one of the following commands to check whether the configuration takes effect:show running-config

show interfaces [ interface-id ] dampening, which is used to check the IP Event Dampening configuration on a
specified port

Related Commands

Enabling IP Event Dampening on a Port

Commanddampening [ half-life-period [ reuse-threshold suppress-threshold max-suppress [ restart[ restart-penalty ] ] ] ]Parameterhalf-life-period: Indicates the half-life period. Value range: <1–30>; default value: 5s.

Description

reuse-threshold: Indicates the reuse threshold. Value range: <1–20,000>; default value: 1,000.
suppress-threshold: Indicates the suppress threshold. Value range: <1–20,000>; default value: 2,000.
max-suppress: Indicates the maximum suppress time. Value range: <1–255>; default value: four times
the half-life period.
restart restart-penalty: Indicates the initial penalty. Value range: <1–20,000>; default value: 2,000.

Command

Interface configuration mode

Mode
Usage Guide

IP Event Dampening can affect direct routes, host routes, static routes, dynamic routes, and VRRP.
When a port is suppressed based on the configured criteria, the affected modules determine that theport is Down and therefore delete corresponding routes. No data packet will be transmitted through the
port.
When the dampening command is rerun on a port configured with IP Event Dampening, the dampening
information on the port will be cleared, but the flap count is retained, unless you use the clear counterscommand to clear the counters on the port.
If the max-suppress parameter is set to a very small value, making the maximum penalty smaller than
the suppress threshold, the port will never be suppressed. When such a configuration error occurs, thefollowing message indicating a configuration failure will be printed:% Maximum penalty (10) is less than suppress penalty (2000). Increase maximum suppress time
If the available system memory is insufficient to run the dampening command, the following message
indicating a configuration failure will be printed:% No memory, configure dampening fail!

Configuration
Example

Configuring IP Event Dampening on Layer-3 Ports

3-4

Configuration Guide

Configuring IP Event Dampening

Scenario
Figure 6-2

Configuratio

Enable IP Event Dampening on port GigabitEthernet 0/1 on Router A and on port GigabitEthernet 0/1 onn Steps

Router B respectively, and set half-time-period to 30s, reuse-threshold to 1,500, suppress-thresholdto 10,000, and max-suppress to 120s.

A

Ruijie(config)#interface GigabitEthernet 0/1
Ruijie(config-if-GigabitEthernet 0/1)#dampening 30 1500 10000 100

BRuijie(config)#interface GigabitEthernet 0/1
Ruijie(config-if-GigabitEthernet 0/1)#dampening 30 1500 10000 100

Verification

Run the show interfaces dampening command to check the IP Event Dampening configuration on thecorresponding ports.
Ruijie#show interfaces dampening
GigabitEthernet 0/1
Flaps Penalty Supp

ReuseTm HalfL

ReuseV SuppV

MaxSTmMaxP

Restart

0

0

1500

100

15119

0

0

FALSE

30

1000

Common Errors


The port on a Layer-3 switch is not converted to a routed port by using the no swithport command before IP
Event Dampening is configured.

3.5 Monitoring
Clearing
Description

CommandClears the interface counters.

clear counters

For details about the clear counter command, see the related chapter for the "Interface" command.

Displaying
Description

Command

Displays the counters on suppressedshow dampening interface

ports.
Displays the IP Event Dampening

show interfaces [ interface-Id ] dampening

configuration on ports.

Debugging

3-5

Configuration Guide

Configuring IP Event Dampening

System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

Command

Enables debugging of IP Event

debug dampening interface

Dampening.

3-6

Configuration Guide

Security Configuration
1. Configuring AAA(beta)
2. Configuring RADIUS(beta)
3. Configuring TACACS+(beta)
4. Configuring Global IP-MAC Binding(beta)
5. Configuring Password Policy
6. Configuring Port Security(beta)
7. Configuring Storm Control
8. Configuring SSH
9. Configuring CPU Protection
10. Configuring DHCP Snooping(beta)
11. Configuring DHCPv6 Snooping(beta)
12. Configuring ARP Check(beta)
13. Configuring Dynamic ARP Inspection(beta)
14. Configuring IP Source Guard(beta)
15. Configuring DoS Protection

16. Configuring PPPoE Intermediate Agent(beta)Configuration Guide

Configuring AAA(beta)

1 Configuring AAA(beta)
1.1 Overview
Authentication, authorization, and accounting (AAA) provides a unified framework for configuring the authentication,authorization, and accounting services. Ruijie Networks devices support the AAA application.
AAA provides the following services in a modular way:
Authentication: Refers to the verification of user identities for network access and network services. Authentication isclassified into local authentication and authentication through Remote Authentication Dial In User Service (RADIUS) andTerminal Access Controller Access Control System+ (TACACS+).
Authorization: Refers to the granting of specific network services to users according to a series of defined attribute-value(AV) pairs. The pairs describe what operations users are authorized to perform. AV pairs are stored on network accessservers (NASs) or remote authentication servers.
Accounting: Refers to the tracking of the resource consumption of users. When accounting is enabled, NASs collectstatistics on the network resource usage of users and send them in AV pairs to authentication servers. The records will be
stored on authentication servers, and can be read and analyzed by dedicated software to realize the accounting, statistics,
and tracking of network resource usage.
AAA is the most fundamental method of access control. Ruijie Networks also provides other simple access control
functions, such as local username authentication and online password authentication. Compared to them, AAA offers
higher level of network security.
AAA has the following advantages:

Robust flexibility and controllability



ScalabilityStandards-compliant authentication

Multiple standby systems

1.2 Applications
Application

Description

Configuring AAA in a Single-Domain

AAA is performed for all the users in one domain.

Environment

1.2.1 Configuring AAA in a Single-Domain Environment
ScenarioIn the network scenario shown in Figure 1-1, the following application requirements must be satisfied to improve thesecurity management on the NAS:

1-1

Configuration Guide
1.

Configuring AAA(beta)

To facilitate account management and avoid information disclosure, each administrator has an individual accountwith different username and password.

2.

Users must pass identity authentication before accessing the NAS. The authentication can be in local or centralized
mode. It is recommended to combine the two modes, with centralized mode as active and local mode as standby. As
a result, users must undergo authentication by the RADIUS server first. If the RADIUS server does not respond, itturns to local authentication.

3.

During the authentication process, users can be classified and limited to access different NASs.

4.

Permission management: Users managed are classified into Super User and Common User. Super users have therights to view and configure the NAS, and common users are only able to view NAS configuration.

5.

The AAA records of users are stored on servers and can be viewed and referenced for auditing. (The TACACS+
server in this example performs the accounting.)

Figure 1-1

Remarks

User A, User B, and User C are connected to the NAS in wired or wireless way.
The NAS is an access or convergence switch.
The RADIUS server can be the Windows 2000/2003 Server (IAS), UNIX system component, and dedicatedserver software provided by a vendor.
The TACACS+ server can be the dedicated server software provided by a vendor.

Deployment
Enable AAA on the NAS.



Configure an authentication server on the NAS.



Configure local users on the NAS.



Configure the authentication service on the NAS.



Configure the authorization service on the NAS.



Configure the accounting service on the NAS.

1.3 Features
Basic Concepts



Local Authentication and Remote Server Authentication

1-2

Configuration Guide

Configuring AAA(beta)

Local authentication is the process where the entered passwords are verified by the database on the NAS.
Remote server authentication is the process where the entered passwords are checked by the database on a remote
server. It is mainly implemented by the RADIUS server and TACACS+ server.



Method List

AAA is implemented using different security methods. A method list defines a method implementation sequence. The
method list can contain one or more security protocols so that a standby method can take over the AAA service when thefirst method fails. On Ruijie devices, the first method in the list is tried in the beginning and then the next is tried one by
one if the previous gives no response. This method selection process continues until a security method responds or all the
security methods in the list are tried out. Authentication fails if no method in the list responds.
A method list contains a series of security methods that will be queried in sequence to verify user identities. It allows you
to define one or more security protocols used for authentication, so that the standby authentication method takes overservices when the active security method fails. On Ruijie devices, the first method in the list is tried in the beginning andthen the next is tried one by one if the previous gives no response. This method selection process continues until amethod responds or all the methods in the method list are tried out. Authentication fails if no method in the list responds.
The next authentication method proceeds on Ruijie devices only when the current method does not respond. Whena method denies user access, the authentication process ends without trying other methods.
Figure 1-2

Figure 1-22 shows a typical AAA network topology, where two RADIUS servers (R1 and R2) and one NAS are deployed.
The NAS can be the client for the RADIUS servers.
Assume that the system administrator defines a method list, where the NAS selects R1 and R2 in sequence to obtain user
identity information and then accesses the local username database on the server. For example, when a remote PC user
initiates dial-up access, the NAS first queries the user's identity on R1. When the authentication on R1 is completed, R1
returns an Accept response to the NAS. Then the user is permitted to access the Internet. If R1 returns a Reject response,
the user is denied Internet access and the connection is terminated. If R1 does not respond, the NAS considers that the
R1 method times out and continues to query the user's identity on R2. This process continues as the NAS keeps trying theremaining authentication methods, until the user request is authenticated, rejected, or terminated. If all the authentication
methods are responded with Timeout, authentication fails and the connection will be terminated.
The Reject response is different from the Timeout response. The Reject response indicates that the user does notmeet the criteria of the available authentication database and therefore fails in authentication, and the Internet
access request is denied. The Timeout response indicates that the authentication server fails to respond to theidentity query. When detecting a timeout event, the AAA service proceeds to the next method in the list to continue
the authentication process.

1-3

Configuration Guide

Configuring AAA(beta)

This document describes how to configure AAA on the RADIUS server. For details about the configuration on the
TACACS+ server, see the Configuring TACACS+.

AAA Server GroupYou can define an AAA server group to include one or more servers of the same type. If the server group is referenced bya method list, the NAS preferentially sends requests to the servers in the referenced server group when the method list is
used to implement AAA.

Overview
FeatureDescription

AAA Authentication

Verifies whether users can access the Internet.

AAA Authorization

Determines what services or permissions users can enjoy.

AAA Accounting

Records the network resource usage of users.

1.3.1 AAA Authentication
Authentication, authorization, and accounting are three independent services. The authentication service verifies whether
users can access the Internet. During authentication, the username, password, and other user information are exchanged
between devices to complete users' access or service requests. You can use only the authentication service of AAA.
To configure AAA authentication, you need to first configure an authentication method list. Applications perform
authentication according to the method list. The method list defines the types of authentication and the sequence inwhich they are performed. Authentication methods are implemented by specified applications. The only exception isthe default method list. All applications use the default method list if no method list is configured.



AAA Authentication Scheme

No authentication (none)

The identity of trusted users is not checked. Normally, the no-authentication (None) method is not used.



Local authentication (local)

Authentication is performed on the NAS, which is configured with user information (including usernames, passwords, andAV pairs). Before local authentication is enabled, run the username password/secret command to create a local user
database.



Remote server group authentication (group)

Authentication is performed jointly by the NAS and a remote server group through RADIUS or TACACS+. A server groupconsists of one or more servers of the same type. User information is managed centrally on a remote server, thus realizing
multi-device centralized and unified authentication with high capacity and reliability. You can configure local authentication
as standby to avoid authentication failures when all the servers in the server group fail.



AAA Authentication Types

Ruijie products support the following authentication types:



Login authentication

Users log in to the command line interface (CLI) of the NAS for authentication through Secure Shell (SSH), Telnet, andFile Transfer Protocol (FTP).

1-4

Configuration GuideConfiguring AAA(beta)

Enable authentication

After users log in to the CLI of the NAS, the users must be authenticated before CLI permission update. This process iscalled Enable authentication (in Privileged EXEC mode).



Dot1X (IEEE802.1X) authentication

Dot1X (IEEE802.1X) authentication is performed for users that initiate dial-up access through IEEE802.1X.

Web (second generation portal) authentication

Web authentication is performed by the second generation portal server.

Related Configuration

Enabling AAA

By default, AAA is disabled.
To enable AAA, run the aaa new-model command.

Configuring an AAA Authentication Scheme

By default, no AAA authentication scheme is configured.
Before you configure an AAA authentication scheme, determine whether to use local authentication or remote server
authentication. If the latter is to be implemented, configure a RADIUS or TACACS+ server in advance. If local
authentication is selected, configure the local user database information on the NAS.



Configuring an AAA Authentication Method List

By default, no AAA authentication method list is configured.
Determine the access mode to be configured in advance. Then configure authentication methods according to the accessmode.

1.3.2 AAA Authorization
AAA authorization allows administrators to control the services or permissions of users. After AAA authorization isenabled, the NAS configures the sessions of users according to the user configuration files stored on the NAS or servers.
After authorization, users can use only the services or have only the permissions permitted by the configuration files.



AAA Authorization SchemeDirect authorization (none)

Direct authorization is intended for highly trusted users, who are assigned with the default permissions specified by theNAS.



Local authorization (local)

Local authorization is performed on the NAS, which authorizes users according to the AV pairs configured for local users.



Remote server-group authorization (group)

Authorization is performed jointly by the NAS and a remote server group. You can configure local or direct authorization
as standby to avoid authorization failures when all the servers in the server group fail.



AAA Authorization Types

1-5

Configuration GuideConfiguring AAA(beta)

EXEC authorization

After users log in to the CLI of the NAS, the users are assigned with permission levels (0 to 15).

Config-commands authorization

Users are assigned with the permissions to run specific commands in configuration modes (including the global
configuration mode and sub-modes).



Console authorization

After users log in through consoles, the users are authorized to run commands.



Command authorization

Authorize users with commands after login to the CLI of the NAS.



Network authorization

After users access the Internet, the users are authorized to use the specific session services. For example, after users
access the Internet through PPP and Serial Line Internet Protocol (SLIP), the users are authorized to use the data service,
bandwidth, and timeout service.

Related Configuration

Enabling AAA

By default, AAA is disabled.
To enable AAA, run the aaa new-model command.

Configuring an AAA Authorization Scheme

By default, no AAA authorization scheme is configured.
Before you configure an AAA authorization scheme, determine whether to use local authorization or remote server-group
authorization. If remote server-group authorization needs to be implemented, configure a RADIUS or TACACS+ server inadvance. If local authorization needs to be implemented, configure the local user database information on the NAS.



Configuring an AAA Authorization Method List

By default, no AAA authorization method list is configured.
Determine the access mode to be configured in advance. Then configure authorization methods according to the accessmode.

1.3.3 AAA Accounting
In AAA, accounting is an independent process of the same level as authentication and authorization. During theaccounting process, start-accounting, update-accounting, and end-accounting requests are sent to the configured
accounting server, which records the network resource usage of users and performs accounting, audit, and tracking ofusers' activities.
In AAA configuration, accounting scheme configuration is optional.



AAA Accounting SchemesNo accounting (none)

1-6

Configuration Guide

Configuring AAA(beta)

Accounting is not performed on users.



Local accounting (local)

Accounting is completed on the NAS, which collects statistics on and limits the number of local user connections. Billing is
not performed.

Remote server-group accounting (group)

Accounting is performed jointly by the NAS and a remote server group. You can configure local accounting as standby toavoid accounting failures when all the servers in the server group fail.



AAA Accounting Types



EXEC accounting

Accounting is performed when users log in to and out of the CLI of the NAS.

Command accounting

Records are kept on the commands that users run on the CLI of the NAS.



Network accounting

Records are kept on the sessions that users set up after completing 802.1X and Web authentication to access theInternet.

Related Configuration

Enabling AAA

By default, AAA is disabled.
To enable AAA, run the aaa new-model command.

Configuring an AAA Accounting Scheme

By default, no AAA accounting method is configured.
Before you configure an AAA accounting scheme, determine whether to use local accounting or remote server-groupaccounting. If remote server-group accounting needs to be implemented, configure a RADIUS or TACACS+ server inadvance. If local accounting needs to be implemented, configure the local user database information on the NAS.



Configuring an AAA Accounting Method List

By default, no AAA accounting method list is configured.
Determine the access mode to be configured in advance. Then configure accounting methods according to the accessmode.

1.4 Configuration
Configuration
Configuring AAA
Authentication

Description and Command
Mandatory if user identities need to be verified.
aaa new-model

Enables AAA.

aaa authentication login

Defines a method list of login authentication.

1-7

Configuration Guide
Configuration

Configuring AAA(beta)
Description and Commandaaa authentication enable

Defines a method list of Enable
authentication.

aaa local authentication attempts

Sets the maximum number of login
attempts.

aaa local authentication lockout-time

Sets the maximum lockout time after a login
failure.

Mandatory if different permissions and services need to be assigned to users.
aaa new-model

Enables AAA.

aaa authorization exec

Defines a method list of EXEC authorization.

aaa authorization commands

Defines a method list of command
authorization.

Configuring AAA
Authorization

aaa authorization network

Configures a method list of network
authorization.
Applies EXEC authorization methods to aauthorization exec

specified VTY line.
Applies command authorization methods toauthorization commands

a specified VTY line.
Mandatory if accounting, statistics, and tracking need to be performed on the network
resource usage of users.
aaa new-model

Enables AAA.

aaa accounting exec

Defines a method list of EXEC accounting.

aaa accounting commands

Defines a method list of commandaccounting.

Configuring AAA Accounting
Applies EXEC accounting methods to aaccounting exec

specified VTY line.
Applies command accounting methods to aaccounting commands

specified VTY line.
aaa accounting update

Enables accounting update.

aaa accounting update periodic

Configures the accounting update interval.

aaa log enable

Enable the system to print the syslog
informing AAA authentication success.

Configuring AAA Logging

Set the rate of printing the syslog informing

aaa log rate-limit num

AAA authentication success.
Recommended if a server group needs to be configured to handle AAA through different
Configuring an AAA ServerGroupservers in the group.
aaa group server

Creates a user-defined AAA server group.

serverAdds an AAA server group member.

1-8

Configuration Guide

Configuring AAA(beta)

1.4.1 Configuring AAA Authentication
Configuration Effect
Verify whether users are able to obtain access permission.

Notes


If an authentication scheme contains multiple authentication methods, these methods are executed according to theconfigured sequence.

The next authentication method is executed only when the current method does not respond. If the current method
fails, the next method will be not tried.

When the none method is used, users can get access even when no authentication method gets response.
Therefore, the none method is used only as standby.
Normally, do not use None authentication. You can use the none method as the last optional authentication methodin special cases. For example, all the users who may request access are trusted users and the users' work must not
be delayed by system faults. Then you can use the none method to assign access permissions to these users when
the authentication server does not respond. It is recommended that the local authentication method be added before
the none method.



If AAA authentication is enabled but no authentication method is configured and the default authentication method
does not exist, users can directly log in to the Console without being authenticated. If users log in by other means,the users must pass local authentication.

When a user enters the CLI after passing login authentication (the none method is not used), the username isrecorded. When the user performs Enable authentication, the user is not prompted to enter the username again,
because the username that the user entered during login authentication is automatically filled in. However, the user
must enter the password previously used for login authentication.



The username is not recorded if the user does not perform login authentication when entering the CLI or the none
method is used during login authentication. Then, a user is required to enter the username each time when
performing Enable authentication.

Configuration Steps

Enabling AAA



Mandatory.



Run the aaa new-model command to enable AAA.



By default, AAA is disabled.

Defining a Method List of Login Authentication



Run the aaa authentication login command to configure a method list of login authentication.

This configuration is mandatory if you need to configure a login authentication method list (including the configurationof the default method list).



By default, no method list of login authentication is configured.

Defining a Method List of Enable Authentication

1-9

Configuration Guide

Configuring AAA(beta)Run the aaa authentication enable command to configure a method list of Enable authentication.

This configuration is mandatory if you need to configure an Enable authentication method list. (You can configure
only the default method list.)

By default, no method list of Enable authentication is configured.



Setting the Maximum Number of Login Attempts



Optional.



By default, a user is allowed to enter passwords up to three times during login.



Setting the Maximum Lockout Time After a Login FailureOptional.



By default, a user is locked for 15 minutes after entering wrong passwords three times.

Verification


Run the show aaa method-list command to display the configured method lists.

Run the show aaa lockout command to display the settings of the maximum number of login attempts and the
maximum lockout time after a login failure.

Run the show running-config command to display the authentication method lists associated with login
authentication and 802.1X authentication.

Related Commands

Enabling AAA

Commandaaa new-modelParameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

To enable the AAA services, run this command. None of the rest of AAA commands can be effective if AAA
is not enabled.

Defining a Method List of Login Authentication

Commandaaa authentication login { default | list-name } method1 [ method2...]

Parameter

default: With this parameter used, the configured method list will be defaulted.

Description

list-name: Indicates the name of a login authentication method list in characters.
method: Indicates authentication methods from local, none, group, and subs. A method list contains up to
four methods.
local: Indicates that the local user database is used for authentication.
none: Indicates that authentication is not performed.
group: Indicates that a server group is used for authentication. Currently, the RADIUS and TACACS+
server groups are supported.

1-10

Configuration Guide

Configuring AAA(beta)

subs: Indicates that the subs database is used for authentication.
Command

Global configuration mode

Mode
Usage Guide

If the AAA login authentication service is enabled on the NAS, users must perform login authentication
negotiation through AAA. Run the aaa authentication login command to configure the default or optional
method lists for login authentication.
In a method list, the next method is executed only when the current method does not receive response.
After you configure login authentication methods, apply the methods to the VTY lines that require login
authentication; otherwise, the methods will not take effect.

Defining a Method List of Enable Authentication

Commandaaa authentication enable default method1 [ method2...]

Parameter

default: With this parameter used, the configured method list will be defaulted.

Description

list-name: Indicates the name of an Enable authentication method list in characters.
method: Indicates authentication methods from enable, local, none, and group. A method list contains up
to four methods.
enable: Indicates that the password that is configured using the enable command is used for authentication.
local: Indicates that the local user database is used for authentication.
none: Indicates that authentication is not performed.
group: Indicates that a server group is used for authentication. Currently, the RADIUS and TACACS+
server groups are supported.

Command

Global configuration mode

Mode
Usage Guide

If the AAA login authentication service is enabled on the NAS, users must perform Enable authentication
negotiation through AAA. Run the aaa authentication enable command to configure the default or optional
method lists for Enable authentication.
In a method list, the next method is executed only when the current method does not receive response.



Setting the Maximum Number of Login Attempts

Commandaaa local authentication attempts max-attempts

Parametermax-attempts: Indicates the maximum number of login attempts. The value ranges from 1 to 2,147,483,647.

Description
Command

Global configuration mode

Mode
Usage GuideUse this command to set the maximum number of times a user can attempt to login.

Setting the Maximum Lockout Time After a Login Failure

Commandaaa local authentication lockout-time lockout-timeParameter

lockout-time: Indicates the time during which a user is locked after entering wrong passwords up to the

Description

specified times. The value ranges from 1 to 43200, in the unit of minutes.

Command

Global configuration mode

Mode
Usage Guide

Use this command to set the maximum time during which a user is locked after entering wrong passwords
up to the specified times.

1-11

Configuration Guide

Configuring AAA(beta)

Configuration
Example

Configuring AAA Login Authentication

Configure a login authentication method list on the NAS containing group radius and local methods in order.
Scenario

10.1.1.1

Gi 0/17

Figure 1-3
User

Gi 0/18

NAS

ServerConfiguration

Step 1: Enable AAA.

Steps

Step 2: Configure a RADIUS or TACACS+ server in advance if group-server authentication needs to be
implemented. Configure the local user database information on the NAS if local authentication needs to be
implemented. (This example requires the configuration of a RADIUS server and local database information.)
Step 3: Configure an AAA authentication method list for login authentication users. (This example uses
group radius and local in order.)Step 4: Apply the configured method list to an interface or line. Skip this step if the default authentication
method is used.

NAS

Ruijie#configure terminal
Ruijie(config)#username user password

pass

Ruijie(config)#aaa new-model
Ruijie(config)#radius-server host 10.1.1.1
Ruijie(config)#radius-server key ruijie
Ruijie(config)#aaa authentication login list1 group radius local
Ruijie(config)#line vty 0 20
Ruijie(config-line)#login authentication list1
Ruijie(config-line)#exit

Verification

Run the show aaa method-list command on the NAS to display the configuration.

NAS

Ruijie#show aaa method-list

Authentication method-list:
aaa authentication login list1 group radius local

Accounting method-list:

Authorization method-list:
Assume that a user remotely logs in to the NAS through Telnet. The user is prompted to enter the username

1-12Configuration Guide

Configuring AAA(beta)

and password on the CLI.
The user must enter the correct username and password to access the NAS.
User

User Access Verification

Username:user
Password:pass

Configuring AAA Enable Authentication

Configure an Enable authentication method list on the NAS containing group radius, local, and then enable methods inorder.
Scenario

10.1.1.1

Gi 0/17

Figure 1-4
User

Gi 0/18

NAS

ServerConfiguration

Step 1: Enable AAA.

Steps

Step 2: Configure a RADIUS or TACACS+ server in advance if group-server authentication needs to be
implemented. Configure the local user database information on the NAS if local authentication needs to be
implemented. Configure Enable authentication passwords on the NAS if you use Enable password
authentication.
Step 3: Configure an AAA authentication method list for Enable authentication users.
You can define only one Enable authentication method list globally. You do not need to define the list
name but just default it. After that, it will be applied automatically.

NAS

Ruijie#configure terminal
Ruijie(config)#username user privilege 15 password pass
Ruijie(config)#enable secret w
Ruijie(config)#aaa new-model
Ruijie(config)#radius-server host 10.1.1.1
Ruijie(config)#radius-server key ruijie
Ruijie(config)#aaa authentication enable default group radius local enable

Verification

Run the show aaa method-list command on the NAS to display the configuration.

NAS

Ruijie#show aaa method-list

Authentication method-list:
aaa authentication enable default group radius local enable

1-13Configuration Guide

Configuring AAA(beta)

Accounting method-list:

Authorization method-list:

The CLI displays an authentication prompt when the user level is updated to level 15. The user must enter
the correct username and password to access the NAS.
NAS

Ruijie>enable
Username:user
Password:pass
Ruijie#Common Errors


No RADIUS server or TACACS+ server is configured.



Usernames and passwords are not configured in the local database.

1.4.2 Configuring AAA Authorization
Configuration Effect

Determine what services or permissions authenticated users can enjoy.

Notes


EXEC authorization is often used with login authentication, which can be implemented on the same line.
Authorization and authentication can be performed using different methods and servers. Therefore, the results of thesame user may be different. If a user passes login authentication but fails in EXEC authorization, the user cannot
enter the CLI.



The authorization methods in an authorization scheme are executed in accordance with the method configuration
sequence. The next authorization method is executed only when the current method does not receive response. If
authorization fails using a method, the next method will be not tried.

Command authorization is supported only by TACACS+.



Console authorization: The RGOS can differentiate between the users who log in through the Console and the users
who log in through other types of clients. You can enable or disable command authorization for the users who log inthrough the Console. If command authorization is disabled for these users, the command authorization method list
applied to the Console line no longer takes effect.

Configuration Steps

Enabling AAA



Mandatory.



Run the aaa new-model command to enable AAA.



By default, AAA is disabled.

1-14

Configuration Guide

Configuring AAA(beta)Defining a Method List of EXEC Authorization



Run the aaa authorization exec command to configure a method list of EXEC authorization.

This configuration is mandatory if you need to configure an EXEC authorization method list (including theconfiguration of the default method list).



By default, no EXEC authorization method list is configured.
The default access permission level of EXEC users is the lowest. (Console users can connect to the NAS throughthe Console port or Telnet. Each connection is counted as an EXEC user, for example, a Telnet user and SSH user.)

Defining a Method List of Command Authorization



Run the aaa authorization commands command to configure a method list of command authorization.

This configuration is mandatory if you need to configure a command authorization method list (including theconfiguration of the default method list).



By default, no command authorization method list is configured.

Configuring a Method List of Network Authorization



Run the aaa authorization network command to configure a method list of network authorization.

This configuration is mandatory if you need to configure a network authorization method list (including theconfiguration of the default method list).



By default, no authorization method is configured.



Applying EXEC Authorization Methods to a Specified VTY LineRun the authorization exec command in line configuration mode to apply EXEC authorization methods to a
specified VTY line.

This configuration is mandatory if you need to apply an EXEC authorization method list to a specified VTY line.



By default, all VTY lines are associated with the default authorization method list.

Applying Command Authorization Methods to a Specified VTY LineRun the authorization commands command in line configuration mode to apply command authorization methods
to a specified VTY line.

This configuration is mandatory if you need to apply a command authorization method list to a specified VTY line.



By default, all VTY lines are associated with the default authorization method list.

Enabling Authorization for Commands in Configuration ModesRun the aaa authorization config-commands command to enable authorization for commands in configuration
modes.



By default, authorization is disabled for commands in configuration modes.

Enabling Authorization for the Console to Run Commands

Run the aaa authorization console command to enable authorization for console users to run commands.



By default, authorization is disabled for the Console to run commands.

1-15

Configuration Guide

Configuring AAA(beta)

Verification
Run the show running-config command to verify the configuration.

Related Commands

Enabling AAA

Commandaaa new-modelParameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

To enable the AAA services, run this command. None of the rest of AAA commands can be effective if AAA
is not enabled.

Defining a Method List of EXEC Authorization

Commandaaa authorization exec { default | list-name } method1 [ method2...]

Parameter

default: With this parameter used, the configured method list will be defaulted.

Description

list-name: Indicates the name of an EXEC authorization method list in characters.
method: Specifies authentication methods from local, none, and group. A method list contains up to four
methods.
local: Indicates that the local user database is used for EXEC authorization.
none: Indicates that EXEC authorization is not performed.
group: Indicates that a server group is used for EXEC authorization. Currently, the RADIUS and TACACS+
server groups are supported.

Command

Global configuration mode

Mode
Usage Guide

The RGOS supports authorization of the users who log in to the CLI of the NAS to assign the users CLI
operation permission levels (0 to 15). Currently, EXEC authorization is performed only on the users who
have passed login authentication. If a user fails in EXEC authorization, the user cannot enter the CLI.
After you configure EXEC authorization methods, apply the methods to the VTY lines that require EXEC
authorization; otherwise, the methods will not take effect.

Defining a Method List of Command Authorization

Commandaaa authorization commands level { default | list-name } method1 [ method2...]

Parameter

default: With this parameter used, the configured method list will be defaulted.

Description

list-name: Indicates the name of a command authorization method list in characters.
method: Indicates authentication methods from none and group. A method list contains up to four methods.
none: Indicates that command authorization is not performed.
group: Indicates that a server group is used for command authorization. Currently, the TACACS+ servergroup is supported.

Command

Global configuration mode

Mode
Usage Guide

The RGOS supports authorization of the commands executable by users. When a user enters a command,
AAA sends the command to the authentication server. If the authentication server permits the execution, the

1-16

Configuration Guide

Configuring AAA(beta)

command is executed. If the authentication server forbids the execution, the command is not executed and amessage is displayed showing that the execution is rejected.
When you configure command authorization, specify the command level, which is used as the default level.
(For example, if a command above Level 14 is visible to users, the default level of the command is 14.)After you configure command authorization methods, apply the methods to the VTY lines that requirecommand authorization; otherwise, the methods will not take effect.

Configuring a Method List of Network Authorization

Commandaaa authorization network { default | list-name } method1 [ method2...]

Parameter

default: With this parameter used, the configured method list will be defaulted.

Description

list-name: Indicates the name of a network authorization method list in characters.
method: Indicates authentication methods from none and group. A method list contains up to four methods.
none: Indicates that authentication is not performed.
group: Indicates that a server group is used for network authorization. Currently, the RADIUS andTACACS+ server groups are supported.

Command

Global configuration mode

Mode
Usage Guide

The RGOS supports authorization of network-related service requests such as PPP and SLIP requests.
After authorization is configured, all authenticated users or interfaces are authorized automatically.
You can configure three different authorization methods. The next authorization method is executed only
when the current method does not receive response. If authorization fails using a method, the next method
will be not tried.
RADIUS or TACACS+ servers return a series of AV pairs to authorize authenticated users. Network
authorization is based on authentication. Only authenticated users can perform network authorization.

Enabling Authorization for Commands in Configuration Modes (Including the Global Configuration Modeand Sub-Modes)

Commandaaa authorization config-commands

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

If you need to enable authorization for commands only in non-configuration modes (for example, privileged
EXEC mode), disable authorization in configuration modes by using the no form of this command. Then
users can run commands in configuration mode and sub-modes without authorization.

Enabling Authorization for the Console to Run Commands

Commandaaa authorization console

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

The RGOS can differentiate between the users who log in through the Console and the users who log in

1-17

Configuration Guide

Configuring AAA(beta)

through other types of clients. You can enable or disable command authorization for the users who log inthrough the Console. If command authorization is disabled for these users, the command authorization
method list applied to the Console line no longer takes effect.

Configuration
Example

Configuring AAA EXEC Authorization

Configure login authentication and EXEC authorization for users on VTY lines 0 to 4. Login authentication is performed inlocal mode, and EXEC authorization is performed on a RADIUS server. If the RADIUS server does not respond, users are
redirected to the local authorization.
Scenario

10.1.1.1

Gi 0/17

Figure 1-6
User

Gi 0/18

NAS

ServerConfiguration

Step 1: Enable AAA.

Steps

Step 2: Configure a RADIUS or TACACS+ server in advance if remote server-group authorization needs tobe implemented. If local authorization needs to be implemented, configure the local user database
information on the NAS.
Step 3: Configure an AAA authorization method list according to different access modes and service types.
Step 4: Apply the configured method list to an interface or line. Skip this step if the default authorization
method is used.
EXEC authorization is often used with login authentication, which can be implemented on the same line.

NAS

Ruijie#configure terminal
Ruijie(config)#username user password

pass

Ruijie(config)#username user privilege 6
Ruijie(config)#aaa new-model
Ruijie(config)#radius-server host 10.1.1.1
Ruijie(config)#radius-server key test
Ruijie(config)#aaa authentication login list1 group local
Ruijie(config)#aaa authorization exec list2 group radius local
Ruijie(config)#line vty 0 4
Ruijie(config-line)#login authentication list1
Ruijie(config-line)# authorization exec list2
Ruijie(config-line)#exit

Verification

Run the show run and show aaa method-list commands on the NAS to display the configuration.

NAS

Ruijie#show aaa method-list

1-18

Configuration Guide

Configuring AAA(beta)

Authentication method-list:
aaa authentication login list1 group local

Accounting method-list:

Authorization method-list:
aaa authorization exec list2 group radius local
Ruijie# show running-config
aaa new-model!
aaa authorization exec list2 group local
aaa authentication login list1 group radius local!
username user password

passusername user privilege 6!
radius-server host 10.1.1.1
radius-server key 7 093b100133!
line con 0line vty 0 4
authorization exec list2
login authentication list1
!
End



Configuring AAA Command Authorization

Provide command authorization for login users according to the following default authorization method: Authorize level-15
commands first by using a TACACS+ server. If the TACACS+ server does not respond, local authorization is performed.
Authorization is applied to the users who log in through the Console and the users who log in through other types ofclients.
Scenario

10.1.1.1

Gi 0/17

Figure 1-7
User

Gi 0/18

NAS

Server

1-19

Configuration Guide

Configuring AAA(beta)

Configuration

Step 1: Enable AAA.

Steps

Step 2: Configure a RADIUS or TACACS+ server in advance if remote server-group authorization needs tobe implemented. If local authorization needs to be implemented, configure the local user database
information on the NAS.
Step 3: Configure an AAA authorization method list according to different access modes and service types.
Step 4: Apply the configured method list to an interface or line. Skip this step if the default authorization
method is used.

NAS

Ruijie#configure terminal
Ruijie(config)#username user1 password pass1
Ruijie(config)#username user1 privilege 15
Ruijie(config)#aaa new-model
Ruijie(config)#tacacs-server host 192.168.217.10
Ruijie(config)#tacacs-server key aaa
Ruijie(config)#aaa authentication login default local
Ruijie(config)#aaa authorization commands 15 default group tacacs+ local
Ruijie(config)#aaa authorization console

Verification

Run the show run and show aaa method-list commands on the NAS to display the configuration.

NAS

Ruijie#show aaa method-list

Authentication method-list:
aaa authentication login default local

Accounting method-list:

Authorization method-list:
aaa authorization commands 15 default group tacacs+ local
Ruijie#show run!
aaa new-model!
aaa authorization console
aaa authorization commands 15 default group tacacs+ local
aaa authentication login default local!

1-20

Configuration Guide

Configuring AAA(beta)

!
nfpp
!
vlan 1!
username user1 password 0 pass1
username user1 privilege 15
no service password-encryption!
tacacs-server host 192.168.217.10
tacacs-server key aaa!
line con 0line vty 0 4
!
!
end



Configuring AAA Network Authorization

Scenario

10.1.1.1

Gi 0/17

Figure 1-8
User

Gi 0/18

NAS

ServerConfiguration

Step 1: Enable AAA.

Steps

Step 2: Configure a RADIUS or TACACS+ server in advance if remote server-group authorization needs tobe implemented. If local authorization needs to be implemented, configure the local user database
information on the NAS.
Step 3: Configure an AAA authorization method list according to different access modes and service types.
Step 4: Apply the configured method list to an interface or line. Skip this step if the default authorization
method is used.

NAS

Ruijie#configure terminal
Ruijie(config)#aaa new-model
Ruijie(config)#radius-server host 10.1.1.1
Ruijie(config)#radius-server key test
Ruijie(config)#aaa authorization network default group radius none
Ruijie(config)# end

1-21

Configuration Guide

Configuring AAA(beta)

Verification

Run the show aaa method-list command on the NAS to display the configuration.

NAS

Ruijie#show aaa method-list

Authentication method-list:

Accounting method-list:

Authorization method-list:
aaa authorization network default group radius none

Common Errors
N/A

1.4.3 Configuring AAA Accounting
Configuration EffectRecord the network resource usage of users.



Record the user login and logout processes and the commands executed by users during device management.

Notes
About accounting methods:

If an accounting scheme contains multiple accounting methods, these methods are executed according to themethod configuration sequence. The next accounting method is executed only when the current method does notreceive response. If accounting fails using a method, the next method will be not tried.

After the default accounting method list is configured, it is applied to all VTY lines automatically. If a non-default
accounting method list is applied to a line, it will replace the default one. If you apply an undefined method list to aline, the system will display a message indicating that accounting on this line is ineffective. Accounting will take effectonly when a defined method list is applied.

EXEC accounting:

EXEC accounting is performed only when login authentication on the NAS is completed. EXEC accounting is not
performed if login authentication is not configured or the none method is used for authentication. If Start accounting
is not performed for a user upon login, Stop accounting will not be performed when the user logs out.

Command accountingOnly the TACACS+ protocol supports command accounting.

Configuration Steps

Enabling AAA



Mandatory.

1-22

Configuration Guide

Configuring AAA(beta)Run the aaa new-model command to enable AAA.



By default, AAA is disabled.

Defining a Method List of EXEC AccountingRun the aaa accounting exec command to configure a method list of EXEC accounting.

This configuration is mandatory if you need to configure an EXEC accounting method list (including the configurationof the default method list).

The default access permission level of EXEC users is the lowest. (Console users can connect to the NAS throughthe Console port or Telnet. Each connection is counted as an EXEC user, for example, a Telnet user and SSH user.)

By default, no EXEC accounting method list is configured.

Defining a Method List of Command AccountingRun the aaa accounting commands command to configure a method list of command accounting.

This configuration is mandatory if you need to configure a command accounting method list (including theconfiguration of the default method list).



By default, no command accounting method list is configured. Only the TACACS+ protocol supports commandaccounting.



Applying EXEC Accounting Methods to a Specified VTY LineRun the accounting exec command in line configuration mode to apply EXEC accounting methods to a specified
VTY line.

This configuration is mandatory if you need to apply an EXEC accounting method list to a specified VTY line.

You do not need to run this command if you apply the default method list.



By default, all VTY lines are associated with the default accounting method list.

Applying Command Accounting Methods to a Specified VTY LineRun the accounting commands command in line configuration mode to apply command accounting methods to a
specified VTY line.

This configuration is mandatory if you need to apply a command accounting method list to a specified VTY line.

You do not need to run this command if you apply the default method list.



By default, all VTY lines are associated with the default accounting method list.

Applying 802.1X Network Accounting Methods

Run the dot1x accounting network command to configure 802.1X network accounting methods.

This configuration is mandatory if you need to specify 802.1X network accounting methods.

You do not need to run this command if you apply the default method list.



By default, all VTY lines are associated with the default accounting method list.

Enabling Accounting Update

Optional.

1-23

Configuration Guide

Configuring AAA(beta)

It is recommended that accounting update be configured for improved accounting accuracy.



By default, accounting update is disabled.

Configuring the Accounting Update Interval

Optional.



It is recommended that the accounting update interval not be configured unless otherwise specified.

Verification
Run the show running-config command to verify the configuration.

Related Commands

Enabling AAA

Commandaaa new-modelParameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

To enable the AAA services, run this command. None of the rest of AAA commands can be effective if AAA
is not enabled.

Defining a Method List of EXEC Accounting

Commandaaa accounting exec { default | list-name } start-stop method1 [ method2...]

Parameter

default: With this parameter used, the configured method list will be defaulted.

Description

list-name: Indicates the name of an EXEC accounting method list in characters.
method: Indicates authentication methods from none and group. A method list contains up to four methods.
none: Indicates that EXEC accounting is not performed.
group: Indicates that a server group is used for EXEC accounting. Currently, the RADIUS and TACACS+
server groups are supported.

Command

Global configuration mode

Mode
Usage Guide

The RGOS enables EXEC accounting only when login authentication is completed. EXEC accounting is not
performed if login authentication is not performed or the none authentication method is used.
After accounting is enabled, when a user logs in to the CLI of the NAS, the NAS sends a start-accounting
message to the authentication server. When the user logs out, the NAS sends a stop-accounting message
to the authentication server. If the NAS does not send a start-accounting message when the user logs in, theNAS will not send a stop-accounting message when the user logs out.
After you configure EXEC accounting methods, apply the methods to the VTY lines that require EXEC
accounting; otherwise, the methods will not take effect.

Defining a Method List of Command Accounting

Commandaaa accounting commands level { default | list-name } start-stop method1 [ method2...]

Parameterlevel: Indicates the command level for which accounting will be performed. The value ranges from 0 to 15.

Description

After a command of the configured level is executed, the accounting server records related information

1-24

Configuration Guide

Configuring AAA(beta)

based on the received accounting packet.
default: With this parameter used, the configured method list will be defaulted.
list-name: Indicates the name of a command accounting method list in characters.
method: Indicates authentication methods from none and group. A method list contains up to four methods.
none: Indicates that command accounting is not performed.
group: Indicates that a server group is used for command accounting. Currently, the TACACS+ servergroup is supported.
Command

Global configuration mode

Mode
Usage Guide

The RGOS enables command accounting only when login authentication is completed. Commandaccounting is not performed if login authentication is not performed or the none authentication method isused. After accounting is enabled, the NAS records information about the commands of the configured levelthat users run and sends the information to the authentication server.
After you configure command accounting methods, apply the methods to the VTY lines that requirecommand accounting; otherwise, the methods will not take effect.

Defining a Method List of Network Accounting

Commandaaa accounting network { default | list-name } start-stop method1 [ method2...]

Parameter

default: With this parameter used, the configured method list will be defaulted.

Description

list-name: Indicates the name of a network accounting method list in characters.
start-stop: Indicates that a start-accounting message and a stop-accounting message are sent when a user
accesses a network and when the user disconnects from the network respectively. The start-accounting
message indicates that the user is allowed to access the network, regardless of whether accounting is
successfully enabled.
method: Indicates authentication methods from none and group. A method list contains up to four methods.
none: Indicates that network accounting is not performed.
group: Indicates that a server group is used for network accounting. Currently, the RADIUS and TACACS+
server groups are supported.

Command

Global configuration mode

Mode
Usage Guide

The RGOS sends record attributes to the authentication server to perform accounting of user activities. The
start-stop keyword is used to configure user accounting options.



Enabling Accounting Update

Commandaaa accounting update

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Accounting update cannot be used if the AAA services are not enabled. After the AAA services are enabled,
run this command to enable accounting update.

Configuring the Accounting Update IntervalCommandaaa accounting update periodic interval

1-25Configuration Guide
Parameter

Configuring AAA(beta)

Interval: Indicates the accounting update interval, in the unit of minutes. The shortest is 1 minute.

Description
Command

Global configuration mode

Mode
Usage Guide

Accounting update cannot be used if the AAA services are not enabled. After the AAA services are enabled,
run this command to configure the accounting update interval.

Configuration
Example

Configuring AAA EXEC Accounting

Configure login authentication and EXEC accounting for users on VTY lines 0 to 4. Login authentication is performed inlocal mode, and EXEC accounting is performed on a RADIUS server.
Scenario

10.1.1.1

Gi 0/17

Figure 1-9
User

Gi 0/18

NAS

ServerConfiguration

Step 1: Enable AAA.

Steps

If remote server-group accounting needs to be implemented, configure a RADIUS or TACACS+ server inadvance.
Step 2: Configure an AAA accounting method list according to different access modes and service types.
Step 3: Apply the configured method list to an interface or line. Skip this step if the default accounting
method is used.

NAS

Ruijie#configure terminal
Ruijie(config)#username user password

pass

Ruijie(config)#aaa new-model
Ruijie(config)#radius-server host 10.1.1.1
Ruijie(config)#radius-server key test
Ruijie(config)#aaa authentication login list1 group local
Ruijie(config)#aaa accounting exec list3 start-stop group radius
Ruijie(config)#line vty 0 4
Ruijie(config-line)#login authentication list1
Ruijie(config-line)# accounting

exec list3

Ruijie(config-line)#exit

Verification

Run the show run and show aaa method-list commands on the NAS to display the configuration.

NAS

Ruijie#show aaa method-list

1-26

Configuration Guide

Configuring AAA(beta)

Authentication method-list:
aaa authentication login list1 group local

Accounting method-list:
aaa accounting exec list3 start-stop group radius
Authorization method-list:
Ruijie# show running-config
aaa new-model!
aaa accounting exec list3 start-stop group radius
aaa authentication login list1 group local!
username user password

pass!
radius-server host 10.1.1.1
radius-server key 7 093b100133!
line con 0line vty 0 4
accounting exec list3
login authentication list1
!
End



Configuring AAA Command Accounting

Configure command accounting for login users according to the default accounting method. Login authentication is
performed in local mode, and command accounting is performed on a TACACS+ server.
Scenario

10.1.1.1

Gi 0/17

Figure 1-10
User

Gi 0/18

NAS

ServerConfiguration

Step 1: Enable AAA.

Steps

If remote server-group accounting needs to be implemented, configure a RADIUS or TACACS+ server inadvance.

1-27

Configuration Guide

Configuring AAA(beta)

Step 2: Configure an AAA accounting method list according to different access modes and service types.
Step 3: Apply the configured method list to an interface or line. Skip this step if the default accounting
method is used.
NAS

Ruijie#configure terminal
Ruijie(config)#username user1 password pass1
Ruijie(config)#username user1 privilege 15
Ruijie(config)#aaa new-model
Ruijie(config)#tacacs-server host 192.168.217.10
Ruijie(config)#tacacs-server key aaa
Ruijie(config)#aaa authentication login default local
Ruijie(config)#aaa accounting commands 15 default start-stop group tacacs+

Verification

Run the show aaa method-list command on the NAS to display the configuration.

NAS

Ruijie#show aaa method-list

Authentication method-list:
aaa authentication login default local

Accounting method-list:
aaa accounting commands 15 default start-stop group tacacs+
Authorization method-list:

Ruijie#show run!
aaa new-model!
aaa authorization config-commands
aaa accounting commands 15 default start-stop group tacacs+
aaa authentication login default local
!
!
nfpp
!
vlan 1

1-28

Configuration Guide

Configuring AAA(beta)!
username user1 password 0 pass1
username user1 privilege 15
no service password-encryption!
tacacs-server host 192.168.217.10
tacacs-server key aaa!
line con 0line vty 0 4!
!
endCommon Errors
N/A

1.4.4 Configuring AAA Logging
Configuration EffectWhen users pass AAA authentication, the device will output logs. Configure this function to disable AAA logging or
configure AAA logging rate limit.

Notes
N/A

Configuration Steps

Enable AAA Logging

AAA logging is enabled by default.



Configuring AAA Logging Rate LimitThe default rate limit is 5 syslogs per second.

Verification
Run the show run command to verify the configuration.

Related Commands

Enabling AAA Logging

1-29

Configuration Guide

Command[ no ] aaa log enable

Parameter

N/A

Configuring AAA(beta)

Description
Command

Global configuration mode

Mode
Usage Guide

Too much printing may flood the screen or even reduce device performance. In this case, use this command
to disable logging.

Configuring AAA Logging Rate Limit

Commandaaa log rate-limit num
no aaa log rate-limit

Parameter
Description

num: The number of syslog entries printed per second. The range is from 0 to 65,535.
0: 0 indicates no rate limit is configured. The range is from 0 to 65,535.
The default rate limit is 5 syslogs per second.

Command

Global configuration mode

Mode
Usage Guide

Too much printing may flood the screen or even reduce device performance. In this case, use this command
to adjust the printing rate.

Common Errors
N/A

1.4.5 Configuring an AAA Server Group
Configuration EffectCreate a user-defined server group and add one or more servers to the group.

When you configure authentication, authorization, and accounting method lists, name the methods after the servergroup name so that the servers in the group are used to handle authentication, authorization, and accounting
requests.

Use self-defined server groups to separate authentication, authorization, and accounting.

Notes
In a user-defined server group, you can specify and apply only the servers in the default server group.

Configuration Steps

Creating a User-Defined AAA Server Group

Mandatory.

1-30

Configuration GuideConfiguring AAA(beta)

Assign a meaningful name to the user-defined server group. Do not use the predefined radius and tacacs+
keywords in naming.

Adding an AAA Server Group Member

Mandatory.



Run the server command to add AAA server group members.



By default, a user-defined server group does not have servers.

Verification
Run the show aaa group command to verify the configuration.

Related Commands



Creating a User-Defined AAA Server Group

Commandaaa group server { radius | tacacs+ } nameParameter

name: Indicates the name of the server group to be created. The name must not contain the radius and

Description

tacacs+ keywords because they are the names of the default RADIUS and TACACS+ server groups.

Command

Global configuration mode

Mode
Usage Guide

Use this command to configure an AAA server group. Currently, the RADIUS and TACACS+ server groups
are supported.

Adding an AAA Server Group Member

Commandserver ip-addr [ auth-port port1 ] [ acct-port port2 ]Parameter

ip-addr: Indicates the IP address of a server.

Description

port1: Indicates the authentication port of a server. (This parameter is supported only by the RADIUS servergroup.)
port2: Indicates the accounting port of a server. (This parameter is supported only by the RADIUS servergroup.)

CommandServer group configuration mode

Mode
Usage Guide

When you add servers to a server group, the default ports are used if you do not specify ports.

Configuration
Example

Creating an AAA Server Group

Create RADIUS server groups named g1 and g2. The IP addresses of the servers in g1 are 10.1.1.1 and 10.1.1.2, and theIP addresses of the servers in g2 are 10.1.1.3 and 10.1.1.4.

1-31

Configuration Guide

Configuring AAA(beta)

Scenario
Figure 1-11

Prerequisites

1. The required interfaces, IP addresses, and VLANs have been configured on the network,

network connections have been set up, and the routes from the NAS to servers arereachable.
2.

Enable AAA.

Configuration

Step 1: Configure a server (which belongs to the default server group).

Steps

Step 2: Create user-defined AAA server groups.
Step 3: Add servers to the AAA server groups.

NAS

Ruijie#configure terminal
Ruijie(config)#radius-server host 10.1.1.1
Ruijie(config)#radius-server host 10.1.1.2
Ruijie(config)#radius-server host 10.1.1.3
Ruijie(config)#radius-server host 10.1.1.4
Ruijie(config)#radius-server key secretRuijie(config)#aaa group server radius g1
Ruijie(config-gs-radius)#server 10.1.1.1
Ruijie(config-gs-radius)#server 10.1.1.2
Ruijie(config-gs-radius)#exit
Ruijie(config)#aaa group server radius g2
Ruijie(config-gs-radius)#server 10.1.1.3
Ruijie(config-gs-radius)#server 10.1.1.4
Ruijie(config-gs-radius)#exit

Verification

Run the show aaa group and show run commands on the NAS to display the configuration.

NAS

Ruijie#show aaa group
Type

Reference

Name

1-32

Configuration Guide

Configuring AAA(beta)---------- ---------- ---------radius

1

radiustacacs+1

tacacs+radius1

g1

radius1

g2

Ruijie#show run!
radius-server host 10.1.1.1
radius-server host 10.1.1.2
radius-server host 10.1.1.3
radius-server host 10.1.1.4
radius-server key secret!
aaa group server radius g1
server 10.1.1.1
server 10.1.1.2!
aaa group server radius g2
server 10.1.1.3
server 10.1.1.4!
!

Common Errors


For RADIUS servers that use non-default authentication and accounting ports, when you run the server command to
add servers, specify the authentication or accounting port.

1.5 Monitoring
Clearing
Description

CommandClears the locked users.

clear aaa local user lockout { all | user-name username }Displaying
Description

Command

Displays the accounting update information.

show aaa accounting update

1-33

Configuration Guide

Configuring AAA(beta)

Displays the current lockout configuration.

show aaa lockout

Displays the AAA server groups.

show aaa group

Displays the AAA method lists.

show aaa method-list

Displays the AAA users.

show aaa user

1-34

Configuration Guide

Configuring RADIUS(beta)

2 Configuring RADIUS(beta)
2.1 Overview
The Remote Authentication Dial-In User Service (RADIUS) is a distributed client/server system.
RADIUS works with the Authentication, Authorization, and Accounting (AAA) to conduct identity authentication on users
who attempt to access a network, to prevent unauthorized access. In RGOS implementation, a RADIUS client runs on a
device or Network Access Server (NAS) and transmits identity authentication requests to the central RADIOUS server,where all user identity authentication information and network service information are stored. In addition to theauthentication service, the RADIUS server provides authorization and accounting services for access users.
RADIUS is often applied in network environments that have high security requirements and allow the access of remoteusers. RADIUS is a completely open protocol and the RADIUS server is installed on many operating systems as acomponent, for example, on UNIX, Windows 2000, and Windows 2008. Therefore, RADIUS is the most widely applied
security server currently.
The Dynamic Authorization Extensions to Remote Authentication Dial In User Service is defined in the IETF RFC3576.
This protocol defines a user offline management method. Devices communicate with the RADIUS server through the
Disconnect-Messages (DMs) to bring authenticated users offline. This protocol implements compatibility between devicesof different vendors and the RADIUS server in terms of user offline processing.
In the DM mechanism, the RADIUS server actively initiates a user offline request to a device, the device locates a user
according to the user session information, user name, and other information carried in the request and brings the user
offline. Then, the device returns a response packet that carries the processing result to the RADIUS server, thereby
implementing user offline management of the RADIUS server.

Protocols andStandards


RFC2865: Remote Authentication Dial In User Service (RADIUS)RFC2866: RADIUS Accounting



RFC2867: RADIUS Accounting Modifications for Tunnel Protocol Support



RFC2868: RADIUS Attributes for Tunnel Protocol Support



RFC2869: RADIUS Extensions



RFC3576: Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)

2.2 Applications
Application

Description

Forcing Users to Go Offline

The server forces an authenticated user to go offline.

2-1

Configuration Guide

Configuring RADIUS(beta)

2.2.1 Forcing Users to Go Offline
Scenario
The RADIUS server forces authenticated online users to go offline for the sake of management.
See Figure 2-3 for the networking topology.

Deployment


Add the following deployment on the basis of 1.2.1 "Deployment".

Enable the RADIUS dynamic authorization extension function on the RADIUS client.

2.3 Features
Basic Concepts

Client/Server Mode

Client: A RADIUS client initiates RADIUS requests and usually runs on a device or NAS. It transmits user information
to the RADIUS server, receives responses from the RADIUS server, and performs processing accordingly. The
processing includes accepting user access, rejecting user access, or collecting more user information for the
RADIUS server.

Server: Multiple RADIUS clients map to one RADIUS server. The RADIUS server maintains the IP addresses andshared keys of all RADIUS clients as well as information on all authenticated users. It receives requests from a
RADIUS client, conducts authentication, authorization, and accounting, and returns processing information to the
RADIUS client.

Structure of RADIUS Packets

The following figure shows the structure of RADIUS packets.



Code: Identifies the type of RADIUS packets, which occupies one byte. The following table lists the values andmeanings.

Code

Packet Type

Code

Packet Type1

Access-Request

4

Accounting-Request

2

Access-Accept

5

Accounting-Response

2-2Configuration Guide
3



Configuring RADIUS(beta)
Access-Reject

11

Access-Challenge

Identifier: Indicates the identifier for matching request packets and response packets, which occupies one byte. The
identifier values of request packets and response packets of the same type are the same.



Length: Identifies the length of a whole RADIUS packet, which includes Code, Identifier, Length, Authenticator,and Attributes. It occupies two bytes. Bytes that are beyond the Length field will be truncated. If the length of areceived packet is smaller than the value of Length, the packet is discarded.



Authenticator: Verifies response packets of the RADIUS server by a RADIUS client, which occupies 16 bytes. This
field is also used for encryption/decryption of user passwords.



Attributes: Carries authentication, authorization, and accounting information, with the length unfixed. The Attributes
field usually contains multiple attributes. Each attribute is represented in the Type, Length, Value (TLV) format. Typeoccupies one byte and indicates the attribute type. The following table lists common attributes of RADIUS
authentication, authorization, and accounting. Length occupies one byte and indicates the attribute length, with theunit of bytes. Value indicates the attribute information.

Attribute No.

Attribute Name

Attribute No.

Attribute Name

1

User-Name

43

Acct-Output-Octets

2

User-Password

44

Acct-Session-Id

3

CHAP-Password

45

Acct-Authentic

4

NAS-IP-Address46

Acct-Session-Time

5

NAS-Port

47

Acct-Input-Packets

6Service-Type48

Acct-Output-Packets

7

Framed-Protocol

49

Acct-Terminate-Cause

8

Framed-IP-Address50

Acct-Multi-Session-Id

9

Framed-IP-Netmask

51

Acct-Link-Count

10

Framed-Routing

52

Acct-Input-Gigawords

11

Filter-ID

53

Acct-Output-Gigawords

12

Framed-MTU

55

Event-Timestamp

13

Framed-Compression60

CHAP-Challenge

14

Login-IP-Host

61

NAS-Port-Type

15

Login-Service

62

Port-Limit

16

Login-TCP-Port

63

Login-LAT-Port

18

Reply-Message

64

Tunnel-Type

19

Callback-Number

65

Tunnel-Medium-Type20

Callback-ID

66

Tunnel-Client-Endpoint

22

Framed-Route67

Tunnel-Server-Endpoint

23

Framed-IPX-Network

68

Acct-Tunnel-Connection

24

State

69

Tunnel-Password

25

Class

70

ARAP-Password

26

Vendor-Specific71

ARAP-Features

27

Session-Timeout

72

ARAP-Zone-Access28

Idle-Timeout

73

ARAP-Security

29

Termination-Action74

ARAP-Security-Data

30

Called-Station-Id

75

Password-Retry

2-3

Configuration Guide

Configuring RADIUS(beta)

Attribute No.

Attribute Name

Attribute No.

Attribute Name

31

Calling-Station-Id

76

Prompt32

NAS-Identifier

77

Connect-Info

33

Proxy-State

78

Configuration-Token

34

Login-LAT-Service

79

EAP-Message

35

Login-LAT-Node80

Message-Authenticator

36

Login-LAT-Group81

Tunnel-Private-Group-id

37

Framed-AppleTalk-Link

82

Tunnel-Assignment-id

38

Framed-AppleTalk-Network

83

Tunnel-Preference

39

Framed-AppleTalk-Zone

84

ARAP-Challenge-Response40

Acct-Status-Type85

Acct-Interim-Interval

41

Acct-Delay-Time

86

Acct-Tunnel-Packets-Lost

42

Acct-Input-Octets

87

NAS-Port-Id

Shared Key

A RADIUS client and a RADIUS server mutually confirm their identities by using a shared key during communication. The
shared key cannot be transmitted over a network. In addition, user passwords are encrypted for transmission for the sakeof security.



RADIUS Server GroupThe RADIUS security protocol, also called RADIUS method, is configured in the form of a RADIUS server group. EachRADIUS method corresponds to one RADIUS server group and one or more RADIUS severs can be added to one
RADIUS server group. For details about the RADIUS method, see the Configuring AAA. If you add multiple RADIUS
servers to one RADIUS server group, when the communication between a device and the first RADIUS server in thisgroup fails or the first RADIUS server becomes unreachable, the device automatically attempts to communicate with thenext RADIUS server till the communication is successful or the communication with all the RADIUS servers fails.



RADIUS Attribute TypeStandard attributes

The RFC standards specify the RADIUS attribute numbers and attribute content but do not specify the format of some
attribute types. Therefore, the format of attribute contents needs to be configured to adapt to different RADIUS server
requirements. Currently, the format of the RADIUS Calling-Station-ID attribute (attribute No.: 31) can be configured.
The RADIUS Calling-Station-ID attribute is used to identify user identities when a network device transmits request
packets to the RADIUS server. The RADIUS Calling-Station-ID attribute is a string, which can adopt multiple formats. It
needs to uniquely identify a user. Therefore, it is often set to the MAC address of a user. For example, when IEEE 802.1X
authentication is used, the Calling-Station-ID attribute is set to the MAC address of the device where the IEEE 802.1X
client is installed. The following table describes the format of MAC addresses.
FormatDescription
Indicates the standard format specified in the IETF standard (RFC3580), which is

Ietf

separated by the separator (-). Example:
00-D0-F8-33-22-AC

2-4

Configuration Guide

Configuring RADIUS(beta)
Indicates the common format that represents a MAC address (dotted hexadecimal

Normalformat), which is separated by the separator (.). Example:
00d0.f833.22ac
Indicates the format without separators. This format is used by default. Example:

Unformatted



00d0f83322ac

Private attributes

RADIUS is an extensible protocol. According to RFC2865, the Vendor-Specific attribute (attribute No.: 26) is used bydevice vendors to extend the RADIUS protocol to implement private functions or functions that are not defined in thestandard RADIUS protocol. Table 1-3 lists private attributes supported by Ruijie products. The TYPE column indicates thedefault configuration of private attributes of Ruijie products and the Extended TYPE column indicates the default
configuration of private attributes of other non-Ruijie products.
ID

Function

TYPE

Extended TYPE

1

max-down-rate

1

76

2

port-priority

2

77

3

user-ip3

3

4vlan-id4

4

5

last-supplicant-version

5

5

6

net-ip6

6

7

user-name7

7

8

password

8

8

9

file-directory

9

9

10

file-count

10

10

11

file-name-0

11

11

12

file-name-1

12

12

13

file-name-2

13

13

14

file-name-3

14

14

15

file-name-4

15

15

16

max-up-rate

16

16

17

current-supplicant-version

17

17

18

flux-max-high32

18

18

19

flux-max-low32

19

19

20

proxy-avoid

20

20

21

dailup-avoid

21

21

22

ip-privilege

22

22

23

login-privilege

42

42

26

ipv6-multicast-address

79

79

27

ipv4-multicast-address

87

87

62

sdg-type

62

62

85

sdg-zone-name

85

85

103

sdg-group-name

103

103

2-5

Configuration Guide

Configuring RADIUS(beta)

Overview
FeatureDescription

RADIUS Authentication,

Conducts identity authentication and accounting on access users, safeguards network

Authorization, and Accounting

security, and facilitates management for network administrators.

Source Address of RADIUS

Specifies the source IP address used by a RADIUS client to transmit packets to a RADIUS

Packets

server.

RADIUS Timeout

Specifies the packet retransmission parameter for a RADIUS client when a RADIUS server

Retransmission

does not respond to packets transmitted from the RADIUS client within a period of time.

RADIUS Server Accessibility

Enables a RADIUS client to actively detect whether a RADIUS server is reachable andDetection

maintain the accessibility of each RADIUS server. A reachable RADIUS server is selected
preferentially to improve the handling performance of RADIUS services.

RADIUS Forced Offline

Enables a RADIUS server to actively force authenticated users to go offline.

2.3.1 RADIUS Authentication, Authorization, and Accounting
Conduct identity authentication and accounting on access users, safeguard network security, and facilitate management
for network administrators.

Working Principle
Figure 2-1

The RADIUS authentication and authorization process is described as follows:1.

A user enters the user name and password and transmits them to the RADIUS client.

2-6

Configuration Guide
2.

Configuring RADIUS(beta)

After receiving the user name and password, the RADIUS client transmits an authentication request packet to the
RADIUS server. The password is encrypted for transmission. For the encryption method, see RFC2865.

3.

The RADIUS server accepts or rejects the authentication request according to the user name and password. When
accepting the authentication request, the RADIUS server also issues authorization information apart from theauthentication acceptance information. The authorization information varies with the type of access users.

The RADIUS accounting process is described as follows:4.

If the RADIUS server returns authentication acceptance information in Step (3), the RADIUS client sends anaccounting start request packet to the RADIUS server immediately.

5.

The RADIUS server returns the accounting start response packet, indicating accounting start.

6.

The user stops accessing network resources and requests the RADIUS client to disconnect the network connection.

7.

The RADIUS client transmits the accounting end request packet to the RADIUS server.

8.

The RADIUS server returns the accounting end response packet, indicating accounting end.

9.

The user is disconnected and cannot access network resources.

Related Configuration

Configuring RADIUS Server Parameters

No RADIUS server is configured by default.
You can run the radius-server host command to configure a RADIUS server.
At least one RADIUS server must be configured so that RADIUS services run normally.

Configuring the AAA Authentication Method List

No AAA authentication method list is configured by default.
You can run the aaa authentication command to configure a method list for different user types and select group radius
when setting the authentication method.
The RADIUS authentication can be conducted only after the AAA authentication method list of relevant user types isconfigured.

Configuring the AAA Authorization Method List

No AAA authorization method list is configured by default.
You can run the aaa authorization command to configure an authorization method list for different user types and selectgroup radius when setting the authorization method.
The RADIUS authorization can be conducted only after the AAA authorization method list of relevant user types isconfigured.

Configuring the AAA Accounting Method List

No AAA accounting method list is configured by default.
You can run the aaa accounting command to configure an accounting method list for different user types and selectgroup radius when setting the accounting method.
The RADIUS accounting can be conducted only after the AAA accounting method list of relevant user types is configured.

2-7

Configuration Guide

Configuring RADIUS(beta)

2.3.2 Source Address of RADIUS Packets
Specify the source IP address used by a RADIUS client to transmit packets to a RADIUS server.

Working Principle
When configuring RADIUS, specify the source IP address to be used by a RADIUS client to transmit RADIUS packets to a
RADIUS server, in an effort to reduce the workload of maintaining a large amount of NAS information on the RADIUS
server.

Related Configuration
The global routing is used to determine the source address for transmitting RADIUS packets by default.
Run the ip radius source-interface command to specify the source interface for transmitting RADIUS packets. The
device uses the first IP address of the specified interface as the source address of RADIUS packets.

2.3.3 RADIUS Timeout Retransmission
Working Principle
After a RADIUS client transmits a packet to a RADIUS server, a timer is started to detect the response of the RADIUS
server. If the RADIUS server does not respond within a certain period of time, the RADIUS client retransmits the packet.

Related Configuration

Configuring the RADIUS Server Timeout Time

The default timeout time is 5 seconds.
You can run the radius-server timeout command to configure the timeout time. The value ranges from 1 second to 1,000
seconds.
The response time of a RADIUS server is relevant to its performance and the network environment. Set an appropriate
timeout time according to actual conditions.



Configuring the Retransmission CountThe default retransmission count is 3.
You can run the radius-server retransmit command to configure the retransmission count. The value ranges from 1 to100.

Configuring Whether to Retransmit Accounting Update Packets

Accounting update packets are not retransmitted by default.
You can run the radius-server account update retransmit command to configure retransmission of accounting update
packets for authenticated users.

2.3.4 RADIUS Server Accessibility Detection
Working Principle
A RADIUS client actively detects whether a RADIUS server is reachable and maintains the accessibility of each RADIUS
server. A reachable RADIUS server is selected preferentially to improve the handling performance of RADIUS services.
2-8

Configuration Guide

Configuring RADIUS(beta)

Related Configuration

Configuring the Criteria for the Device to Judge That a RADIUS Server Is Unreachable

The default criteria configured for judging that a RADIUS server is unreachable meet the two conditions simultaneously: 1.
The device does not receive a correct response packet from the RADIUS security server within 60 seconds. 2. The device
transmits the request packet to the same RADIUS security server for consecutive 10 times.
You can run the radius-server dead-criteria command to configure the criteria for the device to judge that the RADIUS
security server is unreachable.

Configuring the Test User Name for Actively Detecting the RADIUS Security Server

No test user name is specified for actively detecting the RADIUS security server by default.
You can run the radius-server host x.x.x.x test username xxx command to configure the test user name.

2.3.5 RADIUS Forced Offline
Working Principle
Figure 2-2

DM Message Exchange of the RADIUS Dynamic Authorization Extension Protocol

The preceding figure shows the exchange of DM messages between the RADIUS server and the device. The RADIUS
server transmits the Disconnect-Request message to UDP Port 3799 of the device. After processing, the device returns
the Disconnect-Response message that carries the processing result to the RADIUS server.

Related Configuration
N/A

2.4 Configuration
Configuration

Description and Command(Mandatory) It is used to configure RADIUS authentication, authorization, andaccounting.
Configures the IP address of the remote RADIUS

radius-server hostsecurity server.

RADIUS Basic Configuration

Configures the shared key for communication

radius-server key

between the device and the RADIUS server.
Configures the request transmission count, after
which the device confirms that a RADIUS server is

radius-server retransmit

unreachable.

2-9Configuration Guide
Configuration

Configuring RADIUS(beta)
Description and Command
Configures the waiting time, after which the device

radius-server timeout

retransmits a request.

radius-server account update

Configures retransmission of accounting update

retransmit

packets for authenticated users.

ip radius source-interface

Configures the source address of RADIUS packets.

(Optional) It is used to define attribute processing adopted when the device
encapsulates and parses RADIUS packets.
radius-server attribute31

radius-server attribute classConfigures the MAC address format of RADIUS
attribute No. 31 (Calling-Station-ID).
Configures the parsing mode of the RADIUS Class
attribute.
Configures the RADIUS private attribute type.

radius attribute

Sets the private attribute port-priority issued by theConfiguring the RADIUS

server to the COS value of an interface. For

radius set qos cos

COS-relevant concepts, see the Configuring QoS.

Attribute Typeradius support cui

Configures the device to support the CUI attribute.

radius-server authentication

Configures whether RADIUS authentication request

attribute

packets carry a specified attribute.

radius-server account attribute

Configures whether RADIUS accounting request
packets carry a specified attribute.

radius-server authentication

Configures whether RADIUS authentication request

vendorpackets carry the private attributes of other vendors.

radius-server account vendor

Configures whether RADIUS accounting request
packets carry the private attributes of other vendors.

(Optional) It is used to detect whether a RADIUS server is reachable and maintain theaccessibility of the RADIUS server.
radius-server dead-criteria
Configuring RADIUS
Accessibility Detection

Configures the global criteria for judging that a
RADIUS security server is unreachable.
Configures the duration for the device to stoptransmitting request packets to an unreachable

radius-server deadtime

RADIUS server.
Configures the IP address of the remote RADIUS
security server, authentication port, accounting port,

radius-server hostand active detection parameters.

2.4.1 Providing Authentication, Authorization, and Accounting Services for Access
Users
Scenario
RADIUS is typically applied in the authentication, authorization, and accounting of access users. A network device serves
as a RADIUS client and transmits user information to a RADIUS server. After completing processing, the RADIUS server

2-10Configuration Guide

Configuring RADIUS(beta)

returns the authentication acceptance/authentication rejection/accounting response information to the RADIUS client. The
RADIUS client performs processing on the access user according to the response from the RADIUS server.
Figure 2-3 Typical RADIUS Networking Topology

Remarks

PC 1 and PC 2 are connected to the RADIUS client as access users in wired or wireless mode, and initiate
authentication and accounting requests.
The RADIUS client is usually an access switch or aggregate switch.
The RADIUS server can be a component built in the Windows 2000/2003, Server (IAS), or UNIX operating
system or dedicated server software provided by vendors.

Deployment
Configure access device information on the RADIUS server, including the IP address and shared key of the accessdevices.

Configure the AAA method list on the RADIUS client.

Configure the RADIUS server information on the RADIUS client, including the IP address and shared key.

Enable access control on the access port of the RADIUS client.

Configure the network so that the RADIUS client communicates with the RADIUS server successfully.

2.4.2 RADIUS Basic Configuration
Configuration EffectRADIUS authentication, authorization, and accounting can be conducted after RADIUS basic configuration iscomplete.

Notes

Before configuring RADIUS on the device, ensure that the network communication of the RADIUS server is in goodcondition.

When running the ip radius source-interface command to configure the source address of RADIUS packets,
ensure that the device of the source IP address communicates with the RADIUS server successfully.

When conducting RADIUS IPv6 authentication, ensure that the RADIUS server supports RADIUS IPv6
authentication.

Configuration Steps

Configuring the Remote RADIUS Security Server

Mandatory.

2-11

Configuration Guide

Configuring RADIUS(beta)Configure the IP address, authentication port, accounting port, and shard key of the RADIUS security server.

Configuring the Shared Key for Communication Between the Device and the RADIUS Server

Optional.

Configure a shared key in global configuration mode for servers without a shared key.
The shared key on the device must be consistent with that on the RADIUS server.

Configuring the Request Transmission Count, After Which the Device Confirms That a RADIUS Server Is
UnreachableOptional.

Configure the request transmission count, after which the device confirms that a RADIUS server is unreachable,according to the actual network environment.

Configuring the Waiting Time, After which the Device Retransmits a Request



Optional.

Configure the waiting time, after which the device retransmits a request, according to the actual network
environment.

Configuring Retransmission of Accounting Update Packets for Authenticated Users

Optional.



Determine whether to enable the function of retransmitting accounting update packets of authenticated users
according to actual requirements.

Configuring the Source Address of RADIUS Packets

Optional.

Configure the source address of RADIUS packets according to the actual network environment.

Verification
Configure the AAA method list that specifies to conduct authentication, authorization, and accounting on users byusing RADIUS.



Enable the device to interact with the RADIUS server. Conduct packet capture to confirm that the device
communicates with the RADIUS server over the RADIUS protocol.

Related Commands

Configuring the Remote RADIUS Security Server

Commandradius-server host { ipv4-address | ipv6-address } [ auth-port port-number ] [ acct-port port-number ][ test username name [ ignore-auth-port ] [ ignore-acct-port ] [ idle-time time ] ] [ key [ 0 | 7 ] text-string ]Parameteripv4-address: Indicates the IPv4 address of the RADIUS security server.

Description

Ipv6-address: Indicates the IPv6 address of the RADIUS security server.
auth-portport-number: Indicates the UDP port for RADIUS identity authentication. The value ranges from 0
to 65,535. If it is set to 0, the host does not conduct identity authentication.

2-12

Configuration Guide

Configuring RADIUS(beta)acct-port port-number: Indicates the UDP port for RADIUS accounting. The value ranges from 0 to 65,535.
If it is set to 0, the host does not conduct accounting.
test username name: Enables the function of actively detecting the RADIUS security server and specifies
the user name used for active detection.
ignore-auth-port: Disables the function of detecting the authentication port of the RADIUS security server.
It is enabled by default.
ignore-acct-port: Disables the function of detecting the accounting port of the RADIUS security server. It isenabled by default.
idle-timetime: Indicates the interval for the device to transmit test packets to a reachable RADIUS security
server. The default value is 60 minutes. The value ranges from 1 minute to 1,440 minutes (24 hours).
key[ 0 | 7 ] text-string : Configures the shared key of the server. The global shared key is used if it is notconfigured.
Command

Global configuration mode

Mode
Usage Guide

A RADIUS security server must be defined to implement the AAA security service by using RADIUS. You
can run the radius-server host command to define one or more RADIUS security servers.

Configuring the Shared Key for Communication Between the Device and the RADIUS Server

Commandradius-server key [ 0 | 7 ] text-string

Parameter

text-string: Indicates the text of the shared key.

Description

0 | 7: Indicates the encryption type of the key. The value 0 indicates no encryption and 7indicates simple
encryption. The default value is 0.

Command

Global configuration mode

Mode
Usage Guide

A shared key is the basis for correct communication between the device and the RADIUS security server.
The same shared key must be configured on the device and RADIUS security server so that they cancommunicate with each other successfully.

Configuring the Request Transmission Count, After Which the Device Confirms That a RADIUS Server Is
Unreachable

Commandradius-server retransmit retries

Parameter

retries: Indicates the RADIUS retransmission count. The value ranges from 1 to 100.

Description
Command

Global configuration mode

Mode
Usage Guide

The prerequisite for AAA to use the next user authentication method is that the current security server used
for authentication does not respond. The criteria for the device to judge that a security server does not
respond are that the security server does not respond within the RADIUS packet retransmission duration of
the specified retransmission count. There is an interval between consecutive two retransmissions.



Configuring the Waiting Time, After which the Device Retransmits a Request

Commandradius-server timeout seconds

Parameterseconds: Indicates the timeout time, with the unit of seconds. The value ranges from 0 second to 1,000

Description

seconds.

2-13

Configuration Guide
Command

Configuring RADIUS(beta)

Global configuration mode

Mode
Usage GuideUse this command to adjust the packet retransmission timeout time.

Configuring Retransmission of Accounting Update Packets for Authenticated Users

Commandradius-server account update retransmit

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Configure retransmission of accounting update packets for authenticated users. Accounting update packets
are not retransmitted by default. The configuration does not affect users of other types.

Configuration
Example

Using RADIUS Authentication, Authorization, and Accounting for Login Users

Scenario
Figure 2-4

Configuration

Enable AAA.

Steps



Configure the RADIUS server information.

Configure to use the RADIUS authentication, authorization, and accounting methods.



Apply the configured authentication method on the interface.

RADIUS
ClientRuijie#configure terminal
Ruijie (config)#aaa new-model
Ruijie (config)# radius-server host 192.168.5.22
Ruijie (config)#radius-server host 3000::100
Ruijie (config)# radius-server key aaa
Ruijie (config)#aaa authentication login test group radius
Ruijie (config)#aaa authorization exec test group radius
Ruijie (config)#aaa accounting exec test start-stop group radius

2-14Configuration Guide

Configuring RADIUS(beta)

Ruijie (config)# line vty 0 4
Ruijie (config-line)#login authentication test
Ruijie (config-line)# authorization exec test
Ruijie (config-line)# accounting exec test

Verification

Telnet to a device from a PC. The screen requesting the user name and password is displayed. Enter thecorrect user name and password to log in to the device. After obtaining a certain access level granted by theserver, only run commands under this access level. Display the authentication log of the user on the
RADIUS server. Perform management operations on the device as the user and then log out. Display theaccounting information on the user on the RADIUS server.
Ruijie#show running-config!
radius-server host 192.168.5.22
radius-server host 3000::100
radius-server key aaa
aaa new-model
aaa accounting exec test start-stop group radius
aaa authorization exec test group radius
aaa authentication login test group radius
no service password-encryption
iptcp not-send-rst!
vlan 1!
line con 0line vty 0 4
accounting exec test
authorization exec test
login authentication test!

Common Errors


The key configured on the device is inconsistent with that configured on the server.

No method list is configured.

2-15

Configuration Guide

Configuring RADIUS(beta)

2.4.3 Configuring the RADIUS Attribute Type
Configuration EffectDefine the attribute processing adopted when the device encapsulates and parses RADIUS packets.

Notes


Private attributes involved in "Configuring the RADIUS Attribute Type" refer to Ruijie private attributes.

Configuration Steps

Configuring the MAC Address Format of RADIUS Attribute No. 31 (Calling-Station-ID)

Optional.



Set the MAC address format of Calling-Station-Id to a type supported by the server.

Configuring the Parsing Mode of the RADIUS Class Attribute

Optional.

Configure the parsing mode of the Class attribute according to the server type.

Configuring the RADIUS Private Attribute Type

Optional.



If the server is a Ruijie application server, the RADIUS private attribute type needs to be configured.



Setting the Private Attribute port-priority Issued by the Server to the COS Value of an Interface

Optional.



Set the private attribute port-priority issued by the server to the COS value of an interface as required.

Configures the Device to Support the CUI Attribute

Optional.

Configure whether the device supports the RADIUS CUI attribute as required.

Configuring the Mode of Parsing Private Attributes by the Device

Optional.

Configure the index of a Ruijie private attribute parsed by the device as required.

Configuring Whether RADIUS Authentication Request Packets Carry a Specified Attribute

Optional.

Configure whether to specify the attribute type for RADIUS authentication request packets as required.

Configuring Whether RADIUS Accounting Request Packets Carry a Specified Attribute

Optional.

Configure whether to specify the attribute type for RADIUS accounting request packets as required.

2-16

Configuration GuideConfiguring RADIUS(beta)

Configuring Whether RADIUS Authentication Request Packets Carry the Private Attribute of a Specified
Vendor

Optional.

Configure whether RADIUS authentication request packets carry the private attribute of a specified vendor as
required.

Configuring Whether RADIUS Accounting Request Packets Carry the Private Attribute of a Specified Vendor



Optional.

Configure whether RADIUS accounting request packets carry the private attribute of a specified vendor as required.

Configuring Whether RADIUS Server Parses the Private Attribute of Cisco, Huawei or Microsoft



Optional.

Configure whether RADIUS server parses the private attribute of Cisco, Huawei or Microsoft.

Configuring the Nas-Port-Id Encapsulation Format for RADIUS Packets

Optional.

In either QINQ or non-QINQ scenarios, configure the nas-nort-id encapsulation format for RADIUS packets. By
default, the packets are encapsulated in the normal format.

Verification
Configure the AAA method list that specifies to conduct authentication, authorization, and accounting on users byusing RADIUS.



Enable the device to interact with the RADIUS server. Conduct packet capture to display the MAC address format ofCalling-Station-Id.

Enable the device to interact with the RADIUS server. Display the debug information of the device to check thatRuijie private attributes are correctly parsed by the device.

Enable the device to interact with the RADIUS server. Display the debug information of the device to check that the
CUI attribute is correctly parsed by the device.

Related Commands

Configuring the MAC Address Format of RADIUS Attribute No. 31 (Calling-Station-ID)

Commandradius-server attribute 31 mac format { ietf | normal | unformatted }Parameter

ietf: Indicates the standard format specified in the IETF standard (RFC3580), which is separated by the

Description

separator (-). Example: 00-D0-F8-33-22-AC.
normal: Indicates the common format that represents a MAC address (dotted hexadecimal format), which isseparated by the separator (.). Example: 00d0.f833.22ac.
unformatted: Indicates the format without separators. This format is used by default. Example:
00d0f83322ac.

Command

Global configuration mode

Mode
Usage Guide

Some RADIUS security servers (mainly used for 802.1X authentication) can identify only MAC addresses in

2-17

Configuration Guide

Configuring RADIUS(beta)

the IETF format. In this case, set the MAC address format of Calling-Station-ID to IETF.



Configuring the Parsing Mode of the RADIUS Class Attribute

Commandradius-server attribute class user-flow-control control { format-16bytes | format-32bytes }Parameteruser-flow-control: Analyzes flow control value in the CLASS attribute.

Description

format-16bytes: Sets the format of flow control value to 16 bytes.
format-32bytes: Sets the format of flow control value to 32 bytes.

Command

Global configuration mode

Mode
Usage GuideConfigure this command if the server needs to issue the rate limit value by using the Class attribute.

Setting the Private Attribute port-priority Issued by the Server to the COS Value of an Interface

Commandradius set qos cos

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Configure this command to use the issued QoS value as the CoS value. The QoS value is used as the
DSCP value by default.



Configures the Device to Support the CUI Attribute

Commandradius support cui

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage GuideConfigure this command to enable the RADIUS-compliant device to support the CUI attribute.

Configuring Whether RADIUS Authentication Request Packets Carry a Specified Attribute

Commandradius-server authentication attribute type package
radius-server authentication attribute type unpackage

Parameter

type: Indicates the RADIUS attribute type. The value ranges from 1 to 255.

Description
Command

Global configuration mode

Mode
Usage GuideUse this command to specify the attribute to be carried in authentication request packets.

Configuring Whether RADIUS Accounting Request Packets Carry a Specified Attribute

Commandradius-server account attribute type package
radius-server account attribute type unpackage

Parameter

type: Indicates the RADIUS attribute type. The value ranges from 1 to 255.

Description
Command

Global configuration mode

Mode

2-18

Configuration Guide
Usage GuideConfiguring RADIUS(beta)

Use this command to specify the attribute to be carried in accounting request packets.

Configuring Whether RADIUS Authentication Request Packets Carry the Private Attribute of a Specified
VendorCommandradius-server authentication vendor vendor_name package

Parameter

vendor_name: Indicates the vendor name. It can be set to cmcc, Microsoft, or cisco.

Description
Command

Global configuration mode

Mode
Usage Guide

Use this command to configure whether authentication request packets carry the private attribute of a
specified vendor.

Configuring Whether RADIUS Accounting Request Packets Carry the Private Attribute of a Specified Vendor

Commandradius-server account vendor vendor_name package

Parameter

vendor_name: Indicates the vendor name. It can be set to cmcc, Microsoft, or cisco.

Description
Command

Global configuration mode

Mode
Usage Guide

Use this command to configure whether accounting request packets carry the private attribute of a specified
vendor.

Configuration
Example

Configuring the RADIUS Attribute Type

Scenario

One authentication device

Configuration

Configure the MAC address format of RADIUS Calling-Station-Id.

Steps



Configure the RADIUS private attribute type.



Set the QoS value issued by the RADIUS server as the COS value of the interface.

Configure the RADIUS function to support the CUI attribute.

Configure the device to support private attributes of other vendors.



Configure authentication requests not to carry the NAS-PORT-ID attribute.

Configure accounting requests to carry the CMCC private attribute.

Configure the RAIUDS server not to parse Cisoc’s private attributes contained in packets.

Configure application of the nas-port-id encapsulation format in a QINQ scenario.

Ruijie(config)#radius-server attribute 31 mac format ietf
Ruijie(config)#radius attribute 16 vendor-type 211
Ruijie(config)#radius set qos cos
Ruijie(config)#radius support cui

2-19

Configuration Guide

Configuring RADIUS(beta)

Ruijie(config)#radius-server authentication attribute 87 unpackage
Ruijie(config)#radius-server account vendor cmcc package

Verification

Conduct packet capture or display debug information of the device to check whether the RADIUS standard
attributes and private attributes are encapsulated/parsed correctly.

2.4.4 Configuring RADIUS Accessibility Detection
Configuration Effect
The device maintains the accessibility status of each configured RADIUS server: reachable or unreachable. The device
will not transmit authentication, authorization, and accounting requests of access users to an unreachable RADIUS server
unless all the other servers in the same RADIUS server group as the unreachable server are all unreachable.
The device actively detects a specified RADIUS server. The active detection function is disabled by default. If the active
detection function is enabled for a specified RADIUS server, the device will, according to the configuration, periodicallytransmits detection requests (authentication requests or accounting requests) to the RADIUS server. The transmissioninterval is as follows:

For a reachable RADIUS server, the interval is the active detection interval of the reachable RADIUS server (thedefault value is 60 minutes).



For an unreachable RADIUS server, the interval is always 1 minute.

Notes
All the following conditions need to be met before the active detection function is enabled for a specified RADIUS server:



The test user name of the RADIUS server is configured on the device.

At least one tested port (authentication port or accounting port) of the RADIUS server is configured on the device.

If the following two conditions are all met, it is deemed that a reachable RADIUS server becomes unreachable:After the previous correct response is received from the RADIUS server, the time set in radius-server dead-criteria
time seconds has elapsed.

After the previous correct response is received from the RADIUS server, the count that the device transmits requests
to the RADIUS server but fails to receive correct responses (including retransmission) reaches the value set inradius-server dead-criteria tries number.

If any of the following conditions is met, it is deemed that an unreachable RADIUS server becomes reachable:



The device receives correct responses from the RADIUS server.

The duration that the RADIUS server is in the unreachable state exceeds the time set in radius-server deadtime
and the active detection function is disabled for the RADIUS server.



The authentication port or accounting port of the RADIUS server is updated on the device.

Configuration Steps

Configuring the Global Criteria for Judging That a RADIUS Security Server Is Unreachable

Mandatory.

2-20

Configuration GuideConfiguring RADIUS(beta)

Configuring the global criteria for judging that a RADIUS security server is unreachable is a prerequisite for enabling
the active detection function.

Configuring the IP Address of the Remote RADIUS Security Server, Authentication Port, Accounting Port,and Active Detection ParametersMandatory.

Configuring active detection parameters of the RADIUS server is a prerequisite for enabling the active detection
function.

Configuring the Duration for the Device to Stop Transmitting Request Packets to an Unreachable RADIUS
Server

Optional.



The configured duration for the device to stop transmitting request packets to an unreachable RADIUS server takes
effect only when the active detection function is disabled for the RADIUS server.

Verification


Run the show radius server command to display the accessibility information of each RADIUS server.

Related Commands

Configuring the Global Criteria for Judging That a RADIUS Security Server Is Unreachable

Commandradius-server dead-criteria { timeseconds [ triesnumber ] | tries number }Parameter

time seconds: Indicates the time condition parameter. If the device fails to receive a correct response packet

Description

from a RADIUS security server within the specified time, it is deemed that the RADIUS security server meetsthe inaccessibility duration condition. The value ranges from 1 second to 120 seconds.
triesnumber: Indicates the consecutive request timeout count. If the timeout count of request packets
transmitted by the device to the same RADIUS security server reaches the preset count, it is deemed that
the RADIUS security server meets the consecutive timeout count condition of inaccessibility. The value
ranges from 1 to 100.

Command

Global configuration mode

Mode
Usage Guide

If a RADIUS security server meets both the duration condition and the consecutive request timeout countcondition, it is deemed that the RADIUS security server is unreachable. Users can use this command toadjust parameter values in the duration condition and consecutive request timeout count condition.

Configuring the Duration for the Device to Stop Transmitting Request Packets to an Unreachable RADIUS
ServerCommandradius-server deadtime minutes

Parameter

minutes: Indicates the duration for the device to stop transmitting requests to an unreachable RADIUS

Description

security server, with the unit of minutes. The value ranges from 1 minute to 1,440 minutes (24 hours).

Command

Global configuration mode

Mode
Usage Guide

If the active detection function is enabled for a RADIUS security server on the device, the time parameter inradius-server deadtime does not take effect on the RADIUS server. If the active detection function is2-21

Configuration Guide

Configuring RADIUS(beta)

disabled for a RADIUS security server, the device automatically restores the RADIUS security server to thereachable state when the duration that the RADIUS security server is in the unreachable state exceeds thetime specified in radius-server deadtime.

Configuration
Example

Configuring Accessibility Detection on the RADIUS Server

Scenario
Figure 2-5

Configuration

Configure the global criteria for judging that a RADIUS security server is unreachable.

Steps



Configure the IP address of the remote RADIUS security server, authentication port, accounting port,
and active detection parameters.

RADIUS
ClientVerification

Ruijie(config)#radius-server dead-criteria time 120 tries 5
Ruijie(config)# radius-server host 192.168.5.22 test username test ignore-acct-port idle-time 90

Disconnect the network communication between the device and the server with the IP address of
192.168.5.22.Conduct RADIUS authentication through the device. After 120 seconds, run the show radius
server command to check that the server state is dead.
Ruijie#show running-config…
radius-server host 192.168.5.22 test username test ignore-acct-port idle-time 90
radius-server dead-criteria time 120 tries 5…

2.5 Monitoring
Displaying
Description

Command

Displays global parameters of theshow radius parameter

RADIUS server.
Displays the configuration of theshow radius server

RADIUS server.
Displays statistics relevant toshow radius auth statistics

RADIUS authentication.
Displays statistics relevant toshow radius acct statistics

RADIUS accounting.

2-22

Configuration Guide

Configuring RADIUS(beta)

Description

Command

Displays configuration of RADIUS

show radius groupserver groups.
Displays RADIUS standard

show radius attributeattributes.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs the RADIUS event.

debug radius event

Debugs RADIUS packet printing.

debug radius detail2-23

Configuration Guide

Configuring TACACS+(beta)

3 Configuring TACACS+(beta)
3.1 Overview
TACACS+ is a security protocol enhanced in functions based on the Terminal Access Controller Access Control System(TACACS) protocol. It is used to implement the authentication, authorization, and accounting (AAA) of multiple users.

Protocols andStandards


RFC 1492 Terminal Access Controller Access Control System

3.2 Applications
Application

Description

Managing and Controlling Login of

Password verification and authorization need to be conducted on end users.

End Users

3.2.1 Managing and Controlling Login of End Users
Scenario
TACACS+ is typically applied in the login management and control of end users. A network device serves as the
TACACS+ client and sends a user name and password to the TACACS+ server for verification. The user is allowed to log
in to the network device and perform operations after passing the verification and obtaining authorization. See thefollowing figure.
Figure 3-1

RemarksA is a client that initiates TACACS+ requests.



B, C, and D are servers that process TACACS+ requests.

3-1

Configuration Guide

Configuring TACACS+(beta)

Deployment
Start the TACACS+ server on Server B, Server C, and Server D, and configure information on the access device(Device A) so that the servers provide TACACS+-based AAA function for the access device. Enable the AAA
function on Device A to start authentication for the user login.

Enable the TACACS+ client function on Device A, add the IP addresses of the TACACS+ servers (Server B, ServerC, and Server D) and the shared key so that Device A communicates with the TACACS+ servers over TACACS+ to
implement the AAA function.

3.3 Features
Basic Concepts

Format of TACACS+ Packets

Figure 3-2

Major Version: Indicates the major TACACS+ version number.



Minor Version: Indicates the minor TACACS+ version number.

Packet Type: Indicates the type of packets, with the options including:
TAC_PLUS_AUTHEN:= 0x01 (authentication);

TAC_PLUS_AUTHOR: = 0x02 (authorization);
TAC_PLUS_ACCT: = 0x03 (accounting)

Sequence Number: Indicates the sequence number of a data packet in the current session. The sequence numberof the first TACACS+ data packet in a session must be 1 and the sequence number of subsequent each data packet
increases by one. Therefore, the client sends data packets only with an odd sequence number and TACACS+
Daemon sends packets only with an even sequence number.



Flags: Contains various bitmap format flags. One of the bits in the value specifies whether data packets need to be
encrypted.



Session ID: Indicates the ID of a TACACS+ session.



Length: Indicates the body length of a TACACS+ data packet (excluding the header). Packets are encrypted fortransmission on a network.

Overview
FeatureDescription

3-2

Configuration Guide
TACACS+ Authentication,

Configuring TACACS+(beta)
Conducts authentication, authorization, and accounting on end users.

Authorization, andAccounting

3.3.1 TACACS+ Authentication, Authorization, and Accounting
Working Principle
The following figure uses basic authentication, authorization, and accounting of user login to describe interaction of
TACACS+ data packets.
Figure 3-3

The entire basic message interaction process includes three sections:1.

The authentication process is described as follows:1)

A user requests to log in to a network device.

2)

After receiving the request, the TACACS+ client sends an authentication start packet to the TACACS+ server.

3)

The TACACS+ server returns an authentication response packet, requesting the user name.

4)

The TACACS+ client requests the user to enter the user name.

5)

The user enters the login user name.

3-3Configuration Guide
6)

Configuring TACACS+(beta)

After receiving the user name, the TACACS+ client sends an authentication continuation packet that carries theuser name to the TACACS+ server.

7)

The TACACS+ server returns an authentication response packet, requesting the login password.

8)

The TACACS+ client requests the user to enter the login password.

9)

The user enters the login password.

10) After receiving the login password, the TACACS+ client sends an authentication continuation packet thatcarries the login password to the TACACS+ server.
11) The TACACS+ server returns an authentication response packet, prompting that the user passes
authentication.
2.

The user authorization starts after successful authentication:
1)

The TACACS+ client sends an authorization request packet to the TACACS+ server.

2)

The TACACS+ server returns an authorization response packet, prompting that the user passes authorization.

3)

After receiving the authorization success packet, the TACACS+ client outputs the network device configuration
screen for the user.

3.

Accounting and audit need to be conducted on the login user after successful authorization:
1)

The TACACS+ client sends an accounting start packet to the TACACS+ server.

2)

The TACACS+ server returns an accounting response packet, prompting that the accounting start packet has
been received.

3)

The user logs out.

4)

The TACACS+ client sends an accounting end packet to the TACACS+ server.

5)

The TACACS+ server returns an accounting response packet, prompting that the accounting end packet has
been received.

3.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enable the TACACS+ security service.
Configures the TACACS+ server.

tacacs-server hostConfiguring TACACS+ BasicSpecifies the key shared by the server andtacacs-server key

network device.

Functions
Configures the global waiting timeout time of
the TACACS+ server for communication

tacacs-server timeout

between a network device and the
TACACS+ server.

3-4

Configuration Guide

Configuring TACACS+(beta)(Optional) It is used to separately process authentication, authorization, and accounting
requests.
Configuring Separate
Processing of Authentication,
Authorization, andConfigures TACACS+ server groups andaaa group server tacacs+

Accounting of TACACS+

divides TACACS+ servers into different
groups.
Adds servers to TACACS+ server groups.

server

3.4.1 Configuring TACACS+ Basic Functions
Configuration EffectThe TACACS+ basic functions are available after the configuration is complete. When configuring the AAA method
list, specify the method of using TACACS+ to implement TACACS+ authentication, authorization, and accounting.

When authentication, authorization, and accounting operations are performed, TACACS+ initiates the authentication,authorization, and accounting requests to configured TACACS+ servers according to the configured sequence. If
response timeout occurs on a TACACS+ server, TACACS+ traverses the TACACS+ server list in sequence.

Notes


The TACACS+ security service is a type of AAA service. You need to run the aaa new-model command to enable
the security service.

Only one security service is provided after TACACS+ basic functions are configured. To make the TACACS+
functions take effect, specify the TACACS+ service when configuring the AAA method list.

Configuration Steps

Enabling AAA



Mandatory. The AAA method list can be configured only after AAA is enabled. TACACS+ provides services

according to the AAA method list.
Commandaaa new-modelParameter

N/A

Description
Defaults

The AAA function is disabled.

Command

Global configuration mode

Mode
Usage Guide

The AAA method list can be configured only after AAA is enabled. TACACS+ provides services according to
the AAA method list.

Configuring the IP Address of the TACACS+ Server

Mandatory. Otherwise, a device cannot communicate with the TACACS+ server to implement the AAA function.

Commandtacacs-server host {ipv4-address | ipv6-address} [ portinteger ] [ timeout integer ] [ key [ 0 | 7 ] text-string ]Parameteripv4-address: Indicates the IPv4 address of the TACACS+ server.

3-5

Configuration Guide
Description

Configuring TACACS+(beta)

ipv6-address: Indicates the IPv6 address of the TACACS+ server.
portinteger: Indicates the TCP port used for TACACS+ communication. The default TCP port is 49.
timeout integer: Indicates the timeout time of the communication with the TACACS+ server. The global
timeout time is used by default.
key [ 0 | 7 ] text-string: Indicates the shared key of the server. The global key is used if it is not configured.
An encryption type can be specified for the configured key. The value 0 indicates no encryption and 7
indicates simple encryption. The default value is 0.

Defaults

No TACACS+ server is configured.

Command

Global configuration mode

Mode
Usage Guide1.

You can specify the shared key of the server when configuring the IP address of the server. If noshared key is specified, the global key configured using the tacacs-server key command is used as theshared key of the server. The shared key must be completely the same as that configured on the server.
2.

You can specify the communication port of the server when configuring the IP address.

3.

You can specify the communication timeout time of the server when configuring the IP address.

Configuring the Shared Key of the TACACS+ Server

Optional.



If no global communication protocol is configured using this command, set key to specify the shared key of theserver when running the tacacs-server host command to add server information. Otherwise, a device cannot
communicate with the TACACS+ server.



If no shared key is specified by using key when you run the tacacs-server host command to add server information,
the global key is used.

Commandtacacs-server key [ 0 | 7 ] text-string

Parameter

text-string: Indicates the text of the shared key.

Description

0 | 7: Indicates the encryption type of the key. The value 0 indicates no encryption and 7 indicates simple
encryption.

Defaults

No shared key is configured for any TACACS+ server.

Command

Global configuration mode

Mode
Usage Guide

This command is used to configure a global shared key for servers. To specify a different key for eachserver, set key when running the tacacs-server host command.

Configuring the Timeout Time of the TACACS+ Server

Optional.

You can set the timeout time to a large value when the link between the device and the server is unstable.

Commandtacacs-server timeout seconds

Parameterseconds: Indicates the timeout time, with the unit of seconds. The value ranges from 1 second to 1,000

Description

seconds.

Defaults

The default value is 5 seconds.

Command

Global configuration mode

3-6

Configuration Guide

Configuring TACACS+(beta)

Mode
Usage Guide

This command is used to configure the global server response timeout time. To set different timeout time foreach server, set timeout when running the tacacs-server host command.

Verification
Configure the AAA method list that specifies to conduct authentication, authorization, and accounting on users by using
TACACS+.



Enable the device to interact with the TACACS+ server and conduct packet capture to check the TACACS+
interaction process between the device and the TACACS+ server.

View server logs to check whether the authentication, authorization, and accounting are normal.

Configuration
Example

Using TACACS+ for Login Authentication

Scenario
Figure 3-4

Remarks

Configuration

A is a client that initiates TACACS+ requests.



B is a server that processes TACACS+ requests.

Enable AAA.



Configure the TACACS+ server information.

Configure the method of using TACACS+ for authentication.

Apply the configured authentication method on an interface.

Steps

A

Ruijie# configure terminal
Ruijie(config)# aaa new-model
Ruijie(config)# tacacs-server host 192.168.5.22
Ruijie(config)# tacacs-server key aaa
Ruijie(config)# aaa authentication login test group tacacs+
Ruijie(config)# line vty 0 4
Ruijie(config-line)# login authentication test

Verification

Telnet to a device from a PC. The screen requesting the user name and password is displayed. Enter thecorrect user name and password to log in to the device. View the authentication log of the user on the
TACACS+ server.

3-7

Configuration Guide

Configuring TACACS+(beta)

Common Errors


The AAA security service is disabled.

The key configured on the device is inconsistent with the key configured on the server.

No method list is configured.

3.4.2 Configuring Separate Processing of Authentication, Authorization, andAccounting of TACACS+
Configuration Effect

The authentication, authorization, and accounting in the security service are processed by different TACACS+
servers, which improves security and achieves load balancing to a certain extent.

Notes


The TACACS+ security service is a type of AAA service. You need to run the aaa new-model command to enable
the security service.

Only one security service is provided after TACACS+ basic functions are configured. To make the TACACS+
functions take effect, specify the TACACS+ service when configuring the AAA method list.

Configuration Steps

Configuring TACACS+ Server Groups

Mandatory. There is only one TACACS+ server group by default, which cannot implement separate processing ofauthentication, authorization, and accounting.

Three TACACS+ server groups need to be configured for separately processing authentication, authorization, andaccounting.

Commandaaa group server tacacs+ group-nameParametergroup-name: Indicates the name of a group. A group name cannot be radius or tacacs+, which are the

Description

names of embedded groups.

Defaults

No TACACS+ server group is configured.

Command

Global configuration mode

Mode
Usage Guide

Group TACACS+ servers so that authentication, authorization, and accounting are completed by different
server groups.



Adding Servers to TACACS+ Server Groups

Mandatory. If no server is added to a server group, a device cannot communicate with TACACS+ servers.



In server group configuration mode, add the servers that are configured using the tacacs-server host command.

Commandserver { ipv4-address | ipv6-address }Parameteripv4-address: Indicates the IPv4 address of the TACACS+ server.

Description

ipv6-address: Indicates the IPv6 address of the TACACS+ server.

Defaults

No server is configured.

3-8

Configuration Guide
Command

Configuring TACACS+(beta)

TACACS+ server group configuration mode

Mode
Usage Guide

Before configuring this command, you must run the aaa group server tacacs+ command to enter the
TACACS+ server group configuration mode.
For the address of a server configured in a TACACS+ server group, the server must be configured using thetacacs-server host command in global configuration mode.
If multiple servers are added to one server group, when one server does not respond, the device continues
to send a TACACS+ request to another server in the server group.

Verification
Configure the AAA method list that specifies to conduct authentication, authorization, and accounting on users by using
TACACS+.



Enable a device to interact with TACACS+ servers. Conduct packet capture, check that the authentication,authorization, and accounting packets are interacted with different servers, and check the source addresses inpackets.

Configuration
Example

Configuring Different TACACS+ Server Groups for Separately Processing Authentication, Authorization,
and Accounting

Scenario
Figure 3-5

Remarks

Configuration

A is a client that initiates TACACS+ requests.



B is a server that processes TACACS+ authentication requests.



C is a server that processes TACACS+ authorization requests.



D is a server that processes TACACS+ accounting requests.

Enable AAA.



Configure the TACACS+ server information.

Configure TACACS+ server groups.



Add servers to TACACS+ server groups.



Configure the method of using TACACS+ for authentication.

Steps

3-9

Configuration Guide

Configuring TACACS+(beta)Configure the method of using TACACS+ for authorization.

Configure the method of using TACACS+ for accounting.



Apply the configured authentication method on an interface.



Apply the configured authorization method on an interface.



Apply the configured accounting method on an interface.

Ruijie# configure terminal
Ruijie(config)# aaa new-model
Ruijie(config)# tacacs-server host 192.168.5.22
Ruijie(config)# tacacs-server host 192.168.5.34
Ruijie(config)# tacacs-server host 192.168.5.44
Ruijie(config)# tacacs-server key aaa
Ruijie(config)# aaa group server tacacs+ tacgrp1
Ruijie(config-gs-tacacs)# server 192.168.5.22
Ruijie(config-gs-tacacs)# exit
Ruijie(config)# aaa group server tacacs+ tacgrp2
Ruijie(config-gs-tacacs)# server 192.168.5.34
Ruijie(config-gs-tacacs)# exit
Ruijie(config)# aaa group server tacacs+ tacgrp3
Ruijie(config-gs-tacacs)# server 192.168.5.44
Ruijie(config-gs-tacacs)# exit
Ruijie(config)# aaa authentication login test1 group tacacs+
Ruijie(config)# aaa authentication enable default group tacgrp1
Ruijie(config)# aaa authorization exec test2 group tacgrp2
Ruijie(config)# aaa accounting commands 15 test3 start-stop group tacgrp3
Ruijie(config)# line vty 0 4
Ruijie(config-line)# login authentication test1
Ruijie(config-line)# authorization exec test2
Ruijie(config-line)# accounting commands 15 test3

Verification

Telnet to a device from a PC. The screen requesting the user name and password is displayed. Enter thecorrect user name and password to log in to the device. Enter the enable command and enter the correct
enable password to initiate enable authentication. Enter the privilege EXEC mode after passing theauthentication. Perform operations on the device and then exit the device.
View the authentication log of the user on the server with the IP address of 192.168.5.22.
View the enable authentication log of the user on the server with the IP address of 192.168.5.22.
View the exec authorization log of the user on the server with the IP address of 192.168.5.34.

3-10

Configuration Guide

Configuring TACACS+(beta)

View the command accounting log of the user on the server with the IP address of 192.168.5.44.

Common Errors


The AAA security service is disabled.

The key configured on the device is inconsistent with the key configured on the server.



Undefined servers are added to a server group.

No method list is configured.

3.5 Monitoring
Displaying
Description

Command

Displays interaction with each TACACS+

show tacacs

server.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs TACACS+.

debug tacacs+

3-11

Configuration Guide

Configuring Global IP-MAC Binding(beta)

4 Configuring Global IP-MAC Binding(beta)
4.1 Overview
Enable the global IP-MAC binding function manually to verify the input packets. If a specified IP address is bound with a
MAC address, the device receives only the IP packets containing matched IP address and MAC address. The otherpackets are discarded.
The address bounding feature is used to verify the input packets. Note that the address binding feature takes precedence
over the 802.1X authentication, port security, and access control list (ACL).

4.2 Applications
Application

Description

Global IP-MAC Binding

Only hosts with the specified IP addresses can access the network, and the hosts
connected to a device can move freely.

4.2.1 Global IP-MAC Binding
Scenario
The administrator assigns a fixed IP address for each host to facilitate management.



Only hosts with the specified IP addresses can access the external network, which prevents IP address
embezzlement by unauthorized hosts.



Hosts can move freely under the same device.

Figure 4-1

Te 0/19

Gi 0/17

Gi 0/18
RemarkA is an access device.

s

A user is a host configured with a static IP address.
IP Network is an external IP network.

Deployment
Manually configure the global IP-MAC binding. (Take three users as an example.)

4-1

Configuration Guide

Configuring Global IP-MAC Binding(beta)

User

MAC Address

IP Address

User 100d0.3232.0001

192.168.1.10

User 200d0.3232.0002

192.168.1.20



Enable the IP-MAC binding function globally.

Configure the uplink port (Te0/19 port in this example) of the device as the exclude port.

4.3 Features
Basic ConceptsIPv6 Address Binding Mode

IPv6 address binding modes include Compatible, Loose, and Strict. The default mode is Strict. If IPv4-MAC binding is notconfigured, the IPv6 address binding mode does not take effect, and all IPv4 and IPv6 packets are allowed to passthrough. If IPv4-MAC binding is configured, the IPv6 address binding mode takes effect, and the device forwards IPv4 andIPv6 packets based on the forwarding rules described in the following table:
Mode

IPv4 Packet Forwarding Rule

IPv6 Packet Forwarding Rule
Packets matching the global IPv6-MAC binding are

StrictPackets matching the global

forwarded. (The binding is generated by other access

IPv4-MAC binding are forwarded.

security functions, such as port security and IPv6 Source
Guard.)
If IPv6+MAC address binding is configured, packets
matching the IPv6-MAC binding are forwarded. (The binding

Loose

Packets matching the global

is generated by other access security functions, such as port

IPv4-MAC binding are forwarded.

security and IPv6 Source Guard.)
If IPv6-MAC binding does not exist, all IPv6 packets areforwarded.
If the IPv6 packets contain a MAC address matching the
MAC address in the IPv4-MAC binding, the IPv6 packets are

Compatible

Packets matching the global
IPv4-MAC binding are forwarded.

forwarded.
Packets matching the global IPv6-MAC binding conditions
are forwarded. (The binding is generated by other accesssecurity functions, such as port security and IPv6 Source
Guard.)



Exclude Port

By default, the IP-MAC binding function takes effect on all ports of the device. You can configure exclude ports so that theaddress binding function does not take effect on these ports. In practice, the IP-MAC bindings of the input packets on the
uplink port are not fixed. Generally, the uplink port of the device is configured as the exclude port so that the packets on
the uplink port are not checked for IP-MAC binding.

Overview
FeatureDescription

4-2

Configuration Guide
Configuring Global IP-MAC

Configuring Global IP-MAC Binding(beta)
Control forwarding of IPv4 or IPv6 packets.

Binding
Configuring the Exclude

Disable the global address binding function on the specified port.

Port

4.3.1 Configuring Global IP-MAC Binding
Working Principle
Enable the global IP-MAC binding function manually to verify the input packets. If a specified IP address is bound with a
MAC address, the device receives only the IP packets containing matched IP address and MAC address. The otherpackets are discarded.

Related Configuration

Configuring IP-MAC Binding

Run the address-bind command in global configuration mode to add or delete an IPv4-MAC binding.

Enabling the IP-MAC Binding Function

Run the address-bind install command in global configuration mode to enable the IP-MAC binding function. By default,
this function is disabled.

4.3.2 Configuring the Exclude Port
Working Principle
Configure an exclude port so that the address binding function does not take effect on this port.

Related Configuration

Configuring the Exclude Port

Run the address-bind uplink command to configure an exclude port. By default, no port is the exclude port.

4.4 Configuration
Configuration

Description and Command(Mandatory) It is used to configure and enable address binding.

Configuring Global IP-MAC
Binding

Configuring the ExcludePort

address-bind

Configures a global IPv4-MAC binding.

address-bind install

Enables the address binding function.

(Optional) It is used to disable the address binding function on a specified port.
Configures an exclude port.

address-bind uplink

4-3

Configuration Guide

Configuring Global IP-MAC Binding(beta)

4.4.1 Configuring Global IP-MAC Binding
Configuration EffectConfigure a global IPv4-MAC binding.

Enable the address binding function to control forwarding of the IPv4 or IPv6 packets.

Notes


If you run the address-bind install command without IP-MAC binding configured, IP-MAC binding does not takeeffect and all packets are allowed to pass through.

Configuration Steps

Configuring Global IP-MAC Binding(Mandatory) Perform this configuration in global configuration mode.

Enabling the Address Binding Function(Mandatory) Perform this configuration in global configuration mode.

Configuring a Logging Filter of Global IP-MAC Binding(Optional) Perform this configuration in global configuration mode.

Verification
Run the show run or show address-bind command to check whether the configuration takes effect.

Related Commands

Configuring Global IP-MAC Binding

Commandaddress-bind ip-address mac-address

Parameter

ip-address: Indicates the bound IPv4 address.

Description

mac-address: Indicates the bound MAC address.

Command

Global configuration mode

Mode
Configuratio

Run this command to configure the binding relationship between an IPv4 address and a MAC address.

n UsageEnabling the Address Binding Function

Commandaddress-bind install

Parameter

N/A

Description
Command

Global configuration mode

Mode
Configuratio

Run this command to enable the global IP-MAC binding function. This function is used to control

n Usageforwarding of IPv4 or IPv6 packets.

4-4Configuration Guide

Configuring Global IP-MAC Binding(beta)

Configuration
Example

Configuring Global IP-MAC Binding and Enabling Address Binding

Configuratio

Configure a global IPv4-MAC binding.

n Steps

Enable the address binding function.

Ruijie# configure terminal
Ruijie(config)# address-bind 192.168.5.1 00d0.f800.0001
Ruijie(config)# address-bind install

Verification

Display the global IP-MAC binding on the device.
Ruijie# show address-bind
Total Bind Addresses in System : 1
IP Address

Binding MAC Addr-------------------------------

192.168.5.1

00d0.f800.0001

4.4.2 Configuring the Exclude Port
Configuration Effect

The address binding function is disabled on the exclude port, and all IP packets can be forwarded.

Notes


The configuration can be performed only on a switching port or an L2 aggregate port.

Configuration Steps

Configuring the Exclude Port



(Optional) Perform this configuration in global configuration mode when you want to disable the address binding
function on a specified port.

Verification
Run the show run or show address-bind uplink command to check whether the configuration takes effect.

Related Commands

Configuring the Exclude Port

Commandaddress-bind uplink interface-id

Parameterinterface-id: Indicates the ID of a switching port or an L2 aggregate port.

Description
Command

Global configuration mode

Mode

4-5

Configuration Guide
Configuratio

Configuring Global IP-MAC Binding(beta)

N/An Usage

Configuration
Example

Configuring the Exclude Port

Configuratio

Create a global IPv4-MAC binding.

n Steps

Enable the address binding function.

Configure an exclude port.

Ruijie# configure terminal
Ruijie(config)# address-bind 192.168.5.1 00d0.f800.0001
Ruijie(config)# address-bind install
Ruijie(config)# address-bind uplink TenGigabitEthernet 0/19

Verification

Display the global IP-MAC binding on the device.
Ruijie# show address-bind
Total Bind Addresses in System : 1
IP Address

Binding MAC Addr-------------------------------

192.168.5.1

00d0.f800.0001

Ruijie# show address-bind uplink
Port

State

---------- --------Te0/19

EnabledDefault

Disabled

4.5 Monitoring
Displaying
Description

Command

Displays the IP-MAC binding on theshow address-binddevice.
Displays the exclude port.

show address-bind uplink

4-6

Configuration Guide

Configuring Password Policy

5 Configuring Password Policy
5.1 Overview
The Password Policy is a password security function provided for local authentication of the device. It is configured tocontrol users' login passwords and login states.
The following sections introduce password policy only.

Protocols andStandards
N/A

5.2 Features
Basic Concepts



Minimum Password Length

Administrators can set a minimum length for user passwords according to system security requirements. If the password
input by a user is shorter than the minimum password length, the system does not allow the user to set this password but
displays a prompt, asking the user to specify another password of an appropriate length.

Strong Password Detection

The less complex a password is, the more likely it is to crack the password. For example, a password that is the same as
the corresponding account or a simple password that contains only characters or digits may be easily cracked. For thesake of security, administrators can enable the strong password detection function to ensure that the passwords set byusers are highly complex. After the strong password detection function is enabled, a prompt will be displayed for thefollowing types of passwords:
1.

Passwords that are the same as corresponding accounts;

2.

Simple passwords that contain characters or digits only.



Password Life Cycle

The password life cycle defines the validity time of a user password. When the service time of a password exceeds the life
cycle, the user needs to change the password.
If the user inputs a password that has already expired during login, the system will give a prompt, indicating that the
password has expired and the user needs to reset the password. If the new password input during password resetting
does not meet system requirements or the new passwords consecutively input twice are not the same, the system will ask
the user to input the new password once again.

Guard Against Repeated Use of Passwords

5-1

Configuration Guide

Configuring Password Policy

When changing the password, the user will set a new password while the old password will be recorded as the user's
history records. If the new password input by the user has been used previously, the system gives an error prompt andasks the user to specify another password.
The maximum number of password history records per user can be configured. When the number of password history
records of a user is greater than the maximum number configured for this user, the new password history record will
overwrite the user's oldest password history record.



Storage of Encrypted Passwords

Administrators can enable the storage of encrypted passwords for security consideration. When administrators run theshow running-config command to display configuration or run the write command to save configuration files, various
user-set passwords are displayed in the cipher text format. If administrators disable the storage of encrypted passwords
next time, the passwords already in cipher text format will not be restored to plaintext passwords.

5.3 Configuration
Configuration

Description and Command
Optional configuration, which is used to configure a combination of parameters
related to the password security policy.
password policy life-cycle

Configures the password life cycle.

password policy min-size

Configures the minimum length of user
passwords.

password policy no-repeat-times
Configuring the Password

Sets the no-repeat times of latest
password configuration, so that the

Security Policy

passwords specified in these times oflatest password configuration can nolonger be used in future password
configuration.
Enables the strong password detection

password policy strong

function.
service password-encryption

Sets the storage of encrypted passwords.

Networking
Requirements
Provide a password security policy for local authentication of the device. Users can configure different password
security policies to implement password security management.

Notes


The configured password security policy is valid for global passwords (configured using the commands enable
password and enable secret) and local user passwords (configured using the username name password
password command). It is invalid for passwords in Line mode.

5-2

Configuration Guide

Configuring Password Policy

Configuration Steps

Configuring the Password Life Cycle

OptionalPerform this configuration on each device that requires the configuration of a password life cycle unless otherwise
stated.

Configuring the Minimum Length of User Passwords



OptionalPerform this configuration on each device that requires a limit on the minimum length of user passwords unlessotherwise stated.



Setting the No-Repeat Times of Latest Password Configuration



OptionalPerform this configuration on each device that requires a limit on the no-repeat times of latest password
configuration unless otherwise stated.

Enabling the Strong Password Detection Function



OptionalPerform this configuration on each device that requires strong password detection unless otherwise stated.



Setting the Storage of Encrypted Passwords



OptionalPerform this configuration on each device that requires the storage of passwords in encrypted format unlessotherwise stated.

Verification
Configure a local user on the device, and configure a valid password and an invalid password for the user.

When you configure the valid password, the device correctly adds the password.

When you configure the invalid password, the device displays a corresponding error log.

Related Commands

Configuring the Password Life Cycle

Commandpassword policy life-cycle days

Parameter

life-cycle days: Indicates the password life cycle in the unit of days. The value range is from 1 to 65535.

Description
Command

Global configuration mode

Mode
Usage Guide

The password life cycle is used to define the validity period of user passwords. If the user logs in with apassword whose service time already exceeds the life cycle, a prompt is given, asking the user tochange the password.

5-3

Configuration GuideConfiguring Password Policy

Configuring the Minimum Length of User Passwords

Commandpassword policy min-size length

Parametermin-size length: Indicates the minimum length of passwords. The value range is from 1 to 31.

Description
Command

Global configuration mode

Mode
Usage Guide

This command is used to configure the minimum length of passwords. If the minimum length ofpasswords is not configured, users can input a password of any length.

Setting the No-Repeat Times of Latest Password Configuration

Commandpassword policy no-repeat-times times

Parameter

no-repeat-times times: Indicates the no-repeat times of latest password configuration. The value range

Description

is from 1 to 31.

Command

Global configuration mode

Mode
Usage Guide

After this function is enabled, all old passwords used in the several times of latest password
configuration will be recorded as the user's password history records. If the new password input by theuser has been used previously, the system gives an error prompt and the password modification fails.
You can configure the maximum number of password history records per user. When the number ofpassword history records of a user is greater than the maximum number configured for the user, the new
password history record will overwrite the user's oldest password history record.

Enabling the Strong Password Detection Function

Commandpassword policy strong

Parameter-

Description
Command

Global configuration mode

Mode
Usage Guide

After the strong password detection function is enabled, a prompt is displayed for the following types ofpasswords:

3.

Passwords that are the same as corresponding accounts;

4.

Simple passwords that contain characters or digits only.

Setting the Storage of Encrypted Passwords

Commandservice password-encryption

Parameter-

Description
Command

Global configuration mode

Mode
Usage Guide

Before the storage of encrypted passwords is set, all passwords used in the configuration process will be
displayed and stored in plaintext format, unless the passwords are configured in cipher text format. You
can enable the storage of encrypted passwords for security consideration. When you run the show

5-4Configuration Guide

Configuring Password Policy

running-config command to display configuration or run the write command to save configuration files,
various user-set passwords are displayed in the cipher text format. If you disable the storage ofencrypted passwords next time, the passwords already in cipher text format will not be restored toplaintext passwords.



Checking User-Configured Password Security Policy Information

Commandshow password policy

Parameter-

Description
CommandPrivileged EXEC mode/ Global configuration mode/ Interface configuration mode

Mode
Usage Guide

Use this command to display the password security policy configured on the device.

Configuration
ExamplesThe following configuration example describes configuration related to a password security policy.

Configuring Password Security Check on the Device

TypicalAssume that the following password security requirements arise in a network environment:

Application

1.

The minimum length of passwords is 8 characters;

2.

The password life cycle is 90 days;

3.

Passwords are stored and transmitted in cipher text format;

4.

The number of no-repeat times of password history records is 3;

5.

Passwords shall not be the same as user names, and shall not contain simple characters or digits
only.

Configuratio

Set the minimum length of passwords to 8.

n Steps

Set the password life cycle to 90 days.

Enable the storage of encrypted passwords.



Set the no-repeat times of password history records to 3.

Enable the strong password detection function.

Ruijie# configure terminal
Ruijie(config)# password policy min-size 8
Ruijie(config)# password policy life-cycle 90
Ruijie(config)# service password-encryption
Ruijie(config)# password policy no-repeat-times 3
Ruijie(config)# password policy strong

Verification

When you create a user and the corresponding password after configuring the password security policy,
the system will perform relevant detection according to the password security policy.
Run the show password policy command to display user-configured password security policy
information.

5-5

Configuration Guide

Configuring Password Policy

Ruijie# show password policy
Global password policy configurations:
Password encryption:

EnabledPassword strong-check:

EnabledPassword min-size:

Enabled (8 characters)

Password life-cycle:

Enabled (90 days)

Password no-repeat-times:

Enabled (max history record: 3)

Common Errors


The time configured for giving a pre-warning notice about password expiry to the user is greater than the password
life cycle.

5.4 Monitoring
Displaying
Description

Command

Displays user-configured password

show password policy

security policy information.

5-6

Configuration Guide

Configuring Port Security(beta)

6 Configuring Port Security(beta)
6.1 Overview
Port security is used to restrict access to a port. Source MAC addresses of packets can be used to restrict the packets thatenter the ports of a switch. You can set the number of static MAC addresses or the number of MAC addresses that are
dynamically learned to restrict the packets that can enter the port. Ports enabled with port security are called secure ports.

6.2 Applications
Application

Description

Allowing Only Specified Hosts to

For network security, certain ports of a device can be used only by specified hosts.

Use Ports

6.2.1 Allowing Only Specified Hosts to Use Ports
Scenario
In a scenario that has requirements for the network security, devices cannot be completely isolated physically. In this case,the devices need to be configured to restrict the PCs that connected to the ports of the devices.



Only specified PCs can connect to the ports and normally use the network.

Other PCs cannot use the network even if connected to the ports.

After the configuration is complete, the administrator does not need to perform regular maintenance.

Figure 6-1

X

Port-security address(Gi0/17,MAC A, IP A)

Gi 0/17
S

RemarkS is the access device.

s

A is a PC that can use the portGi0/17.
B is an unknown PC.

Deployment
Enable ARP Check for port Gi0/17 (omitted).

Enable port security on access device S and set the violation handling mode to protect.

6-1

Configuration Guide

Configuring Port Security(beta)

Set the maximum number of secure addresses allowed by port Gi0/17 to 1.

Configure a static port security address on the port Gi0/17.

6.3 Features
Basic ConceptsSecure Port

Ports configured with port security are called secure ports. At present, Ruijie devices require that secure ports cannot be
destination ports of mirroring.



Secure Addresses

Addresses bound to secure ports are called secure addresses. Secure addresses can be layer-2 addresses, namely MAC
addresses, and can also be layer-3 addresses, namely, IP or IP+MAC addresses. When a secure address is bound to
IP+MAC and a static secure MAC address is configured, the static secure MAC address must be the same as the MAC
address bound to IP+MAC; otherwise, communication may fail due to inconsistency with the binding. Similarly, if only IP
binding is set, only packets whose secure MAC addresses are statically configured or learned and whose source IP
addresses are the bound IP address can enter the device.

Dynamic Binding

A method for a device to automatically learn addresses and convert learned addresses into secure addresses.



Static Binding

A command for manually binding secure addresses.



Aging of Secure Addresses

Regularly delete secure address records. Secure addresses for port security support aging configuration. You can specify
only dynamically learned addresses for aging or specify both statically configured and dynamically learned secure
addresses for aging.



Sticky MAC Address

Convert dynamically learned secure addresses into statically configured addresses. Addresses will not age. After theconfigurations are saved, dynamic secure addresses will not be learned again upon restart. If this function is not enabled,
the secure MAC addresses dynamically learned must be learned again after device restart.

Security Violation Events

When the number of learned MAC addresses learned by a port exceeds the maximum number of secure addresses,
security violation events will be triggered. You can configure the following modes for handing security violation events:



protect: When security violation occurs, a corresponding secure port will stop learning MAC addresses and discard
all packets of newly accessed users. This is the default mode for handling violation.



restrict: When violation occurs, a port violation trap notification will be sent in addition to the behavior in the protect
mode.



shutdown: When violation occurs, the port will be disabled in addition to the behaviors in the preceding two modes.

6-2Configuration GuideConfiguring Port Security(beta)

Maximum Number of Secure Addresses

The maximum number of secure addresses indicates the total number of secure addresses statically configured anddynamically learned. When the number of secure addresses under a secure port does not reach the maximum number of
secure addresses, the secure port can dynamically learn new dynamic secure addresses. When the number of secure
addresses reaches the maximum number, the secure port will not learn dynamic secure addresses any longer. If newusers access the secure port in this case, security violation events will occur.

Overview
FeatureDescription

Enabling Port

Creates a secure address list for a port.

Security
Filtering Layer-2

Processes the packets received by a port from non-secure addresses.

Users
Filtering Layer-3

Checks the layer-2 and layer-3 addresses of packets passing a port.

Users
Aging of Secure

Regularly deletes secure addresses.

Addresses

6.3.1 Enabling Port Security
Enable port security for a port to restrict packets that access the network through the port.

Working Principle
When port security is enabled, the device security module will check the sources of received packets. Only packets fromaddresses in the secure address list can be normally forwarded; otherwise, the packets will be discarded or the port
performs other violation handling behaviors.
When the port security and 802.1x are configured at the same time, packets can enter a switch only when the MAC
addresses of the packets meet the static MAC address configurations of 802.1x or port security. If a port is configured witha secure channel or is bound to global IP+MAC, packets in compliance with the secure channel or bound to global
IP+MAC can avoid checking of port security.

Related Configuration

Enabling Port Security for a Port

By default, port security is disabled.
You can run the switchport port-security command to enable or disable the port security function for a port.
You cannot enable this function for a destination port of SPAN.



Setting the Maximum Number of Secure Addresses for a Port

By default, the maximum number of secure addresses for a port is 64.
You can run the switchport port-security maximum command to adjust the maximum number of secure addresses forthe port.
6-3

Configuration Guide

Configuring Port Security(beta)

A smaller number of secure addresses mean fewer users that access the network through this port.



Setting the Mode for Handling Violation

By default, when the number of secure addresses reaches the maximum number, the secure port will discard packets
from unknown addresses (none of the secure addresses of the port).
You can run the switchport port-security violation command to modify the violation handling mode.



Setting Secure Addresses That Can Be Dynamically Saved

By default, no secure address dynamically learned will be saved.
You can run the switchport port-security mac-address sticky command to save dynamically learned addresses to theconfiguration file. As long as the configuration file is saved, the device does not need to re-learn the secure addresses
after the device is restarted.

6.3.2 Filtering Layer-2 Users
Set the secure addresses on a port to ensure that only devices whose MAC addresses are the same as the secure
addresses can access the network through this port.

Working Principle
Add secure addresses for a secure port. When the number of secure addresses for a secure port does not reach the
maximum number, the secure port can dynamically learn new dynamic secure addresses. When the number of secure
addresses for the secure port reaches the maximum number, the secure port will not learn dynamic secure addresses any
longer. The MAC addresses of users connecting to this port must be in the secure address list; otherwise, violation events
will be triggered.

Related Configuration

Adding Secure Addresses for a Secure port

By default, a port dynamically learns secure addresses. If an administrator has special requirements, the administrator
can manually configure secure addresses.
You can run the switchport port-security interface command to add or delete secure addresses for a device.

6.3.3 Filtering Layer-3 Users
Add binding of secure addresses and check layer-2 and layer-3 addresses of packets passing a port.

Working Principle
Layer-3 secure addresses support only IP binding and IP+MAC binding, and supports only static binding (not dynamic
binding).
When a layer-3 secure port receives packets, layer-2 and layer-3 addresses need to be parsed. Only packets whose
addresses are bound are valid packets. Other packets are considered as invalid packets and will be discarded, but noviolation event will be triggered.

6-4

Configuration Guide

Configuring Port Security(beta)

Related Configuration

Configuring Binding of Secure Addresses on Secure Ports

Binding of layer-3 secure addresses must be added manually.
You can run the switchport port-security binding command to add binding of secure addresses.
If only IP addresses are input, only IP addresses are bound. If IP addresses and MAC addresses are input, IP+MAC will
be bound.

6.3.4 Aging of Secure Addresses
Regularly delete secure addresses. When this function is enabled, you need to set the maximum number of secure
addresses. In this way, the device can automatically add and delete secure addresses on this port.

Working Principle
Enable the aging timer to regularly query and delete secure addresses whose aging time expires.

Related Configuration

Configuring Aging Time of Secure Addresses

By default, no secure address of a port will be aged.
You can run the switchport port-security aging command to enable aging time.
The static parameter can be used to age static addresses.

6.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enable the port security service.
Enables port security.

switchport port-security

switchport port-security maximum
错误!书签自引用无效。
switchport port-security violation

Sets the maximum number of secure
addresses for a port.
Configures the violation handling mode forport security.

switchport port-security mac-address

Configures automatic saving of dynamic

stickyaddresses.

(Optional) It is used to configure security filtering items.
Configuring Secure
Addresses on Secure Ports

switchport port-security mac-address

6-5

Configures the static secure addresses in
the interface configuration mode.

Configuration Guide

Configuring Port Security(beta)

switchport port-security interface

Configures the static secure addresses in

mac-address

the global configuration mode.

switchport port-security binding

switchport port-security interface binding

switchport port-security aging

Configures binding of secure addresses in
the interface configuration mode.
Configures binding of secure addresses in
the global configuration mode.
Configures aging time for all secure
addresses on a port.

6.4.1 Configuring Secure ports and Violation Handling Modes
Configuration Effect

Restrict the number of MAC addresses that can be learned from a port.

Filter invalid packets based on MAC addresses, IP addresses or IP+MAC.

Notes


A secure port cannot be the destination port of SPAN.



The port security function cannot be configured for a DHCP Snooping trusted port.



The port security function cannot be configured for excluded ports of global IP+MAC.

The security function can be enabled only for wired switching ports and layer-2 AP ports in the interface configuration
mode.



The port security can work with other access control functions such as the 802.1x, global IP+MAC binding, and IP
source guard. When these functions are used together, packets can enter a switch only when passing all security
checks. If a security channel is configured for a port, packets in compliance with the security channel will avoid
checking of the port security.

Configuration Steps

Enabling the Port Security Service



Mandatory.



If there is no special requirement, enable the port security service for a port on the access device.

Configuring the Maximum Number of Secure Addresses for a Port

Optional. To adjust the maximum number of secure addresses running on a secure port, you can configure this item.



Configure this item on a port enabled with port security.

Configuring Violation Handling Modes

Optional. If you hope that other handling modes except discarding packets are implemented in case of violation, you
can configure other handling modes.



Configure this item on a port enabled with port security.

6-6

Configuration Guide

Configuring Port Security(beta)Saving Dynamically Learned Addresses

Optional. If you hope that secure addresses are not re-learned after the device is restarted, you can configure this
item.



Configure this item on a port enabled with port security.

Verification
Run the command of the device for displaying the port security configurations to check whether the configurations takeeffect.

Related Commands



Setting Port Security

Commandswitchport port-security

Parameter-

Description
Command

Interface configuration mode

Mode
Usage Guide

By using the port security feature, you can strictly control the input of a port of a device by restricting the
MAC addresses and IP addresses (optional) that access the port.



Setting the Maximum Number of Secure Addresses for a Port

Commandswitchport port-security maximum value

Parameter

value: Indicates the number of secure addresses, ranging from 1 to 64.

Description
Command

Interface configuration mode

Mode
Usage Guide

If you set the maximum number to 1 and configure a secure address for this port, the workstation (whose
address is the configured secure address) connected to this port will exclusively use all bandwidth of the
port.



Configuring the Violation Handling Mode for Port Security

Commandswitchport port-security violation { protect | restrict | shutdown }Parameter

protect: Discards violated packets.

Description

restrict: Discards violated packets and send trap notifications.
shutdown: Discards packets and disables the port.

Command

Interface configuration mode

Mode
Usage Guide-

Saving Dynamic Secure Addresses to a Configuration File

Commandswitchport port-security mac-address sticky mac-address [ vlan vlan-id ]Parameter

mac-address: Indicates a static secure address.

Description

vlan-id: Indicates the VID of a MAC address.

6-7

Configuration Guide
Command

Configuring Port Security(beta)

Interface configuration mode

Mode
Usage Guide-

Configuration
Example

Enabling Port Security for the Port gigabitethernet 0/3, Setting the Maximum Number of Addresses to 8, andSetting the Violation Handing Mode to protect

ConfiguratioEnable port security.

n Steps

Set the maximum number of secure addresses.

Modify the violation handling mode.

Ruijie# configure terminal
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport mode accessRuijie(config-if-GigabitEthernet 0/17)# switchport port-security
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security maximum 8
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security violation protect
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security mac-address sticky
Ruijie(config-if-GigabitEthernet 0/17)# end

Verification

Check the port security configuration on the device.
Ruijie# show port-security interface gigabitethernet 0/17
Interface: GigabitEthernet 0/17

Port status: shutdown

Port Security: enabled

SecureStatic address aging: disabled

Sticky dynamic address: enabled

Violation mode

: protect

Maximum MAC Addresses: 8

Total MAC Addresses: 0

Configured MAC Addresses: 0

Dynamic MAC Addresses: 0

Sticky MAC Addresses: 0

Total security binding: 0

IPv4-ONLY Binding Addresses: 0IPv4-MAC Binding Addresses

: 0

6-8

Configuration Guide
Aging time(min)Configuring Port Security(beta): 0

Common ErrorsPort security is enabled on a SPAN port.

Port security is enabled on a DHCP trusted port.



The configured maximum number of secure addresses is smaller than the number of existing secure addresses.

6.4.2 Configuring Secure Addresses on Secure Ports
Configuration EffectAllow specified users to use ports.

Regularly update secure addresses of users.

Notes


Sticky MAC addresses are special MAC addresses not affected by the aging mechanism. No matter dynamic or
static aging is configured, sticky MAC addresses will not be aged.

Configuration Steps

Configuring Secure Addresses

Optional. You need to manually add secure addresses for configuration.

Configure this item on a port enabled with port security.

Configuring Binding of Secure Addresses

Optional. You need to add layer-3 secure addresses for configuration.

Configure this item on a port enabled with port security.

Configuring Aging Time

Optional.

Configure this item on a port enabled with port security.

Verification


Run the command of the device for displaying the port security configurations to check whether the configurations
take effect.

Related Commands

Adding Secure Addresses for Secure Ports in the Global Configuration Mode

Commandswitchport port-security interface interface-id mac-address mac-address [ vlan vlan-id ]Parameterinterface-id: Indicates the interface ID.

Description

mac-address: Indicates a static secure address.

6-9

Configuration Guide

Configuring Port Security(beta)vlan-id: Indicates the VID of a MAC address.
Command

Global configuration mode

Mode
Usage Guide

-Adding Secure Addresses for Secure Ports in the Interface Configuration Mode

Commandswitchportport-security mac-address mac-address [ vlan vlan-id ]Parameter

mac-address: Indicates a static secure address.

Description

vlan-id: Indicates the VID of a MAC address.

Command

Interface configuration mode

Mode
Usage Guide

-Adding Binding of Secure Addresses for Secure Ports in the Global Configuration Mode

Commandswitchport port-security interface interface-id binding [ mac-address vlan vlan-id ] ipv4-address

Parameterinterface-id: Indicates the interface ID.

Description

mac-address: Indicates a bound source MAC address.
vlan-d: Indicates the VID of a bound source MAC address.
ipv4-address: Indicates a bound IPv4 address.

Command

Global configuration mode

Mode
Usage Guide

-Adding Binding of Secure Addresses for Secure Ports in the Interface Configuration Mode

Commandswitchport port-security binding [ mac-address vlan vlan-id ] ipv4-address

Parameter

mac-address: Indicates a bound source MAC address.

Description

vlan-id: Indicates the VID of a bound source MAC address.
ipv4-address: Indicates a bound IPv4 address.

Command

Interface configuration mode

Mode
Usage Guide-Configuring Aging Time for All Secure Addresses on a Port

Commandswitchport port-security aging { static | time time }Parameter

static: Indicates that the aging time will be applied to manually configured secure addresses and

Description

automatically learned addresses; otherwise, the aging time will be applied to only automatically learned
addresses.
time time: Indicates the aging time of the secure addresses on this port, ranging from 0 to 1440 minutes.
If it is set to 0, it indicates that the aging function is disabled actually.

Command

Interface configuration mode

Mode
Usage Guide

-

6-10

Configuration Guide

Configuring Port Security(beta)

Configuration
Example

Configuring a Secure MAC Address 00d0.f800.073c for the Port GigabitEthernet 0/17

ConfiguratioEnable port security.

n Steps

Add a secure address.

Ruijie# configure terminal
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport mode accessRuijie(config-if-GigabitEthernet 0/17)# switchport port-security
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security mac-address 00d0.f800.073c
vlan 1
Ruijie(config-if-GigabitEthernet 0/17)# end

Verification

Check the port security configuration on the device.
Ruijie# show port-security address
NO. VLAN MacAddress



PORT

TYPE

RemainingAge(mins)

STATUS---- ----- --------------- ------------------------- ---------- ---------------------------

1

active100d0.f800.073c GigabitEthernet 0/17

Configured--

Configuring a Security Binding of the IP Address 192.168.12.202 for the Port GigabitEthernet 0/17

ConfiguratioEnable port security.

n Steps

Add a binding of the secure address.

Ruijie# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport mode accessRuijie(config-if-GigabitEthernet 0/17)# switchport port-security
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security binding 192.168.12.202
Ruijie(config-if-GigabitEthernet 0/17)# end

Verification

Check the port security configuration on the device.
Ruijie# show port-security address
NO. VLAN MacAddress

PORT

TYPE

RemainingAge(mins)---- ----- --------------- ------------------------- ---------- ------------------

6-11

STATUS---------

Configuration Guide
1

Configuring Port Security(beta)
100d0.f800.073c GigabitEthernet 0/17

Configured--

activeConfiguring a Secure MAC Address 00d0.f800.073c and a Security Binding of the IP Address 192.168.12.200
for the Port GigabitEthernet 0/17

ConfiguratioEnable port security.

n Steps

Add a binding of the secure address.

Ruijie# configure terminal
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport mode accessRuijie(config-if-GigabitEthernet 0/17)# switchport port-security
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security binding 00d0.f800.073c vlan
1 192.168.12.200
Ruijie(config-if)# end

Verification

Check the port security configuration on the device.
Ruijie# show port-security address
NO. VLAN MacAddress



PORT

TYPE

RemainingAge(mins)

STATUS---- ----- --------------- ------------------------- ---------- ---------------------------

1

active100d0.f800.073c GigabitEthernet 0/17

Configured--

Configuring the Aging Time of the Port GigabitEthernet 0/7 to 8 Minutes, Which Is Also Applied to StaticallyConfigured Secure Addresses

ConfiguratioEnable port security.

n StepsConfigure aging time.

Ruijie# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Ruijie(config)# interface gigabitthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security aging time 8
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security aging static
Ruijie(config-if-GigabitEthernet 0/17)# end

Verification

Check the port security configuration on the device.
Ruijie# show port-security gigabitethernet 0/17
Interface: GigabitEthernet 0/17

Port status: shutdown

Port Security: enabled

6-12

Configuration Guide

Configuring Port Security(beta)

SecureStatic address aging: enabled

Sticky dynamic address: enabled

Violation mode

: protect

Maximum MAC Addresses: 8

Total MAC Addresses: 1

Configured MAC Addresses: 1

Dynamic MAC Addresses: 0

Sticky MAC Addresses: 0

Total security binding: 2

IPv4-ONLY Binding Addresses: 1

IPv4-MAC Binding Addresses: 1

Aging time(min): 8

6.5 Monitoring
Displaying
Description

Command

Displays all secure addresses or allshow port-security address [ interface interface-id ]secure addresses of a specified
port.
Displays all bindings or all bindings

show port-security binding [ interface interface-id ]of a specified port.
Displays all valid secure addresses

show port-security allof ports and the security binding
records of the ports.
Displays the port security

show port-security interface interface-id

configurations of an interface.
Displays the statistics about portshow port-security

security.

6-13

Configuration Guide

Configuring Storm Control

7 Configuring Storm Control
7.1 Overview
When a local area network (LAN) has excess broadcast data flows, multicast data flows, or unknown unicast data flows,
the network speed will slow down and packet transmission will have an increased timeout probability. This situation iscalled a LAN storm. A storm may occur when topology protocol execution or network configuration is incorrect.
Storm control can be implemented to limit broadcast data flows, multicast data flows, or unknown unicast data flows. If therate of data flows received by a device port is within the configured bandwidth threshold, packets-per-second threshold, orkilobits-per-second threshold, the data flows are permitted to pass through. If the rate exceeds the thresholds, excess
data flows are discarded until the rate falls within the thresholds. This prevents flood data from entering the LAN causing astorm.

7.2 Applications
Application

Description

Network Attack Prevention

Enable storm control to prevent flooding.

7.2.1 Network Attack Prevention
Scenario
The application requirements of network attack prevention are described as follows:Protect devices from flooding of broadcast packets, multicast packets, or unknown unicast packets.

Figure 7-1
Switch A

Te 0/19
Gi 0/18
Gi 0/17

PC 1

PC 2

RemarkSwitch A and Switch B are access devices.

s

PC 1, PC 2, PC 3, and PC 4 are desktop computers.

Deployment
Enable storm control on the ports of all access devices (Switch A and Switch B).

7-1

Configuration Guide

Configuring Storm Control

7.3 Features
Basic Concepts



Storm Control

If the rate of data flows (broadcast packets, multicast packets, or unknown unicast packets) received by a device port iswithin the configured bandwidth threshold, packets-per-second threshold, or kilobits-per-second threshold, the data flows
are permitted to pass through. If the rate exceeds the thresholds, excess data flows are discarded until the rate falls within
the thresholds.



Storm Control Based on the Bandwidth Threshold

If the rate of data flows received by a device port is within the configured bandwidth threshold, the data flows are permitted
to pass through. If the rate exceeds the threshold, excess data flows are discarded until the rate falls within the threshold.



Storm Control Based on the Packets-per-Second Threshold

If the rate of data flows received by a device port is within the configured packets-per-second threshold, the data flows are
permitted to pass through. If the rate exceeds the threshold, excess data flows are discarded until the rate falls within thethreshold.



Storm Control Based on the Kilobits-per-Second Threshold

If the rate of data flows received by a device port is within the configured kilobits-per-second threshold, the data flows are
permitted to pass through. If the rate exceeds the threshold, excess data flows are discarded until the rate falls within thethreshold.

Overview
FeatureDescription

Unicast Packet

Limits unknown unicast packets to prevent flooding.

Storm Control
Multicast Packet

Limits multicast packets to prevent flooding.

Storm Control
Broadcast Packet

Limits broadcast packets to prevent flooding.

Storm Control

7.3.1 Unicast Packet Storm Control
The unicast packet storm control feature monitors the rate of unknown unicast data flows received by a device port to limit
LAN traffic and prevent flooding caused by excess data flows.

Working Principle
If the rate of unknown unicast data flows received by a device port is within the configured bandwidth threshold,packets-per-second threshold, or kilobits-per-second threshold, the data flows are permitted to pass through. If the rate
exceeds the thresholds, excess data flows are discarded until the rate falls within the thresholds.

7-2

Configuration Guide

Configuring Storm Control

Related Configuration

Enabling Unicast Packet Storm Control on Ports

By default, unicast packet storm control is disabled on ports.
Run the storm-control unicast [ level percent | pps packets | rate-bps ] command to enable unicast packet storm control
on ports.
Run the no storm-control unicast or default storm-control unicast command to disable unicast packet storm control
on ports.
The default command parameters are determined by related products.

7.3.2 Multicast Packet Storm Control
The multicast packet storm control feature monitors the rate of multicast data flows received by a device port to limit LAN
traffic and prevent flooding caused by excess data flows.

Working Principle
If the rate of multicast data flows received by a device port is within the configured bandwidth threshold,packets-per-second threshold, or kilobits-per-second threshold, the data flows are permitted to pass through. If the rate
exceeds the thresholds, excess data flows are discarded until the rate falls within the thresholds.

Related Configuration

Enabling Multicast Packet Storm Control on Ports

By default, multicast packet storm control is disabled on ports.
Run the storm-control multicast [ level percent | pps packets | rate-bps ] command to enable multicast packet storm
control on ports.
Run the no storm-control multicast or default storm-control multicast command to disable multicast packet storm
control on ports.
The default command parameters are determined by related products.

7.3.3 Broadcast Packet Storm Control
The broadcast packet storm control feature monitors the rate of broadcast data flows received by a device port to limit
LAN traffic and prevent flooding caused by excess data flows.

Working Principle
If the rate of broadcast data flows received by a device port is within the configured bandwidth threshold,packets-per-second threshold, or kilobits-per-second threshold, the data flows are permitted to pass through. If the rate
exceeds the thresholds, excess data flows are discarded until the rate falls within the thresholds.

Related Configuration

Enabling Broadcast Packet Storm Control on Ports

By default, broadcast packet storm control is disabled on ports.

7-3

Configuration Guide

Configuring Storm Control

Run the storm-control broadcast [ level percent | pps packets | rate-bps ] command to enable broadcast packet storm
control on ports.
Run the no storm-control broadcast or default storm-control broadcast command to disable broadcast packet storm
control on ports.

7.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enable storm control.

Configuring Basic Functionsof Storm Control

storm-control { broadcast | multicast |unicast} [ { level percent | pps packets |Enables storm control.

rate-bps} ]7.4.1 Configuring Basic Functions of Storm Control
Configuration EffectPrevent flooding caused by excess broadcast packets, multicast packets, and unknown unicast packets.

Notes


When you run a command (for example, storm-control unicast) to enable storm control, if you do not set theparameters, the default values are used.

Configuration Steps

Enabling Unicast Packet Storm Control



Mandatory.



Enable unicast packet storm control on every device unless otherwise specified.

Enabling Multicast Packet Storm Control



Mandatory.



Enable multicast packet storm control on every device unless otherwise specified.

Enabling Broadcast Packet Storm Control



Mandatory.



Enable broadcast packet storm control on every device unless otherwise specified.

Verification


Run the show storm-control command to check whether the configuration is successful.

Related Commands

Enabling Unicast Packet Storm Control

7-4

Configuration Guide

Configuring Storm Control

Commandstorm-control unicast [ level percent | pps packets | rate-bps ]Parameterlevel percent: Indicates the bandwidth percentage.

Description

pps packets: Indicates the number of packets per second.
rate-bps: Indicates the packet rate.

Command

Interface configuration mode

Mode
Usage GuideStorm control can be enabled only on switch ports.

Enabling Multicast Packet Storm Control

Commandstorm-control multicast [ level percent | pps packets | rate-bps ]Parameterlevel percent: Indicates the bandwidth percentage.

Description

pps packets: Indicates the number of packets per second.
rate-bps: Indicates the packet rate.

Command

Interface configuration mode

Mode
Usage GuideStorm control can be enabled only on switch ports.

Enabling Broadcast Packet Storm Control

Commandstorm-control broadcast [ level percent | pps packets | rate-bps ]Parameterlevel percent: Indicates the bandwidth percentage.

Description

pps packets: Indicates the number of packets per second.
rate-bps: Indicates the packet rate.

Command

Interface configuration mode

Mode
Usage Guide

Storm control can be enabled only on switch ports.

Configuration
Example

Enabling Storm Control on Devices

Scenario
Figure 7-2

Switch A

Te 0/19
Gi 0/18
Gi 0/17

PC 1

Configuratio



PC 2

Enable storm control on Switch A and Switch B.

n Step7-5

Configuration Guide
Switch A

Configuring Storm Control

Ruijie(config)# interface range gigabitethernet 0/17-18
Ruijie(config-if-range)# storm-control broadcast
Ruijie(config-if-range)# storm-control multicast
Ruijie(config-if-range)# storm-control unicast

Verification

Check whether storm control is enabled on Switch A.

Switch A

Ruijie# show storm-control
Interface

Broadcast Control Multicast Control Unicast Control Action------------------------- ----------------- ----------------- --------------- -------GigabitEthernet 0/17
GigabitEthernet 0/18

default
default

default

default

default

7.5 Monitoring
Displaying
Description

Command

Displays storm control information.

show storm-control [ interface-type interface-number ]

7-6

none

defaultnoneConfiguration Guide

Configuring SSH

8 Configuring SSH
8.1 Overview
Secure Shell (SSH) connection is similar to a Telnet connection except that all data transmitted over SSH is encrypted.
When a user in an insecure network environment logs into a device remotely, SSH helps ensure information security andpowerful authentication, protecting the device against attacks such as IP address spoofing and plain-text password
interception.
An SSH-capable device can be connected to multiple SSH clients. In addition, the device can also function as an SSH
client, and allows users to set up an SSH connection with a SSH-server device. In this way, the local device can safely log
in to a remote device through SSH to implement management.
Currently, a device can work as either the SSH server or an SSH client, supporting SSHv1 and SSHv2 versions.
Ruijie SSH service supports both IPv4 and IPv6.
Unless otherwise specified, SSH in this document refers to SSHv2.

Protocols andStandards


RFC 4251: The Secure Shell (SSH) Protocol Architecture

RFC 4252: The Secure Shell (SSH) Authentication Protocol

RFC 4253: The Secure Shell (SSH) Transport Layer Protocol

RFC 4254: The Secure Shell (SSH) Connection Protocol

RFC 4419: Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol

RFC 4716: The Secure Shell (SSH) Public Key File Format



RFC 4819: Secure Shell Public Key Subsystem



RFC 3526: More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)

RFC 2409: The Internet Key Exchange (IKE)

RFC 1950: ZLIB Compressed Data Format Specification version 3.3



draft-ietf-secsh-filexfer-05: SSH File Transfer Protocol

draft-ylonen-ssh-protocol-00: The version of the SSH Remote Login Protocol is 1.5. Comware implements the SSH
server functions, but not the SSH client functions.

8.2 Applications
Application

Description

SSH Device Management

Use SSH to manage devices.

SSH Local Line Authentication

Use the local line password authentication for SSH user authentication.

SSH AAA Authentication

Use the authentication, authorization and accounting (AAA) mode for SSH user

8-1

Configuration Guide
Application

Configuring SSH
Description
authentication.

SSH Public Key Authentication
SSH File Transfer

Use the public key authentication for SSH user authentication.
Use the Secure Copy (SCP) commands on the client to exchange data with the
SSH server.

8.2.1 SSH Device Management
Scenario
You can use SSH to manage devices on the precondition that the SSH server function is enabled. By default, this function
is disabled. The Telnet component that comes with the Windows system does not support SSH. Therefore, a third-party
client software must be used. Currently, well-compatible software includes PuTTY, Linux, and SecureCRT. The following
takes the PuTTY as an example to introduce the configurations of the SSH client. Figure 8-1 shows the network topology.
Figure 8-1 Networking Topology of SSH Device Management

Deployment
Configure the SSH client as follows:Start the PuTTY software.



On the Session option tab of PuTTY, type in the host IP address of the SSH server and SSH port number 22, andselect the connection type SSH.

On the SSH option tab of PuTTY, select the preferred SSH protocol version 2.

On the SSH authentication option tab of PuTTY, select the authentication method Attempt"keyboard-interactive" auth.



Click Open to connect to the SSH server.

Type in the correct user name and password to enter the terminal login interface.

8.2.2 SSH Local Line Authentication
Scenario
SSH clients can use the local line password authentication mode, as shown in Figure 8-2.To ensure security of dataexchange, PC 1 and PC 2 function as the SSH clients, and use the SSH protocol to log in to the network device where the
SSH server function is enabled. The requirements are as follows:

SSH users use the local line password authentication mode.

Five lines, including Line 0 to Line 4, are activated concurrently. The login password is "passzero" for Line 0 and"pass" for the remaining lines. Any user name can be used.

Figure 8-2 Networking Topology of SSH Local Line Password Authentication

8-2

Configuration Guide

Configuring SSH

Deployment
Configure the SSH server as follows:5.

Enable the SSH server function globally. By default, the SSH server supports two SSH versions: SSHv1 and SSHv2.

6.

Configure the key. With this key, the SSH server decrypts the encrypted password received from the SSH clients,
compares the decrypted plain text with the password stored on the server, and returns a message indicating the
successful or unsuccessful authentication. SSHv1 uses an RSA key, whereas SSHv2 adopts an RSA or DSA key.

7.

Configure the IP address of the GigabitEthernet 0/1 interface on the SSH server. The SSH client is connected to the
SSH server using this IP address. The routes from the SSH clients to the SSH server are reachable.

Configure the SSH client as follows:

Diversified SSH client software is available, including PuTTY, Linux, and OpenSSH. This document takes PuTTY as an
example to explain the method for configuring the SSH clients.
10. Open the PuTTY connection tab, and select SSHv1 for authenticated login. (The method is similar if SSHv2 isselected.)
11. Set the IP address and connected port ID of the SSH server. As shown in the network topology, the IP address of theserver is 192.168.23.122, and the port ID is 22. Click Open to start the connection. As the current authentication
mode does not require a user name, you can type in any user name, but cannot be null. (In this example, the username is "anyname".)8.2.3 SSH AAA Authentication
Scenario
SSH users can use the AAA authentication mode for user authentication, as shown in Figure 8-3.To ensure security ofdata exchange, the PCs function as the SSH clients, and uses the SSH protocol to log in to the network device where the
SSH server is enabled. To better perform security management, the AAA authentication mode is used for user login on
the SSH clients. Two authentication methods, including RADIUS server authentication and local authentication, areprovided in the AAA authentication method list to ensure reliability. The RADIUS server authentication method is preferred.
If the RADIUS server does not respond, it turns to the local authentication.
Figure 8-3 Networking Topology of SSH AAA Authentication

8-3

Configuration Guide

Configuring SSH

Deployment
The routes from the SSH clients to the SSH server are reachable, and the route from the SSH server to the RADIUS
server is also reachable.

Configure the SSH server on the network device that functions as an SSH client.

Configure the AAA parameters on the network device. When the AAA authentication mode is used, method lists are
created to define the identity authentication and types, and applied to a specified service or interface.

8.2.4 SSH Public Key Authentication
Scenario
SSH clients can use the public keys for authentication, and the public key algorithm can be RSA or DSA, as shown in
Figure 8-4.SSH is configured on the client so that a secure connection is set up between the SSH client and the SSH
server.
Figure 8-4 Network Topology for Public Key Authentication of SSH Users

Deployment
To implement public key authentication for the client, generate a key pair (RSA or DSA) on the client, configure thepublic key on the SSH server, and select the public key authentication mode.

After the key is generated on the client, the SSH server will copy the file of the public key from the client to the flash
and associates the file with the SSH user name. Each user can be associated with one RSA public key and one DSA
public key.

8-4

Configuration Guide

Configuring SSH

8.2.5 SSH File Transfer
Scenario
The SCP service is enabled on the server, and SCP commands are used on the client to transfer data to the server, as
shown in Figure 8-5.
Figure 8-5 Networking Topology of SSH File Transfer

Deployment
Enable the SCP service on the server.

On the client, use SCP commands to upload files to the server, or download files from the server.

8.3 Features
Basic Concepts

User Authentication Mechanism

Password authentication

During the password authentication, a client sends a user authentication request and encrypted user name and password
to the server. The server decrypts the received information, compares the decrypted information with those stored on theserver, and then returns a message indicating the successful or unsuccessful authentication.

Public key authentication

During the public key authentication, digital signature algorithms, such as RSA and DSA, are used to authenticate a client.
The client sends a public key authentication request to the server. This request contains information including the user
name, public key, and public key algorithm. On receiving the request, the server checks whether the public key is correct.
If wrong, the server directly sends an authentication failure message. If right, the server performs digital signatureauthentication on the client, and returns a message indicating the successful or unsuccessful authentication.
Public key authentication is applicable only to the SSHv2 clients.



SSH Communication

To ensure secure communication, interaction between an SSH server and an SSH client undergoes the following sevenstages:Connection setup

The server listens on Port 22 to the connection request from the client. After originating a socket initial connection request,
the client sets up a TCP socket connection with the server.

Version negotiation

8-5

Configuration Guide

Configuring SSH

If the connection is set up successfully, the server sends a version negotiation packet to the client. On receiving thepacket, the client analyzes the packet and returns a selected protocol version to the server. The server analyzes thereceived information to determine whether version negotiation is successful.

Key exchange and algorithm negotiation

If version negotiation is successful, key exchange and the algorithm negotiation are performed. The server and the client
exchange the algorithm negotiation packet with each other, and determine the final algorithm based on their capacity. In
addition, the server and the client work together to generate a session key and a session ID according to the key
exchange algorithm and host key, which will be applied to subsequent user authentication, data encryption, and datadecryption.

User authentication

After the encrypted channel is set up, the client sends an authentication request to the server. The server repeatedly
conducts authentication for the client until the authentication succeeds or the server shuts down the connection because
the maximum number of authentication attempts is reached.



Session request

After the successful authentication, the client sends a session request to the server. The server waits and processes theclient request. After the session request is successfully processed, SSH enters the session interaction stage.



Session interaction

After the session request is successfully processed, SSH enters the session interaction stage. Encrypted data can betransmitted and processed in both directions. The client sends a command to be executed to the client. The server
decrypts, analyzes, and processes the received command, and then sends the encrypted execution result to the client.
The client decrypts the execution result.



Session ending

When the interaction between the server and the client is terminated, the socket connection disconnects, and the session
ends.

Overview
FeatureDescription

SSH Server

Enable the SSH server function on a network device, and you can set up a secure connection
with the network device through the SSH client.

SCP Service

After the SCP service is enabled, you can directly download files from the network device andupload local files to the network device. In addition, all interactive data is encrypted, featuring
authentication and security.

8.3.1 SSH Server
Enable the SSH server function on a network device, and you can set up a secure connection with the network device
through the SSH client. You can also shut down the SSH server function to disconnect from all SSH clients.

Working Principle
For details about the working principle of the SSH server, see the "SSH Communication" in "Basic Concepts." In practice,after enabling the SSH server function, you can configure the following parameters according to the application
requirements:

8-6

Configuration Guide

Configuring SSH

Version: Configure the SSH version as SSHv1 orSSHv2 to connect SSH clients.



Authentication timeout: The SSH server starts the timer after receiving a user connection request. The SSH server isdisconnected from the client either when the authentication succeeds or when the authentication timeout is reached.

Maximum number of authentication retries: The SSH server starts authenticating the client after receiving its
connection request. If authentication does not succeed when the maximum number of user authentication retries isreached, a message is sent, indicating the authentication failure.

Public key authentication: The public key algorithm can be RSA or DSA. It provides a secure connection between theclient and the server. The public key file on the client is associated with the user name. In addition, the public key
authentication mode is configured on the client, and the corresponding private key file is specified. In this way, when
the client attempts to log in to the server, public key authentication can be implemented to set up a secureconnection.

Related Configuration

Enabling the SSH Server

By default, the SSH server is disabled.
In global configuration mode, run the [no] enable service ssh-server command to enable or disable the SSH server.
To generate the SSH key, you also need to enable the SSH server.

Specifying the SSH Version

By default, the SSH server supports both SSHv1 and SSHv2, connecting either SSHv1 clients or SSHv2 clients.
Run the ip ssh version command to configure the SSH version supported by the SSH server.
If only SSHv1 or SSHv2 is configured, only the SSH client of the configured version can be connected to the SSH server.

Configuring the SSH Authentication Timeout

By default, the user authentication timeout is 120s.
Run the ip ssh time-out command to configure the user authentication timeout of the SSH server. Use the no form of thecommand to restore the default timeout. The SSH server starts the timer after receiving a user connection request. If
authentication does not succeed before the timeout is reached, authentication times out and fails.

Configuring the Maximum Number of SSH Authentication Retries

By default, the maximum number of user authentication retries is 3.
Run the ip ssh authentication-retries command to configure the maximum number of user authentication retries on the
SSH server. Use the no form of the command to restore the default number of user authentication retries. If authentication
still does not succeed when the maximum number of user authentication retries is reached, user authentication fails.

Specifying the SSH Encryption Mode

By default, the encryption mode supported by the SSH server is Compatible, that is, supporting cipher block chaining(CBC), counter (CTR) and other encryption modes.
Run the ip ssh cipher-mode command to configure the encryption mode supported by the SSH server. Use the no formof the command to restore the default encryption mode supported by the SSH server.

8-7

Configuration GuideConfiguring SSH

Specifying the SSH Message Authentication Algorithm

By default, the message authentication algorithms supported by the SSH server are as follows: (1) For the SSHv1, noalgorithm is supported; (2) For the SSHv2, four algorithms, including MD5,SHA1,SHA1-96, and MD5-96, are supported.
Run the ip ssh hmac-algorithm command to configure the message authentication algorithm supported by the SSH
server. Use the no form of the command to restore the default message authentication algorithm supported by the SSH
server.



Enabling the Public Key Authentication on the SSH Server

Run the ip ssh peer command to associate the public key file on the client with the user name. When the client isauthenticated upon login, a public key file is specified based on the user name.

8.3.2 SCP Service
The SSH server provides the SCP service to implement secure file transfer between the server and the client.

Working Principle

SCP is a protocol that supports online file transfer. It runs on Port 22 based on the BSC RCP protocol, whereas RCP
provides the encryption and authentication functions based on the SSH protocol. RCP implements file transfer, and
SSH implements authentication and encryption.



Assume that the SCP service is enabled on the server. When you use an SCP client to upload or download files, the
SCP client first analyzes the command parameters, sets up a connection with a remote server, and starts another
SCP process based on this connection. This process may run in source or sink mode. (The process running insource mode is the data provider. The process running in sink mode is the destination of data.) The process runningin source mode reads and sends files to the peer end through the SSH connection. The process running in sinkmode receives files through the SSH connection.

Related Configuration

Enabling the SCP Server

By default, the SCP server function is disabled.
Run the ip scp server enable command to enable SCP server function on a network device.

8.4 Configuration
Configuration

Description and Command
It is mandatory to enable the SSH server.
enable service ssh-server

Configuring the SSH Server

disconnect ssh [ vty ] session-id

Enables the SSH server.
Disconnects an established SSH
session.

crypto key generate { dsa | rsa }Generates an SSH key.

ip ssh version { 1 | 2 }Specifies the SSH version.

8-8Configuration Guide
Configuration

Configuring SSH
Description and Command
Configures the SSH authentication

ip ssh time-out time

timeout.

ip ssh authentication-retries retry-times

SSH authentication retries.

Ip ssh cipher-mode { cbc | ctr | others }Specifies the SSH encryption mode.

Ip ssh hmac-algorithm { md5 | md5-96 |Specifies the SSH message

sha1 | sha1-96 }authentication algorithm.

ip ssh peer test public-key rsa flash:rsa.pub

Configuring the SCP Service

Configures the maximum number of

Associates an RSA public key file with auser.

ip ssh peer test public-key dsa

Associates a DSA public key file with aflash:dsa.pub

user.

Mandatory.
Enables the SCP server.

ip scp server enable

8.4.1 Configuring the SSH Server
Configuration EffectEnable the SSH server function on a network device so that you can set up a secure connection with a remote
network device through the SSH client. All interactive data is encrypted before transmitted, featuring authenticationand security.

You can use diversified SSH user authentications modes, including local line password authentication, AAAauthentication, and public key authentication.

You can generate or delete an SSH key.

You can specify the SSH version.

You can configure the SSH authentication timeout.

You can configure the maximum number of SSH authentication retries.



You can specify the SSH encryption mode.

You can specify the SSH message authentication algorithm.

You can specify ACL filtering of the SSH server.

Notes


The precondition of configuring a device as the SSH server is that communication is smooth on the network that thedevice resides, and the administrator can access the device management interface to configure related parameters.



The no crypto key generate command does not exist. You need to run the crypto key zeroize command to delete
a key.

The SSH module does not support hot standby. Therefore, for products that supports hot standby on the supervisor
modules, if no SSH key file exist on the new active module after failover, you must run the crypto key generatecommand to re-generate a key before using SSH.

8-9

Configuration Guide

Configuring SSH

Configuration Steps

Enabling the SSH Server

Mandatory.



By default, the SSH server is disabled. In global configuration mode, enable the SSH server and generate an SSH
key so that the SSH server state changes to ENABLE.



Specifying the SSH Version



Optional.



By default, the SSH server supports SSHv1 and SSHv2, connecting either SSHv1 or SSHv2clients. If only SSHv1 orSSHv2 is configured, only the SSH client of the configured version can be connected to the SSH server.

Configuring the SSH Authentication Timeout

Optional.



By default, the SSH authentication timeout is 120s. You can configure the user authentication timeout as required.
The value ranges from 1 to 120. The unit is second.



Configuring the Maximum Number of SSH Authentication Retries



Optional.

Configure the maximum number of SSH authentication retries to prevent illegal behaviors such as malicious
guessing. By default, the maximum number of SSH authentication retries is 3, that is, a user is allowed to enter theuser name and password three times for authentication. You can configure the maximum number of retries as
required. The value ranges from 0 to 5.

Specifying the SSH Encryption Mode

Optional.

Specify the encryption mode supported by the SSH server. By default, the encryption mode supported by the SSH
server is Compatible, that is, supporting CBC, CTR and other encryption modes.

Specifying the SSH Message Authentication Algorithm

Optional.

Specify the message authentication algorithm supported by the SSH server. By default, the message authentication
algorithms supported by the SSH server are as follows: (1) For the SSHv1, no algorithm is supported; (2) For theSSHv2, four algorithms, including MD5, SHA1, SHA1-96, and MD5-96, are supported.



Setting ACL Filtering of the SSH Server

Optional.



Set ACL filtering of the SSH server. By default, ACL filtering is not performed for all connections to the SSH server.
According to needs, set ACL filtering to perform for all connections to the SSH server.

Enabling the Public Key Authentication for SSH Users

Optional.

8-10Configuration GuideConfiguring SSH

Only SSHv2 supports authentication based on the public key. This configuration associates a public key file on theclient with a user name. When a client is authenticated upon login, a public key file is specified based on the user
name.

Verification


Run the show ip ssh command to display the current SSH version, authentication timeout, and maximum number ofauthentication retries of the SSH server.



Run the show crypto key mypubkey command to display the public information of the public key to verify whether
the key has been generated.

Configure the public key authentication login mode on the SSH client and specify the private key file. Check whether
you can successfully log in to the SSH server from the SSH client. If yes, the public key file on the client is
successfully associated with the user name, and public key authentication succeeds.

Related Commands

Enabling the SSH Server

Commandenable service ssh-server

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

To disable the SSH server, run the no enable service ssh-server command in global configuration
mode. After this command is executed, the SSH server state changes to DISABLE.



Disconnecting an Established SSH Session

Commanddisconnect ssh [ vty ] session-id

Parameter

vty: Indicates an established virtual teletype terminal (VTY) session.

Description

session-id: Indicates the ID of the established SSH session. The value ranges from 0 to 35.

CommandPrivileged EXEC mode

Mode
Usage Guide

Specify an SSH session ID to disconnect the established SSH session. Alternatively, specify a VTY
session ID to disconnect a specified SSH session. Only an SSH session can be disconnected.

Generating an SSH Key

Commandcrypto key generate { dsa | rsa }Parameter

dsa: Generates a DSA key.

Description

rsa: Generates an RSA key.

Command

Global configuration mode

Mode
Usage Guide

The no crypto key generate command does not exist. You need to run the crypto key zeroizecommand to delete a key.
SSHv1 uses an RSA key, whereas SSHv2 uses an RSA or DSA key.
If an RSA key is generated, both SSHv1 and SSHv2 are supported. If only a DSA key is generated, only

8-11

Configuration Guide

Configuring SSH

SSHv2 can use the key.

Specifying the SSH Version

Commandip ssh version { 1 | 2 }Parameter

1: Indicates that the SSH server only receives the connection requests sent by SSHv1 clients.

Description

2: Indicates that the SSH server only receives the connection requests sent by SSHv2 clients.

Command

Global configuration mode

Mode
Usage Guide

Run the no ip ssh version command to restore the default settings. By default, the SSH server supports
both SSHv1 and SSHv2.



Configuring the SSH Authentication Timeout

Commandip ssh time-out time

Parameter

time: Indicates the SSH authentication timeout. The value ranges from 1 to 120. The unit is second.

Description
Command

Global configuration mode

Mode
Usage GuideRun the no ip ssh time-out command to restore the default SSH authentication timeout, which is 120s.

Configuring the Maximum Number of SSH Authentication Retries

Commandip ssh authentication-retries retry-times

Parameter

retry-times: Indicates the maximum number of user authentication retries. The value ranges from 0 to 5.

Description
Command

Global configuration mode

Mode
Usage Guide

Run the no ip ssh authentication-retries command to restore the default number of user authentication
retries, which is 3.

Specifying the SSH Encryption Mode

Commandip ssh cipher-mode { cbc | ctr | others }Parameter

cbc: Sets the encryption mode supported by the SSH server to the CBC mode. Corresponding

Description

algorithms include DES-CBC,3DES-CBC,AES-128-CBC,AES-192-CBC,AES-256-CBC, andBlowfish-CBC.
ctr: Sets the encryption mode supported by the SSH server to the CTR mode. Corresponding algorithms
include AES128-CTR, AES192-CTR, and AES256-CTR.
others: Sets the encryption mode supported by the SSH server to others. The corresponding algorithm
is RC4.

Command

Global configuration mode

Mode
Usage Guide

This command is used to configure the encryption mode supported by the SSH server.
On Ruijie devices, the SSHv1 server supports the DES-CBC, 3DES-CBC, and Blowfish-CBC encryption
algorithms; the SSHv2 server supports the AES128-CTR, AES192-CTR, AES256-CTR, DES-CBC,
3DES-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC, Blowfish-CBC, and RC4 encryption

8-12

Configuration Guide

Configuring SSH

algorithms. These algorithms can be grouped into three encryption modes: CBC, CTR, and others.
As the cryptography continuously develops, it is approved that encryption algorithms in the CBC andothers modes can be decrypted in a limited period of time. Therefore, organizations or companies thathave high security requirements can set the encryption mode supported by the SSH server to CTR toincrease the security level of the SSH server.

Specifying the SSH Message Authentication Algorithm

Commandip ssh hmac-algorithm { md5 | md5-96 | sha1 | sha1-96 }Parameter

md5: Indicates that the message authentication algorithm supported by the SSH server is MD5.

Description

md5-96: Indicates that the message authentication algorithm supported by the SSH server is MD5-96.
sha1: Indicates that the message authentication algorithm supported by the SSH server is SHA1.
sha1-96: Indicates that the message authentication algorithm supported by the SSH server is SHA1-96.

Command

Global configuration mode

Mode
Usage Guide

This command is used to configure the message authentication algorithm supported by the SSH server.
On Ruijie devices, the SSHv1 server does support any message authentication algorithm; the SSHv2
server supports the MD5, SHA1, SHA1-96, and MD5-96 message authentication algorithms. You canselect message authentication algorithms supported by the SSH server as required.

Configuring RSA Public Key Authentication

Commandip ssh peer test public-key rsa flash:rsa.pub

Parameter

test: Indicates the user name.

Description

rsa: Indicates that the public key type is RSA.
rsa.pub: Indicates the name of a public key file.

Command

Global configuration mode

Mode
Usage Guide

This command is used to configure the RSA public key file associated with user test.
Only SSHv2 supports authentication based on the public key. This command associates the public key
file on the client with the user name. When the client is authenticated upon login, a public key file is
specified based on the user name.



Configuring DSA Public Key Authentication

Commandip ssh peer test public-key dsa flash:dsa.pub

Parameter

test: Indicates the user name.

Description

dsa: Indicates that the public key type is DSA.
dsa.pub: Indicates the name of a public key file.

Command

Global configuration mode

Mode
Usage Guide

This command is used to configure the DSA key file associated with user test.
Only SSHv2 supports authentication based on the public key. This command associates the public key
file on the client with the user name. When the client is authenticated upon login, a public key file is
specified based on the user name.

8-13Configuration Guide

Configuring SSH

Configuration
ExampleThe following configuration examples describe only configurations related to SSH.

Generating a Public Key on the SSH Server

ConfiguratioRun the crypto key generate { dsa | rsa } command to generate a RSA public key for the server.

n Steps
SSH Server

Ruijie# configure terminal
Ruijie(config)# crypto key generate rsa
Choose the size of the rsa key modulus in the range of 512 to 2048
and the size of the dsa key modulus in the range of 360 to 2048 for yourSignature Keys. Choosing a key modulus greater than 512 may takea few minutes.

How many bits in the modulus [512]:


If the generation of the RSA key is successful, the following information is displayed:% Generating 512 bit RSA1 keys ...[ok]% Generating 512 bit RSA keys ...[ok]

If the generation of the RSA key fails, the following information is displayed:% Generating 512 bit RSA1 keys ...[fail]% Generating 512 bit RSA keys ...[fail]

Verification



Run the show crypto key mypubkey rsa command to display the public information about the
RSA key. If the public information about the RSA key exists, the RSA key has been generated.

SSH Server

Ruijie# show crypto key mypubkey rsa% Key pair was generated at: 1:49:47 UTC Jan 4 2013
Key name: RSA1 private
Usage: SSH Purpose Key
Key is not exportable.
Key Data:
AAAAAwEA AQAAAHJM 6izXt1pp rUSOEGZ/ UhFpRRrW nngP4BU7 mG836apf jajSYwcU
8O3LojHL ayJ8G4pG 7j4T4ZSf FKg09kfr 92JpRNHQ gbwaPc5/ 9UnTtX9t qFIKDj1j
0dKBcCfN tr0r/CT+ cs5tlGKV S0ICGifz oB+pYaE=% Key pair was generated at: 1:49:47 UTC Jan 4 20138-14

Configuration Guide

Configuring SSH

Key name: RSA private
Usage: SSH Purpose Key
Key is not exportable.
Key Data:
AAAAAwEAAQAAAHJfLwKnzOgO F3RlKhTN /7PmQYoE v0a2VXTX 8ZCa7Sll EghLDLJc
w3T5JQXk Rr3iBD5s b1EeOL4b 21ykZt/u UetQ0Q80 sISgIfZ9 8o5No3Zz MPM0LnQR
G4c7/28+ GOHzYkTk 4IiQuTIL HRgtbyEYXCFaaxU=

Specifying the SSH Version

Configuratio

SSHv2.

n Steps
SSH Server

Run the ip ssh version { 1 | 2 } command to set the version supported by the SSH server to

Ruijie# configure terminal
Ruijie(config)# ip ssh version 2

Verification



SSH Server

Ruijie# show ip ssh

Run the show ip ssh command to display the SSH version currently supported by the SSH server.

SSH Enable - version 2.0
Authentication timeout: 120 secs
Authentication retries: 3
SSH SCP Server: disabledConfiguring the SSH Authentication Timeout

ConfiguratioRun the ip ssh time-out time command to set the SSH authentication timeout to 100s.

n Steps
SSH Server

Ruijie# configure terminal
Ruijie(config)# ip sshtime-out100

Verification



SSH Server

Ruijie(config)# show ip ssh

Run the show ip ssh command to display the configured SSH authentication timeout.

SSH Enable - version 2.0
Authentication timeout: 100 secs
Authentication retries: 3
SSH SCP Server: disabledConfiguring the Maximum Number of SSH Authentication Retries

8-15

Configuration Guide
ConfiguratioRun the ip ssh authentication-retries retry-times command to set the maximum number of user
authentication retries on the SSH server to 2.

n Steps
SSH Server

Configuring SSH

Ruijie# configure terminal
Ruijie(config)# ip ssh authentication-retries 2

Verification



Run the show ip ssh command to display the configured maximum number of authentication
retries.

SSH Server

Ruijie# show ip ssh
SSH Enable - version 2.0
Authentication timeout: 100 secs
Authentication retries: 3
SSH SCP Server: disabledSpecifying the SSH Encryption Mode

Configuratio

by the SSH server to CTR.

n Steps
SSH Server

Run the ip ssh cipher-mode { cbc | ctr | others }command to set the encryption mode supported

Ruijie# configure terminal
Ruijie(config)# ip ssh cipher-mode ctr

Verification

Select the CTR encryption mode on the SSH client, and verify whether you can successfully log into the SSH server from the SSH client.

Specifying the SSH Message Authentication Algorithm

Configuratioauthentication algorithm supported by the SSH server to SHA1.

n Steps
SSH Server

Run the ip ssh hmac-algorithm { md5 | md5-96 | sha1 | sha1-96 } command to set the message

Ruijie# configure terminal
Ruijie(config)# ip ssh hmac-algorithmsha1

Verification

Select the SHA1 message authentication algorithm on the SSH client, and verify whether you cansuccessfully log in to the SSH server from the SSH client.

Configuring the Public Key Authentication

Configuration Steps

Run the ip ssh peer username public-key { dsa | rsa } filename command to associate a public
key file of the client with a user name. When the client is authenticated upon login, a public key file(for example, RSA) is specified based on the user name.

SSH Server

Ruijie# configure terminal
Ruijie(config)# ip ssh peer test public-key rsa flash:rsa.pub

8-16

Configuration Guide
Verification

Configuring SSH
Configure the public key authentication login mode on the SSH client and specify the private key
file. Check whether you can successfully log in to the SSH server from the SSH client. If yes, thepublic key file on the client is successfully associated with the user name, and public key
authentication succeeds.

Configuring SSH Device Management

Scenario
Figure 8-6

You can use SSH to manage devices on the precondition that the SSH server function is enabled. By
default, this function is disabled. The Telnet component that comes with the Windows does not support
SSH. Therefore, a third-party client software must be used. Currently, well-compatible client software
includes PuTTY, Linux, and SecureCRT. The following takes the PuTTY as an example to introduce theconfigurations of the SSH client.

ConfiguratioStart the PuTTY software.

n StepsOn the Session option tab of PuTTY, type in the host IP address 192.168.23.122 and SSH port
number 22, and select the connection type SSH.

On the SSH option tab of PuTTY, select the preferred SSH protocol version 2.

On the SSH authentication option tab of PuTTY, select the authentication method Attempt"keyboard-interactive" auth.

SSH Client

Click Open to connect to the SSH server.

Type in the correct user name and password to enter the terminal login interface.

Figure 8-7

8-17

Configuration Guide

Configuring SSH

Host Name (or IP address) indicates the IP address of the host to be logged in. In this example, the IP
address is 192.168.23.122. Port indicates the port ID 22, that is, the default ID of the port listened by
SSH. Connection type is SSH.
Figure 8-8

As shown in Figure 8-8, select 2 as the preferred SSH protocol version in the Protocol options pane
because SSHv2 is used for login.
Figure 8-9

8-18

Configuration Guide

Configuring SSH

As shown in Figure 8-9, select Attempt "keyboard-interactive" auth as the authentication method to
support authentication based on the user name and password.
Then, click Open to connect to the configured server host, as shown in Figure 8-9.
Figure 8-10

The PuTTY Security Alert box indicates that you are logging in to the client of the server 192.168.23.122,
and asks you whether to receive the key sent from the server.
If you select Yes, a login dialog box is displayed, as shown in Figure 8-10.
Figure 8-11

8-19

Configuration Guide

Configuring SSH

Type in the correct user name and password, and you can log in to the SSH terminal interface, as shownin Figure 8-11.
Figure 8-12

Verification



Run the show ip ssh command to display the configurations that are currently effective on the
SSH server.

8-20

Configuration GuideConfiguring SSH
Run the show ssh command to display information about every SSH connection that has been
established.

Ruijie# show ip ssh
SSH Enable - version 1.99
Authentication timeout: 120 secs
Authentication retries: 3
Ruijie# show ssh
Connection Version Encryption0

2.0 aes256-cbc

Hmac

State

Username

hmac-sha1

Session started test

Configuring SSH Local Line Authentication

Scenario
Figure 8-13

SSH users can use the local line password for user authentication, as shown in Figure 8-13.To ensure
security of data exchange, PC 1 and PC 2 function as the SSH clients, and use the SSH protocol to log
in to the network device where the SSH server is enabled. The requirements are as follows:

SSH users use the local line password authentication mode.

Five lines, including Line 0 to Line 4, are activated concurrently. The login password is "passzero"for Line 0 and "pass" for the remaining lines. Any user name can be used.

Configuratio

Configure the SSH server as follows:n Steps

Enable the SSH server function globally. By default, the SSH server supports two SSH versions:
SSHv1 and SSHv2.



Configure the key. With this key, the SSH server decrypts the encrypted password received fromthe SSH client, compares the decrypted plain text with the password stored on the server, andreturns a message indicating the successful or unsuccessful authentication. SSHv1 uses the RSA
key, whereas SSHv2 uses the RSA or DSA key.

Configure the IP address of the GigabitEthernet 0/1 interface on the SSH server. The SSH client isconnected to the SSH server based on this IP address. The route from the SSH client to the SSH
server is reachable.

Configure the SSH client as follows:

Diversified SSH client software is available, including PuTTY, Linux, and SecureCRT. This
document takes PuTTY as an example to explain the method for configuring the SSH client. For
details about the configuration method, see "Configuration Steps."

8-21

Configuration Guide
SSH Server

Configuring SSH

Before configuring SSH-related function, ensure that the route from the SSH user to the network
segment of the SSH server is reachable. The interface IP address configurations are shown in Figure
8-13 The detailed procedures for configuring IP addresses and routes are omitted.
Ruijie(config)# enable service ssh-server
Ruijie(config)# crypto key generate rsa% You already have RSA keys.
% Do you really want to replace them? [yes/no]:Choose the size of the key modulus in the range of 360 to 2048 for yourSignature Keys. Choosing a key modulus greater than 512 may takea few minutes.
How many bits in the modulus [512]:% Generating 512 bit RSA1 keys ...[ok]% Generating 512 bit RSA keys ...[ok]Ruijie(config)# interface gigabitethernet 0/1
Ruijie(config-if-GigabitEthernet 0/1)# ip address 192.168.23.122 255.255.255.0
Ruijie(config-if-GigabitEthernet 0/1)# exit
Ruijie(config)# line vty 0
Ruijie(config-line)# password passzero
Ruijie(config-line)# privilege level 15
Ruijie(config-line)# login
Ruijie(config-line)# exit
Ruijie(config)# line vty 1 4
Ruijie(config-line)# password pass
Ruijie(config-line)# privilege level 15
Ruijie(config-line)# login
Ruijie(config-line)# exit

SSH

Figure 8-14

Client(PC1/
PC2)

8-22

Configuration Guide

Configuring SSH

Set the IP address and port ID of the SSH server. As shown in the network topology, the IP address ofthe server is 192.168.23.122, and the port ID is 22 (For details about the configuration method, see"Configuring SSH Device Management."). Click Open to start the SSH server. As the current
authentication mode does not require a user name, you can type in any user name, but cannot leave theuser name unspecified. (In this example, the user name is "anyname".)Verification

SSH ServerRun the show running-config command to display the current configurations.



Verify that the SSH client configurations are correct.

Ruijie# show running-config
Building configuration...
!
enable secret 5 $1$eyy2$xs28FDw4s2q0tx97
enable service ssh-server!
interface GigabitEthernet 0/1
ip address 192.168.23.122 255.255.255.0!
line vty 0
privilege level 15

8-23

Configuration Guide

Configuring SSH

login
password passzero
line vty 1 4
privilege level 15
login
password pass!
end
SSH Client

Set up a connection, and enter the correct password. The login password is "passzero" for Line 0 and"pass" for the remaining lines. Then, the SSH server operation interface is displayed, as shown in Figure
8-15.
Figure 8-15

Ruijie# show users
Line

User

Host(s)

Idle

Location---------------- ------------ -------------------- ---------- -----------------*

0 con 0---idle

00:00:00---

1 vty 0---idle

00:08:02

192.168.23.83

2 vty 1---

idle

00:00:58

192.168.23.121

Configuring AAA Authentication of SSH Users

8-24

Configuration Guide

Configuring SSH

Scenario
Figure 8-16

SSH users can use the AAA authentication mode for user authentication, as shown in Figure 8-16. To
ensure security of data exchange, the PC functions as the SSH client, and uses the SSH protocol to log
in to the network device where the SSH server is enabled. To better perform security management, theAAA authentication mode is used on the user login interface of the SSH client. Two authentication
methods, including RADIUS server authentication and local authentication, are provided in the AAA
authentication method list to ensure reliability. The RADIUS server authentication method is preferred. If
the RADIUS server does not respond, select the local authentication method.

ConfiguratioThe route from the SSH client to the SSH server is reachable, and the route from the SSH server tothe RADIUS server is also reachable.

n StepsConfigure the SSH server on the network device. The configuration method is already described in
the previous example, and therefore omitted here.

Configure the AAA parameters on the network device. When the AAA authentication mode is used,method lists are created to define the identity authentication and types, and applied to a specified
service or interface.

SSH Server

Ruijie(config)# enable service ssh-server
Ruijie(config)# crypto key generate rsa% You already have RSA keys.
% Do you really want to replace them? [yes/no]:Choose the size of the key modulus in the range of 360 to 2048 for yourSignature Keys. Choosing a key modulus greater than 512 may takea few minutes.
How many bits in the modulus [512]:% Generating 512 bit RSA1 keys ...[ok]% Generating 512 bit RSA keys ...[ok]Ruijie(config)# crypto key generate dsa
Choose the size of the key modulus in the range of 360 to 2048 for your

8-25

Configuration Guide

Configuring SSH

Signature Keys. Choosing a key modulus greater than 512 may takea few minutes.
How many bits in the modulus [512]:% Generating 512 bit DSA keys ...[ok]Ruijie(config)# interface gigabitethernet 0/1
Ruijie(config-if-GigabitEthernet 0/1)# ip address 192.168.217.81 255.255.255.0
Ruijie(config-if-GigabitEthernet 0/1)# exit
Ruijie# configure terminal
Ruijie(config)# aaa new-model
Ruijie(config)# radius-server host 192.168.32.120
Ruijie(config)# radius-server key aaaradius
Ruijie(config)# aaa authentication login methodgroup radius local
Ruijie(config)# line vty 0 4
Ruijie(config-line)# login authentication method
Ruijie(config-line)# exit
Ruijie(config)# username user1 privilege 1 password 111
Ruijie(config)# username user2 privilege 10 password 222
Ruijie(config)# username user3 privilege 15 password 333
Ruijie(config)# enable secret w

Verification



Run the show running-config command to display the current configurations.

This example assumes that the SAM server is used.



Set up a remote SSH connection on the PC.

Check the login user.

Ruijie# show running-config
aaa new-model!
aaa authentication login method group radius local!
username user1 password 111
username user2 password 222
username user2 privilege 10
username user3 password 333
username user3 privilege 15

8-26

Configuration Guide

Configuring SSH

no service password-encryption!
radius-server host 192.168.32.120
radius-server key aaaradiusenable secret 5 $1$hbgz$ArCsyqty6yyzzp03
enable service ssh-server!
interface gigabitEthernet1/1
no ip proxy-arp
ip address 192.168.217.81 255.255.255.0!
ip route 0.0.0.0 0.0.0.0 192.168.217.1!
line con 0line vty 0 4login authentication method!
End
On the SSH client, choose System Management>Device Management, and add the device IP address
192.168.217.81 and the device key aaaradius.
Choose Security Management>Device Management Rights, and set the rights of the login user.
Choose Security Management>Device Administrator, and add the user name user and password
pass.
Configure the SSH client and set up a connection to the SSH server. For details, see the previous
example.
Type in the user name user and password pass. Verify that you can log in to the SSH server
successfully.
Ruijie# show users
Line

User

0 con 0* 1 vty 0user

Host(s)

Idle

idle

00:00:31

idle

00:00:33

Configuring Public Key Authentication of SSH Users

Scenario
Figure 8-17

8-27

Location

192.168.217.60

Configuration Guide

Configuring SSH

SSH users can use the public key for user authentication, and the public key algorithm is RSA or DSA,
as shown in Figure 8-17. SSH is configured on the client so that a secure connection is set up between
the SSH client and the SSH server.

Configuratio

To implement public key authentication on the client, generate a key pair (for example, RSA key)on the client, place the public key on the SSH server, and select the public key authenticationn Stepsmode.
After the key pair is generated on the client, you must save and upload the public key file to theserver and complete the server-related settings before you can continue to configure the client andconnect the client with the server.


After the key is generated on the client, copy the public key file from the client to the flash of the
SSH server, and associate the file with an SSH user name. A user can be associated with one RSA
public key and one DSA public key.

SSH Client

Run the puttygen.exe software on the client. Select SSH-2 RSA in the Parameters pane, and click
Generate to generate a key, as shown in Figure 8-18.
Figure 8-18

When a key is being generated, you need to constantly move the mouse over a blank area outside thegreen progress bar; otherwise, the progress bar does not move and key generation stops, as shown in
Figure 8-19.
Figure 8-19

8-28

Configuration Guide

Configuring SSH

To ensure security of the RSA public key authentication, the length of the generated RSA key pair must
be equal to or larger than 768 bits. In this example, the length is set to 1024 bits.
Figure 8-20

8-29

Configuration Guide

Configuring SSH

After the key pair is generated, click Save public key, type in the public key name test_key.pub, selectthe storage path, and click Save. Then click Save private key. The following prompt box is displayed.
Select Yes, type in the public key name test_private, and click Save.
Figure 8-21

You must select the OpenSSH key file; otherwise, the key file cannot be used. The puttygen.exe
software can be used to generate a key file in OpenSSH format, but this file cannot be directly used by
the PuTTY client. You must use puttygen.exe to convert the private key to the PuTTY format. Format
conversion is not required for the public key file stored on the server, and the format of this file is still
OpenSSH, as shown in Figure 8-22.
Figure 8-22

8-30

Configuration Guide

SSH Server

Configuring SSH

Ruijie# configure terminal
Ruijie(config)# ip ssh peer test public-key rsa flash:test_key.pub

Verification

After completing the basic configurations of the client and the server, specify the private key filetest_private on the PuTTY client, and set the host IP address to 192.168.23.122 and port ID to 22
to set up a connection between the client and the server. In this way, the client can use the public
key authentication mode to log in to the network device.

Figure 8-23

8-31

Configuration Guide

Configuring SSH

Common Errors


The no crypto key generate command is used to delete a key.

8.4.2 Configuring the SCP Service
Configuration Effect
After the SCP function is enabled on a network device, you can directly download files from the network device andupload local files to the network device. In addition, all interactive data is encrypted, featuring authentication and security.

Notes


The SSH server must be enabled in advance.

Configuration Steps

Enabling the SCP Server

Mandatory.



By default, the SCP server function is disabled. Run the ip scp server enable command to enable the SCP server
function in global configuration mode.

Verification
Run the show ip ssh command to check whether the SCP server function is enabled.

8-32

Configuration Guide

Configuring SSH

Related Commands

Enabling the SCP Server

Commandip scp server enable

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

This command is used to enable the SCP server.
Run the no ip scp server enable command to disable the SCP server.

Configuration
Example

Enabling the SCP Server

ConfiguratioRun the ip scp server enable command to enable the SCP server.

n StepsRuijie#configure terminal
Ruijie(config)#ip scp server enable

Verification



Run the show ip ssh command to check whether the SCP server function is enabled.

Ruijie(config)# show ip ssh
SSH Enable - version 1.99
Authentication timeout: 120 secs
Authentication retries: 3
SSH SCP Server: enabledConfiguring SSH File Transfer

Scenario
Figure 8-24

The SCP service is enabled on the server, and SCP commands are used on the client to transfer data to
the server.

Configuratio

n Steps

Enable the SCP service on the server.
The SCP server uses SSH threading. When connecting to a network device for SCP transmission,
the client occupies a VTY session (You can finds out that the user type is SSH by running the showuser command).



On the client, use SCP commands to upload files to the server, or download files from the server.

8-33

Configuration Guide

Configuring SSH

Syntax of the SCP command:scp [-1246BCpqrv] [-c cipher] [-F ssh_config] [-iidentity_file][-l limit] [-o ssh_option] [-P port] [-S program][[user@]host1:]file1 [...] [[user@]host2:]file2
Descriptions of some options:-1: Uses SSHv1 (If not specified, SSHv2 is used by default);-2: Uses SSHv2 (by default);-C: Uses compressed transmission.
-c: Specifies the encryption algorithm to be used.
-r:Transmits the whole directory;-i: Specifies the key file to be used.
-l: Limits the transmission speed (unit: Kbit/s).
For other parameters, see the filescp.0.
Most options are related to terminals. Few options are supported on both terminals and servers. Ruijie’s
SCP servers do not support d-p-q-r options. When these options are applied, there are prompts.
SSH Server

Ruijie# configure terminal
Ruijie(config)# ip scp server enable

VerificationFile transmission example on the Ubuntu 7.10 system:

Set the username of a client to test and copy the config.text file from the network device with the IP
address of 192.168.195.188 to the /root directory on the local device.
root@dhcpd:~# scp test@192.168.23.122:/config.text /root/config.text
test@192.168.195.188's password:
config.text

100% 1506

1.5KB/s

00:00

Read from remote host 192.168.195.188: Connection reset by peer

8.5 Monitoring
Displaying
Description

Command

Displays the effective SSH servershow ip ssh

configurations.
Displays the established SSH connection.

show ssh

Displays the public information of the SSH public

show crypto key mypubkey

key.

8-34

Configuration Guide

Configuring SSH

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs SSH sessions.

debug ssh

8-35

Configuration Guide

Configuring CPP

9 Configuring CPP
9.1 Overview
The CPU Protect Policy (CPP) provides policies for protecting the CPU of a switch.
In network environments, various attack packets spread, which may cause high CPU usages of the switches, affectprotocol running and even difficulty in switch management. To this end, switch CPUs must be protected, that is, traffic
control and priority-based processing must be performed for various incoming packets to ensure the processing
capabilities of the switch CPUs.
CPP can effectively prevent malicious attacks in the network and provide a clean environment for legitimate protocol
packets.
CPP is enabled by default. It provides protection during the entire operation of switches.

9.2 Applications
Application

Description

Preventing Malicious Attacks

When various malicious attacks such as ARP attacks intrude in a network, CPP
divides attack packets into queues of different priorities so that the attack packets
will not affect other packets.

Preventing CPU Processing
Bottlenecks

Even when no attacks exist, it would become a bottleneck for CPU to handle
excessive normal traffic. CPP can limit the rate of packets being sent to the CPU toensure normal operation of switches.

9.2.1 Preventing Malicious Attacks
Scenario
Network switches at all levels may be attacked by malicious packets, typically ARP attacks.
As shown in Figure 9-1 错误!未找到引用源。, switch CPUs process three types of packets: forwarding-plane, control-planeand protocol-plane. Forwarding-plane packets are used for routing, including ARP packets and IP route disconnection
packets. Control-plane packets are used to manage services on switches, including Telnet packets and HTTP packets.
Protocol-plane packets serve for running protocols, including BPDU packets.
When an attacker initiates attacks by using ARP packets, the ARP packets will be sent to the CPU for processing. Since
the CPU has limited processing capabilities, the ARP packets may force out other packets (which may be discarded) andconsume many CPU resources (for processing ARP attack packets). Consequently, the CPU fails to work normally. In the
scenario as shown in Figure 9-1, possible consequences include: common users fail to access the network;
administrators fail to manage switches.
Figure 9-1 Networking Topology of Switch Services and Attacks

9-1

Configuration Guide

Configuring CPP

Deployment


By default, CPP classifies ARP packets, Telnet packets, IP route disconnection packets, and OSFP packets intoqueues of different priorities. In this way, ARP packets will not affect other packets.



By default, CPP limits the rates of ARP packets and the rates of the priority queue where the ARP packets reside toensure that the attack packets do not occupy too many CPU resources.



Packets in the same priority queue with ARP packets may be affected by ARP attack packets. You can divide thepackets and the ARP packets into different priority queues by means of configuration.

When ARP attack packets exist, CPP cannot prevent normal ARP packets from being affected. CPP can only
differentiate the packet type but cannot distinguish attack packets from normal packets of the same type. In this case,
the Network Foundation Protection Policy (NFPP) function can be used to provide higher-granularity attack
prevention.
For description of NFPP configurations, see the Configuring NFPP.

9.2.2 Preventing CPU Processing Bottlenecks
Scenario
Even though no attacks exist, many packets may need to be sent to the CPU for processing at an instant.
For example, the accesses to the core device of a campus network are counted in ten thousands. The traffic of normal
ARP packets may reach dozens of thousands packets per second (PPS). If all packets are sent to the CPU for processing,
the CPU resources cannot support the processing, which may cause protocol flapping and abnormal CPU running.

Deployment


By default, the CPP function limits the rates of ARP packets and the rates of the priority queue where the APR
packets reside to control the rate of ARP packets sent to the CPU and ensure that the CPU resource consumption iswithin a specified range and that the CPU can normally process other protocols.



By default, the CPP function also limits the rates of other packets at the user level, such as Web authentication and802.1X authentication packets.

9-2

Configuration Guide

Configuring CPP

9.3 Features
Basic Concepts



QoS, DiffServ

Quality of Service (QoS) is a network security mechanism, a technology used to solve the problems of network delay andcongestion.
DiffServ refers to the differentiated service model, which is a typical model implemented by QoS for classifying service
streams to provide differentiated services.



Bandwidth, Rate

Bandwidth refers to the maximum allowable data rate, which refers to the rate threshold in this document. Packets whose
rates exceed the threshold will be discarded.
The rate indicates an actual data rate. When the rate of packets exceeds the bandwidth, packets out of the limit will bediscarded. The rate must be equal to or smaller than the bandwidth.
The bandwidth and rate units in this document are packets per second (pps).

L2, L3, L4

The structure of packets is hierarchical based on the TCP/IP model.
L2 refers to layer-2 headers, namely, the Ethernet encapsulation part; L3 refers to layer-3 headers, namely, the IP
encapsulation part; L4 refers to layer-4 headers, usually, the TCP/UDP encapsulation part.



Priority Queue, SP

Packets are cached inside a switch and packets in the output direction are cached in queues. Priority queues are mappedto Strict Priorities (SPs). Queues are not equal but have different priorities.
The SP is a kind of QoS scheduling algorithm. When a higher priority queue has packets, the packets in this queue arescheduled first. Scheduling refers to selecting packets from queues for output and refers to selecting and sending thepackets to the CPU in this document.



CPU interface

Before sending packets to the CPU, a switch will cache the packets. The process of sending packets to the CPU is similar
to the process of packet output. The CPU interface is a virtual interface. When packets are sent to the CPU, the packets
will be output from this virtual interface. The priority queue and SP mentioned above are based on the CPU interface.

Overview
CPP protects the CPU by using the standard QoS DiffServ model.
Figure 9-2 CPP Implementation Model

9-3

Configuration Guide

Configuring CPP

FeatureDescription

Classifier

Classifies packet types and provides assurance for the subsequent implementation of QoS
policies.

Meter

Limits rates based on packet types and controls the bandwidth for a specific packet type.

Queue

Queue packets to be sent to the CPU and select different queues based on packet types.

Scheduler
Shaper

Selects and schedules queues to be sent to the CPU.
Performs rate limit and bandwidth control on priority queues and the CPU interface.

9.3.1 Classifier
Working Principle
The Classifier classifies all packets to be sent to the CPU based on the L2, L3 and L4 information of the packets.
Classifying packets is the basis for implementing QoS policies. In subsequent actions, different policies are implemented
based on the classification to provide differentiated services. A switch provides fixed classification. The management
function classifies packet types based on the protocols supported by the switch, for example, STP BPDU packets and
ICMP packets. Packet types cannot be customized.

9.3.2 Meter
Working Principle
The Meter limits the rates of different packets based on the preset rate thresholds. You can set different rate thresholds fordifferent packet types. When the rate of a packet type exceeds the corresponding threshold, the packets out of the limit
will be discarded.
By using the Meter, you can control the rate of a packet type sent to the CPU within a threshold to prevent specific attack
packets from exerting large impacts on the CPU resources. This is the level-1 protection of the CPP.

Related Configuration


By default, each packet type corresponds to a rate threshold (bandwidth) and Meter policies are implemented basedon the rate threshold.



In application, you can run the cpu-protect type packet-type bandwidth bandwidth-value command to set Meter
policies for specified packet types.

9-4

Configuration Guide

Configuring CPP

9.3.3 Queue
Working Principle
Queues are used to classify packets at level 2. You can select the same queue for different packet types; meanwhile,queues cache packets inside switches and provide services for the Scheduler and Shaper.
CPP queues are SP queues. The SPs of the packets are determined based on the time when they are added to a queue.
Packets with a larger queue number have a higher priority.

Related Configuration


By default, each packet type is mapped to an SP queue.

9.3.4 Scheduler
Working Principle
The Scheduler schedules packets based on SPs of queues. That is, packets in a queue with a higher priority arescheduled first.
Before being scheduled, packets to be sent to the CPU are cached in queues. When being scheduled, the packets aresent to the CPU for processing.
Only the SP scheduling policy is supported and cannot be modified.

9.3.5 Shaper
Working Principle
The Shaper is used to shape packets to be sent to the CPU, that is, when the actual rate of packets is greater than theshaping threshold, the packets must stay in the queue and cannot be scheduled. When packet rates fluctuate, the Shaper
ensures that the rates of packets sent to the CPU are smooth (no more than the shaping threshold).
When the Shaper is available, packets in a queue with a lower priority may be scheduled before all packets in a queuewith a higher priority are scheduled. If the rate of packets in a queue with certain priority exceeds the shaping threshold,scheduling of the packets in this queue may be stopped temporarily. Therefore, the Shaper can prevent packets in queues
with lower priorities from starvation (which means that only packets in queues with higher priorities are scheduled andpackets in queues with higher priorities are not scheduled).
Since the Shaper limits the scheduling rates of packets, it actually plays the rate limit function. The Shaper provides
level-2 rate limit for priority queues and all packets sent to the CPU (CPU interface). The Shaper and Meter functions
provide 3-level rate limit together and provide level-3 protection for the CPU.
Figure 9-3 3-Level Rate Limit of the CPP

9-5

Configuration Guide

Configuring CPP

Related Configuration

Configuring the Shaper for priority queues

By default, each priority queue determines a shaping threshold (bandwidth).



In application, you can run the cpu-protect traffic-class traffic-class-num bandwidth bandwidth_value command to
perform Shaper configuration for a specific priority queue.

Configuring the Shaper for the CPU Interface

By default, the CPU interface determines a shaping threshold (bandwidth).

Run the cpu-protect cpu bandwidth bandwidth_value command to perform Shaper configuration for the CPUinterface.

9.4 Configuration
Configuration

Description and Command(Optional and configured by default) It is used to adjust the configuration parametersof CPP.

Configuring CPP

cpu-protect type packet-type bandwidth

Configures the Meter for a packet type.

9.4.1 Configuring CPP
Configuration Effect

By configuring the Meter function, you can set the bandwidth and rate limit for a packet type. Packets out of the limit
will be directly discarded.



By configuring the Queue function, you can select a priority queue for a packet type. Packets in a queue with ahigher priority will be scheduled first.

9-6

Configuration GuideConfiguring CPP

By configuring the Shaper function, you can set the bandwidth and rate limit for a CPU interface and a priority queue.
Packets out of the limit will be directly discarded.

Notes


Pay special attention when the bandwidth of a packet type is set to a smaller value, which may affect the normal
traffic of the same type. To provide per-user CPP, combine the NFPP function.

When the Meter and Shaper functions are combined, 3-level protection will be provided. Any level protection fights
alone may bring negative effects. For example, if you want to increase the Meter of a packet type, you also need toadjust the Shaper of the corresponding priority queue. Otherwise, the packets of this type may affect other types ofpackets in the same priority queue.

Configuration Steps

Configuring the Meter for a packet type

You can use or modify the default value but cannot disable it.

You need to modify the configuration in the following cases: when packets of a type are not attackers but are
discarded, you need to increase the Meter of this packet type. If attacks of a packet type cause abnormal CPU
running, you need to decrease the Meter of this packet type.



This configuration is available on all switches in a network environment.

Configuring the priority queue for a packet type

You can use or modify the default value but cannot disable it.

You need to modify the configuration in the following cases: When attacks of a packet type cause abnormality ofother packets in the same queue, you can put the packet type in an unused queue. If a packet type cannot be
discarded but the packet type is in the same queue with other packet types in use, you can put this packet type in aqueue with a higher priority.

This configuration is available on all switches in a network environment.

Configuring the Shaper for a priority queue

You can use or modify the default value and cannot disable it.

You need to modify the configuration in the following cases: If the Meter value of a packet type is greater whichcauses that other packets in the corresponding priority queue do not have sufficient bandwidth, you need to increase
the Shaper for this priority queue. If attack packets are put in a priority queue and no other packets are in use, youneed to increase the Shaper of this priority queue.

This configuration is available on all switches in a network environment.

Configuring the Shaper for the CPU interfaceYou can use or modify the default value and cannot disable it.



You are not advised to change the Shaper of the CPU interface.

This configuration is available on all switches in a network environment.

9-7

Configuration Guide

Configuring CPP

VerificationModify the configurations when the system runs abnormally, and view the system running after the modification tocheck whether the configurations take effect.

Check whether the configurations take effect by viewing corresponding configurations and statistic values. For
details, see the following commands.

Related Commands

Configuring the Meter for a packet typeCommandcpu-protect type packet-type bandwidth bandwidth-value

Parameter

packet-type: Specifies a packet type. Packet types are defined.

Description

bandwidth_value: Sets the bandwidth, in the unit of packets per second (pps).

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Preventing packet attacks and network flapping by using CPP

Scenario

ARP, IP, dot1x, VRRP, Telnet and ICMP streams are available in the system. In the current
configurations, ARP and 802.1X are in priority queue 2; IP, ICMP and Telnet streams are inpriority queue 4; VRRP streams are in priority queue 6. The Meter for each packet type is 10,000
pps; the shaper for each priority queue is 20,000 pps; the Shaper for the CPU interface is 100,000
pps.



ARP attacks and IP scanning attacks exist in the system, which causes abnormal running of thesystem, authentication failure, Ping failure, and management failure.

Configuration



limit the bandwidth for ARP packets

Steps
Ruijie# configure terminal
Ruijie(config)# cpu-protect type arp bandwidth 5000
Ruijie(config)# end
Verification

Run the show cpu-protect command to view the configuration and statistics.

9.5 Monitoring
Clearing
Description
Clears the CPP statistics.

Commandclear cpu-protect counters

9-8Configuration Guide

Configuring CPP

Displaying
Description

Command

Displays all configurations andshow cpu-protect

statistics on the master device.

Debugging
N/A
The preceding monitoring commands are available on both chassis and cassette devices in either the standalone
mode or the VSU mode.
If the device and slot values are not specified, the clear command is used to clear the statistics of all nodes in thesystem and the show command is used to display the configurations on the master device.
In the standalone mode, the parameter device is unavailable. For chassis devices, the parameter slot is used to
specify a line card; for cassette devices, slot is unavailable.
In the VSU mode, the parameter device indicates a chassis or cassette device. If the device value is not specified, it
indicates the master chassis or the master device. For chassis devices, if the device value is specified the slot value
must also be specified to identify a line card in a chassis; for cassette devices, slot is unavailable.

9-9Configuration Guide

Configuring DHCP Snooping(beta)

10 Configuring DHCP Snooping(beta)
10.1 Overview
DHCP Snooping: DHCP Snooping snoops DHCP interactive packets between clients and servers to record and monitor
users' IP addresses and filter out illegal DHCP packets, including client request packets and server response packets.
The legal user database generated from DHCP Snooping records may serve security applications like IP Source Guard.

Protocols andStandards


RFC 2131: Dynamic Host Configuration Protocol

RFC 2132: DHCP Options and BOOTP Vendor Extensions

10.2 Applications
Application

Description

Guarding against DHCP service

In a network with multiple DHCP servers, DHCP clients are allowed to obtainspoofing

network configurations only from legal DHCP servers.

Guarding against DHCP packet

Malicious network users may frequently send DHCP request packets.

flooding
Guarding against forged DHCP

Malicious network users may send forged DHCP request packets, for example,

packets

DHCP-RELEASE packets.

Guarding against IP/MAC spoofing

Malicious network users may send forged IP packets, for example, tampered
source address fields of packets.

Preventing Lease of IP Addresses

Network users may lease IP addresses rather than obtaining them from a DHCP
server.

Detecting ARP attack

Malicious users forge ARP response packets to intercept packets during normal
users' communication.

10.2.1 Guarding Against DHCP Service Spoofing
Scenario
Multiple DHCP servers may exist in a network. It is essential to ensure that user PCs obtain network configurations only
from the DHCP servers within a controlled area.
Take the following figure as an example. The DHCP client can only communicate with trusted DHCP servers.



Request packets from the DHCP client can be transmitted only to trusted DHCP servers.



Only the response packets from trusted DHCP servers can be transmitted to the client.

Figure 10-1

10-1

Configuration Guide

Remarks:

Configuring DHCP Snooping(beta)

S is an access device.
A is a user PC.
B is a DHCP server within the controlled area.
C is a DHCP server out of the controlled area.

Deployment
Enable DHCP Snooping on S to realize DHCP packet monitoring.



Set the port on S connecting to B as trusted to transfer response packets.

Set the rest of ports on S as untrusted to filter response packets.

10.2.2 Guarding Against DHCP Packet Flooding
Scenario
Potential malicious DHCP clients in a network may send high-rate DHCP packets. As a result, legitimate users cannot
obtain IP addresses, and access devices are highly loaded or even break down. It is necessary to take actions to ensure
network stability.
With the DHCP Snooping rate limit function for DHCP packets, a DHCP client can only send DHCP request packets at a
rate below the limit.

The request packets from a DHCP client are sent at a rate below the limit.

Packets sent at rates beyond the limit will be discarded.

Enable DHCP Snooping correlation with ARP, and delete the non-existing entries.

Deployment
Enable DHCP Snooping on S to realize DHCP monitoring.



Limit the rates of DHCP packets from the untrusted ports.

Enable DHCP Snooping correlation with ARP, and detect whether the user is online.

10-2Configuration Guide

Configuring DHCP Snooping(beta)

10.2.3 Guarding Against Forged DHCP Packets
Scenario
Potential malicious clients in a network may forge DHCP request packets, consuming applicable IP addresses from theservers and probably preempting legal users' IP addresses. Therefore, it is necessary to filter out illegal DHCP packets.
For example, as shown in the figure below, the DHCP request packets sent from DHCP clients will be checked.

The source MAC address fields of the request packets from DHCP clients must match the chaddr fields of DHCP
packets.



The Release packets and Decline packets from clients must match the entries in the DHCP Snooping binding
database.

Figure 10-2

Remarks:

S is an access device.
A and C are user PCs.
B is a DHCP server within the controlled area.

Deployment
Enable DHCP Snooping on S to realize DHCP monitoring.



Set the port on S connecting to B as trusted to transfer response packets.

Set the rest of ports on S as untrusted to filter response packets.

Enable DHCP Snooping Source MAC Verification on untrusted ports of S to filter out illegal packets.

10.2.4 Guarding Against IP/MAC Spoofing
Scenario
Check IP packets from untrusted ports to filter out forged IP packets based on IP or IP-MAC fields.
For example, in the following figure, the IP packets sent by DHCP clients are validated.



The source IP address fields of IP packets must match the IP addresses assigned by DHCP.

10-3

Configuration GuideConfiguring DHCP Snooping(beta)

The source MAC address fields of layer-2 packets must match the chaddr fields in DHCP request packets fromclients.

Figure 10-3

Remarks:

S is an access device.
A and C are user PCs.
B is a DHCP server within the controlled area.

Deployment
Enable DHCP Snooping on S to realize DHCP monitoring.



Set all downlink ports on the S as DHCP Snooping untrusted.

Enable IP Source Guard on S to filter IP packets.

Enable IP Source Guard in IP-MAC based mode to check the source MAC and IP address fields of IP packets.

10.2.5 Preventing Lease of IP Addresses
Scenario
Validate the source addresses of IP packets from untrusted ports compared with DHCP-assigned addresses.
If the source addresses, connected ports, and layer-2 source MAC addresses of ports in IP packets do not match theassignments of the DHCP server, such packets will be discarded.
The networking topology scenario is the same as that shown in the previous figure.

Deployment
The same as that in the section "Guarding Against IP/MAC Spoofing".

10.2.6 Detecting ARP Attacks
Scenario
Check the ARP packets from untrusted ports and filter out the ARP packets unmatched with the assignments of the DHCP
server.

10-4

Configuration Guide

Configuring DHCP Snooping(beta)

For example, in the following figure, the ARP packets sent from DHCP clients will be checked.

The ports receiving ARP packets, the layer-2 MAC addresses, and the source MAC addresses of ARP packets
senders shall be consistent with the DHCP Snooping histories.

Figure 10-4

Remarks:

S is an access device.
A and C are user PCs.
B is a DHCP server within the controlled area.

Deployment
Enable DHCP Snooping on S to realize DHCP monitoring.



Set all downlink ports on the S as untrusted.

Enable IP Source Guard and ARP Check on all the untrusted ports on S to realize ARP packet filtering.
All the above security control functions are only effective to DHCP Snooping untrusted ports.

10.3 Features
Basic Concepts



DHCP Request Packets

Request packets are sent from a DHCP client to a DHCP server, including DHCP-DISCOVER packets, DHCP-REQUEST
packets, DHCP-DECLINE packets, DHCP-RELEASE packets and DHCP-INFORM packets.



DHCP Response Packets

Response packets are sent from a DHCP server to a DHCP client, including DHCP-OFFER packets, DHCP-ACK packets
and DHCP-NAK packets.



DHCP Snooping Trusted Ports

IP address request interaction is complete via broadcast. Therefore, illegal DHCP services will influence normal clients'
acquisition of IP addresses and lead to service spoofing and stealing. To prevent illegal DHCP services, DHCP Snooping
10-5

Configuration Guide

Configuring DHCP Snooping(beta)

ports are divided into two types: trusted ports and untrusted ports. The access devices only transmit DHCP response
packets received on trusted ports, while such packets from untrusted ports are discarded. In this way, we may configure
the ports connected to a legal DHCP Server as trusted and the other ports as untrusted to shield illegal DHCP Servers.
On switches, all switching ports or layer-2 aggregate ports are defaulted as untrusted, while trusted ports can be specified.



DHCP Snooping Packet Suppression

To shield all the DHCP packets on a specific client, we can enable DHCP Snooping packet suppression on its untrusted
ports.



VLAN-based DHCP Snooping

DHCP Snooping can work on a VLAN basis. By default, when DHCP Snooping is enabled, it is effective to all the VLANsof the current client. Specify VLANs help control the effective range of DHCP Snooping flexibly.



DHCP Snooping Binding Database

In a DHCP network, clients may set static IP addresses randomly. This increases not only the difficulty of network
maintenance but also the possibility that legal clients with IP addresses assigned by the DHCP server may fail to use the
network normally due to address conflict. Through snooping packets between clients and servers, DHCP Snooping
summarizes the user entries including IP addresses, MAC address, VLAN ID (VID), ports and lease time to build the
DHCP Snooping binding database. Combined with ARP detection and ARP check, DHCP Snooping controls the reliableassignment of IP addresses for legal clients.



DHCP Snooping Rate Limit

DHCP Snooping rate limit function can be configured through the rate limit command of Network Foundation Protection
Policy (NFPP). For NFPP configuration, see the Configuring NFPP.



DHCP Option82

DHCP Option82, an option for DHCP packets, is also called DHCP Relay Agent Information Option. As the option number
is 82, it is known as Option82. Option82 is developed to enhance the security of DHCP servers and improve the strategies
of IP address assignment. The option is often configured for the DHCP relay services of a network access device like
DHCP Relay and DHCP Snooping. This option is transparent to DHCP clients, and DHCP relay components realize theaddition and deduction of the option.



Illegal DHCP Packets

Through DHCP Snooping, validation is performed on the DHCP packets passing through a client. Illegal DHCP packets
are discarded, user information is recorded into the DHCP Snooping binding database for further applications (forexample, ARP detection). The following types of packets are considered illegal DHCP packets.



The DHCP response packets received on untrusted ports, including DHCP-ACK, DHCP-NACK and DHCP-OFFER
packets

The DHCP request packets carrying gateway information giaddr, which are received on untrusted portsWhen MAC verification is enabled, packets with source MAC addresses different with the value of the chaddr field in
DHCP packets



DHCP-RELEASE packets with the entry in the DHCP Snooping binding database Snooping while with untrusted
ports inconsistent with settings in this binding database

10-6Configuration GuideConfiguring DHCP Snooping(beta)

DHCP packets in wrong formats, or incomplete

Overview
FeatureDescription

Filtering DHCP

Perform legality check on DHCP packets and discard illegal packets (see the previous section for

Packets

the introduction of illegal packets). Transfer requests packets received on trusted ports only.

Building the DHCP

Snoop the interaction between DHCP clients and the server, and generate the DHCP Snooping

Snooping binding

binding database to provide basis for other filtering modules.

database

10.3.1 Filtering DHCP Packets
Perform validation on DHCP packets from untrusted ports. Filter out the illegal packets as introduced in the previous
section "Basic Concepts".

Working Principle
During snooping, check the receiving ports and the packet fields of packets to realize packet filtering, and modify thedestination ports of packets to realize control of transmit range of the packets.

Checking Ports

In receipt of DHCP packets, a client first judges whether the packet receiving ports are DHCP Snooping trusted ports. Ifyes, legality check and binding entry addition are skipped, and packets are transferred directly. For not, both the checkand addition are needed.

Checking Packet Encapsulation and Length

A client checks whether packets are UDP packets and whether the destination port is 67 or 68. Check whether the packet
length match the length field defined in protocols.



Checking Packet Fields and Types

According to the types of illegal packet introduced in the section "Basic Concepts", check the fields giaddr and chaddr inpackets and then check whether the restrictive conditions for the type of the packet are met.

Related Configuration

Enabling Global DHCP Snooping

By default, DHCP Snooping is disabled.
It can be enabled on a device using the ip dhcp snooping command.
Global DHCP Snooping must be enabled before VLAN-based DHCP Snooping is applied.

Configuring VLAN-based DHCP Snooping

By default, when global DHCP Snooping is effective, DHCP Snooping is effective to all VLANs.
Use the [ no ] ip dhcp snooping vlan command to enable DHCP Snooping on specified VLANs or delete VLANs fromthe specified VLANs. The value range of the command parameter is the actual range of VLAN numbers.

Configuring DHCP Snooping Source MAC Verification

10-7

Configuration Guide

Configuring DHCP Snooping(beta)

By default, the layer-2 MAC addresses of packets and the chaddr fields of DHCP packets are not verified.
When the ip dhcp snooping verify mac-address command is used, the source MAC addresses and the chaddr fieldsof the DHCP request packets sent from untrusted ports are verified. The DHCP request packets with different MAC
addresses will be discarded.

10.3.2 Building the Binding Database
DHCP Snooping detects the interactive packets between DHCP clients and the DHCP server, and generate entries of the
DHCP Snooping binding database according to the information of legal DHCP packets. All these legal entries areprovided to other security modules of a client as the basis of filtering packets from network.

Working Principle
During snooping, the binding database is updated timely based on the types of DHCP packets.

Generating Binding Entries

When a DHCP-ACK packet on a trusted port is snooped, the client's IP address, MAC address, and lease time field are
extracted together with the port ID (a wired interface index) and VLAN ID. Then, a binding entry of it is generated.

Deleting Binding Entries

When the recorded lease time of a binding entry is due, it will be deleted if a legal DHCP-RELEASE/DHCP-DECLINE
packet sent by the client or a DHCP-NCK packet received on a trusted port is snooped, or the clear command is used.

Related Configuration
No configuration is needed except enabling DHCP Snooping.

10.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enable DHCP Snooping.
Enables DHCP Snooping.

ip dhcp snooping
ip dhcp snooping suppression

suppression.
Enables VLAN-based DHCP Snooping.

ip dhcp snooping vlan
ip dhcp snooping verify mac-address
Configuring basic functionsof DHCP Snooping

Enables DHCP Snooping packet

ip dhcp snooping database write-delay

ip dhcp snooping database write-to-flash

renew ip dhcp snooping database

Configures DHCP Snooping source MAC
verification.
Writes the DHCP Snooping binding
database to Flash periodically.
Writes the DHCP Snooping binding
database to Flash manually.
Imports Flash storage to the DHCP
Snooping Binding database.

ip dhcp snooping trust

Configures DHCP Snooping trusted ports.

ip dhcp snooping bootp

Enables BOOTP support.

10-8Configuration Guide

Configuring DHCP Snooping(beta)

ip dhcp snooping check-giaddr
ip dhcp snooping loose-forward

Enables DHCP Snooping to support thefunction of processing Relay requests.
Enables loose forwarding.

(Optional)It is used to optimize the address assignment by DHCP servers.
ip dhcp snooping Information option

Configuring Option82

ip dhcp snooping information option
format remote-id

Adds Option82 functions to DHCP request
packets.
Configures the sub-potion remote-id ofOption82 as a user-defined character
string.

ip dhcp snooping vlan information option
format-type circuit-id string

Configures the sub-option circuit-id ofOption82 as a user-defined character
string.

10.4.1 Configuring Basic Features
Configuration EffectEnable DHCP Snooping.

Generate the DHCP Snooping binding database.

Control the transmit range of DHCP packets.

Filter out illegal DHCP packets.

Notes


The ports on clients connecting a trusted DHCP server must be configured as trusted.



DHCP Snooping is effective on the wired switching ports, layer-2 aggregate ports, and layer-2 encapsulation
sub-interfaces. The configuration can be implemented in interface configuration mode.



DHCP Snooping and DHCP Relay are mutually exclusive in VRF scenarios.

Configuration Steps

Enabling Global DHCP SnoopingMandatory.



Unless otherwise noted, the feature should be configured on access devices.



Enabling or Disabling VLAN-based DHCP Snooping



DHCP Snooping can be disabled if not necessary for some VLANs.



Unless otherwise noted, the feature should be configured on access devices.



Configuring DHCP Snooping Trusted Ports

Mandatory.

Configure the ports connecting a trusted DHCP server as trusted.

Enabling DHCP Snooping Source MAC Validation

10-9

Configuration GuideConfiguring DHCP Snooping(beta)

This configuration is required if the chaddr fields of DHCP request packets match the layer-2 source MAC
addresses of data packets.

Unless otherwise noted, the feature should be enabled on all the untrusted ports of access devices.



Writing the DHCP Snooping Binding Database to Flash Periodically

Enable this feature to timely save the DHCP Snooping binding database information in case that client reboot.



Unless otherwise noted, the feature should be configured on access devices.



Enabling BOOTP Support

Optional

Unless otherwise noted, the feature should be configured on access devices.



Enabling DHCP Snooping to Process Relay Requests



Optional.



Unless otherwise noted, the feature should be enabled on access devices.



Enabling Loose Forwarding

Optional.



Unless otherwise noted, the feature is disabled.

Verification
Configure a client to obtain network configurations through the DHCP protocol.

Check whether the DHCP Snooping Binding database is generated with entries on the client.

Related Commands

Enabling or Disabling DHCP Snooping

Command[ no ] ip dhcp snooping

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

After global DHCP Snooping is enabled, you can check DHCP Snooping using the show ip dhcp
snooping command.

Configuring VLAN-based DHCP Snooping

Command[ no ] ip dhcp snooping vlan { vlan-rng | { vlan-min [ vlan-max ] } }Parametervlan-rng: Indicates the range of VLANs

Description

vlan-min: The minimum VLAN ID
vlan-max: The maximum VLAN ID

Command

Global configuration mode

Mode
Usage Guide

Use this command to enable or disable DHCP Snooping on specified VLANs. This feature is available

10-10Configuration Guide

Configuring DHCP Snooping(beta)

only after global DHCP Snooping is enabled.

Configuring DHCP Snooping Packet Suppression

Command[ no ] ip dhcp snooping suppression

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

Use this command to reject all DHCP request packets at the port, that is, to forbid all users under the
port to apply for addresses via DHCP.



Configuring DHCP Snooping Source MAC Verification

Command[ no ] ip dhcp snooping verify mac-address

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Through the source MAC address verification, the MAC addresses in link headers and the CLIENT MAC
fields in the request packets sent by a DHCP CLIENT are checked for consistence. When the source
MAC address verification fails, packets will be discarded.



Writing DHCP Snooping Database to Flash Periodically

Command[ no ] ip dhcp snooping database write-delay [ time ]Parameter

time: Indicates the interval between two times of writing the DHCP Snooping database to the Flash.

Description
Command

Global configuration mode

Mode
Usage Guide

Use this command to write the DHCP Snooping database to FLASH document. This can avoid binding
information loss which requires re-obtaining IP addresses to resume communication after the device
restarts.



Writing the DHCP Snooping Database to Flash Manually

Commandip dhcp snooping database write-to-flash

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Use this command to write the dynamic user information in the DHCP Snooping database in FLASH
documents in real time.
If a device is upgraded from a non-QinQ version to a QinQ version (or vice versa), binding entries cannot
be restored from FLASH documents because of version differences between FLASH documents.



Importing Backep File Storage to the DHCP Snooping Binding Database

Commandrenew ip dhcp snooping database

10-11

Configuration Guide
Parameter

Configuring DHCP Snooping(beta)

N/A

Description
CommandPrivileged configuration mode

Mode
Usage GuideUse this command to import the information from backup file to the DHCP Snooping binding database.

Configuring DHCP Snooping Trusted Ports

Command[ no ] ip dhcp snooping trust

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

Use this command to configure a port connected to a legal DHCP server as a trusted port. The DHCP
response packets received by trusted ports are transferred, while those received by untrusted ports are
discarded.

Enabling or Disabling BOOTP Support

Command[ no ] ip dhcp snooping bootp-bind

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage GuideUse this command to support the BOOPT protocol.

Enabling DHCP Snooping to Process Relay Requests

Command[ no ] ip dhcp snooping check-giaddr

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

After the feature is enabled, services using DHCP Snooping binding entries generated based on Relay
requests, such as IP Source Guard/802.1x authentication, cannot be deployed. Otherwise, users fail toaccess the Internet.
After the feature is enabled, the ip dhcp snooping verify mac-address command cannot be used.
Otherwise, DHCP Relay requests will be discarded and as a result, users fail to obtain addresses.

Enabling DHCP Snooping Loose Forwarding

Commandip dhcp snooping loose-forward

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

After this feature is enabled, when the capacity of DHCP Snooping binding entries is reached, DHCP
packets of new users are forwarded and obtain addresses, but DHCP Snooping does not record binding

10-12

Configuration Guide

Configuring DHCP Snooping(beta)

entries of new users.

Configuration
Example

DHCP Client Obtaining IP addresses Dynamically from a Legal DHCP Server

Scenario

Switch A

Figure 10-5

DHCP Server
Gi 0/1
Gi 0/17

Switch B

DHCP Client

ConfiguratioEnable DHCP Snooping on an access device (Switch B in this case).

n StepsConfigure the uplink port (port Gi 0/1 in this case) as a trusted port.

B

B# configure terminal
B(config)# ip dhcp snooping
B(config)# interface gigabitEthernet 0/17
B(config-if-GigabitEthernet 0/17)# ip dhcp snooping trust
B(config-if-GigabitEthernet 0/17)# end

Verification

Check the configuration on Switch B.
Check whether DHCP Snooping is enabled, and whether the configured DHCP Snooping trusted
port is uplink.

Check the DHCP Snooping configuration on Switch B, and especially whether the trusted port iscorrect.

B

B# show running-config!
ip dhcp snooping!
interface GigabitEthernet 0/17
B# show ip dhcp snooping
Switch DHCP Snooping status:

ENABLE

DHCP Snooping Verification of hwaddr status:

DISABLEDHCP Snooping database write-delay time:

0 seconds

10-13

Configuration Guide

Configuring DHCP Snooping(beta)

DHCP Snooping option 82 status:

DISABLEDHCP Snooping Support BOOTP bind status:

DISABLEInterface

TrustedRate limit (pps)-----------------------------------------------

GigabitEthernet 0/17

YES

unlimited

B#show ip dhcp snooping binding
Total number of bindings: 1
MacAddress

IpAddress

Lease(sec)

Type

VLAN

Interface------------------ --------------- ------------ ------------- ----- -------------------0013.2049.9014

172.16.1.2

86207

DHCP-Snooping 1

GigabitEthernet 0/11

Common Errors


The uplink port is not configured as a DHCP trusted port.



Another access security option is already configured for the uplink port, so that a DHCP trusted port cannot be
configured.

10.4.2 Configuring Option82
Configuration EffectEnable a DHCP server to obtain more information and assign addresses better.



The Option82 function is client-oblivious.

Notes


The Opion82 functions for DHCP Snooping and DHCP Relay are mutually exclusive.

Configuration Steps

To realize optimization of address allocation, implement the configuration.



Unless otherwise noted, enable this function on access devices with DHCP Snooping enabled.

Verification
Check whether the DHCP Snooping configuration options are configured successfully.

Related Commands

Adding Option82 to DHCP Request Packets

Command[ no ] ip dhcp snooping information option [ standard-format | dot1x-format ]Parameter

standard-format: Indicates a standard format of the Option82 options

Description

dot1x-format: Indicates a dot1x format of the Option82 options

Command

Global configuration mode

Mode

10-14

Configuration Guide
Usage Guide

Configuring DHCP Snooping(beta)

Use this command to add Option82 to DHCP request packets so that a DHCP server assigns addresses
according to such information.
When dot1x-format is used, if DHCP Relay is configured on the local device and the uplink port
connected to the DHCP Server is an SVI port, DHCP Snooping needs to be disabled in the VLAN towhich the SVI port belongs.

Configuring Sub-option remote-id of Option82 as User-defined Character String

Command[ no ] ip dhcp snooping information option format remote-id { string ASCII-string | hostname }Parameter

string ASCII-string: Indicates the content of the extensible format, the Option82 option remote-id, is a

Descriptionuser-defined character string
hostname: Indicates the content of the extensible format, the Option82 option remote-id, is a hostname.

Configuratio

Global configuration moden modeUsage Guide

Use this command to configure the sub-option remote-id of the Option82 as user-defined content, whichis added to DHCP request packets. A DHCP server assigns addresses according to Option82
information.

Configuring Sub-Option circuit -id of Option82 as User-defined Character String

Command[ no ] ip dhcp snooping vlan vlan-id information option format-type circuit-id string ascii-string

Parametervlan-id: Indicates the VLAN where a DHCP request packet is

Description

ascii-string: Indicates the user-defined string

Configuratio

Interface configuration moden modeUsage Guide

Use this command to configure the sub-option circuit-id of the Option82 as user-defined content, whichis added to DHCP request packets. A DHCP server assigns addresses according to Option82
information.

Configuration
Example

Configuring Option82 to DHCP Request Packets

Configuratio

Configuring basic functions of DHCP Snooping.

n StepsConfiguring Option82.

B

Ruijie# configure terminal
Ruijie(config)# ip dhcp snooping information option
Ruijie(config)# end

Verification

Check the DHCP Snooping configuration.

B

B# show ip dhcp snooping
Switch DHCP Snooping

statusDHCP Snooping Verification of hwaddr status

10-15

:

ENABLE:DISABLEConfiguration Guide

Configuring DHCP Snooping(beta)

DHCP Snooping database write-delay time:

0 seconds

DHCP Snooping option 82 status:

ENABLE

DHCP Snooping Support bootp bind status:

DISABLEInterface

TrustedRate limit (pps)-----------------------------------------------

GigabitEthernet 0/17

YES

unlimited

Common Errors


N/A

10.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears dynamic user inforamtion ofclear ip dhcp snooping binding [ ip ] [ mac ] [ vlan vlan-id ] [ interface

DHCP Snooping database.

interface-id ]Displaying
Description

Command

Displays DHCP Snoopingshow ip dhcp snooping

configuration.
Displays the DHCP Snooping binding

show ip dhcp snooping binding

database.

Debugging
System resources are occupied when debugging information is output. Disable the debugging switch immediately
after use.
Description

CommandDebugs DHCP Snooping events.

debug snooping ipv4 event

Disables debugging DHCP Snooping
events.
Debugs DHCP Snooping packets.
Disables debugging DHCP Snooping
packets.

no debug snooping ipv4 event
debug snooping ipv4 packet
no debug snooping ipv4 packet

10-16

Configuration Guide

Configuring DHCPv6 Snooping(beta)

11 Configuring DHCPv6 Snooping(beta)
11.1 Overview
DHCPv6 Snooping: Dynamic Host Configuration Protocol version 6 (DHCPv6) snooping enables recording andmonitoring of IPv6 address usage by snooping DHCPv6 packets exchanged between the client and the server, and filters
illegal DHCPv6 packets, including request packets from the client and response packets from the server. The user data
entries generated by DHCPv6 snooping recording can serve security applications such as IPv6 Source Guard.

Protocols andStandards


RFC3315

Dynamic Host Configuration Protocol For IPv6



RFC5007

DHCPv6 Leasequery

RFC5460

DHCPv6 Bulk Leasequery11.2 Applications
Application

Description

Prevention of DHCPv6 Spoofing

There is more than one DHCPv6 server on the network, and DHCPv6 clients canobtain network configuration parameters only from legal DHCPv6 servers.

Prevention of Forged DHCPv6

Malicious users on the network send forged DHCPv6 request packets such as

Packet Attacks

DHCPv6 release packets.

Prevention of IPv6/MAC Spoofing

Malicious users on the network send forged IPv6 request packets that temper thesource address fields.

Prevention of Unauthorized IPv6

Users do not obtain IPv6 addresses from the DHCPv6 server as required andConfiguration

configure IPv6 addresses without authorization.

11.2.1 Prevention of DHCPv6 Spoofing
Scenario
There may exist more than one DHCPv6 server on the network, and it is necessary to ensure that user PCs obtainnetwork configuration parameters only from the controlled DHCPv6 servers.
As shown in the following figure, the DHCPv6 client only communicates with trusted DHCPv6 servers.

The request packets from the DHCPv6 client are transmitted only to a trusted DHCPv6 server.



Only the response packets from the trusted DHCPv6 server can be transmitted to the client.

11-1

Configuration Guide

Configuring DHCPv6 Snooping(beta)

Figure 11-1

RemarkS is an access device.

s

A is a user PC.
B is a controlled DHCPv6 server.
C is an uncontrolled DHCPv6 server.

Deployment
Enable DHCPv6 snooping on the access device S for DHCPv6 packet monitoring.



Set the port connecting the access device S to the DHCPv6 server B as a DHCPv6 trusted port to forward response
packets.



Set the other ports of the access device S as DHCPv6 untrusted ports to filter response packets.

11.2.2 Prevention of Forged DHCPv6 Packet Attacks
Scenario
There may exist malicious users on the network who forge DHCPv6 request packets. The packets not only consume
available IPv6 addresses of the server but may also snatch IPv6 addresses from legal users. Therefore, such packets on
the network must be filtered.
As shown in the following figure, the DHCPv6 request packets sent by the DHCPv6 client will be checked.



Release packets and decline packets from the client must match those recorded in the internal snooping database.

11-2

Configuration Guide

Configuring DHCPv6 Snooping(beta)

Figure 11-2

RemarkS is an access device.

s

A and C are user PCs.
B is a controlled DHCPv6 server.

Deployment
Enable DHCPv6 snooping on the access device S for DHCPv6 monitoring.



Set the port connecting the access device S to the DHCPv6 server as a DHCPv6 trusted port to forward response
packets.



Set the other ports of the access device S as DHCPv6 untrusted ports to filter DHCPv6 packets.

11.2.3 Prevention of IPv6/MAC Spoofing
Scenario
When checking IPv6 packets from the untrusted port, you may check IP address fields only or IP+MAC fields to filter
forged IPv6 packets.
As shown in the following figure, IPv6 packets sent from the DHCPv6 client will be checked.

The source address fields of IPv6 packets must match IPv6 addresses assigned by the DHCPv6 client.

The source Media Access Control (MAC) addresses of Layer-2 packets must match the client MAC addresses in
DHCPv6 request packets of the client.

11-3

Configuration Guide

Configuring DHCPv6 Snooping(beta)

Figure 11-3

RemarkS is an access device.

s

A and C are user PCs.
B is a controlled DHCPv6 server.

Deployment
Enable DHCPv6 snooping on the access device S for DHCPv6 monitoring.



Set all downstream ports on the access device S as DHCPv6 untrusted ports.

Enable IPv6 Source Guard on the access device S to filter IPv6 packets.

On the access device S, set the match mode of IPv6 Source Guard as IPv6+MAC to check both MAC fields and IPv6
fields of IPv6 packets.

11.2.4 Prevention of Unauthorized IPv6 Configuration
Scenario
When checking IPv6 packets from untrusted ports, you need to check whether source IPv6 addresses of the packets are
consistent with the IPv6 addresses assigned by the DHCPv6.
If the source IPv6 addresses, connection ports, or Layer-2 MAC addresses of IPv6 packets fail to match the assignment
records of the DHCPv6 server snooped by the device, the packets should be discarded.
The operating process of the device in the scenario is the same as that in the preceding figure.

Deployment
See section 11.2.3 "Prevention of IPv6/MAC Spoofing".

11-4

Configuration Guide

Configuring DHCPv6 Snooping(beta)

11.3 Features
Basic Concepts



DHCPv6 Request Packet

A DHCPv6 request packet is the packet sent from the DHCPv6 client to the DHCPv6 server. It includes DHCPv6 solicit
packet, DHCPv6 request packet, DHCPv6 confirm packet, DHCPv6 rebind packet, DHCPv6 release packet, DHCPv6
decline packet, DHCPv6 renew packet, DHCPv6 inform-req packet, and DHCPv6 leasequery packet.



DHCPv6 Response Packet

A DHCPv6 response packet is the packet sent from the DHCPv6 server to the DHCPv6 client. It includes DHCPv6
advertise packet, DHCPv6 reply packet, DHCPv6 reconfigure packet, DHCPv6 relay-reply packet, DHCPv6
leasequery-reply packet, DHCPv6 leasequery-done packet, and DHCPv6 leasequery-data packet.



DHCPv6 Snooping Trusted PortAs the interactive packets used by DHCPv6 to obtain IPv6 addresses or prefixes are multicast packets, there may exist
illegal DHCPv6 services affecting IPv6 acquisition, and user information may even be stolen by such illegal services. To
prevent such issues, DHCPv6 snooping classifies ports into trusted and untrusted ports, and the devices forwards only
the DHCPv6 response packets received by the trusted port and discards all DHCPv6 response packets from the untrusted
port. By setting the ports connected to a legal DHCPv6 server as trusted ports and the others as untrusted ports, illegal
DHCPv6 servers will be shielded.
On a switch, all switch ports or Layer-2 aggregate ports (APs) are untrusted ports by default, which can be configured astrusted ports.

Filtering DHCPv6 Snooping Request Packets

When DHCPv6 packets are disabled for an individual user, any DHCPv6 packets sent from the user's device shall beshielded. DHCPv6 request packet filtering can be configured on an untrusted port to filter all DHCPv6 request packets
received by the port.



VLAN-based DHCPv6 Snooping

DHCPv6 snooping takes effect in the unit of VLAN. If DHCPv6 snooping is enabled by default, the function is enabled on
all VLANs of the device. The VLAN on which DHCPv6 snooping takes effect can be flexibly controlled throughconfiguration.



DHCPv6 Snooping User Database

On a DHCPv6 network, a frequently encountered problem is that users may arbitrarily set static IPv6 addresses. Suchaddresses are difficult to maintain and may conflict with legal user addresses, making the users unable to access theInternet. By snooping the packets exchanged between the client and the server, DHCPv6 snooping forms IPv6
information obtained by users, user MAC, VID, PORT, and lease time into a user record, thus making a DHCPv6
snooping user database to control legal use of IPv6 addresses.



DHCPv6 Option 18 and Option 37

When managing user IP addresses, some network administrators expect to determine the IP addresses to be assigned
according to the user locations; that is, they expect to assign IP addresses to users according to the information on the

11-5Configuration Guide

Configuring DHCPv6 Snooping(beta)

connected network devices, thereby adding user-related device information to DHCP request packets through DHCPv6
option while performing DHCPv6 snooping. The option number for RFC3315 is 18; the option number for RFC4649, theoption number used is 37. After the content of Option 18 and Option 37 is parsed on the DHCPv6 server, the server canobtain information of more users according to the content uploaded by Option 18 and option 37 so as to assign IP
addresses more accurately.

Option 18: Interface ID

The default content of Interface ID include the number of the VLAN to which the port receiving request packets from the
DHCPv6 client belongs, and the port index (the values of the port index are the slot number and port number); theextension content is a customized character string. Default and extension fillings take effect only for wired interfaces,
including switch ports, Layer-2 APs, or Layer-2 encapsulation sub-interfaces.
The Interface ID filling format can be classified into standard and extension formats, only one of which can be used on thesame network. When the standard filling format is used, only default content can be filled in for sub-options of Interface ID,
as shown in the following figure:
Figure 11-4

To use customized content, the extension filling format can be used. The content filled in by extension can be default or
extension content. To distinguish between the content, add a content type field and a content length field of one byte
respectively following the sub-option length. For default content, set the content type as 0; for extension content, set thecontent type as 1.
The format of default content is as follows:
Figure 11-5

The format of extension content is as follows:
Figure 11-6

11-6

Configuration GuideConfiguring DHCPv6 Snooping(beta)

Option 37: Remote ID

The default content of Remote ID is the bridge MAC address of the DHCPv6 relay that receives request packets from the
DHCPv6 client, and the extension content is a customized character string.
The Remote ID filling format can be classified into standard and extension formats, only one of which can be used on thesame network. When the standard filling format is used, only default content are filled in for sub-options of Remote ID, as
shown in the following figure:
Figure 11-7

To use customized content, the extension filling format can be used. The content filled in by extension can be default or
extension content. To distinguish between the content, add a content type field and a content length field of one byte
respectively following the sub-option length. For default content, set the content type as 0; for extension content, set thecontent type as 1.
The format of default content is as follows:
Figure 11-8

The format of extension content is as follows:
Figure 11-9

11-7

Configuration GuideConfiguring DHCPv6 Snooping(beta)

Note

Option 18: The values of port index for Interface ID are the slot number and port number. The port can be a wired switch
port, Layer-2 AP, or Layer-2 encapsulation sub-interface. The port number refers to the sequence number of the port in
the slot. The port number of a Layer-2 AP is an AP number. For example, the port number of Gi0/10 is 10, the port numberof AP 11 is 11;
Slot numbers are the sequence numbers of all slots on a device (one device in stack mode). The slot number of an AP is
the last one. The sequence numbers of slots start from 0. Run the show slots command to display the numbers. For
example:Example 1:
Ruijie# show slots (only Dev and slot displayed)
Dev Slot--- ---10------> The slot number is 0.

11------> The slot number is 1.

12------> The slot number is 2.

In this case, the slot number of an AP is 3.
Example 2:
Ruijie# show slots (only Dev and slot displayed)
Dev Slot--- ---10------> The slot number is 0.

11------> The slot number is 1.

12------> The slot number is 2.

20------> The slot number is 3.

21------> The slot number is 4.

22------> The slot number is 5.

In this case, the slot number of an AP is 6.

Illegal DHCPv6 Packet

11-8

Configuration Guide

Configuring DHCPv6 Snooping(beta)

DHCPv6 snooping checks the validity of DHCPv6 packets passing through the device, discards illegal DHCPv6 packets,records user information, and generates a DHCPv6 snooping binding database for query of other functions. The following
packets are considered as illegal DHCPv6 packets.



DHCPv6 response packets received by untrusted ports. For details, see the section DHCPv6 Response Packet.



Relayed DHCPv6 packets received by untrusted ports, namely DHCPv6 relay-forw packets and DHCPv6 relay-reply
packets.



DHCPv6 relay-reply packets received by trusted ports. The egress for these packets is an untrusted ports according
to the entry.



DHCPv6 release packets; no corresponding users are found in the DHCPv6 snooping user database according to
the Layer-2 source MAC and VID of these packets.



DHCPv6 release packets. The IPv6 addresses or prefixes of these packets do not exist in the DHCPv6 snooping
user database.



DHCPv6 release packets. The IPv6 addresses or prefixes of these packets all exist in the DHCPv6 snooping user
database but the untrusted ports of DHCPv6 release packets are inconsistent with those untrusted ports in the
DHCPv6 snooping user database.



DHCPv6 packets in incorrect formats or incomplete packets.

Overview
Features

Description

Filtering Illegal

Checks the validity of exchanged DHCPv6 packets, and discards illegal packets (see the

DHCPv6 Packets

preceding section for instructions for illegal packets). Forwards only legal response packets totrusted ports.

Establishing a User

Snoops interaction between the client and the server, and generates the DHCPv6 snooping user

Database

database to provide a basis for other security filtering modules.

11.3.1 Filtering Illegal DHCPv6 Packets
This function is to check the validity of DHCPv6 packets from untrusted ports, filter the packets according to the types ofillegal packets described in Basic Concepts above, and control the transmission scope of packets to prevent malicious
users from spoofing.

Working Principle
During snooping, the receipt ports of packets and packet fields are checked to filter the packets; the destination ports ofpackets are modified to control the transmission scope of packets.

Checking Ports

When receiving DHCPv6 packets, the device first determines whether the port receiving packets is a DHCPv6 trusted port.
If the port is a trusted port, the packets will be forwarded without validity check, binding, or prefix record generation. If theport is an untrusted port, validity check is required.



Checking whether Packet Encapsulation and Length are Complete

Check whether the packets are User Datagram Protocol (UDP) packets and the destination port is 546 or 547. Check
whether the actual length of a packet matches the length field described in the protocol.

11-9Configuration GuideConfiguring DHCPv6 Snooping(beta)

Checking Whether DHCPv6 Packet Field and Packet Type are Correct

Check whether the packets are relayed according to the types of illegal packets described in the preceding section Basic
Concepts, and then check whether the restrictions specific to a type of packets are met according to the actual type of
packets.

Related Configuration

Enabling Global DHCPv6 Snooping

By default, DHCPv6 snooping is disabled.
Run the [ no ] ipv6 dhcp snooping command to enable or disable DHCPv6 snooping.
To enable or disable DHCPv6 snooping on different VLANs, global DHCPv6 snooping must be enabled first.



Setting DHCPv6 Snooping on a VLAN

By default, when global DHCPv6 snooping is enabled, DHCPv6 snooping takes effect on all VLANs.
Run the [ no ] ipv6 dhcp snooping vlan command to enable or disable DHCPv6 snooping on a VLAN. The range ofcommand parameter values is the actual range of VLAN numbers.

11.3.2 Establishing a User Database
The packets exchanged between the DHCPv6 client and the DHCPv6 server are snooped, and DHCPv6 snooping
binding entries and prefix entries are generated according to the information on legal DHCPv6 packets. All the entries areprovided for other security configuration modules as an information list of legal users and a basis for network packet
filtering.

Working Principle
During snooping, binding database and prefix database are continuously updated according to the types of DHCPv6
packets.



Generating Binding or Prefix Records

When DHCPv6 reply packets are snooped on a trusted port, client IPv6 addresses or prefixes, client MAC addresses, andlease time fields of the packets are extracted, and a binding or prefix record is generated according to the client port ID
recorded by the device (wired interface index), and the client VLAN.

Deleting Binding or Prefix Records

When the recorded lease time is over, or the legal DHCPv6 release/DHCPv6 decline packets sent from the client aresnooped, or users run the clear command to delete binding or prefix records, the corresponding binding or prefix records
are deleted.

Related Configuration
Enable DHCPv6 snooping without extra configuration.

11-10

Configuration Guide

Configuring DHCPv6 Snooping(beta)

11.4 Configuration
Configuration

Description and Command(Mandatory) It is used to establish DHCPv6 snooping.
Enables DHCPv6 snooping.

ipv6 dhcp snooping

Delays assignment of the DHCPv6
ipv6 dhcp snooping binding-delay

snooping binding entries to the hardware
filtering entries.

ipv6 dhcp snooping filter-dhcp-pkt

Enables DHCPv6 request packet filtering.
Enables and disables DHCPv6 snooping

ipv6 dhcp snooping vlan

for specified VLANs.
Enables the function for regularly saving

Configuring Basic

ipv6 dhcp snooping database write-delay

DHCPv6 Snooping

DHCPv6 snooping binding and prefix
records.

Functions
ipv6 dhcp snooping database write-to-flash

Manually saves DHCPv6 snooping binding
and prefix records.
Manually imports the user records saved inrenew ipv6 dhcp snooping databaseflash to the DHCPv6 snooping user
database.
Configures DHCPv6 snooping trusted

ipv6 dhcp snooping trust

ports.
Clears dynamical biding entries on a port

ipv6 dhcp snooping link-detection

when the port is configured into Link Down
state.

(Optional) It is used to optimize assignment of DHCPv6 server addresses.
Adds Option 18 or Option 37 to DHCPv6
request packets.
ipv6 dhcp snooping

Information option

standard-format: Fills in content in astandard format if such keyword exists;[ standard-format ]otherwise, fills in content in an extension
format.
Configuring Option 18

Configures Remote ID in an extension

and Option 37
ipv6 dhcp snooping information option
format remote-id [ string ASCII-string |hostname ]format.
string: Indicates that the content filled in isa customized character string.
hostname: Indicates that the content filled
in is hostname.

ipv6 dhcp snooping vlan vlan-id information
option format-type interface-id string
ASCII-string

11-11

Configures the customized character stringof Interface ID in an extension format.

Configuration Guide
Configuration

Configuring DHCPv6 Snooping(beta)
Description and Command
Configures VLAN mapping for Interface ID
ipv6 dhcp snooping vlan vlan-id information
option change-vlan-to vlan vlan-id

in an extension format, which is exclusivefrom the [no] ipv6 dhcp snooping vlan
vlan-id information option format-type
interface-id string ASCII-string command.

11.4.1 Configuring Basic DHCPv6 Snooping Functions
Configuration EffectEnable DHCPv6 snooping.

Generate DHCPv6 snooping binding and prefix databases.

Control the transmission scope of DHCPv6 packets.

Filter illegal DHCPv6 packets.

Notes


The port connecting the device to a trusted DHCPv6 server must be set as a trusted port.



The port on which DHCPv6 snooping takes effect can be a wired switch port, Layer-2 AP or Layer-2 encapsulation
sub-interface. Configuration on a port can be classified into configuration in interface mode.

The Link Down entry clearing function applies only to wired ports.

Configuration Steps

Enabling Global DHCPv6 SnoopingMandatory.



If not specified, configure this function on an access device.

Delaying Assignment of DHCPv6 Snooping Binding Entries to Hardware Filtering EntriesConfigure the function if assignment needs to be delayed. Assignment is not delayed by default.



If not specified, configure this function on an access device.

Enabling DHCPv6 Request Packet FilteringEnable the function if users' DHCPv6 requests need to be restricted on a port.



If not specified, disable the function on the access device.

Enabling and Disabling VLAN-based DHCPv6 Snooping

Disable DHCPv6 snooping if the function is not needed on a VLAN.



If not specified, configure this function on an access device.

Enabling Regular Saving of DHCPv6 Snooping Binding Records

This function should be enabled if DHCPv6 snooping binding records need to be maintained after the device isrestarted.

11-12

Configuration Guide

Configuring DHCPv6 Snooping(beta)

If not specified, enable the function on the access device.

Configuring DHCPv6 Trusted Ports

Mandatory.



Set the port connecting the device to a trusted DHCPv6 device as a DHCPv6 trusted port.

Enabling and Disabling Clearing of Dynamically Bound Entries When the Port is Configured into Link Down
State



On a stable network, enable the function to release spaces occupied by hardware entries and timely clear the entries
on the Link Down port.



If not specified, disable the function on the access device.

Verification
Enable the device to use DHCPv6 to obtain network configuration parameters.



Check whether user records are generated in the DHCPv6 snooping binding database.

Related Commands

Enabling and Disabling DHCPv6 Snooping

Command[ no ] ipv6 dhcp snooping

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

After global DHCPv6 snooping is enabled, run the show ipv6 dhcp snooping command to check
whether DHCPv6 snooping is enabled.

Delaying Assignment of the DHCPv6 Snooping Binding Entries to the Hardware Filtering Entries

Command[ no ] ipv6 dhcp snooping binding-delay

Parameterseconds: Indicates the time for delaying assignment of binding entries to hardware filtering entries, in the

Description

unit of seconds.
The value is 0 by default.

Command

Global configuration mode

Mode
Usage Guide

By default, dynamically bound entries are added to hardware filtering entries in real time. After thefunction is configured, the dynamically generated binding entries are bound to hardware filtering entries
only when no IPv6 address conflicts are detected within a specified time period.

Configuring a VLAN on Which DHCPv6 Snooping Takes EffectCommand[ no ] ipv6 dhcp snooping vlan { vlan-rng | { vlan-min [ vlan-max ] } }Parametervlan-rng: Indicates the VLAN scope in which DHCPv6 snooping takes effect.

Description

vlan-min: Indicates the lower VLAN limit where DHCPv6 snooping takes effect.
vlan-max: Indicates the upper VLAN limit where DHCPv6 snooping takes effect.

11-13

Configuration Guide
Command

Configuring DHCPv6 Snooping(beta)

Global configuration mode

Mode
Usage Guide

DHCPv6 snooping is enabled or disabled on a specified VLAN by configuring the command. Thisfunction takes effect only if global DHCPv6 snooping is enabled.

Filtering DHCPv6 Request Packets on a Port

Command[ no ] ipv6 dhcp snooping filter-dhcp-pkt

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage GuideAll DHCPv6 request packets can be prohibited on the port by configuring the command; that is, all users
are prohibited from applying for addresses on the port.

Regularly Writing DHCPv6 Snooping Database Information into Flash

Command[ no ] ipv6 dhcp snooping database write-delay [ time ]Parameter

time: Indicates the interval for regularly writing the DHCPv6 snooping database into flash.

Description
Command

Global configuration mode

Mode
Usage Guide

The DHCPv6 snooping database can be written into a flash file by configuring the command. The
function prevents user information loss after the device restarts. If user information is lost, users have tore-obtain IP addresses for normal communication.



Manually Writing DHCPv6 Snooping Database Information into Flash

Commandipv6 dhcp snooping database write-to-flash

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Dynamic user information in the DHCPv6 snooping database can be written into a flash file in real timeby running the command.



Manually Importing Information in Flash to the DHCPv6 Snooping Binding Database

Commandrenew ipv6 dhcp snooping database

Parameter

N/A

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

Flash file information can be written into the DHCPv6 snooping database in real time by running thecommand.

Configuring a Port as a Trusted Port

Command[ no ] ipv6 dhcp snooping trust

11-14

Configuration Guide
Parameter

Configuring DHCPv6 Snooping(beta)

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

The port connecting to a legal DHCPv6 server is configured as a trusted port by configuring thecommand. The DHCPv6 response packets received by a trusted port are forwarded, while the DHCPv6
response packets received by an untrusted port are discarded.



Clears dynamical biding entries on a port when the port is configured into Link Down state

Commandipv6 dhcp snooping link-detection

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

By default, the dynamic binding entries are not cleared on a wired interface when the interface links
down. With this function enabled, the dynamic binding entries are auto-cleared on an interface when theinterface is in the LINK DOWN status.

Configuration
Example

Dynamically obtaining IPv6 addresses through the legal DHCPv6 server on a DHCPv6 client

Scenario

Switch A

Figure 11-10

DHCPv6 Server
Gi 0/1
Gi 0/17
Switch B

DHCP Client

ConfiguratioEnable DHCPv6 snooping on the access device (Switch B).

n Steps

Set the uplink port (Gi 0/1) as a trusted port.

B

B# configure terminal
B(config)# ipv6 dhcp snooping
B(config)# interface gigabitEthernet 0/17
B(config-if-GigabitEthernet 0/17)# ipv6 dhcp snooping trust

Verification

Confirm configuration of Switch B.
Confirm whether DHCPv6 snooping is enabled and whether the DHCPv6 snooping trusted port
configured is the uplink port.

11-15

Configuration GuideConfiguring DHCPv6 Snooping(beta)
On Switch B, check the configuration of DHCP snooping, especial whether the trusted port iscorrect.

B

Ruijie# show ipv6 dhcp snooping
DHCPv6 snooping status : ENABLE
DHCPv6 snooping database write-delay time : 0 seconds
DHCPv6 snooping binding-delay time : 0 seconds
DHCPv6 snooping option18/37 status : DISABLE
DHCPv6 snooping link detection : DISABLE
Interface

TrustedFilter DHCPv6--------------------------------------------

GigabitEthernet 0/17

YES

DISABLE

Ruijie#show ipv6 dhcp snooping binding
Total number of bindings: 1
NO.

MacAddress

IPv6 Address

Lease(sec)

VLAN

Interface----- ------------------------------------------------------------ ------------ ------------------------1

00d0.f801.0101

2001::1042368

2GigabitEthernet 0/17

Common Errors


The uplink port is not set as a DHCPv6 trusted port.



Other access security options are configured on the uplink port, resulting in failure of DHCPv6 trusted port
configuration.

11.4.2 Configuring Option 18 and Option 37
Configuration EffectThe DHCPv6 server can obtain more information during address assignment, thus improving address assignment.

The option is transparent to the DHCPv6 client, and such function is perception-free to the client.

Configuration Steps

Run the configuration if the optimization is needed.



If not specified, enable the function on the device where DHCPv6 snooping is enabled.

Verification
Check the configuration of DHCPv6 snooping to ensure that such function is enabled.

11-16

Configuration Guide

Configuring DHCPv6 Snooping(beta)

Related Commands

Adding Option18 and Option 37 to DHCPv6 Request Packets

Command[no] ipv6 dhcp snooping information option [ standard-format ]Parameter

standard-format: Fills in content in a standard format if such keyword exists; otherwise, fills in content in

Description

an extension format.

Command

Global configuration mode

Mode
Usage Guide

Information on Option 18 and Option 37 is added to DHCPv6 request packets by configuring thecommand, and the DHCPv6 server assigns addresses according to information on Option 18 and Option
37.



Setting Option 37 (Remote ID) as a Customized Character String

Command[ no ] ipv6 dhcp snooping information option format remote-id { string ASCII-string | hostname }Parameter

string ASCII-string: Indicates that the content of Remote ID in an extension format is a customized

Description

character string.
hostname: Indicates that the content of Remote ID in an extension format is hostname.

Command

Global configuration mode

Mode
Usage Guide

Remote ID is configured in an extension format by configuring the command. Remote ID is customized,
and the DHCPv6 server assigns addresses according to information on Option 37.



Setting Option 18 (Interface ID) as a Customized Character String

Command[ no ] ipv6 dhcp snooping vlan vlan-id information option format-type interface-id string
ASCII-string

Parametervlan-id: Indicates the VLAN to which DHCPv6 request packets belong.

Description

ASCII-string: Indicates the user-customized content to be filled in for Interface-ID.

Command

Interface configuration mode

Mode
Usage Guide

Customized character strings of Interface ID are configured in an extension format by configuring thecommand, and the DHCPv6 server assigns addresses according to information on Option 18.



Setting Option 18 (Interface ID) as a Modified VLAN

CommandParameter[ no ] ipv6 dhcp snooping vlan vlan-id information option change-vlan-to vlan vlan-id
vlan-id (the first one): Indicates the VLAN to which DHCPv6 request packets belong.

Description
vlan-id (the second one): Indicates the VLAN after modification.
Command

Interface configuration mode

Mode
Usage Guide

Interface ID is configured as VLAN mapping in an extension format by configuring the command, and the
DHCPv6 server assigns addresses according to information on Option 18.

11-17

Configuration Guide

Configuring DHCPv6 Snooping(beta)

Configuration
Example

The following example shows how to add Option 18 and Option 37 to DHCPv6 request packets.

Configuratio

Configure basic DHCPv6 snooping functions.(Omitted)

n Steps

Enable the function for adding Option 18 and Option 37.

B

Ruijie# configure terminal
Ruijie(config)# ipv6 dhcp snooping information option
Ruijie(config)# end

Verification

Display the DHCPv6 snooping configuration.

B

Ruijie# show ipv6 dhcp snooping
DHCPv6 snooping status : ENABLE
DHCPv6 snooping database write-delay time : 0 seconds
DHCPv6 snooping binding-delay time : 0 seconds
DHCPv6 snooping option 18/37 status : ENABLE
DHCPv6 snooping link detection : DISABLE
Interface

TrustedFilter DHCPv6------------------------------------------

GigabitEthernet 0/10

YES

DISABLE

11.5 Monitoring and Maintenance
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description
Clears dynamic user information in
the DHCPv6 snooping database.
Clears all entries in the DHCPv6

Commandclear ipv6 dhcp snooping binding [ vlan vlan-id | mac | ipv6 | interface
interface-id ]clear ipv6 dhcp snooping prefix

snooping prefix database.
Clears statistics about DHCPv6

clear ipv6 dhcp snooping statistics

snooping handling DHCPv6 packets.

Displaying
Description

Command

Displays DHCPv6 snoopingshow ipv6 dhcp snooping

configuration.
Displays the VLANs on whichshow ipv6 dhcp snooping vlan

DHCPv6 snooping fails to take effect.

11-18

Configuration Guide
Displays all dynamically bound entries

Configuring DHCPv6 Snooping(beta)
show ipv6 dhcp snooping binding

in the DHCPv6 snooping binding
database.
Displays all entries in the DHCPv6

show ipv6 dhcp snooping prefix

snooping prefix database.
Displays the counters of DHCPv6

show ipv6 dhcp snooping statistics

snooping handling packets.

Debugging
System resources are occupied when debugging information is output. Therefore, disable debugging immediately
after use.
Description

CommandDebugs DHCPv6 snooping events.

debug snooping ipv6 event

Disables debugging of DHCPv6

no debug snooping ipv6 event

snooping events.
Debugs DHCPv6 snooping packets.

debug snooping ipv6 packet

Disables debugging of DHCPv6

no debug snooping ipv6 packet

snooping packets.

11-19

Configuration Guide

Configuring ARP Check(beta)

12 Configuring ARP Check(beta)
12.1 Overview
The Address Resolution Protocol (ARP) packet check filters all ARP packets under ports (including wired layer-2
switching ports, layer-2 aggregate ports (APs), and layer-2 encapsulation sub-interfaces) and discards illegal ARP
packets, so as to effectively prevent ARP deception via networks and to promote network stability. On devices supporting
ARP check, illegal ARP packets in networks will be ignored according to the legal user information (IP-based or IP-MAC
based) generated by security application modules such as IP Source Guard, global IP+MAC binding, 802.1X
authentication, GSN binding, Web authentication and port security.
Figure 12-1

ARP check function
User ARP

Legal user ARP

Legal user
information
table

Global IP+MAC
binding function

Port security

The above figure shows that security modules generate legal user information (IP-based or IP-MAC based). ARP Checkuses the information to detect whether the Sender IP fields or the <Sender IP, Sender MAC>fields in all ARP packets at
ports matches those in the list of legal user information. If not, all unlisted ARP packets will be discarded.

Protocols andStandards


RFC826: An Ethernet Address Resolution Protocol or Converting Network Protocol Addresses

12.2 Applications
Application

Description

Filtering ARP Packets in Networks

Illegal users in networks launch attacks using forged ARP packets.

12-1

Configuration Guide

Configuring ARP Check(beta)

12.2.1 Filtering ARP Packets in Networks
Scenario
Check ARP packets from distrusted ports and filter out ARP packets with addresses not matching the results assigned by
the DHCP server.
For example, in the following figure, the ARP packets sent by DHCP clients are checked.

The ports receiving ARP packets, the source MAC addresses of ARP packets, and the source IP addresses of ARP
packets shall be consistent with the snooped DHCP-assigned records.

Figure 12-2
C
MAC C
IP C
（I

am MAC A）

X（I

am MAC A）

Gi0/17
S

A
MAC A
IP A

Remarks:

Gi0/18Legal user list:(Gi 0/17, MAC A, IP A)(Gi 0/18, MAC C , IP C)

Forge ARP Packets
Leglimate ARP Packets

S is an access device.
A and C are user PCs.

Deployment
Enable DHCP Snooping on S to realize DHCP monitoring.



Set all the downlink ports on S as DHCP distrusted ports.

Enable IP Source Guard and ARP Check on all distrusted ports on S to realize ARP packet filtration.

12.3 Features
Basic Concepts

Compatible Security Modules

Presently, the ARP Check supports the following security modules.

IP-based: IP-based mode: port security, and static configuration of IP Source Guard.

IP-MAC based: IP-MAC based mode: port security, global IP+MAC binding, 802.1X authorization, IP Source Guard,
GSN binding, and Web authentication.



Two Modes of APR Check

The ARP Check has two modes: Enabled and Disabled. The default is Enabled.
12. Enabled Mode

12-2

Configuration Guide

Configuring ARP Check(beta)

Through ARP Check, ARP packets are detected based on the IP/IP-MAC based binding information provided by thefollowing modules.

Global IP-MAC binding

802.1X authorization

IP Source Guard

GSN bindingPort securityWeb authentication

Port security IP+MAC binding or IP binding
When only ARP Check is enabled on a port but the above-mentioned modules are not enabled, legal user
information cannot be generated, and thereby all ARP packets from this port will be discarded.
When the ARP Check and VRRP functions are enabled on an interface, if the physical IP address and virtual IP
address of the interface can be used as the gateway address, the physical IP address and VRRP IP address need tobe permitted to pass. Otherwise, ARP packets sent to the gateway will be filtered out.

13. Disabled Mode
ARP packets on a port are not checked.

Overview
FeatureDescription

Filtering ARPCheck the source IP and source MAC addresses of ARP packets to filter out illegal ARP packets.

Packets

12.3.1 Filtering ARP Packets
Enable ARP Check on specified ports to realize filtration of illegal ARP packets.

Working Principle
A device matches the source IP and source MAC addresses of the ARP packets received at its ports with the legal user
information of the device. With successful matching, packets will be transferred, or otherwise they will be discarded.

Related Configuration

Enabling ARP Check on Ports

By default, the ARP Check is disabled on ports.
Use the arp-check command to enable ARP Check.
Unless otherwise noted, this function is usually configured on the ports of access devices.

12-3

Configuration Guide

Configuring ARP Check(beta)

12.4 Configuration
Configuration

Description and Command

Configuring ARP Check(Mandatory) It is used to enable APR Check.
Enables ARP Check.

arp-check12.4.1 Configuring ARP Check
Configuration EffectIllegal ARP packets are filtered out.

Notes


When ARP Check is enabled, the number of policies or users of related security applications may decrease.



ARP Check cannot be configured on mirrored destination ports.



ARP Check cannot be configured on the trusted ports of DHCP Snooping.



ARP Check cannot be configured on global IP+MAC exclude ports.



ARP Check can be enabled only on wired switching ports, layer-2 APs, layer-2 encapsulation sub-interfaces. Enable
ARP check for the wired in interface configuration mode.

Configuration Steps

Enabling ARP Check(Mandatory) The function is disabled by default. To use the ARP Check function, an administrator needs to run acommand to enable it.

Verification


Use the show running-config command to display the system configuration.

Use the show interfaces [ interface-type interface-number ] arp-check list command to display filtering entries.

Related Commands

Enabling ARP Check

Commandarp-check

Parameter

N/A

Description
Command

Interface configuration mode

Usage Guide

Generate ARP filtration information according to the legal user information of security application
modules to filter out illegal ARP packets in networks.

Configuration
ExampleThe following configuration example introduces only ARP Check related configurations.

12-4

Configuration GuideConfiguring ARP Check(beta)

Enabling ARP Check on ports

ConfiguratioEnable ARP Check. Restricted ARP packets must conform to entries of IP Source Guard, port
security, or global IP+MAC binding.

n StepsRuijie# configure terminal
Ruijie(config)# address-bind 192.168.1.3 00D0.F800.0003
Ruijie(config)# address-bind install
Ruijie(config)# ip source binding 00D0.F800.0002 vlan 1 192.168.1.4 interface gigabitethernet
0/16
Ruijie(config)# interface gigabitethernet 0/16
Ruijie(config-if-GigabitEthernet 0/16)# arp-check
Ruijie(config-if-GigabitEthernet 0/16)# ip verify source port-security
Ruijie(config-if-GigabitEthernet 0/16)# switchport port-security
Ruijie(config-if-GigabitEthernet 0/16)# switchport port-security binding 00D0.F800.0001 vlan
1 192.168.1.1
Ruijie(config-if-GigabitEthernet 0/16)# exit
Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security
Ruijie(config-if-GigabitEthernet 0/17)# switchport port-security binding 192.168.1.5
Ruijie(config-if-GigabitEthernet 0/17)# arp-check
Ruijie(config-if-GigabitEthernet 0/17)# exit

Verification

Use the show interface arp-check list command to display the effective ARP Check list for interfaces.
Ruijie# show interface arp-check list
INTERFACESENDER MAC

SENDER IP

POLICY SOURCE------------------------ -------------------- -------------------- -------------------GigabitEthernet 0/16

00d0.f800.0003

192.168.1.3

address-bind

GigabitEthernet 0/16

00d0.f800.0001

192.168.1.1

port-security

GigabitEthernet 0/16

00d0.f800.0002

192.168.1.4

DHCP snooping

GigabitEthernet 0/1700d0.f800.0003

192.168.1.3

address-bind

192.168.1.5

port-security

GigabitEthernet 0/17

Common Errors


If ARP packets at a port need to be checked but APR-Check is disabled, then APR-Check will not be effective.

12-5

Configuration Guide

Configuring ARP Check(beta)

12.5 Monitoring
Displaying
Description

Command

Displays the effective ARP Checkshow interface [ interface-type interface-number ] arp-check list

list based on ports.

12-6

Configuration Guide

Configuring Dynamic ARP Inspection(beta)

13 Configuring Dynamic ARP Inspection(beta)
13.1 Overview
Dynamic Address Resolution Protocol (ARP) inspection (DAI) checks the validity of received ARP packets. Invalid ARP
packets will be discarded.
DAI ensures that only valid ARP packets can be forwarded by devices. DAI mainly performs the following steps:Intercepts all ARP request packets and ARP reply packets on untrusted ports in the virtual local area networks(VLANs) where the DAI function is enabled.

Checks the validity of intercepted ARP packets according to user records stored in a security database.



Discards the ARP packets that do not pass the validity check.



Sends the ARP packets that pass the validity check to the destination.



The DAI validity criteria are the same as those of ARP Check. For details, see the Configuring ARP Check.

DAI and ARP Check have same functions. The only difference is that DAI takes effect by VLAN whereas ARP Checktakes effect by port.

Protocols andStandards


RFC826: An Ethernet Address Resolution Protocol or Converting Network Protocol Addresses

13.2 Applications
Application

Description

ARP Spoofing Prevention

Prevent ARP spoofing that is mounted by taking advantage of ARP defects.

13.2.1 ARP Spoofing Prevention
Scenario
Due to inherent defects, ARP does not check the validity of received ARP packets. Attackers can take advantage of thedefects to mount ARP spoofing. A typical example is man-in-the-middle (MITM) attack. See Figure 13-1.

13-1

Configuration Guide

Configuring Dynamic ARP Inspection(beta)

Figure 13-1

RemarkDevice S is a Ruijie access switch enabled with DAI.

s

User A and User B are connected to Device S, and they are in the same subnet.
User C is a malicious user connected to Device S.
IP A and MAC A are the IP address and MAC address of User A.
IP B and MAC B are the IP address and MAC address of User B.
IP C and MAC C are the IP address and MAC address of User C.

When User A needs to initiate network layer communication with User B, User A broadcasts an ARP request in the subnet
to query the MAC address of User B. Upon receiving the ARP request packet, User B updates its ARP cache with IP A
and MAC A, and sends an ARP reply. Upon receiving the ARP reply packet, User A updates its ARP cache with IP B and
MAC B.
In this model, User C can make the ARP entry mapping between User A and User B incorrect by continuously
broadcasting ARP reply packets to the network. The reply packets contain IP A, IP B, and MAC C, After receiving these
reply packets, User A stores the ARP entry (IP B, MAC C), and User B stores the ARP entry (IP A, MAC C). As a result,the communication between User A and User B is directed to User C, without the knowledge of User A and User B. Here
User C acts as the man in the middle by modifying received packets and forwarding them to User A or User B.
If Device S is enabled with DAI, it will filter out forged ARP packets to prevent ARP spoofing as long as the IP addressesof User A and User B meet the validity criteria described in section 13.1 Overview. Figure 13-2 shows the working process
of DAI.
Figure 13-2

RemarkDevice S is a Ruijie access switch enabled with DAI.

s

User A and User B are connected to Device S, and they are in the same subnet.

13-2

Configuration Guide

Configuring Dynamic ARP Inspection(beta)

User C is a malicious user connected to Device S.
IP A and MAC A are the IP address and MAC address of User A.
IP B and MAC B are the IP address and MAC address of User B.
IP C and MAC C are the IP address and MAC address of User C.
The ARP packets of User A and User B are forwarded normally by Device S. The forged ARP packets of User C are
discarded because the packets do not match the records in the security database of Device S.

Deployment
Enable DHCP Snooping on Device S.

Enable DAI and IP Source Guard on Device S.

13.3 Features
Basic ConceptsTrust Status of Ports and Network Security

ARP packet check is performed according to the trust status of ports. DAI considers packets received from trusted ports
as valid without checking their validity, but it checks the validity of packets received from untrusted ports.
For a typical network configuration, you should configure Layer-2 ports connected to network devices as trusted ports,
and configure Layer-2 ports connected to hosts as untrusted ports.
Network communication may be affected if a Layer-2 port connected to a network device is configured as an
untrusted port.

Overview
FeatureDescription

Invalid ARP Packet Filter

Checks the source IP addresses and MAC addresses of ARP packets to filter out
invalid packets.

DAI Trusted Port

Permits the ARP packets received from specific ports to pass through without
checking their validity.

13.3.1 Invalid ARP Packet Filter
Enable DAI in a specific VLAN to filter out invalid ARP packets. The DAI validity criteria are the same as those of ARPCheck.

Working Principle
Upon receiving an ARP packet, the device matches the IP address and MAC address of the packet with the valid user
records in its security database. If the packet matches a record, it will be forwarded normally. If it does not match any
record, it will be discarded.
DAI and ARP Check use the same set of valid user records. For details, see the packet validity check description in the
Configuring ARP Check.

13-3

Configuration Guide

Configuring Dynamic ARP Inspection(beta)

Related Configuration

Enabling DAI in a VLAN

By default, DAI is disabled in VLANs.
Run the ip arp inspection vlan vlan-id command to enable DAI in a specific VLAN.
After DAI is enabled in a VLAN, DAI may not take effect on all ports in the VLAN. A DHCP Snooping trusted port
does not perform DAI check.

Disabling DAI in a VLAN

By default, DAI is disabled in VLANs.
After DAI is enabled in a VLAN, you can run the no ip arp inspection vlan vlan-id command to disable DAI.
Disabling DAI in a VLAN does not mean disabling packet validity check on all ports in the VLAN. The ports with ARPCheck effective still check the validity of received ARP packets.

13.3.2 DAI Trusted Port
Configure specific device ports as DAI trusted ports.

Working Principle
The validity of ARP packets received from trusted ports is not checked. The ARP packets received from untrusted ports
are checked against the user records in a security database.

Related Configuration

Configuring DAI Trusted Ports

By default, all ports are untrusted ports.
Run the ip arp inspection trust command to set ports to trusted state.
A port already enabled with access security control cannot be set to DAI trusted state. To set the port to DAI trusted
state, first disable access security control.
In normal cases, uplink ports (ports connected to network devices) can be configured as DAI trusted ports.

13.4 Configuration
Configuration

Description and Command(Optional) It is used to enable ARP packet validity check.

Configuring DAI

ip arp inspection vlan

Enables DAI.

ip arp inspection trust

Configures DAI trusted ports.

13-4

Configuration Guide

Configuring Dynamic ARP Inspection(beta)

13.4.1 Configuring DAI
Configuration EffectCheck the validity of incoming ARP packets in a specific VLAN.

Notes


DAI cannot be enabled on DHCP Snooping trusted ports.

Configuration Steps

Enabling ARP Packet Validity Check in a Specific VLAN



Optional.

Perform this configuration when you need to enable ARP packet validity check on all ports in a VLAN.



Perform this configuration on Ruijie access devices unless otherwise specified.

Configuring DAI Trusted Ports

Optional.



It is recommended to configure uplink ports as DAI trusted ports after DAI is enabled. Otherwise, the uplink ports
enabled with other security features and set to trusted state accordingly may filter out valid ARP packets due to theabsence of DAI user entries.



Perform this configuration on Ruijie access devices unless otherwise specified.

Configuring the ARP Packet Reception RateFor details, see the rate limit command description in the Configuring the NFPP.

VerificationConstruct invalid ARP packets by using a packet transfer tool and check whether the packets are filtered out on
DAI-enabled devices.



Run the show command to check the device configuration.

Related Commands

Enabling DAICommand

ip arp inspection vlan { vlan-id | word }Parametervlan-id: Indicates a VLAN ID.

Description

word: Indicates the VLAN range string, such as 1, 3–5, 7, and 9–11.

Command

Global configuration mode

Mode
Usage Guide

N/A

Configuring DAI Trusted Ports

Command

ip arp inspection trust

Parameter

N/A

13-5

Configuration Guide

Configuring Dynamic ARP Inspection(beta)

Description
Command

Interface configuration mode

Mode
Usage Guide

Use this command to configure a DAI trusted port so that the ARP packets received by the port can passthrough without validity check.

Configuration
Example

Allowing Users' PCs to Use only Addresses Allocated by a DHCP Server to Prevent ARP Spoofing

Scenario
Figure 13-3
DHCP Server

Te 0/19

Switch A
Gi 0/17

Gi 0/18

DHCP Client
VLAN 2

Configuration Steps

Enable DHCP Snooping on the access switch (Switch A) and configure its uplink port
(GigabitEthernet 0/3) connected to the valid DHCP server as a trusted port.
Enable IP Source Guard on Switch A.
Enable DAI.

Switch A

A# configure terminalA(config)# vlan 2A(config-vlan)# exit
A(config)# interface range gigabitethernet 0/17-18
A(config-if-range)# switchport access vlan 2A(config-if-range)# ip verify source
A(config-if-range)# exit
A(config)# ip dhcp snooping
A(config)# ip arp inspection vlan 2A(config)# interface TenGigabitEthernet 0/19
A(config-if-TenGigabitEthernet 0/19)# switchport access vlan 2A(config-if-TenGigabitEthernet 0/19)# ip dhcp snooping trustA(config-if-TenGigabitEthernet 0/19)# ip arp inspection trust

13-6

Configuration Guide

Configuring Dynamic ARP Inspection(beta)Check whether DHCP Snooping, IP Source Guard, and DAI are enabled and whether trusted ports

Verification

are configured correctly.

Switch A

Check whether the uplink port on Switch A is a DHCP Snooping trusted port.



Check whether DAI is enabled successfully in the VLAN and the uplink ports are DAI trusted ports.

A# show running-config
A# show ip dhcp snoopingA# show ip arp inspection vlan

Common Errors


A port with security control enabled is configured as a DAI trusted port.

13.5 Monitoring
Displaying
Description

Command

Displays the DAI state of a specificshow ip arp inspection vlan [ vlan-id | word ]VLAN.
Displays the DAI configuration stateshow ip arp inspection interfaceof each Layer-2 port.

13-7

Configuration Guide

Configuring IP Source Guard(beta)

14 Configuring IP Source Guard(beta)
14.1 Overview
The IP Source Guard function realizes hardware-based IP packet filtering to ensure that only the users having theirinformation in the binding database can access networks normally, preventing users from forging IP packets.

14.2 Applications
Application

Description

Guarding Against IP/MAC Spoofing

In network environments, users set illegal IP addresses and malicious users
launch attacks through forging IP packets.

Attack

14.2.1 Guarding Against IP/MAC Spoofing Attack
Scenario
Check the IP packets from DHCP untrusted ports. Forged IP packets will be filtered out based on the IP or IP-MAC field.
For example, in the following figure, the IP packets sent by DHCP clients are checked.

The Source IP Address fields of IP packets should match DHCP-assigned IP addresses.



The Source MAC Address fields of layer-2 packets should match the MAC addresses in DHCP request packets fromclients.

Figure 14-1

Remarks:

S is a network access server (NAS).
A and C are user PCs.
B is a DHCP server within the control area.

Deployment
Enable DHCP Snooping on S to realize DHCP monitoring.



Set all downlink ports on S as DHCP untrusted ports.

14-1

Configuration Guide

Configuring IP Source Guard(beta)Enable IP Source Guard on S to realize IP packet filtering.

Enable IP–MAC match mode for IP Source Guard on S, filtering IP packets based on IP and MAC addresses.

14.3 Features
Basic Concepts

Source IP Address

Indicate the source IP address field of an IP packet.

Source MAC Address

Indicate the source MAC address field of an IP packet.

IP-based Filtering

Indicate a policy of IP packet filtering, where only the source IP addresses of all IP packets (except DHCP packets)
passing through a port are checked. It is the default filtering policy of IP Source Guard.

IP-MAC based Filtering

A policy of IP packet filtering, where both the source IP addresses and source MAC addresses of all IP packets arechecked, and only those user packets with these IP addresses and MAC addresses existing in the binding database are
permitted.

Address Binding Database

As the basis of security control of the IP Source Guard function, the data in the address binding database comes from two
ways: the DHCP Snooping binding database and static configuration. When IP Source Guard is enabled, the data of the
DHCP Snooping binding database is synchronized to the address binding database of IP Source Guard, so that IP
packets can be filtered strictly through IP Source Guard on a device with DHCP Snooping enabled.

Excluded VLAN

By default, when IP Source Guard is enabled on a port, it is effective to all the VLANs under the port. Users may specify
excluded VLANs, within which IP packets are not checked and filtered, which means that such IP packets are notcontrolled by IP Source Guard. At most 32 excluded VLANs can be specified for a port.

Overview
FeatureChecking Source Address

Description
Filter the IP packets passing through ports by IP-based or IP-MAC based filtering.

Fields of Packets

14.3.1 Checking Source Address Fields of Packets
Filter the IP packets passing through ports based on source IP addresses or on both source IP addresses and source
MAC addresses to prevent malicious attack by forging packets. When there is no need to check and filter IP packets
within a VLAN, an excluded VLAN can be specified to release such packets.

14-2

Configuration Guide

Configuring IP Source Guard(beta)

Working Principle
When IP Source Guard is enabled, the source addresses of packets passing through a port will be checked. The port canbe a wired switching port, a layer-2 aggregate port (AP), or a layer-2 encapsulation sub-interface. Such packets will pass
the port only when the source address fields of the packets match the set of the address binding records generated by
DHCP Snooping, or the static configuration set by the administrator. There are two matching modes as below.

IP-based Filtering

Packets are allowed to pass a port only if the source IP address fields of them belong to the address binding database.

IP-MAC Based Filtering

Packets are allowed to pass a port only when both the layer-2 source MAC addresses and layer-3 source IP addresses ofthem match an entry in the address binding database.

Specifying Excluded VLAN

Packets within such a VLAN are allowed to pass a port without check or filtering.

Related Configuration

Enabling IP Source Guard on a Port

By default, the IP Source Guard is disabled on ports.
It can be enabled using the ip verify source command.
Usually IP Source Guard needs to work with DHCP Snooping. Therefore, DHCP Snooping should also be enabled.
DHCP Snooping can be enabled at any time on Ruijie devices, either before or after IP Source Guard is enabled.

Configuring a Static Binding

By default, legal users passing IP Source Guard check are all from the binding database of DHCP Snooping.
Bound users can be added using the ip source binding command.

Specifying an Excluded VLAN

By default, IP Source Guard is effective to all the VLANs under a port.
Excluded VLANs may be specified which are exempted from IP Source Guard using the ip verify source exclude-vlan
command.
Excluded VLANs can be specified only after IP Source Guard is enabled on a port. Specified excluded VLANs will bedeleted automatically when IP Source Guard is disabled on a port.
The above-mentioned port can be a wired switching port, a layer-2 AP port or a layer-2 encapsulation sub-interface.

14.4 Configuration
Configuration
Configuring IP Source
Guard

Description and Command(Mandatory) It is used to enable IP Source Guard.
Enables IP Source Guard on a port.

ip verify source

14-3Configuration Guide

Configuring IP Source Guard(beta)
Configures a static binding.

ip source binding
Ip verify source exclude-vlan

Specifies an excluded VLAN for IP Source
Guard.

14.4.1 Configuring IP Source Guard
Configuration EffectCheck the source IP addresses of input IP packets.

Notes


When IP Source Guard is enabled, IP packets forwarding may be affected. In general case, IP Source Guard isenabled together with DHCP Snooping.



IP Source Guard cannot be configured on the trusted ports controlled by DHCP Snooping.



IP Source Guard cannot be configured on the global IP+MAC exclusive ports.

IP Source Guard can be configured and enabled only on wired switch ports, Layer-2 AP ports and Layer-2
encapsulation sub-ports. In a wired access scenario, it is supposed to be configured in the interface configuration
mode.

Configuration Steps

Enable DHCP Snooping.

Enable IP Source Guard.

Verification
Use the monitoring commands to display the address binding database of IP Source Guard.

Related Commands

Enabling IP Source Guard on a Port

CommandParameter

ip verify source [ port-security ]port-security: Enable IP-MAC based filtering.

Description
Command

Interface configuration mode

Usage Guide

Detection of users based on IP address or both IP and MAC addresses can be realized by enabling IP
Source Guard for a port.



Configuring a Static Binding

Commandip source binding mac-address vlan vlan-id ip-address { interface interface-id | ip-mac | ip-only }Parameter

mac-address: The MAC address of a static binding

Description

vlan-id: The VLAN ID of a static binding. It indicates the outer VLAN ID of a QINQ-termination user.
ip-address: The IP address of a static binding
interface-id: The Port ID (PID) of a static binding
ip-mac: IP-MAC based mode

14-4

Configuration Guide

Configuring IP Source Guard(beta)

ip-only: IP-based mode
Configuratio

Global configuration moden ModeUsage Guide

Through this command, legitimate users can pass IP Source Guard detection instead of being controlled
by DHCP.



Specifying an Exception VLAN for IP Source Guard

Command

ip verify source exclude-vlan vlan-id

Parametervlan-id: A VLAN ID exempted from IP Source Guard on a port

Description
Command

Interface configuration mode

Usage Guide

By using this command, the specified VLANs under a port where IP Source Guard function is enabled
can be exempted from check and filtering.

Configuration
Example

Enabling IP Source Guard on Port 17

ConfiguratioEnable DHCP Snooping.

n Steps

Enable IP Source Guard.

Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# ip verify source
Ruijie(config-if-GigabitEthernet 0/17)# end

Verification

Displays the address filtering table of IP Source Guard.
Ruijie# show ip verify sourceConfiguring a Static Binding

ConfiguratioEnable DHCP Snooping.

n Steps

Enable IP Source Guard.

Configure a static binding.

Ruijie# configure terminal
Ruijie(config)# ip source binding 00d0.f801.0101 vlan 1 192.168.4.243 interface gigabitethernet
0/18
Ruijie(config)# end

Verification

Displays the address filtering table of IP Source Guard.
Ruijie# show ip verify source
NO.

INTERFACE

FilterType FilterStatus

VLAN TYPE

14-5

IPADDRESSMACADDRESS

Configuration Guide

Configuring IP Source Guard(beta)

ConfiguratioEnable DHCP Snooping.

n Steps

Enable IP Source Guard.

Configure a static binding.

Ruijie# configure terminal
Ruijie(config)# ip source binding 00d0.f801.0101 vlan 1 192.168.4.243 interface gigabitethernet
0/18
Ruijie(config)# end

Verification

Displays the address filtering table of IP Source Guard.
----- ------------------------- ---------- -------------------------------------------------- ---- ------------1

GigabitEthernet 0/18

00d0.f801.0101 1
2



UNSET

Inactive-restrict-off 192.168.4.243

IP-ONLY

ActiveStaticGigabitEthernet 0/17

Deny-All

Specifying an Excluded VLAN

ConfiguratioEnable DHCP Snooping.

n Steps

Enable IP Source Guard.

Ruijie(config)# interface gigabitethernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# ip verify source
Ruijie(config-if-GigabitEthernet 0/17)# ip verify source exclude-vlan 1
Ruijie(config-if)# end

Verification

Display the configuration of excluded VLANs specified on a port.
Ruijie# show running-config

Common Errors
Enable IP Source Guard on a trusted port under DHCP Snooping.

Specify an excluded VLAN before IP Source Guard is enabled.

14.5 Monitoring
Displaying
Description
Displays the address filtering table

Commandshow ip verify source [ interface interface-id ]of IP Source Guard.
Displays the address binding

show ip source binding

database of IP Source Guard.

14-6

Configuration Guide

Configuring IP Source Guard(beta)

14-7

Configuration Guide

Configuring DoS Protection

15 Configuring DoS Protection
15.1 Overview
Denial of Service (DoS) attacks refer to attacks that cause DoS and aim to put computers or networks out of service.
DoS attacks are diversified in types and can be implemented in many ways, but have one common purpose, that is,prevent victim hosts or networks cannot receive, respond, or process external requests in time. In particular, on a layer-2(L-2) network, DoS attack packets can be spread in the entire broadcast domain. If hackers maliciously initiate DoS
attacks, some operating systems (OSs) may collapse. Ruijie products supports the following anti DoS attack functions:

Denying land attacks



Denying invalid TCP packets

Denying invalid layer-4 (L4) ports

15.2 Applications
Application
Protecting Servers Against DoS
Attacks

Description
On a campus network, configure the anti DoS attack function on the devices
connected to servers to effectively reduce the negative impacts brought by DoS
attacks to servers.

15.2.1 Protecting Servers Against DoS Attacks
As show in Figure 15-1, servers are connected to the core switch. The anti DoS attack function is configured on the coreswitch to prevent malicious DoS attacks and ensure that servers can provide services normally.
Figure 15-1

15-1

Configuration Guide

Configuring DoS Protection

Deployment
Enable the function of denying land attacks on the core switch to protect servers against land attacks.
Enable the function of denying invalid TCP packets on the core switch to protect servers against invalid TCP packets.
Enable the function of denying invalid L4 ports on the core switch to protect servers against attacks caused by invalid L4
ports.

15.3 Features
Overview
FeatureDenying Land
Attacks
Denying Invalid TCP
Packets

Description
Drop packets with the same source and destination IP addresses or the same L4 source anddestination port IDs on the device to prevent these packets from attacking OSs on the network.
Drop invalid TCP packets on the device to prevent invalid TCP packets from attacking OSs on the
network. (For details about the definition of invalid TCP packets, see "Denying Invalid TCP
Packets".

Denying Invalid L4
Ports

Drop packets with the same L4 source and destination port IDs on the device to prevent thesepackets from attacking OSs on the network.

15.3.1 Denying Land Attacks
This function protects servers against land attacks.

15-2

Configuration Guide

Configuring DoS Protection

Working Principle
In a land attack, the attacker sets the source and destination IP addresses or the L4 source and destination port IDs in a
SYN packet to the same address of the target host. Consequently, the attacked host will be trapped in an infinite loop oreven collapse when attempting to set up a TCP connection with itself.
If the function of denying land attacks is enabled, the device checks packets based on characteristics of land packets (thatis, SYN packets with the same source and destination IP addresses), and drops invalid packets.

Related Configuration

Enabling the Function of Denying Land Attacks

By default, the function of denying land attacks is disabled.
Run the ip deny land command to enable or disable the function of denying land attacks.

15.3.2 Denying Invalid TCP Packets
This function protects servers against invalid TCP packets.

Working Principle
There are several flag fields in the TCP packet header:

SYN: Connection establishment flag. The TCP SYN packet is used to set this flag to 1 to request establishment of aconnection.



ACK: Acknowledgement flag. In a TCP connection, this field must be available in every flag (except the first packet,
that is, the TCP SYN packet) as the acknowledgement of the previous packet.

FIN: Finish flag. When a host receives the TCP packet with the FIN flag, the host disconnects the TCP connection.



RST: Reset flag. When the IP protocol stack receives a TCP packet that contains a non-existent destination port, it
responds with a packet with the RST flag.

PSH: This flag notifies the protocol stack to submit TCP data to the upper-layer program for processing as soon as
possible.

In invalid TCP packets, flag fields are set improperly so that the processing resources of hosts are exhausted or even thesystem collapses. The following lists several common methods for setting flag fields in invalid TCP packets:

TCP packets with both the SYN and FIN flags

Normally, a TCP packet cannot contain both the SYN and FIN flags. In addition, RFC does not stipulate how the IP
protocol stack should process such invalid packets containing both the SYN and FIN flags. Therefore, the protocol stackof each OS may process such packets in different ways when receiving these packets. Attackers can use this feature tosend packets containing both the SYN and FIN flags to identify the OS type and initiate attacks on this OS.



TCP packets without any flag

Normally, a TCP packet contains at least one of the five flags, including SYN, FIN, ACK, RST, and PSH. The first TCP
packet (TCP SYN packet) must contain the SYN flag, and the subsequent packets contain the ACK flag. Based on suchassumptions, some protocol stack does not specify the method for processing TCP packets without any flag, andtherefore may collapse if such protocol stack receives TCP packets without any flag. Attackers use this feature to initiate
attacks on target hosts.

15-3

Configuration GuideConfiguring DoS Protection

TCP packets with the FIN flag but without the ACK flag

Normally, except the first packet (TCP SYN packet), all other packets, including the packets with the FIN flag, contain the
ACK flag. Some attackers may send TCP packets with the FIN flag but without the ACK flag to the target hosts, causing
breakdown of the target hosts.



TCP packets with the SYN flag and the source port ID set to a value between 0 and 1,023

Port IDs 0 to 1,023 are known port IDs allocated by the Internet Assigned Numbers Authority (IANA). In most systems,
these port IDs can be used only by the system (or root) processes or programs run by privileged users. These ports(0–1023) cannot be used as the source port IDs in the first TCP packets (with the SYN flag) sent by clients.
If the function of denying invalid TCP packets is enabled, the device checks packets based on characteristics of invalid
TCP packets, and drops invalid TCP packets.

Related Configuration

Enabling the Function of Denying Invalid TCP Packets

By default, the function of denying invalid TCP packets is disabled.
Run the ip deny invalid-tcp command to enable or disable the function of denying invalid TCP packets.

15.3.3 Denying Invalid L4 Ports
This function protects servers against invalid L4 ports.

Working Principle
Attackers sends packets in which the IP address of the target host is the same as the L4 port ID of the host to the hosttarget. As a result, the target host sends TCP connection setup requests to itself. Under such attacks, resources of thetarget host will soon be exhausted and the system will collapse.
If the function of denying invalid L4 ports is enabled, the device checks the L4 source port ID and destination port ID in thepackets. If they are the same, the device drops the packets.

Related Configuration

Enabling the Function of Denying Invalid L4 Ports

By default, the function of denying invalid L4 ports is disabled.
Run the ip deny invalid-l4port command to enable or disable the function of denying invalid L4 ports.

15.4 Configuration
Configuration Item
Configuring the Function of
Denying Land Attacks

Configuring the Function of

Description and Command
Optional.
Enables the function of denying land

ip deny land

attacks.

Optional.

15-4

Configuration Guide

Configuring DoS Protection

Denying Invalid TCP

Enables the function of denying invalid

ipdeny invalid-tcp

Packets

Optional.

Configuring the Function of
Denying Invalid L4 Ports

TCP packets.

Enables the function of denying invalid L4

ip deny invalid-l4port

ports.

15.4.1 Configuring the Function of Denying Land Attacks
Configuration EffectEnable the function of denying land attacks. Then, the device checks packets based on characteristics of land packets,and drops land packets.

Configuration Steps

Enabling the Function of Denying Land Attacks



Mandatory.



Perform this configuration on a device connected to a server.

Verification


Run the show ip deny land command to display the status of the function of denying land attacks.

After this function is enabled, construct a land attack packet and confirm that this packet cannot be forwarded.

Related Commands

Configuring the Function of Denying Land Attacks

Command[no] ip deny landParameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Enabling the Function of Denying Land Attacks

ConfiguratioEnable the function of denying land attacks in global configuration mode.

n StepsRuijie# configure terminal
Ruijie(config)# ip deny land
Ruijie(config)# end

15-5

Configuration Guide

Configuring DoS Protection

Run the showipdenyland command to display the status of the function of denying land attacks.

Verification

The following example shows how to display the status of the function of denying land attacks:
Ruijie# show ip deny land
DoS Protection Mode

State------------------------------------------

protect against land attack On

15.4.2 Configuring the Function of Denying Invalid TCP Packets
Configuration EffectEnable the function of denying invalid TCP packets. Then, the device checks packets based on characteristics of invalid
TCP packets, and drops invalid TCP packets.

Configuration Steps

Enables the Function of Denying Invalid TCP Packets

Mandatory.



Perform this configuration on a device connected to a server.

Verification


Run the show ip deny invalid-tcp command to display the status of the function of denying invalid TCP packets.

After this function is enabled, construct an invalid TCP packet and confirm that this packet cannot be forwarded.

Related Commands

Configuring the Function of Denying Invalid TCP Packets

Command[no] ip deny invalid-tcp

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Enabling the Function of Denying Invalid TCP Packets

ConfiguratioEnable the function of denying invalid TCP packets in global configuration mode.

n StepsRuijie# configure terminal
Ruijie(config)# ip deny invalid-tcp
Ruijie(config)# end

15-6

Configuration Guide

Verification

Configuring DoS Protection

Run the show ip deny invalid-tcp command to display the status of the function of denying invalid TCP
packets.
The following example shows how to display the status of the function of denying invalid TCP packets:
Ruijie# show ip deny invalid-tcp
DoS Protection Mode

State------------------------------------------

protect against invalid tcp attackOn

15.4.3 Configuring the Function of Denying Invalid L4 Ports
Configuration EffectEnable the function of denying invalid L4 ports. Then, the device checks the L4 source port ID and destination port ID in
the packets. If they are the same, the device drops the packets.

Configuration Steps

Enabling the Function of Denying Invalid L4 Ports

Mandatory.



Perform this configuration on a device connected to a server.

Verification


Run the show ip deny invalid-l4port command to display the status of the function of denying invalid L4 ports.

After this function is enabled, construct a packet in which the L4 source port ID is the same as the destination port ID
and confirm that this packet cannot be forwarded.

Related Commands

Configuring the Function of Denying Invalid L4 Ports

Command[no] ip deny invalid-l4port

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Enabling the Function of Denying Invalid L4 Ports

ConfiguratioEnable the function of denying invalid L4 ports in global configuration mode.

n Steps

15-7

Configuration Guide

Configuring DoS Protection

Ruijie# configure terminal
Ruijie(config)# ip deny invalid-l4port
Ruijie(config)# end

Verification

Run the show ip deny invalid-l4port command to display the status of the function of denying invalid
L4 ports.
The following example shows how to display the status of the function of denying invalid L4 ports:
Ruijie# show ip deny invalid-l4port
DoS Protection Mode

State------------------------------------------

protect against invalid l4port attackOn

15.5 Monitoring
Displaying
Description

Command

Displays the status of the function ofshow ip deny land

denying land attacks.
Displays the status of the function ofshow ip deny invalid-tcp

denying invalid TCP packets.
Displays the status of the function ofshow ip deny invalid-l4port

denying invalid L4 ports.
Displays the status of all antiDoS

show ip denyattack functions.

15-8

Configuration Guide

Configuring PPPoE Intermediate Agent(beta)

16 Configuring PPPoE Intermediate Agent(beta)
16.1 Overview
As the technology of broadband access becomes more mature, the broadband access network has witnessed great
development. Under this background, security issues have been brought to the center of public attention, because users
and devices accessing the network or the network itself are facing many threats, especially those from clients. In a
traditional Ethernet, users can not be identified, traced and located, while the identification and location of users are thebasic features and requirements in an open and manageable network for public use. PPPoE Intermediate Agent can offer
these functions toprevent the use accounts from being stolen as an APP requires users to log in with accounts.

The working process of PPPoE protocol can be divided into two different stages: PPPoE discovery and PPPoE session. In
the former stage, the protocol helps to get the MAC address of a remote server so as to build a point-to-point connection,and to establish a session ID used for communication in the session stage. In this chapter, we will briefly introduce the
PPPoE discovery stage because PPPoE Intermediate Agent is only involved in this stage.
PPPoE protocol includes four steps:
1. A host sends a PPPoE Active Discovery Initiation (PADI) packet. The client regards the broadcast address as adestination address to broadcast PADI packet in order to discover the access concentrators in layer 2 network.
Please note that the packet might be sent to several access concentrators.
2. An access concentrator responses a PPPoE Active Discovery Offer (PADO) packet. According to the source
MAC address received, the server will response the PADO packet that contains the names of the accessconcentrator and services.
3. The host sends a PPPoE Active Discovery Request (PADR) packet. With the PADO packet received, the client
selects one access concentrator based on its requested services and the information contained in the packet for
session, because it might receive several PADO packets as the PADI packet in the step 1 is sent to several
concentraotors. As the access concentrator has been selected, the client can get the MAC address of the remotepeer and send PADR packet for requesting a session with the access concentrator.
4. The selected access concentrator responses the PPPoE Active Discovery Session-confirmation (PADS) packet.
With the PADR packet received, the client establishes a session ID and sent this ID to the client via the PADS
packetfor session. As both the client and server get the session ID, the PPPoE discovery stage is over.
PPPoE Active Discovery Terminate (PADT) is a special packet of PPPoE protocol, which shares the same Ethernet
protocol number 0x8863 with the above four packets, thus can be regarded as a packet in PPPoE discovery stage.
However, this packet, mainly used to terminate a session, can be sent at any time after the PPPoE session stage starts. It
can be sent by a host or an access concentrator.
PPPoE Intermediate Agent (PPPoE IA) provides a function of identifying and locating users. Its work principle is to tag the
PADI and PADR packets sent by the host of a client with the access link of the device as the device accesses the networkin the stage of PPPoE discovery so that the server (usually refers to BRAS) can accurately identify and locate users. If theaccess device is LAN Switch, the information added to the PPPoE packets includes the MAC address of the accessswitch, slot ID, port index and VLAN ID. The realization of PPPoE IA depends on the Migration to Ethernet-based DSL
aggregation of DSL Forum Technical Report 101.

16-1

Configuration Guide

Configuring PPPoE Intermediate Agent(beta)

16.2 Applications
Application

Description
Both the host and server run PPPoE protocol and connect with each other through

PPPoE IA Scenario

Layer 2 Ethernet. The PPPoE IA is enabled on the switch directly connected to thehost.

16.2.1 PPPoE IA Scenario
Scenario
Figure 16-1

Gi 0/17

Gi 0/18

SwitchPC

Server

The figure shown above is a typical PPPoE IA application topology: the switch processes the PADI and PADR packets
sent by the PC and tags these packets with access link.

Deployment
Enable the function of PPPoE IA on the switch globally.

Enable the function of PPPoE IA on the Gi 0/1 port of the switch and configure the Gi 0/2 port connected to theserver as a trusted port.



Tag the Gi 0/1 port with customized access link.

16.3 Features
Basic Concepts
Process PADI and PADR packets sent by users and add a circuit-id and a remote-id to the packets so as to identify andlocate users.



PPPoE Packet Format

Ethernet II Frame Format
Destination Mac Address

Source MAC address

Type Field

PPPoE data

CRC

PPPoE Data
Version

Type

Code

Session ID

TLC Structure

16-2

Length

Field

TLV 1

...

TLV N

Configuration Guide

Type

Configuring PPPoE Intermediate Agent(beta)

LengthData

The meanings of above fields are as follows:
Type field of Ethernet frame (2 bytes): according to the Ethernet protocol, five packets involved in discovery stage sharethe same value of type field of 0x8863, while the value of packets in PPPoE session stage is 0x8864.
Version field of PPPoE (4 bits): indicates the current version of PPPoE protocol and configures 0x1 as its type field.
Code field of PPPoE (1 byte): indicates the types of PPPoE packets. 0x09 presents PADI packet; 0x07 presents PADO
packet; 0x19 presents PADR packet; 0x65 presents PADS packet and 0xa7 presents PADT packet.
PPPoE session ID (2 bytes): indicates a session ID.
Length field of PPPoE (2 bytes): indicates all the length of TLV and the type field of TLV (2 bites). One TLV stands for one
TGA and the type field presents TAG type. The length field of TLV in the following table indicates the length of the data
field of TAG and the data field of TLV (varying in length) indicates the transmitted data of the TAG.
Table 16-1 The Type of TAG in PPPoE
Type
0x00000x0101

Description
Refers to the end of a series of tags in the data field of PPPoE packets. But some flags are kept for
application in order to ensure version compatibility.
The name of a service. Indicates the service that can be offered by the network to users.
The name of an access concentrator. As the client receives the PADO packet responded by AC, it can

0x0102

gain the name of access concentrator from the tag contained in the packet. Based on the name, it canselect the related access concentrator.
The only tag of the host. Being similar with the identify field in the data packets of PPP, it is mainly used

0x0103to match the sending end and the receiving end, because several PPPoE data packets exist in the
broadcast network at the same time.

0x0104AC-Cookies. It is mainly used to prevent malicious DoS attack.

0x0105The identifier of vendor

0x01100x0201

Intermediate session ID. Like the data packets of DHCP, the data packets of PPPoE can also beintercepted and terminated in another AC. This field aims to maintain another connection.

The error name of a service. As the requested service name is rejected by the end, this tag
will be contained in the response packet.

0x0202The error name of an access concentrator.

0x0203

A common error.



PPPoE Request Packets

The packets sent from a PPPoE client to a PPPoE server, including PADI and PADR packets.



PPPoE Response Packets
16-3

Configuration Guide

Configuring PPPoE Intermediate Agent(beta)

The packets sent from a PPPoE server to a PPPoE client, including PADO and PADS packets.

Trusted Ports of PPPoE Intermediate Agent

The port connected to a server is configured as a trusted port and the port connected to a client as a untrusted port so as
to ensure the security and reduce the traffic generated in PPPoE IA. Trusted ports can receive the five packets of PPPoE
mentioned above, while the untrusted ports only can receive the PADI, PADR and PADT packets sent from a server to aclient. For making the server run correctly, please configure the port connected to it as a trusted port and ensure that eachaccess device has at least one trusted port.

Strip Function

PPPoE IA vendor tag is not allowed to exist in the PPPoE packets sent from a server to a client. Therefore, if thosepackets contains it, you need to strip these vendor tags and then forward these packets. Strip function must be configuredon trusted ports. If it is configured on untrusted ports, it would fail to take effect.

Port-based PPPoE Intermediate Agent

The validity of PPPoE Intermediate Agent is based on ports. By default, this function is disabled. After being globallyenabled, it can only become valid as it is enabled on ports.

Overview
FeatureDescription

PPPoE IA

Process the interactive PPPoE packets and forward legal request packets to trusted ports
only.

16.3.1 PPPoE IA
PPPoE IA provides a function of identifying and locating users.

Working Principle
The following figure shows the structure of the designation of link added to PPPoE IA, which is the main function of
PPPoE IA.
Figure 16-2 PPPoE IA Vendor-tag (four bits per line)

16-4

Configuration Guide

Configuring PPPoE Intermediate Agent(beta)

The type identifier of TLV added to PPPoE IA is 0x0105, and the TAG_LENGTH refers to the length field of a vendor tag;
0x00000DE9 refers to“ADSL Forum” IANA entry fixed with 4 bytes; 0x01 refers to the type fields followed by its lengthand value; 0x02 refers to the type fields of Agent Remote ID followed by its length and value.
Figure 16-3 Agent Circuit ID ValuePPPoE IA provides a default circuit ID value shown as Figure 16-3. The circuit ID includes five fields, including Access
Node Identifier (ANI), eth, slot ID, port index and VLAN ID. ANI with a length of less than 47 bits can be configured byusers; if it is not configured, its value will be the MAC address (6 bytes) by default and separated with its following field bya space. The field “eth” with 3 bytes is also separated with its following field by a space. Slot ID with 2 bytes is separated
with its following field by a “/” of 1 byte. Port index with 3 bytes is separated with others with a “:” of 1 byte. VLAN ID
occupies 4 bytes. All the fields mentioned here are presented in ASCII code. In addition, you can also configure a circuit
ID for each port based on your requirements. RG-S2300 series switches do not support hexadecimal fields.

RelatedConfiguration

Enabling PPPoE IA Globally

By default, this function is disabled.
Use pppoe intermediat-agent command to enable PPPoE IA on the device.
After being enabled globally, this function can be enabled on different ports.
The function must be enabled globally first, and then it can be allowed to be enabled on different ports.

Enabling PPPoE IA on Ports

By default, after being enabled globally, this function becomes valid as it is enabled on ports.

16-5

Configuration Guide

Configuring PPPoE Intermediate Agent(beta)

Use [ no ] pppoe intermediate-agent command to enable or disable PPPoE IA on ports.

Enabling PPPoE IA Trusted Ports

By default, PPPoE IA trusted ports is disabled on ports.
Use pppoe intermediate-agent trust command to enable PPPoE IA.
The PPPoE IA packets only can be forwarded as the PPPoE IA trusted ports are enabled on the ports connected to aserver.



Enabling the Strip Function of PPPoE IA Vendor Tag

By default, this function is disabled.
Use pppoe intermediate-agent vendor-tag strip command to enable this function.
This function can be enabled on the port connected to a server.

16.4 Configuration
Configuration

Description and Command(Mandatory) It is used to establish PPPoE IA.
pppoe intermediate-agent

Enable PPPoE IA.

pppoe intermediate-agent trust

Configure a port as a trusted port.

Optional.

PPPoE IApppoe intermediate-agent type tr-101

Configure the value of access node id of

circuit-id access-node-id

circuit ID added to a vendor tag.

pppoe intermediate-agent type tr-101

Configure the circuit-id of the added

circuit-id identifier-string

vendor tag.

pppoe intermediate-agent type self-definedConfigure the format of a customized

circuit-id

circuit-id.

pppoe intermediate-agent type self-definedConfigure the format of a customized

remoteid

remote-id.

pppoe intermediate-agent delimiter

pppoe intermediate-agent vendor-tag strip

Configure the separator among the fieldsof circuit-id and remote id.
Configure the vendor tag strip function ofports.

pppoe intermediate-agent circuit-id

Configure the circuit-id of a port.

pppoe intermediate-agent remote-id

Configure the remote-id of a port.

16.4.1 PPPoE IA
Configuration EffectEnable PPPoE IA.



Add identifiers to the PPPoE packets of users.

16-6

Configuration Guide

Configuring PPPoE Intermediate Agent(beta)

Notes


If you want to run pppoe intermediate-agent on the ports of switch, you must enable the function globally first,
otherwise it is invalid to enable it on ports.

Configure at least one trusted port to ensure it can be connected to the server.



Vendor tag strip function must be configured on trusted ports.

The priority order of the coverage of a circuit-id: (1) pppoe intermediate-agent circuit-id; (2)pppoe intermediate-agent
identifier-string option delimiter; (3) pppoe intermediate-agent access-node-id.

Configuration Steps

Enabling PPPoE IAMandatory

Unless otherwise specified, this feature should be configured on an access device.

Enabling PPPoE IA Trusted Ports

MandatoryConfigure the port connected to a trusted PPPoE server as a trusted port.



Configuring the Format of Circuit-id

Optional

Unless otherwise specified, this feature should be enabled globally on access devices or ports.

Configuring the Format of Remote-idOptional

Unless otherwise specified, this feature should be enable globally on an access device or a port.



Configuring Vendor Tag Strip Function on Ports

Optional Unless otherwise specified, this feature should be enabled on a trusted port.

Verification

Access devices can process PPPoE packets normally.



Clients and servers can interact with each other normally.

Related Commands

Enabling or Disabling PPPoE IA

Command[ no ] pppoe intermediate-agent

Parameter

N/A

Description
Command

Global configuration mode and interface configuration mode

Mode
Usage Guide

If you want to run pppoe intermediate-agent on the ports of a switch, you must enable it globally first,

16-7

Configuration Guide

Configuring PPPoE Intermediate Agent(beta)

otherwise it is invalid to enable this function on ports.

Enabling PPPoE IA Trusted Ports

Command[ no ] pppoe intermediate-agent trust

Parameter

N/A

Description
Command

Interface configuration mode

Mode
Usage Guide

At least one port should be configured as a trusted port that can be connected to a server to copy andforward the PPPoE packets of clients.

Adding the Value of Access Node ID

Commandpppoe intermediate-agent type tr-101 circuit-id access-node-id string

Parameter

string: The value of the access node id of circuit ID in vendor tag.

Description
Command

Global configuration mode

Mode
Usage Guide

Add the value of the access node id of the circuit ID in a vendor tag.

Configuring Circuit-id

Commandpppoe intermediate-agent type tr-101 circuit-id identifier-string string option { pv | sp | spv | sv }delimiter string

Parameter

string: Custom identifier

Descriptiondelimiter: Separators between fields

Configuratio

Global configuration moden modeUsage Guide

Add a circuit-id to a vendor tag.

Configuring a Customized Circuit-id

Commandpppoe intermediate-agent type self-defined circuit-id { id { remote-mac | switch-id { hostname |mac } } | port | string word | vlan }Parametervlan: The VLAN where PPPoE request packets exist.

Description

port: The port used to receive PPPoE request packets.
Id: The MAC address and name of an access device.

Configuratio

Global configuration moden modeUsage GuideConfigure a customized circuit-id.

Configuring a Customized Remote-id

Commandpppoe intermediate-agent type self-defined remoteid { hostname | mac | string word | vlan-mac }Parameter

mac: The MAC address of an access device.

Description

vlan-mac: The VLAN-MAC address of an access device.
hostname: The name of an access device.

16-8

Configuration Guide
Configuratio

Configuring PPPoE Intermediate Agent(beta)

Global configuration moden modeUsage GuideConfigure the format of a customized remote-id.

Configuring Separators between Fields

Commandpppoe intermediate-agent delimiter word

Parameter

word: The separators between the fields of a circuit-id and a remote-id.

Description
Configuratio

Global configuration moden modeUsage GuideConfigure separators between the fields of circuit-id and remote-id.

Configuring Vendor Tag Strip Function of Ports

Command[ no ] pppoe intermediate-agent vendor-tag strip

Parameter

N/A

Description
Configuratio

Interface configuration moden modeUsage Guide

Strip function must be configured on trusted ports. If the function is configured on a untrusted port, it
would fail to take effect.

Configuring the Circuit-id of a Port

Commandpppoe intermediate-agent circuit-id string

Parameter

N/A

Description
Configuratio

Interface configuration moden modeUsage GuideConfigure the circuit-id of a port.

Configuring the Remote-id of a Port

Commandpppoe intermediate-agent remote-id string

Parameter

N/A

Description
Configuratio

Interface configuration moden modeUsage Guide

Configure the remote-id of a port.

Configuration
ExampleThe Scenarios of PPPoE IA

Scenario
Figure 16-4

16-9

Configuration Guide

Configuring PPPoE Intermediate Agent(beta)

Gi 0/17PC

Gi 0/18

SwitchServerConfiguratioEnable PPPoE IA globally on the switch.

n StepsConfigure the GigabitEthernet 0/18 port connected to the server as a trust port, and vendor tag strip
function.

Switch

Enable PPPoE IA on the GigabitEthernet 0/17 port of VLAN 1.



Configure pppoe intermediate-agent access-node-id as abcd.

Configure the remote-id as xyz on the GigabitEthernet 0/17 port.

Ruijie(config)# pppoe intermediate-agent
Ruijie(config)# interface gigabitethernet 0/18
Ruijie(config-if-GigabitEthernet 0/18)# pppoe intermediate-agent trust
Ruijie(config-if-GigabitEthernet 0/18)# pppoe intermediate-agent vendor-tag strip
Ruijie(config-if-GigabitEthernet 0/18)# exit
Ruijie(config)# interface gigabitEthernet 0/17
Ruijie(config-if-GigabitEthernet 0/17)# pppoe intermediate-agent
Ruijie(config-if-GigabitEthernet 0/17)# pppoe intermediate-agent remote-id xyz
Ruijie(config-if-GigabitEthernet 0/17)# exit
Ruijie(config)# pppoe intermediate-agent type tr-101 circuit-id access-node-id abcd

Verification

Check the configuration of the switch.
Check whether PPPoE IA is enabled and whether its trusted ports are uplink.

Check the configuration of PPPoE IA, especially to check whether trusted ports are correct.

16-10

System Configuration
1. Configuring Command Line Interface
2. Configuring Basic Management
3. Configuring Lines
4. Configuring Time Range
5. Configuring HTTP
6. Configuring Syslog
7. Configuring ZAM
8. Configuring MONITOR

Configuration Guide

Basic Management

1 Basic Management
1.1 Overview
This document is a getting started guide to network device management. It describes how to manage, monitor, andmaintain network devices.

1.2 Applications
Application

Description

Network Device Management

A user logs in to a network device from a terminal and runs commands on acommand line interface (CLI) to manage device configurations.

1.2.1 Network Device Management
Scenario
Network device management described in this document is performed through the CLI. A user logs in to Network
Device A from a terminal and runs commands on the CLI to manage device configurations. See Figure 1-1.
Figure 1-1

1.3 Features
Basic Concepts



TFTP

Trivial File Transfer Protocol (TFTP) is a TCP/IP protocol which allows a client to transfer a file to a server or get a filefrom a server.

AAA

AAA is short for Authentication, Authorization and Accounting.
Authentication refers to the verification of user identities and the related network services.
Authorization refers to the granting of network services to users according to authentication results.

1-1

Configuration Guide

Basic Management

Accounting refers to the tracking of network service consumption by users. A billing system charges users based on
consumption records.
AAA provides effective means of network management and security protection.



RADIUS

Remote Authentication Dial In User Service (RADIUS) is the most widely used AAA protocol at present.



TelnetTelnet is a terminal emulation protocol in the TCP/IP protocol stack which provides access to a remote host through avirtual terminal connection. It is a standard protocol located at Layer 7 (application layer) of the Open System
Interconnection (OSI) model and used on the internet for remote login. Telnet sets up a connection between the local
PC and a remote host.

System Information

System information includes the system description, power-on time, hardware and software versions, control-layer
software version, and boot-layer software version.

Hardware Information

Hardware information includes the physical device information as well as slot and module information. The device
information includes the device description and slot quantity. The slot information includes the slot ID, module
description (which is empty if a slot does not have a module), and actual and maximum number of physical ports.

Overview
FeatureDescription

User Access Control

Controls the terminal access to network devices on the internet based on passwords andprivileges.

Login Authentication

Performs username-password authentication to grant access to network devices when AAA is

Controlenabled. (Authentication is performed by a dedicated server.)

Basic System

Refer to the parameters of a system, such as the clock, banner, and Console baud rate.

Parameters
Displaying

Displays the system configurations, including the configurations that the system is currently

Configurations

running and the device configurations stored in the nonvolatile random access memory (NVRAM).

Multiple-configuratio

Allows users to modify the path for saving startup configurations of the device and then Bootingcorresponding file name.

Zero Configuration

Allows automatic service delivery and configuration maintenance for remote devices after device
power-on, without requiring manual operation of network administrators.

TelnetTelnet is an application-layer protocol in the TCP/IP protocol stack. It provides the standard
governing remote login and virtual terminal communication on the internet.

RestartIntroduces system restart.

Running Batch File

Runs commands in a file.

Commands

1-2

Configuration Guide

Basic Management

1.3.1 User Access Control
User access control refers to the control of terminal access to network devices on the internet based on passwords andprivileges.

Working PrinciplePrivilege Level

16 privilege levels are defined ranging from 0 to 15 for CLI on network devices to grant users access to different
commands. Level 0 is the lowest level granting access to just a few commands, whereas level 15 is the highest level
granting access to all commands. Levels 0 and 1 are common user levels without the device configuration permission(users are not allowed to enter global configuration mode by default). Levels 2–15 are privileged user levels with thedevice configuration permission.

Password Classification

Passwords are classified into two types: password and security. The first type refers to simple encrypted passwords atlevel 15. The second type refers to secure encrypted passwords at levels 0–15. If a level is configured with both simple
and secure encrypted passwords, the simple encrypted password will not take effect. If you configure a non-15 level
simple encrypted password, a warning is displayed and the password is automatically converted into a secure
encrypted password. If you configure the same simple encrypted password and secure encrypted password at level 15,
a warning is displayed.



Password Protection

Each privilege level on a network device has a password. An increase in privilege level requires the input of the target
level password, whereas a reduction in privilege level does not require password input.
By default, only two privilege levels are password-protected, namely, level 1 (common user level) and level 15(privileged user level). Sixteen privilege levels with password protection can be assigned to the commands in eachmode to grant access to different commands.
If no password is configured for a privileged user level, access to this level does not require password input. It is
recommended that a password be configured for security purposes.

Command Authorization

Each command has its lowest execution level. A user with a privilege level lower than this level is not allowed to run thecommand. After the command is assigned a privilege level, users at this level and higher have access to the command.

RelatedConfiguration

Configuring a Simple Encrypted Password

Run the enable password command.

Configuring a Secure Encrypted Password

Run the enable secret command.

1-3

Configuration GuideBasic Management

A secure encrypted password is used to control the switching between user levels. It has the same function as asimple encrypted password but uses an enhanced password encryption algorithm. Therefore, secure encrypted
passwords are recommended out of security consideration.

Raising/Lowering a User Privilege LevelRun the enable command or the disable command to raise or lower a user privilege level respectively.

After logging in to a network device, the user can change his/her level to obtain access to commands at different
privilege levels.

To enable level increase logging, run the login privilege log command.

Enabling Line Password ProtectionLine password protection is required for remote login (such as login through Telnet).

Run the password[ 0 | 7 ] line command to configure a line password, and then run the login command to enable
password protection.



By default, terminals do not support the lock command.

1.3.2 Login Authentication Control
In login authentication with AAA disabled, the password entered by a user is checked against the configured line
password. If they are consistent, the user can access the network device. In local authentication, the username andpassword entered by a user are checked against those stored in the local user database. If they are matched, the user
can access the network device with proper management permissions.
In AAA, the username and password entered by a user are authenticated by a server. If authentication is successful,the user can access the network device and enjoy certain management permissions.
For example, a RADIUS server can be used to authenticate usernames and passwords and control users' management
permissions on network devices. Network devices no longer store users' passwords, but send encrypted user
information to the RADIUS server, including usernames, passwords, shared passwords, and access policies. This
provides a convenient way to manage and control user access and improve user information security.

Working PrincipleLine Password

If AAA is disabled, you can configure a line password used to verify user identities during login. After AAA is enabled,
line password verification does not take effect.



Local Authentication

If AAA is disabled, you can configure local authentication to verify user identities and control management permissions
by using the local user database. After AAA is enabled, local authentication does not take effect.

AAA

AAA provides three independent security functions, namely, Authentication, Authorization and Accounting. A server (orthe local user database) is used to perform authentication based on the configured login authentication method list andcontrol users' management permissions. For details about AAA, see Configuring AAA.

1-4

Configuration Guide

Basic Management

RelatedConfiguration

Configuring Local User Information



Run the username command to configure the account used for local identity authentication and authorization,
including usernames, passwords, and optional authorization information.

Configuring Local Authentication for Line-Based LoginRun the login local command (in the case that AAA is disabled).



Perform this configuration on every device.

Configuring AAA Authentication for Line-Based LoginThe default authentication method is used after AAA is enabled.

Run the login authentication command to configure a login authentication method list for a line.

Perform this configuration when the local AAA authentication is required.

Configuring Non-AAA Authentication for Line-Based Login When AAA Is EnabledRun the login access non-aaa command in global configuration mode.

Perform this configuration on every device.

Configuring the Connection Timeout TimeThe default connection timeout time is 10 minutes.

Run the exec-timeout command to change the default connection timeout time. An established connection will beclosed if no output is detected during the timeout time.

Perform this configuration when you need to increase or reduce the connection timeout time.

Configuring the Session Timeout TimeThe default session timeout time is 0 minutes, indicating no timeout.

Run the session-timeout command to change the default session timeout time.

The session established to a remote host through a line will be disconnected if no output is detected during thetimeout time. Then the remote host is restored to Idle. Perform this configuration when you need to increase or
reduce the session timeout time.



Locking a Session



By default, terminals do not support the lock command.



Run the lockable command to lock the terminals connected to the current line.

To lock a session, first enable terminal lock in line configuration mode, and then run the lock command in terminal
EXEC mode to lock the terminal.

1.3.3 Basic System Parameters

System Time

1-5

Configuration Guide

Basic Management

The network device system clock records the time of events on the device. For example, the time shown in system logs
is obtained from the system clock. Time is recorded in the format of year-month-day, hour:minute:second, day of theweek.
When you use a network device for the first time, set its system clock to the current date and time manually.

Configuring a System Name and Command Prompt

You can configure a system name to identify a network device. The default system name is Ruijie. A name with morethan 32 characters will be truncated to keep only the first 32 characters. The command prompt keeps consistent withthe system name.



Banner

A banner is used to display login prompt information. There are two types of banner: Daily notification and login banner.



Daily notification is displayed on all terminals connected to network devices soon after login. Urgent messages(such as immediate system shutdown) can be delivered to users through daily notification.



A login banner appears after daily notification to display login information.

Configuring the Console Baud Rate

You can manage network device through a Console port The first configuration on the network device must be
performed through the Console port. The serial port baud rate can be changed based on actual requirements. Note thatthe management terminal must have consistent baud rate setting with the device console.



Configuring the Connection Timeout Time

The connection timeout time is used to control device connections (including established connections and sessions
established to remote hosts). A connection will be closed when no input is detected during the timeout time.

RelatedConfiguration

Configuring the System Date and Clock

Run the clock set command to configure the system time of a network device manually. The device clock starts
from the configured time and keeps running even when the device is powered off.

Updating the Hardware Clock

If the hardware clock and software clock are not synchronized, run the clock update-calendar command to copy
the date and time of the software clock to the hardware clock.



Configuring a System NameRun the hostname command to change the default system name.



The default host name is Ruijie.

Configuring a Command PromptRun the prompt command.

Configuring Daily Notification

1-6

Configuration Guide

Basic Management



By default, no daily notification is configured.

Run the banner motd command to configure daily notification.



Daily notification is displayed on all terminals connected to network devices soon after login. Urgent messages(such as immediate system shutdown) can be delivered to users through daily notification.

Configuring a Login Banner

By default, no login banner is configured.

Run the banner login command to configure a login banner to display login information.

Configuring the Console Baud RateRun the speed command.

The default baud rate is 9,600 bps.

1.3.4 Displaying Configurations
Displays the system configurations, including the configurations that the system is currently running and the device
configurations stored in the NVRAM.

Working Principle

Running Configurations

Running configurations, namely, running-config, are the configurations that individual component modules run in realtime. A request can be made to all running components to collect configurations, which will be orchestrated before
being displayed to users. Only running components may provide real-time configurations, whereas unloaded
components do not display configurations. In the case that the system is started, a component process is restarted, anda hot patch is executed, the configurations collected during this period may be inaccurate due to the component
unstable state. For example, the configurations of a component may not be missing initially but can be displayed later.

Startup Configurations

The configurations stored in the NVRAM, namely, startup-config, are the configurations executed during device startup.
When the system is restarted, startup-config is loaded to become new running-config. To display permanent
configurations, the system needs to read the startup-config file in the NVRAM.

RelatedConfigurationDisplaying Running Configurations

Run the show running-config [ interface interface ] command to display the configurations that the system is currently
running or the configurations on an interface.

Displaying Startup Configurations

Run the show startup-config command.



Storing Startup Configurations

1-7

Configuration Guide

Basic Management

Run the write or copy running-config startup-config command to store the current running configurations as new
startup configurations.

1.3.5 Multiple-configuration Booting
Multiple-configuration booting allows users to modify the path for saving startup configurations of the device and thecorresponding file name. At present, configurations can be saved to an extended flash memory.

Working Principle

By default, the startup configuration file of a device is saved in Flash:/config.text and named config.text. Use
this command to modify the path for saving startup configurations of the device and the corresponding file name.
The startup configuration file name follows a slash ''/'', for example, flash:/ruijie.text.
The startup configuration file name consists of a path and a file name. The path is mandatory. Otherwise,
configurations cannot be saved by using the write command. Take Flash:/ruijie/ruijie.text as examples,
where the Flash:/ruijie folder must exist. In master-slave mode, all device paths are required.

1.3.6 Zero Configuration
The zero configuration function allows automatic service delivery and configuration maintenance for remote devices
after device power-on, without requiring manual operation of network administrators.

Working Principle
The zero configuration function involves the following process: A device with default configurations is powered on,
obtains a device management address from the DHCP server of the ACS, and sends the SNMP INFORM message to
the ACS; after receiving the SNMP INFORM message, the ACS delivers startup configurations of the device, andimmediately validates the configurations.
The zero configuration function is applicable to the ACS solution only.
The zero configuration function is applicable to standalone systems only.
With the zero configuration function, DHCP Snooping Trust is enabled only on the last two electrical ports
and all SFP ports of the device by default, regardless of whether the device supports the MGMT port.
Enabling and disabling the zero configuration function will delete the startup configuration file of the device
and trigger device restart.

1.3.7 Telnet
Working Principle
Telnet is an application-layer protocol in the TCP/IP protocol stack. It provides the standard governing remote login andvirtual terminal communication on the internet.
The Telnet Client service allows a local or remote user who has logged in to a network device to use its Telnet Client
program to access other remote system resources on the internet. In 错误!未找到引用源。, a user with a PC connects to
Network Device A by using the terminal emulation or Telnet program and then logs in to Network Device B by using thetelnet command to perform configuration management.

1-8

Configuration Guide

Basic Management

Ruijie Telnet program supports the use of IPv4 and IPv6 addresses. A Telnet server accepts Telnet connection
requests that carry IPv4 and IPv6 addresses. A Telnet client can send connection requests to hosts identified by IPv4
and IPv6 addresses.
Figure 1-2

RelatedConfiguration

Enabling the Telnet Client ServiceRun the telnet command to log in to a remote device.

Enabling the DoTelnet Client ServiceRun the do telnet command to log in to a remote device.

Restoring a Telnet Client Session

Run the <1-99> command.



Disconnecting a Suspended Telnet Client Session

Run the disconnect session-id command.

Enabling the Telnet Server ServiceRun the enable service telnet-server command.



Perform this configuration when you need to enable Telnet login.

1.3.8 Restart
The timed restart feature makes user operation easier in some scenarios (such as tests).



If you configure a time interval, the system will restart after the interval. The interval is in the format of mmm or
hhh:mm, in the unit of minutes. You can specify the interval name to reflect the restart purpose.



If you define a future time, the system will restart when the time is reached.
The clock feature must be supported by the system if you want to use the at option. It is recommended that you
configure the system clock in advance. A new restart plan will overwrite the existing one. A restart plan will be
invalid if the system is restarted before the plan takes effect.
The span between the restart time and current time must not exceed 31 days, and the restart time must be later
than the current system time. After you configure a restart plan, do not to change the system clock; otherwise, theplan may fail (for example, the system time is changed to a time after the restart time.)

1-9

Configuration Guide

Basic Management

RelatedConfiguration

Configuring RestartRun the reload command to configure a restart policy.

Perform this configuration when you need to restart a device at a specific time.

1.3.9 Running Batch File Commands
In system management, sometimes it takes a long time to enter many commands on the CLI to manage a function. This
process is prone to errors and omissions. You can put the commands to a batch file according to configuration steps
and execute the file to complete related configuration.
You can specify the name and content of the batch file on your PC and transfer the file to the device flash memory
through TFTP. The batch processing content simulates user input. Therefore, you need to edit the batch filecontent according to the CLI command configuration sequence. In addition, you need to write the responses tointeractive commands to the batch file to ensure normal command execution.
The batch file size must not exceed 128 KB; otherwise, it will fail to be executed. You can divide a large batch file
into multiple parts not larger than 128 KB each.

RelatedConfiguration

Batch-Running Commands

Run execute to run the commands in batches.

This command provides a convenient way to run multiple commands at a time.

1.4 Configuration
Configuration

Description and Command(Optional) It is used to configure passwords and command privilege levels.
enable password

Configures a simple encrypted password.

enable secret

Configures a secure encrypted password.

enableRaises a user privilege level.

Configuring Passwords andPrivileges

Configuring Login andAuthentication

Outputs log information of user privilege

login privilege log

level increase.

disableLowers a user privilege level.

privilege

Configures command privilege levels.

password

Specifies a line password.

login

Enables line password protection.

(Optional) It is used to configure different login modes and authentication methods.
configureEnters the global configuration mode

username

Configures local user account information

1-10

Configuration Guide
Configuration

Basic Management
Description and Commandand optional authorization information.
username import

Imports the user information from the file.

username export

Exports the user information to the file.
Configures local authentication forlogin local

line-based login.
Configures non-AAA authentication forlogin access non-aaa

line-based login when AAA is enabled.
Configures AAA authentication forlogin authentication

line-based login.

telnetEnables the Telnet Client service.

do telenet

Enables the DoTelnet Client service.

ip telnet source-interface
enable service telnet-server

Configures the IP address of an interface as
the source address for Telnet connection.
Enables the Telnet Server service.
Enables display of the EXEC message on a

exec-banner

specific line

exec-timeout

Configures the connection timeout time.

session-timeout

Configures the session timeout time.

lockable

Enables line-based terminal lock.
Locks a terminal connected to the current

lock

line.
(Optional) It is used to configure basic system parameters.

clock set

Configures the system date and clock.

clock update-calendar

Updates the hardware clock.

hostname

Configures a system name.

promptConfigures a command prompt.

banner motd

Configures daily notification.

banner login

Configures a login banner.

Configuring Basic System
Parameters

Configures a message to welcome the user

banner exec

entering user EXEC mode.
Configures a prompt message for reverse

banner incoming

Telnet session.
Configures the prompt-timeout message tobanner prompt-timeout

notify timeout.
Configures the slip-ppp message for thebanner slip-ppp

SLIP/PPP session.
Configures the Console baud rate.

speed
Enabling and Disabling aSpecific Service
Configuring a Restart Policy(Optional) It is used to enable and disable a specific service.
Enables a service.

enable service(Optional) It is used to configure a system restart policy.

1-11Configuration Guide
Configuration

Basic Management
Description and Command
Restarts a device.

reloadRunning Batch File
Commands(Optional) It is used to run the commands in batches.
execute { [ flash: ] filename }Runs the commands in batches.

1.4.1 Configuring Passwords and Privileges
Configuration EffectConfigure passwords to control users' access to network devices.



Assign a privilege level to a command to grant the command access to only the users at or higher than the level.

Lower the command privilege level to grant more users access to the command.



Raise the command privilege level to limit the command access to a few users.

Notes


You can use the password configuration command with the level option to configure a password for a specificprivilege level. After you specify the level and the password, the password works for the users who need to accessthis level.



By default, no password is configured for any level. The default level is 15.



If you configure a simple encrypted password with a non-15 level, a warning is displayed and the password isautomatically converted into a secure encrypted password.

The system chooses the secure encrypted password over the simple encrypted password if both of them are
configured.

Configuration Steps

Configuring a Simple Encrypted Password(Optional) Perform this configuration when you need to establish simple encrypted password verification whenusers switch between different privilege levels.

Run the enable password command to configure a simple encrypted password.

Configuring a Secure Encrypted Password(Optional) Perform this configuration when you need to establish secure encrypted password verification whenusers switch between different privilege levels.

Run the enable secret command to configure a secure encrypted password.

A secure encrypted password has the same function as a simple encrypted password but uses an enhanced
password encryption algorithm. Therefore, secure encrypted passwords are recommended out of security
consideration.

Configuring Command Privilege Levels

Optional.



A command at a lower level is accessible by more users than a command at a higher level.

1-12Configuration Guide

Basic Management

Raising/Lowering a User Privilege LevelAfter logging in to a network device, the user can change his/her level to obtain access to commands at different
privilege levels.

Run the enable command or the disable command to raise or lower a user privilege level respectively.

To enable level increase logging, run the login privilege log command.

Enabling Line Password Protection

(Optional) Line password protection is required for remote login (such as login through Telnet).

Run the password [ 0 | 7 ] line command to configure a line password, and then run the login command to enablelogin authentication.
If a line password is configured but login authentication is not configured, the system does not display password
prompt.

Verification


Run the show privilege command to display the current user level.

Run the show running-config command to display the configuration.

Related Commands

Configuring a Simple Encrypted Password

Commandenable password [ level level ] { password | [ 0 | 7 ] encrypted-password }Parameterlevel: Indicates a specific user level.

Description

password: Indicates the password used to enter privileged EXEC mode.
0: Indicates that the password is entered in plaintext.
7: Indicates that the password is entered in cyphertext.
encrypted-password: Indicates the password text, which must contain case-sensitive English letters anddigits.
Leading spaces are allowed, but will be ignored. However, intermediate and trailing spaces arerecognized.

Command

Global configuration mode

Mode
Usage Guide

Currently, simple encrypted passwords can be configured with only level 15 and take effect only whenno secure encrypted password is configured.
If you configure a simple encrypted password with a non-15 level, a warning is displayed and thepassword is automatically converted into a secure encrypted password.
If the level 15 simple encrypted password and secure encrypted password are configured the same, awarning is displayed.
After configuring the Ruijie product, it is prohibited to use universal and weak passwords during normal
online operation. Password strength

Requirement: It must contain at least three types of uppercase letters, lowercase letters, numbers,

1-13

Configuration Guide

Basic Management
and special symbols, with a length of at least 8 digits.If you specify an encryption type and enter apassword in plaintext, you cannot re-enter privileged EXEC mode. An encrypted password cannot
be retrieved once lost. You have to configure a new password.

Configuring a Secure Encrypted Password

Commandenable secret [ level level ] {secret | [ 0 | 5 ] encrypted-secret }Parameterlevel: Indicates a specific user level.

Description

secret: Indicates the password used to enter privileged EXEC mode.
0 | 5: Indicates the password encryption type. 0 indicates no encryption, and 5 indicates secure
encryption.
encrypted-password: Indicates the password text.

Command

Global configuration mode

Mode
Usage GuideUse this command to configure passwords for different privilege levels.

Raising a User Privilege Level

Commandenable [ privilege-level ]Parameter

privilege-level: Indicates a specific privilege level.

Description
CommandPrivileged EXEC mode

Mode
Usage GuideAn increase in privilege level requires the input of the target level password.

Lowering a User Privilege Level

Commanddisable [ privilege-level ]Parameter

privilege-level: Indicates a specific privilege level.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

A reduction in privilege level does not require password input.
Use this command to exit Privileged EXEC mode and return to user EXEC mode. If privilege-level is
specified, the current privilege level is reduced to the specified level.
privilege-level must be lower than the current level.

Enabling Level Increase Logging

Commandlogin privilege log

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Use this command to enable logging of privilege level increase. The configuration takes effect for all
terminals.

1-14

Configuration GuideBasic Management

Configuring Command Privilege Levels

Commandprivilege mode [ all ] { level level | reset } command-string

Parameter

mode: Indicates the CLI mode of the command. For example, config indicates the global configuration

Descriptionmode, EXEC indicates the privileged command mode, and interface indicates the interface
configuration mode.
all: Changes the subcommand privilege levels of a specific command to the same level.
level level: Indicates a privilege level, ranging from 0 to 15.
reset: Restores the command privilege level to the default.
command-string: Indicates the command to be assigned a privilege level.

Command

Global configuration mode

Mode
Usage Guide

To restore a command privilege level, run the no privilege mode [ all ] level level command commandin global configuration mode.

Specifying a Line Password

Commandpassword[ 0 | 7 ] line

Parameter

0: Indicates to configure a password in plaintext.

Description

7: Indicates to configure a password in cyphertext.
line: Indicates the password string.

CommandLine configuration mode

Mode
Usage Guide

N/AEnabling Line Password Protection

Commandlogin

Parameter

N/A

Description
CommandLine configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring Command Authorization

Scenario

Assign privilege level 1 to the reload command and its subcommands and configure level 1 as the valid
level (by configuring the test password).

Configuratio

Assign privilege level 1 to the reload command and its subcommands.

n StepsRuijie# configure terminal
Ruijie(config)# privilege exec all level 1 reload
Ruijie(config)# enable secret level 1 0 Nihao123!

1-15

Configuration Guide

Basic Management

Ruijie(config)# end

Verification



Check whether the reload command and its subcommands are accessible at level 1.

Ruijie# disable 1
Ruijie> reload ?
atreload at<cr>

1.4.2 Configuring Login and Authentication
Configuration EffectEstablish line-based login identity authentication.

Run the telnet command on a network device to log in to a remote device.

Close an established connection if no output is detected during the timeout time.

Disconnect an established session connecting to a remote host and restore the host to Idle if no output is detectedduring the timeout time.



Lock a terminal to deny access. When a user enters any character on the locked terminal, the password prompt is
displayed. The terminal will be automatically unlocked if the entered password is correct.

Configuration Steps

Configuring Local User Information



Mandatory.



Run the username command to configure the account used for local identity authentication and authorization,
including usernames, passwords, and optional authorization information.



Perform this configuration on every device.

Configuring Local Authentication for Line-Based Login

Mandatory.

Configure local authentication for line-based login in the case that AAA is disabled.

Perform this configuration on every device.

Configuring AAA Authentication for Line-Based Login(Optional) Perform this configuration to configure AAA authentication for line-based login.

Configure AAA authentication for line-based login in the case that AAA is enabled.

Perform this configuration on every device.

Configuring Non-AAA Authentication for Line-Based Login When AAA Is Enabled

Optional.

Run the login access non-aaa command in global configuration mode to authenticate line-based login in
non-AAA mode in the case that AAA is enabled.

1-16

Configuration Guide

Basic Management

Perform this configuration on every device.

Enabling the Telnet Client ServiceRun the telnet command to log in to a remote device.

Enabling the DoTelnet Client ServiceRun the do telnet command to log in to a remote device.

Restoring a Telnet Client Connection

(Optional) Perform this configuration to restore the connection on a Telnet client.

Closing a Suspended Telnet Client Connection

(Optional) Perform this configuration to close the suspended connection on a Telnet client.

Enabling the Telnet Server Service

Optional.

Enable the Telnet Server service when you need to enable Telnet login.

Configuring the Connection Timeout Time

Optional.

An established connection will be closed if no output is detected during the timeout time.

Perform this configuration when you need to increase or reduce the connection timeout time.

Configuring the Session Timeout Time

Optional.

The session connecting to a remote host will be disconnected and the host be restored to Idle if no output isdetected during the timeout time.

Perform this configuration when you need to increase or reduce the session timeout time.



Locking a Session

(Optional) Perform this configuration when you need to temporarily exit a session on a device.

To lock a session, first enable terminal lock in line configuration mode, and then run the lock command to lock theterminal.

Verification


Run the show running-config command to display the configuration.

In the case that AAA is disabled, after local user information and line-based local authentication are configured,
check whether users are prompted for username and password input for access to the CLI.

In the case that AAA is enabled, after local user information and local AAA authentication are configured, check
whether users are prompted for username and password input for access to the CLI.



Run the show user command to display the information about the users who have logged in to the CLI.

1-17

Configuration Guide

Basic Management

Telnet clients can connect to devices enabled with the Telnet Server service.

When a user presses Enter on a locked CLI, the user is prompted for password input. The session is unlocked
only when the entered password is the same as the configured one.



Run the show sessions command to display every established Telnet client instance.

Related Commands

Entering Global Configuration Mode

Commandconfigure [ terminal ]Parameter

N/A

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring Local User Information

Commandusername name [ login mode { aux | console | ssh | telnet } ] [ online amount number ] [ permission
oper-mode path ] [ privilege privilege-level ] [ reject remote-login ] [ web-auth ] [ pwd-modify ][ nopassword | password [ 0 | 7 ] text-string | secret [ 0 | 5] text-string ]Parameter

name: Indicates a user name.

Description

login mode: Indicates the login mode.
aux: Sets the login mode to AUX.
console: Sets the login mode to Console.
ssh: Sets the login mode to SSH.
telnet: Sets the login mode to Telnet.
online amount number: Indicates the maximum number of online accounts.
permission oper-mode path: Configures the file operation permission. op-mode indicates the operationmode, and path indicates the directory or path of a specific file.
privilege privilege-level: Indicates the account privilege level, ranging from 0 to 15.
reject remote-login: Rejects remote login by using the account.
web-auth: Allows only Web authentication for the account.
pwd-modify: Allows the account owner to change the password. This option is available only whenweb-auth is configured.
nopassword: Indicates that no password is configured for the account.
password [ 0 | 7 ] text-string: Indicates the password configured for the account. 0 indicates that the
password is input in plaintext, and 7 indicates that the password is input in cyphertext. The default is
plaintext.
secret [ 0 | 5 ] text-string: If the password type is 0, the password is in plain text. If the type is 5, thepassword is encrypted. The password is in plain text by default.

Command

Global configuration mode

Mode
Usage Guide

Use this command to create a local user database to be used by authentication.
If the value 7 is selected for the encryption type, the entered cyphertext string must consist of an evennumber of characters.

1-18

Configuration Guide

Basic Management

This setting is applicable to the scenario where encrypted passwords may be copied and pasted. In
other cases, the value 7 is not selected.

Importing User Information from the File

Commandusername import filename

Parameter

filename: The file name

Description
CommandPrivileged EXEC mode

Mode
Usage GuideThis command is used to import user information from the file.

Exporting User Information from the File

Commandusername export filename

Parameter

filename: The file name

Description
CommandPrivileged EXEC mode

Mode
Usage GuideThis command is used to export user information to the file.

Configuring Local Authentication for Line-Based LoginCommandlogin local

Parameter

N/A

Description
CommandLine configuration mode

Mode
Usage Guide

Use this command to configure local authentication for line-based login in the case that AAA is disabled.
Local user information is configured by using the username command.

Configuring AAA Authentication for Line-Based LoginCommandlogin authentication { default | list-name }Parameter

default: Indicates the default authentication method list name.

Description

list-name: Indicates the optional method list name.

CommandLine configuration mode

Mode
Usage Guide

Use this command to configure AAA authentication for line-based login in the case that AAA is enabled.
The AAA authentication methods, including RADIUS authentication, local authentication, and noauthentication, are used during the authentication process.

Configuring Non-AAA Authentication for Line-Based Login When AAA Is Enabled

Commandlogin access non-aaa

Parameter

N/A

Description
Command

Global configuration mode

Mode

1-19

Configuration Guide
Usage Guide

Basic Management

Use this command when you need to perform non-AAA authentication on line-based login in the casethat AAA is enabled. The configuration takes effect for all terminals.

Enabling the Telnet Client Service

Commandtelnet host [ port ] [ /source { ip A.B.C.D | ipv6 X:X:X:X::X | interface interface-name } ]Parameter

host: Indicates the IPv4 address, IPv6 address, or host name of the Telnet server.

Description

port: Indicates the TCP port number of the Telnet server. The default value is 23.
/source: Indicates the source IP address or source port used by a Telnet client.
ip A.B.C.D: Indicates the source IPv4 address used by the Telnet client.
ipv6 X:X:X:X::X: Indicates the source IPv6 address used by the Telnet client.
interface interface-name: Indicates the source port used by the Telnet client.

CommandPrivileged EXEC mode

Mode
Usage Guide

A user can telnet to a remote device identified by an IPv4 host name, IPv6 host name, IPv4 address, orIPv6 address.

Enabling the DoTelnet Client Service

Commanddo telnet host [ port ] [ /source { ip A.B.C.D | ipv6 X:X:X:X::X | interface interface-name } ]Parameter

host: Indicates the IPv4 address, IPv6 address, or host name of the Telnet server.

Description

port: Indicates the TCP port number of the Telnet server. The default value is 23.
/source: Indicates the source IP address or source port used by a Telnet client.
ip A.B.C.D: Indicates the source IPv4 address used by the Telnet client.
ipv6 X:X:X:X::X: Indicates the source IPv6 address used by the Telnet client.
interface interface-name: Indicates the source port used by the Telnet client.

CommandPrivileged EXEC mode/configuration mode/interface configuration mode

Mode
Usage Guide

A user can telnet to a remote device identified by an IPv4 host name, IPv6 host name, IPv4 address, orIPv6 address.

Configuring the IP Address of an Interface as the Source Address for Telnet Connection

Commandip telnet source-interface interface-nameParameterinterface-name: Configures the IP address of the interface as the source address for Telnet connection

Description
Command

Global configuration mode

Mode
Usage Guide

This command is used to specify the IP address of an interface as the source address for global Telnet
connetction. When using the telnet command to log in a Telnet server, apply the global setting if nosource interface or source address is specified. Use the no ip telnet source-interface command torestore it to the default setting.



Restoring a Telnet Client Session

Command<1-99>

Parameter

N/A

Description

1-20

Configuration Guide
Command

Basic Management

User EXEC mode

Mode
Usage Guide

Use this command to restore a Telnet client session. A user can press the shortcut key Ctrl+Shift+6 X to
temporarily exit the Telnet client session that is established using the telnet command, run the <1-99>
command to restore the session, and run the show sessions command to display the session
information.

Closing a Suspended Telnet Client Connection

Commanddisconnect session-id

Parameter

session-id: Indicates the suspended Telnet client session ID.

Description
CommandUser EXEC mode

Mode
Usage GuideUse this command to close a specific Telnet client session by entering the session ID.

Enabling the Telnet Server Service

Commandenable service telnet-server

Parameter

N/A

Description
Command

Global configuration mode

Mode
Usage Guide

Use this command to enable the Telnet Server service. The IPv4 and IPv6 services are also enabled
after the command is executed.



Displaying of the EXEC Message on a Specific Line

Commandexec-banner

Parameter

N/A

Description
CommandLine configuration mode

Mode
Usage Guide

After you configure the banner exec and the banner motd commands, the EXEC and the MOTD
messages are displayed on all lines by default. If you want to disable display of the EXEC and the MOTD
messages on a specific line, configure the no form of this command on the line.

Configuring the Connection Timeout Time

Commandexec-timeout minutes [ seconds ]Parameter

minutes: Indicates the connection timeout time in the unit of minutes.

Description

seconds: Indicates the connection timeout time in the unit of seconds.

CommandLine configuration mode

Mode
Usage Guide

Use this command to configure the timeout time for the established connections on a line. A connection
will be closed when no input is detected during the timeout time.
To remove the connection timeout configuration, run the no exec-timeout command in line
configuration mode.

1-21

Configuration GuideBasic Management

Configuring the Session Timeout Time

Commandsession-timeout minutes[ output ]Parameter

minutes: Indicates the session timeout time in the unit of minutes.

Description

output: Indicates whether to add data output as a timeout criterion.

CommandLine configuration mode

Mode
Usage Guide

Use this command to configure the timeout time for the remote host sessions on a line. A session will be
disconnected when no input is detected during the timeout time.
To cancel the session timeout time, run the no session-timeout command in line configuration mode.

Enabling Line-Based Terminal Lock

Commandlockable

Parameter

N/A

Description
CommandLine configuration mode

Mode
Usage Guide

N/A

Locking a Terminal Connected to the Current Line

Commandlock

Parameter

N/A

Description
CommandLine configuration mode

Mode
Usage Guide

N/A

Configuration
Example

Establishing a Telnet Session to a Remote Network Device

Configuratio



Establish a Telnet session to a remote network device with the IP address 192.168.65.119.

n StepsEstablish a Telnet session to a remote network device with the IPv6 address 2AAA:BBBB::CCCC.



Run the telnet command in privileged EXEC mode, and run the do telnet command in privileged
EXEC mode/configuration mode/interface configuration mode.

Ruijie# telnet 192.168.65.119
Trying 192.168.65.119 ... OpenUser Access Verification
Password:
Ruijie# telnet 2AAA:BBBB::CCCC
Trying 2AAA:BBBB::CCCC ... OpenUser Access Verification

1-22

Configuration Guide

Basic Management

Password:
Ruijie(config)# do telnet 2AAA:BBBB::CCCC
Trying 2AAA:BBBB::CCCC ... OpenUser Access Verification
Password:

Verification



Check whether the Telnet sessions are established to the remote network devices.

Configuring the Connection Timeout Time

Configuratio

Set the connection timeout time to 20 minutes.

n StepsRuijie# configure terminal//Enter global configuration mode.
Ruijie# line vty 0
Ruijie(config-line)#exec-timeout 20

Verification

//Enter line configuration mode.
//Set the connection timeout time to 20 minutes.

Check whether the connection between a terminal and the local device is closed when no input isdetected during the timeout time.

Configuring the Session Timeout Time

Configuratio

Set the session timeout time to 20 minutes.

n StepsRuijie# configure terminal//Enter global configuration mode.
Ruijie(config)# line vty 0//Enter line configuration mode.

Ruijie(config-line)#session-timeout 20//Set the session timeout time to 20 minutes.

Verification



Check whether the session between a terminal and the local device is disconnected when no input
is detected during the timeout time.

1.4.3 Configuring Basic System Parameters
Configuration EffectConfigure basic system parameters.

Configuration Steps

Configuring the System Date and Clock

Mandatory.

Configure the system time of a network device manually. The device clock starts from the configured time andkeeps running even when the device is powered off.

1-23

Configuration Guide

Basic Management

The time configuration is applied only to the software clock if the network device does not provide a hardware
clock. The configuration will be invalid when the device is powered off.

Updating the Hardware Clock

Optional.

Perform this configuration when you need to copy the date and time of the software clock to the hardware clock sothat the hardware clock is synchronized with the software clock.



Configuring a System Name

(Optional) Perform this configuration to change the default system name.



Configuring a Command Prompt(Optional) Perform this configuration to change the default command prompt.

Configuring Daily Notification

(Optional) Perform this configuration when you need to display important prompts or warnings to users.



You can configure notification in one or multiple lines, which will be displayed to users after login.

Configuring a Login Banner(Optional) Perform this configuration when you need to display important messages to users upon login or logout.

Configuring the Console Baud Rate

(Optional) Perform this configuration to change the default Console baud rate.

Verification


Run the show clock command to display the system time.

Check whether a login banner is displayed after login.

Run the show version command to display the system information and version.

Related Commands

Configuring the System Date and ClockCommandclock set hh:mm:ss month day year

Parameter

hh:mm:ss: Indicates the current time, in the format of hour (24-hour format):minute:second.

Description

day: Indicates a day (1–31) of the month.
month: Indicates a month (from January to December) of the year.
year: Indicates a year, ranging from 1993 to 2035. Abbreviation is not supported.

CommandPrivileged EXEC mode

Mode
Usage Guide

Use this command to configure the system time.
If the device does not provide a hardware clock, the time configuration will be invalid when the device ispowered off.

1-24

Configuration GuideBasic Management

Updating the Hardware ClockCommandclock update-calendar

Parameter

N/A

Description
CommandPrivileged EXEC mode

Mode
Usage GuideAfter the configuration, the time of the software clock will overwrite that of the hardware clock.

Configuring a System Name

Commandhostname nameParameter

name: Indicates the system name, which must consist of printable characters and must not exceed 63

Description

bytes.

Command

Global configuration mode

Mode
Usage Guide

To restore the system name to the default, run the no hostname command in global configuration
mode.



Configuring a Command Prompt

Commandprompt string

Parameter

string: Indicates the command prompt name. A name with more than 32 characters will be truncated to

Description

keep only the first 32 characters.

CommandPrivileged EXEC mode

Mode
Usage Guide

To restore the command prompt to the default settings, run the no prompt command in global
configuration mode.

Configuring Daily Notification

Commandbanner motd c message cParameter

c: Indicates a delimiter, which can be any character, such as "&".

Description
Command

Global configuration mode

Mode
Usage Guide

A message must start and end with delimiter+carriage return respectively. Any characters following theending delimiter will be dropped. Any letter contained in the message must not be used as the delimiter.
The message must not exceed 255 bytes.

Configuring a Login Banner

Commandbanner login c message cParameter

c: Indicates a delimiter, which can be any character, such as "&".

Description
Command

Global configuration mode

Mode
Usage Guide

A message must start and end with delimiter+carriage return respectively. Any characters following the

1-25

Configuration Guide

Basic Management

ending delimiter will be dropped. Any letter contained in the message must not be used as the delimiter.
The message must not exceed 255 bytes.
To remove the login banner configuration, run the no banner login command in global configuration
mode.



Configuring a Welcome Message for Users Entering EXEC mode

Commandbanner exec c message cParameter

c: Separator of the message. Delimiters are not allowed in the message.

Description
Command

Global configuration mode

Mode
Usage Guide

This command is used to configure the welcome message. The system discards all the characters next
to the terminating symbol.
When you are logging in to the device, the MOTD message is displayed at first, and then the banner
login message. After you have logged in, the EXEC message or the incoming message is displayed. If
it’s a reverse Telnet session, the incoming message is displayed. Otherwise, the EXEC message isdisplayed.
The messages are for all lines. If you want to disable display the EXEC message on a specific line,
configure the no exec-banner command on the line.

Configuring a Prompt Message for Reverse Telnet Session

Commandbanner incoming c message cParameter

c: Separator of the message. Delimiters are not allowed in the message.

Description

Message: Contents of the message.

Command

Global configuration mode

Mode
Usage Guide

This command is used to configure a prompt message. The system discards all the characters next to
the terminating symbol.
When you are logging in to the device, the MOTD message is displayed at first, and then the banner
login message. After you have logged in, the welcome message or the prompt message is displayed. If
it’s a reverse Telnet session, the prompt message is displayed. Otherwise, the welcome message isdisplayed.

Configuring the Prompt-Timeout Message to Notify Timeout

Commandbanner prompt-timeout c message cParameter

c: Separator of the message. Delimiters are not allowed in the message.

Description

Message: Contents of the message.

Command

Global configuration mode

Mode
Usage Guide

The system discards all the characters next to the terminating symbol.
When authentication times out, the banner prompt-timeout message is displayed.

Configuring the slip-ppp Message for the SLIP/PPP Session

Commandbanner slip-ppp c message c

1-26

Configuration Guide

Basic Management

Parameter

c: Separator of the message. Delimiters are not allowed in the message.

Description

Message: Contents of the message.

Command

Global configuration mode

Mode
Usage Guide

This command is used to configure the slip-ppp message for the SLIP/PPP session. The system
discards all the characters next to the terminating symbol.
When the SLIP/PPP session is created, the slip-ppp message is displayed on the corresponding
terminal.

Configuring the Console Baud Rate

Commandspeed speed

Parameter

speed: Indicates the console baud rate, in the unit of bps. The serial port baud rate can be set to 9,600

Description

bps, 19,200 bps, 38,400 bps, 57,600 bps, or 115,200 bps. The default is 9,600 bps.

CommandLine configuration mode

Mode
Usage Guide

You can configure the asynchronous line baud rate based on requirements. The speed command isused to configure receive and transmit rates for the asynchronous line.

Configuration
Example

Configuring the System Time

ConfiguratioChange the system time to 2003-6-20, 10:10:12.

n StepsRuijie# clock set 10:10:12 6 20 2003

Verification

//Configure the system time and date.

Run the show clock command in privileged EXEC mode to display the system time.

Ruijie# show clock//Confirm that the changed system time takes effect.

clock: 2003-6-20 10:10:54

Configuring Daily Notification

Configuratio

Configure the daily notification message "Notice: system will shutdown on July 6th." with the poundkey (#) as the delimiter.

n StepsRuijie(config)# banner motd #//Starting delimiter
Enter TEXT message. End with the character '#'.
Notice: system will shutdown on July 6th.# //Ending delimiter
Ruijie(config)#

Verification



Run the show running-config command to display the configuration.

Connect to the local device through the Console, Telnet or SSH, and check whether daily
notification is displayed before the CLI appears.

1-27

Configuration Guide

Basic ManagementConfigure the daily notification message "Notice: system will shutdown on July 6th." with the pound

Configuratiokey (#) as the delimiter.

n StepsRuijie(config)# banner motd #//Starting delimiter
Enter TEXT message. End with the character '#'.
Notice: system will shutdown on July 6th.# //Ending delimiter
Ruijie(config)#

Verification



Run the show running-config command to display the configuration.

Connect to the local device through the Console, Telnet or SSH, and check whether daily
notification is displayed before the CLI appears.

C:\>telnet 192.168.65.236
Notice: system will shutdown on July 6th.
Access for authorized users only. Please enter your password.
User Access Verification
Password:

Configuring a Login Banner

Configuratio

Configure the login banner message "Access for authorized users only. Please enter yourpassword." with the pound key (#) as the delimiter.

n StepsRuijie(config)# banner login #//Starting delimiter
Enter TEXT message. End with the character '#'.
Access for authorized users only. Please enter your password.
#//Ending delimiter

Ruijie(config)#

Verification



Run the show running-config command to display the configuration.

Connect to the local device through the Console, Telnet or SSH, and check whether the loginbanner is displayed before the CLI appears.

C:\>telnet 192.168.65.236
Notice: system will shutdown on July 6th.
Access for authorized users only. Please enter your password.
User Access Verification
Password:

Configuring the Serial Port Baud Rate

Configuratio

Set the serial port baud rate to 57,600 bps.

n Steps

1-28

Configuration Guide

Basic Management

Ruijie# configure terminal//Enter global configuration mode.

Ruijie(config)# line console 0//Enter console line configuration mode.

Ruijie(config-line)# speed 57600 //Set the console baud rate to 57,600 bps.
Ruijie(config-line)# end

Verification

//Returns to privileged mode.

Run the show command to display the configuration.

Ruijie# show line console 0//Displays the console configuration.

CON

Type

speed

Overruns

* 0

CON

57600

0

Line 0, Location: "", Type: "vt100"
Length: 25 lines, Width: 80 columns
Special Chars: Escape Disconnect^^xTimeouts:

none

Activation^M

Idle EXEC

Idle Session

never

never

History is enabled, history size is 10.
Total input: 22 bytes
Total output: 115 bytes
Data overflow:

0 bytesstop rx interrupt:

0 times

Modem: READY

1.4.4 Enabling and Disabling a Specific Service
Configuration Effect

Dynamically adjust system services when the system is running, and enable and disable specific services (SNMP
Agent, SSH Server, and Telnet Server).

Configuration Steps

Enabling the SNMP Agent, SSH Server, and Telnet Server Services

(Optional) Perform this configuration when you need to use these services.

Verification


Run the show running-config command to display the configuration.

Run the show services command to display the service Enabled/Disable state.

1-29

Configuration Guide

Basic Management

Related Commands

Enabling the SSH Server, Telnet Server, Web Server, and SNMP Agent Services

Commandenable service { ssh-server | telnet-server | snmp-agent }Parameterssh-server: Enables or disables the SSH Server service. The IPv4 and IPv6 services are also enabled

Description

together with this service.
telnet-server: Enables or disables the Telnet Server service. The IPv4 and IPv6 services are alsoenabled together with this service.
web-server: Enables or disables the Web Server service. snmp-agent: Enables or disables the SNMPAgent service. The IPv4 and IPv6 services are also enabled together with this service.
Global configuration mode

CommandMode
Usage Guide

Use this command to enable and disable specific services.

Configuration
Example

Enabling the SSH Server Service

ConfiguratioEnable the SSH Server service.

n StepsRuijie# configure terminal//Enter global configuration mode.

Ruijie(config)#enable service ssh-server

Verification//Enable the SSH Server service.



Run the show running-config command to display the configuration.

Run the show ip ssh command to display the configuration and running state of the SSH Server
service.

1.4.5 Configuring a Restart Policy
Configuration EffectConfigure a restart policy to restart a device as scheduled.

Configuration Steps

Configuring Direct Restart

Run the reload command in privileged EXEC mode to restart the system immediately.

Configuring Timed Restart

reloadat

hh:mm:ss month day year

If you configure a specific time, the system will restart at the time. The time must be a time in the future. The month day
year parameter is optional. If it is not specified, the system clock time is used by default.

1-30

Configuration Guide

Basic Management

The clock feature must be supported by the system if you want to use the at option. It is recommended that you
configure the system clock in advance. A new restart plan will overwrite the existing one. A restart plan will be
invalid if the system is restarted before the plan takes effect.
The restart time must be later than the current system time. After you configure a restart plan, do not change thesystem clock; otherwise, the plan may fail (for example, the system time is changed to a time after the restart
time.)

Related Commands



Restarting a Device

Commandreload [ at { hh [ :mm [ :ss ] ] } [ month [ day [ year ] ] ] ]Parameter

at hh:mm:ss: Indicates the time when the system will restart.

Description

month: Indicates a month of the year, ranging from 1 to 12.
day: Indicates a date, ranging from 1 to 31.
year: Indicates a year, ranging from 1993 to 2035. Abbreviation is not supported.

CommandPrivileged EXEC mode

Mode
Usage Guide

Use this command to enable a device to restart at a specific time.

1.4.6 Running Batch File Commands
Configuration Effect
Run the commands in batches.

Configuration Steps

Running the execute Command

Run the execute command, with the path set to the batch file to be executed.
You can specify the name and content of the batch file on your PC and transfer the file to the device flash memory
through TFTP. The batch processing content simulates user input. Therefore, you need to edit the batch filecontent according to the CLI command configuration sequence. In addition, you need to write the responses tointeractive commands to the batch file to ensure normal command execution.
The batch file size must not exceed 128 KB; otherwise, it will fail to be executed. You can divide a large batch file
into multiple parts not larger than 128 KB each.

Related Commands
Commandexecute { [ flash: ] filename }Parameter

filename: Indicates the path for the batch file to be executed.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

Use this command to run the commands related to a function in batches.

1-31

Configuration Guide

Basic Management

1.5 Monitoring
Displaying
Description

Command

Displays the current system time.

show clock

Displays debugging state.

show debugging

Displays line configurations.
Displays system restart settings.
Displays the current running configurations of the device
or the configurations on an interface.
Displays the device configurations stored in the
NVRAM.
Displays the information of each established Telnet

show line { aux line-num | console line-num | tty line-num |vty line-num | line-num }show reload
show running-config [ interface interface ]show startup-config
show service

client instance.
Displays the information of each established Telnet

show sessions

client instance.

1-32

Configuration Guide

Configuring Lines

2 Configuring Lines
2.1 Overview
There are various types of terminal lines on network devices. You can manage terminal lines in groups based on theirtypes. Configurations on these terminal lines are called line configurations. On network devices, terminal lines areclassified into multiple types such as CTY, TTY, AUX, and VTY.

2.2 Applications
Application

Description

Accessing a Device ThroughEnter the command-line interface (CLI) of a network device through the Console.

ConsoleAccessing a Device ThroughEnter the CLI of a network device through Telnet or SSH.

Console2.2.1 Accessing a Device Through Console
Scenario
Figure 2-1

RemarkA is a network device to be managed.

s

PC is a network management station.

Deployment
The network management station connects to the Console port of a network device through a serial cable. Using theConsole software (Hyper Terminal or other terminal simulation software) on the network management station, you canaccess the Console of the network device and enter the CLI to configure and manage the network device.

2.2.2 Accessing a Device Through VTY
Scenario
Figure 2-2

2-1

Configuration Guide

Configuring Lines

RemarkA is a network device to be managed.

s

PC is a network management station.

Deployment
The network management station connects to a network device through the network. Using a VTY client (such as Putty)on the network management station, you can access the network device through Telnet or SSH and enter the CLI toconfigure and manage the network device.

2.3 Features
Basic Concepts

CTY

The CTY line refers to the line connected to the Console port. Most network devices have a Console port. You canaccess the local system through the Console port.



VTY

The VTY line is a virtual terminal line that does not correspond to any hardware. It is used for Telnet or SSH connection.

Overview
FeatureDescription

Basic Features

Configures a terminal, displays and clears terminal connection information.

2.3.1 Basic Features
RelatedConfiguration

Configuring Terminal Lines

Run the line command in global configuration mode to enter the configuration mode of a specified line.
Configure the line attributes.



Clearing Terminal Connections

When a terminal connects to the network device, the corresponding terminal line is occupied. Run the show usercommand to display the connection status of these terminal lines. If you want to disconnect the terminal from the
network device, run the clear line command to clear the terminal line. After the terminal lines are cleared, the related
connections (such as Telnet and SSH) are interrupted, the CLI exits, and the terminal lines restore to the unoccupied
status. Users can re-establish connections.

2-2

Configuration GuideConfiguring Lines

Specifying the Number of VTY Terminals

Run the line vty command to enter the VTY line configuration mode and specify the number of VTY terminals.
By default, there are 5 VTY terminals, numbered from 0 to 4. You can increase the number of VTY terminals to 36, withnew ones numbered from 5 to 35. Only new terminals can be removed.

2.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enter the line configuration mode.

Entering Line Configuration

Enters the specified line configurationline [console | vty] first-line [last-line]

mode.

Mode

Increases or reduces the number ofline vty line-number

access-class{available VTY lines.
access-list-number|

Configures Login into the Terminal

access-list-name } { in | out }Through IPv4 ACL

absolute-timeout minutes

Configures the Absolute Timeout forLine Disconnection

activation-character ascii-value

Configures the Character You Enter ata Vacant Terminal to Begin a Terminal
Sessionautocommand autocommand-string

Enables

Automatic

Command

Execution

Configuring Line Attributes

Configures the Number of Data Bits per

databits bit

CharacterforPhysicalTerminal

Connections

disconnect-character ascii-value

exec-character-bits { 7 | 8 }Configures the hot key for terminal
service disconnection
Configures the EXEC Character Width
for Physical Terminal Connections

escape-character escape-value

Configures the escape character for theline
Allows the line to enter command line

exec

interface

2-3

Configuration Guide

Configuring Lines

Configures the privilege level for theprivilege level level

line
parity { even | none | odd }Configures the Parity Bit for PhysicalTerminal Connections

start-character ascii-value

Configures the

Start

Character ofSoftware Flow Control for PhysicalTerminal Connections
ipv6 access-class access-list-name { in |Configures

login

out }

through IPv6 ACL

into

the

terminal

Enables command history for the line orconfiguring the number of commands inhistory [ size size ]the command history
Configures the screen length for thelength screen-lengthline
Configures the location description forlocation location

the linemonitorEnables log display on the terminal

refuse-message [ c message c ]Configures the login refusal message
for the line

speed speed

Configures the console baud ratewidth screen-width

Configures the screen width for the line

stop-character ascii-value

Configures

the

Stop

Character ofSoftware Flow Control for PhysicalTerminal Connections
Configures the Number of Stop Bits per

stopbits { 1 | 2 }Byte for Physical Terminal Connections
terminal-type terminal-type-string

Configures

the

Type

of

Terminal

Connected to a Line
Configures the Number of Data Bits per

terminal databits bit

Character for the Current Session
Configuring Terminal

terminal exec-character-bits { 7 | 8 }Attributes

Configures the EXEC Character Widthfor the Current Session

terminal escape-character escape-value

Configures the escape character for theterminal

2-4Configuration Guide

Configuring Lines

terminal flowcontrol { hardware | none |Configures Flow Control Mode for thesoftware

Current Session}

terminal parity { even | none | odd }Configures

theParity

Bit

of

the

Asynchronous Line for the Current
Sessionterminal start-character ascii-value

Configures the

Start

Character ofSoftware Flow Control for the Current
Sessionterminal stop-character ascii-value

Configures

the

Stop

Character ofSoftware Flow Control for the Current
Sessionterminal history [ size size ]Enablescommandhistory fortheterminal or configuring the number ofcommands in the command history
terminal length screen-length

Configures the screen length for theterminal
Configures the location description for

terminal location location

the terminal
Configures the baud rate for theterminal speed baudrateterminal
terminal width screen-width

Configures the screen width for theterminal

timeout login response seconds

Configures the authentication timeout
for the terminaltransport input { all | telnet | ssh | none }Configures the communication protocol
for the terminal

vacant-message [ c message c ]Configures the logout message for theterminal

2.4.1 Entering Line Configuration Mode
Configuration EffectEnter line configuration mode to configure other functions.

Configuration StepsEntering Line Configuration Mode

2-5

Configuration Guide

Configuring Lines

Mandatory.



Unless otherwise specified, enter line configuration mode on each device to configure line attributes.



Increasing/Reducing the Number of VTY Lines

Optional.

Run the (no) line vty line-number command to increase or reduce the number of VTY lines.

Verification
Run the show line command to display line configuration.

Related Commands

Entering Line Configuration Mode

Commandline [console | vty ] first-line [ last-line ]Parameter

console: Indicates the Console port.

Description

vty: Indicates a virtual terminal line, which supports Telnet or SSH.
first-line: Indicates the number of the first line.
last-line: Indicates the number of the last line.

Command

Global configuration mode

Mode
Usage Guide

N/A

Increasing/Reducing the Number of VTY Lines

CommandParameterline vty line-number
line-number: Indicates the number of VTY lines. The value ranges from 0 to 35.

Description
Command

Global configuration mode

Mode
Usage GuideRun the no line vty line-number command to reduce the number of available VTY lines.

Displaying Line Configuration

Commandshow line {console line-num | vty line-num | line-num }Parameter

console: Indicates the Console port.

Description

vty: Indicates a virtual terminal line, which supports Telnet or SSH.
line-num: Indicates the line to be displayed.

CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuration
Example
2-6

Configuration Guide

Configuring Lines

Scenario
Figure 2-3

ConfiguratioConnect the PC to network device A through the Console line and enter the CLI on the PC.

n Steps

Run the show user command to display the connection status of the terminal line.

Run the show line console 0 command to display the status of the Console line.

Enter global configuration mode and run the line vty command to increase the number of VTY
terminals to 36.

A

Ruijie#show user
Line

User

Host(s)

Idle

Location---------------- ------------ -------------------- ---------- -----------------*

0 con 0---idle

00:00:00

Ruijie#show line console 0

CON

Type

speed

Overruns

* 0

CON

9600

0

Line 0, Location: "", Type: "vt100"
Length: 24 lines, Width: 79 columns
Special Chars: Escape Disconnect^^xTimeouts:^D

Activation^M

Idle EXEC

Idle Session

00:10:00

neverHistory is enabled, history size is 10.
Total input: 490 bytes
Total output:

59366 bytes

Data overflow:

0 bytesstop rx interrupt:

0 timesRuijie#show line vty ?
<0-5>Line number

Ruijie#configure terminal
Enter configuration commands, one per line.

2-7

End with CNTL/Z.

---

Configuration Guide

Configuring Lines

Ruijie(config)#line vty 35
Ruijie(config-line)#*Oct 31 18:56:43: %SYS-5-CONFIG_I: Configured from console by console

VerificationA

After running the show line command, you can find that the number of terminals increases.

Run the show running-config command to display the configuration.

Ruijie#show line vty ?
<0-35>

Line number

Ruijie#show running-config

Building configuration...
Current configuration : 761 bytes

version 11.0(1C2B1)(10/16/13 04:23:54 CST -ngcf78)
ip tcp not-send-rst
vlan 1!
interface GigabitEthernet 0/1
ip address 192.168.23.164 255.255.255.0!
interface GigabitEthernet 0/2!
interface GigabitEthernet 0/3!
interface GigabitEthernet 0/4!
interface GigabitEthernet 0/5!
interface GigabitEthernet 0/6!
interface GigabitEthernet 0/7!
interface Mgmt 0

2-8

Configuration Guide

Configuring Lines!
line con 0line vty 0 35
login
!
end

2.4.2 Configuring Line Attributes
Configuration EffectConfigure line attributes in line configuration mode.

Configuration Steps

Configuring the Absolute Timeout for Line Disconnection



Optional.

Run the absolute-timeout command to ensure that a line is disconnected after the specified time.

Configuring the Character You Enter at a Vacant Terminal to Begin a Terminal Session

Optional.

Run the activation-character command in line configuration mode to configure a character to activate a terminal.

Enabling Automatic Command Execution



Optional.

Run the autocommand command in line configuration mode to enable automatic command execution on
terminals with asynchronous ports.

Configuring the Number of Data Bits per Character for Physical Terminal Connections



Optional.

Run the databits command in line configuration mode.

Configuring the EXEC Character Width for Physical Terminal Connections



Optional.

Run the exec-character-bits command in line configuration mode.

Configuring Flow Control Mode for Physical Terminal Connections



Optional.

Run the flowcontrol command in line configuration mode.

Configuring the Parity Bit for Physical Terminal Connections



Optional.

2-9Configuration Guide

Configuring Lines

Run the parity command in line configuration mode.

Configuring the Start Character of Software Flow Control for Physical Terminal Connections



Optional.

Run the start-character command in line configuration mode.

Configuring the Stop Character of Software Flow Control for Physical Terminal Connections



Optional.

Run the stop-character command in line configuration mode.

Configuring the Number of Stop Bits per Byte for Physical Terminal Connections



Optional.

Run the stopbits command in line configuration mode.

Configuring the Type of Terminal Connected to a Line

Optional.

Run the terminal-type command in line configuration mode.

Verification
Run the show line command to display line configuration.

Related Commands

Configuring Login into the Terminal Through IPv4 ACL

Commandaccess-class { access-list-number | access-list-name } { in | out }Parameteraccess-list-number: Specifies the ACL number. Standard IP ACL number is from 1 to 99 and from 1300

Description

to 1999. Extended IP ACL number is from 100 to 199 and from 2000 to 2699.
access-list-name: Specifies the ACL name.
in: Filters the incoming connections.
out: Filters the outgoing connections.

CommandLine configuration mode

Mode
Usage Guide

N/A

Configuring the Absolute Timeout for Line Disconnection

Commandabsolute-timeout minutes

Parameter

minutes: Indicates the absolute timeout of the current line in minutes. The value ranges from 0 to 60.

Description
CommandLine configuration mode

Mode
Usage Guide

Configure the absolute timeout for line disconnection. As long as the specified time expires, the line is
disconnected no matter whether you are on the operating terminal or not. Before the line is
disconnected, the system displays the remaining time after which the terminal will exit:

2-10Configuration Guide

Configuring Lines

Terminal will be login out after 20 secondConfiguring the Character You Enter at a Vacant Terminal to Begin a Terminal Session

Commandactivation-character ascii-value

Parameter

ascii-value: Indicates the ASCII value of the hotkey character for beginning a terminal session. The value

Description

ranges from 0 to 127.

CommandLine configuration mode

Mode
Usage Guide

If auto-selection is enabled for the current line, the hotkey character for beginning a terminal session
must be set to the default value.

Enabling Automatic Command Execution

Commandautocommand autocommand-string

Parameter

autocommand-string: Indicates the command line to be automatically executed.

Description
CommandLine configuration mode

Mode
Usage Guide

In most cases, after a user acts as a dumb terminal to connect to a router through an asynchronous
serial port, the user can remotely log in to the specified host through Telnet or obtain the specified
application-based terminal service with the autocommand command.

Configuring the Number of Data Bits per Character for Physical Terminal Connections

Commanddatabits bit

Parameter

bit: Indicates the number of data bits per character. The value ranges from 5 to 8.

Description
CommandLine configuration mode

Mode
Usage Guide

The asynchronous hardware (such as an asynchronous serial port and AUX port) of a router generates
seven data bits with parity in flow communication mode. If parity is being generated, specify 7 data bits
per character. If no parity is being generated, specify 8 data bits per character. Only early devices
support 5 or 6 data bits, which are seldom used.

Configuring the Hot Key for Terminal Service Disconnection

Commanddisconnect-character ascii-value

Parameter

ascii-value: ASCII decimal value of the hot key that disconnects the terminal service connection, in the

Description

range from 0 to 255.

CommandLine configuration mode

Mode
Usage Guide

This command is used to set the hot key that disconnects the terminal service connection. The hot key
cannot be the commonly used ASCII node such as characters ranging from a to z, from A to Z or
numbers ranging from 0 to 9. Otherwise, the terminal service cannot operate properly.

Configuring the EXEC Character Width for Physical Terminal Connections

2-11

Configuration Guide
Commandexec-character-bits { 7 | 8 }Parameter

7: Selects the 7-bit ASCII character set.

Description

8: Selects the 8-bit ASCII character set.

CommandLine configuration mode

Configuring Lines

Mode
Usage Guide

If you need to enter Chinese characters or display Chinese characters, images, or other international
characters in the command line, run the exec-character-bits 8 command.

Configuring the Escape Character for the Line

Commandescape-character escape-value

Parameter

escape-value: Sets the ASCII value corresponding to the escape character for the line, in the range from

Description

0 to 255.

CommandLine configuration mode

Mode
Usage Guide

Configure this command, press the key combination of the escape character and then press x, thecurrent session will be terminated and the line will return to the original session.

Allowing the Line to Enter Command Line Interface

Commandexec

Parameter

N/A

Description
CommandLine configuration mode

Mode
Usage Guide

The no exec command is used to ban the line from entering the command line interface. You have toenter the command line interface through other lines.

Configuring the Privilege Level for the Line

Commandprivilege level level

Parameterlevel: Privilege level, in the range from 0 to 15.

Description
CommandLine configuration mode

Mode
Usage Guide

N/A

Configuring the Parity Bit for Physical Terminal Connections

Commandparity { even | none | odd }Parameter

even: Indicates the even parity check.

Description

none: Indicates no parity check.
odd: Indicates the odd parity check.

CommandLine configuration mode

Mode
Usage Guide

When using certain hardware (such as an asynchronous serial port and Console port) for
communication, you are usually required to configure a parity bit.

2-12

Configuration GuideConfiguring Lines

Configuring the Start Character of Software Flow Control for Physical Terminal Connections

Commandstart-character ascii-value

Parameter

ascii-value: Indicates the ASCII value of the start character of software flow control for physical terminal

Description

connections. The value ranges from 0 to 255.

CommandLine configuration mode

Mode
Usage Guide

After software flow control is enabled, the start character for software flow control indicates the start ofdata transmission.

Configuring Login into the Terminal Through IPv6 ACL

Commandipv6 access-class access-list-name { in | out }Parameteraccess-list-name: Specifies the ACL name.

Description

in: Filters the incoming connections.
out: Filters the outgoing connections.

CommandLine configuration mode

Mode
Usage Guide

N/AEnabling Command History for the Line or Configuring the Number of Commands in the Command History

Commandhistory [ size size ]Parameter

size size: Configures number of commands, in the range from 0 to 256.

Description
CommandLine configuration mode

Mode
Usage Guide

N/A

Configuring the Screen Length for the Line

Commandlength screen-length

Parameter

screen-length: Configures the screen length, in the range from 0 to 512.

Description
CommandLine configuration mode

Mode
Usage Guide

N/A

Configuring the Location Description for the Line

Commandlocation location

Parameter

location: Line location description

Description
CommandLine configuration mode

Mode
Usage Guide

N/AEnabling Log Display on the Terminal

2-13Configuration Guide
CommandmonitorParameter

N/A

Configuring Lines

Description
CommandLine configuration mode

Mode
Usage Guide

N/A

Configuring the Login Refusal Message for the Line

Commandrefuse-message [ c message c ]Parameter

c: Delimiter of the login refusal message, which is not allowed within the message.

Description

message: Login refusal message.

CommandLine configuration mode

Mode
Usage Guide

This command is used to set the login refusal message for the line. The characters entered after theending delimiter are discarded directly, The login refusal message is displayed when the user has beenrefused to login.

Configuring the Console Baud Rate

Commandspeed speed

Parameter

speed: Indicates the console baud rate, in the unit of bps. The serial port baud rate can be set to 9,600

Description

bps, 19,200 bps, 38,400 bps, 57,600 bps, or 115,200 bps. The default is 9,600 bps.

CommandLine configuration mode

Mode
Usage Guide

You can configure the asynchronous line baud rate based on requirements. The speed command isused to configure receive and transmit rates for the asynchronous line.

Configuring the Screen Width for the Line

Commandwidth screen-widthParameter

screen-width: Configures the screen width for the line, in the range from 0 to 256.

Description
CommandLine configuration mode

Mode
Usage Guide

N/A

Configuring the Stop Character of Software Flow Control for Physical Terminal Connections

Commandstop-character ascii-value

Parameter

ascii-value: Indicates the ASCII value of the stop character of software flow control for physical terminal

Description

connections. The value ranges from 0 to 255.

CommandLine configuration mode

Mode
Usage Guide

After software flow control is enabled, the stop character for software flow control indicates the end ofdata transmission.

Configuring the Number of Stop Bits per Byte for Physical Terminal Connections

2-14

Configuration Guide

Configuring Lines

Commandstopbits { 1 | 2 }Parameter

1: Indicates one stop bit.

Description

2: Indicates two stop bits.

CommandLine configuration mode

Mode
Usage Guide

You should configure the stop bits for communication between the asynchronous line and the connected
network device (such as a conventional numb terminal and modem).

Configuring the Type of Terminal Connected to a Line

Commandterminal-type terminal-type-string

Parameter

terminal-type-string: Indicates the description of the terminal type, such as vt100 and ansi.

Description
CommandLine configuration mode

Mode
Usage Guide

You can run the terminal-type vt100 command to restore the default terminal type or run theterminal-type command to configure the type of terminal connected to a line as required. Upon Telnet
connection, one end negotiates with the other end about the terminal type based on its terminal typeconfiguration (Telnet ID: 0x18). For details, see RFC 854.

Configuration
Example

Configuring the Baud Rate, Data Bits, Parity Bits, and Stop Bits

Scenario
Figure 2-4

ConfiguratioConnect the PC to network device A through the Console line and enter the CLI on the PC.

n StepsConfigure the baud rate, data bits, parity bit, and stop bits in global configuration mode.

Run the show line console 0 command to display the status of the Console line.

A

Ruijie#configure terminal
Enter configuration commands, one per line.
Ruijie(config)#line console 0
Ruijie(config-line)#speed 115200
Ruijie(config-line)#databits 8
Ruijie(config-line)#parity even
Ruijie(config-line)#stopbits 1
Ruijie#show line console 0

CON

Type

speed

Overruns

2-15

End with CNTL/Z.

Configuration Guide

Configuring Lines

* 0

CON

1152000Line 0, Location: "", Type: "vt100"
Length: 24 lines, Width: 79 columns
Special Chars: Escape Disconnect^^xTimeouts:

Activation

none

Idle EXEC

Idle Session

00:10:00

neverHistory is enabled, history size is 10.
Total input: 636 bytes
Total output:

30498 bytes

Data overflow:

0 bytesstop rx interrupt:

0 times

Verification

A

Ruijie#show line vty ?

Run the show running-config command to display the configuration.

<0-35>

Line number

Ruijie#show running-config

Building configuration...
Current configuration: 1380 bytes

version HS2310_RGOS 11.4(1)B90, Release(10222515)!
ghn
no vectorboost enable!
cwmp
acs url http://devicereg.ruijienetworks.com/service/tr069servlet!
install 0 RG-HS2310-16GH2GT1XS!
enable service web-server httpenable service web-server httpswebmaster level 0 username admin password 7 113c2e0d13455c7341

2-16

Configuration Guide

Configuring Lines!
password policy min-size 8
password policy strong
service password-encryption!
no enable service telnet-server!
vlan 1!
interface Ghn 0/1
switchport protected!
interface Ghn 0/2
switchport protected!
interface Ghn 0/3
switchport protected!
interface Ghn 0/4
switchport protected!
interface Ghn 0/5
switchport protected!
interface Ghn 0/6
switchport protected!
interface Ghn 0/7
switchport protected!
interface Ghn 0/8
switchport protected!
interface Ghn 0/9

2-17

Configuration Guide

Configuring Lines

switchport protected!
interface Ghn 0/10
switchport protected!
interface Ghn 0/11
switchport protected!
interface Ghn 0/12
switchport protected!
interface Ghn 0/13
switchport protected!
interface Ghn 0/14
switchport protected!
interface Ghn 0/15
switchport protected!
interface Ghn 0/16
switchport protected!
interface GigabitEthernet 0/17!
interface GigabitEthernet 0/18!
interface TenGigabitEthernet 0/19!
interface VLAN 1
ip address dhcp!
line console 0
parity even

2-18

Configuration Guide

Configuring Lines

stopbits 1
speed 115200
line vty 0 35
login
!
end

2.4.3 Configuring Terminal Attributes
Configuration EffectConfigure terminal attributes in privileged EXEC mode of a terminal.

Configuration Steps

Configuring the Number of Data Bits per Character for the Current Session

Optional.

Run the terminal databits command on the terminal.

Configuring the EXEC Character Width for the Current Session

Optional.

Run the terminal exec-character-bits command on the terminal.

Configuring Flow Control Mode for the Current Session

Optional.

Run the terminal flowcontrol command on the terminal.

Configuring the Parity Bits for the Current Session

Optional.

Run the terminal parity command on the terminal.

Configuring the Start Character of Software Flow Control for the Current Session

Optional.

Run the terminal start-character command on the terminal.

Configuring the Stop Character of Software Flow Control for the Current Session

Optional.

Run the terminal stop-character command on the terminal.

Configuring the Number of Stop Bits in Each Byte for the Current Session

Optional.

Run the terminal stopbits command on the terminal.

2-19

Configuration Guide

Configuring Lines

Configuring the Type of Terminal Connected to the Current Line for the Current Session

Optional.

Run the terminal terminal-type command on the terminal.

Verification
Run the show line command to display line configuration.

Related Commands

Configuring the Number of Data Bits per Character for the Current Session

CommandParameter

terminal databits bit
bit: Indicates the number of data bits per character, ranging from 5 to 8.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the EXEC Character Width for the Current Session

Commandterminal exec-character-bits { 7 | 8 }Parameter

7: Selects the 7-bit ASCII character set.

Description

8: Selects the full 8-bit ASCII character set.

CommandPrivileged EXEC mode

Mode
Usage Guide

If you need to enter Chinese characters or display Chinese characters, images, or other international
characters in the command line, run the terminal exec-character-bits 8 command.

Configuring Flow Control Mode for the Current Session

Commandterminal flowcontrol { hardware | none | software

Parameter

hardware: Configures hardware flow control.

Description

none: Configures no flow control.

}

software: Configures software flow control.
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the Parity Bit of the Asynchronous Line for the Current Session

Commandterminal parity { even | none | odd }Parameter

even: Indicates the even parity check.

Description

none: Indicates no parity check.
odd: Indicates the odd parity check.

CommandLine configuration mode

Mode

2-20

Configuration Guide
Usage Guide

Configuring Lines

When using certain hardware (such as an asynchronous serial port and Console port) for
communication, you are usually required to configure a parity bit.



Configuring the Start Character of Software Flow Control for the Current Session

Commandterminal start-character ascii-value

Parameter

ascii-value: Indicates the ASCII value of the start character of software flow control for the current

Description

session. The value ranges from 0 to 255.

CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the Stop Character of Software Flow Control for the Current Session

Commandterminal stop-character ascii-value

Parameter

ascii-value: Indicates the ASCII value of the stop character of for the current session. The value ranges

Description

from 0 to 255.

CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the Escape Character for the Terminal

Commandterminal escape-character escape-value

Parameter

escape-value: Sets the ASCII value corresponding to the escape character for the current terminal, in

Description

the range from 0 to 255.

CommandPrivileged EXEC mode

Mode
Usage Guide

After configuring this command, press the key combination of the escape character and then press x,
the current session is disconnected to return to the original session.

Enabling Command History for the Terminal or Configuring the Number of Commands in the Command
History

Commandterminal history [ size size ]Parameter

size size: Sets the number of commands, in the range from 0 to 256.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the Screen Length for the Terminal

Commandterminal length screen-length

Parameter

screen-length: Sets the screen length, in the range from 0 to 512.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

2-21

Configuration GuideConfiguring Lines

Configuring the Location Description for the Terminal

Commandterminal location location

Parameter

location: Configures location description of the current device.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the Baud Rate for the Terminal

Commandterminal speed baudrate

Parameter

baudrate: Sets the baud rate, in the range from 9600 to 115200.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the Screen Width for the Terminal

Commandterminal width screen-widthParameter

screen-width: Sets the screen width for the terminal, in the range from 0 to 256.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the Authentication Timeout for the Terminal

Command

timeout login response seconds

Parameter

response: The time period during which the line waits for the user to enter any message.

Description

seconds: Timeout value, in the range from 1 to 300 in the unit of seconds.

CommandLine configuration mode

Mode
Usage Guide

N/A

Configuring the Communication Protocol for the Terminal

Commandtransport input { all | telnet | none }Parameter

all: Allows all the protocols under Line to be used for communication.

Description

telnet: Allows only the Telnet protocol under Line to be used for communication.
none: Allows none of protocols under line to be used for communication.

CommandLine configuration mode

Mode
Usage Guide

N/A

Configuring the Logout Message for the Terminal

Commandvacant-message [ c message c ]2-22

Configuration Guide

Configuring Lines

Parameter

c: Delimiter of the logout message, which is not allowed within the message.

Description

message: Logout message.

CommandLine configuration mode

Mode
Usage Guide

This command is used to set the logout message for the line. The characters entered after the ending
delimiter are discarded directly. The logout message is displayed when the user logs out.

Configuring the Number of Stop Bits for the Current Session

Commandterminal stopbits { 1 | 2 }Parameter

1: Indicates one stop bit.

Description

2: Indicates two stop bits.

CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuring the Type of Terminal Connected to the Current Line for the Current Session

Commandterminal terminal-type terminal-type-string

Parameter

terminal-type-string: Indicates the description of the terminal type, such as vt100 and ansi.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

N/A

Configuration
Example

Configuring the Terminal Type and Baud Rate of a Terminal

Scenario
Figure 2-5

ConfiguratioConnect the PC to network device A through the Console line and enter the CLI on the PC.

n StepsConfigure the terminal type and baud rate of the terminal in privileged EXEC mode.

A

Ruijie#terminal terminal-type ansi
Ruijie#terminal speed 115200

Verification

A

Ruijie#show line console 0

Run the show line console 0 command to display the status of the Console line.

CON

Type

speed

Overruns* 0

CON115200 0

2-23

Configuration Guide

Configuring Lines

Line 0, Location: "", Type: "ansi"
Length: 24 lines, Width: 79 columns
Special Chars: Escape Disconnect^^xTimeouts:

Activation

none

Idle EXEC

Idle Session

00:10:00

neverHistory is enabled, history size is 10.
Total input: 858 bytes
Total output:

57371 bytes

Data overflow:

0 bytesstop rx interrupt:

0 times

2.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears the line connection status.

clear line { console line-num | vty line-num | line-num }Displaying
Description

Command

Displays the line configuration.

show line { console line-num | vty line-num | line-num }Displays historical records of a line.

show history

Displays the privilege level of a line.

show privilege

Displays users on a line.

show user [ all ]2-24

Configuration Guide

Configuring Time Range

3 Configuring Time Range
3.1 Overview
Time Range is a time-based control service that provides some applications with time control. For example, you canconfigure a time range and associate it with an access control list (ACL) so that the ACL takes effect within certain time
periods of a week.

3.2 Applications
Typical Application

Scenario

Applying Time Range to an ACL

Apply a time range to an ACL module so that the time-based ACL takes effect3.2.1 Applying Time Range to an ACL
Application Scenario
An organization allows users to access the Telnet service on a remote Unix host during working hours only, as shown in
Figure 3-1.
Figure 3-1

RemarkConfigure an ACL on device B to implement the following security function:s
Hosts in network segment 192.168.12.0/24 can access the Telnet service on a remote Unix host during
normal working hours only.

Functional
Deployment

3-1

Configuration GuideConfiguring Time Range

On device B, apply an ACL to control Telnet service access of users in network segment 192.168.12.0/24.
Associate the ACL with a time range, so that the users' access to the Unix host is allowed only during working
hours.

3.3 Features
Basic Concepts

Absolute Time Range

The absolute time range is a time period between a start time and an end time. For example, [12:00 January 1 2000,
12:00 January 1 2001] is a typical absolute time range. When an application based on a time range is associated withthe time range, a certain function can be effective within this time range.

Periodic Time

Periodic time refers to a periodical interval in the time range. For example, “from 8:00 every Monday to 17:00 every
Friday” is a typical periodic time interval. When a time-based application is associated with the time range, a certain
function can be effective periodically from every Monday to Friday.

FeaturesFeatureFunction

Using Absolute Time

Sets an absolute time range for a time-based application, so that a certain function takes effectRange

within the absolute time range.

Using Periodic Time

Sets periodic time or a time-based application, so that a certain function takes effect within the
periodic time.

3.3.1 Using Absolute Time Range
Working Principle
When a time-based application enables a certain function, it determines whether current time is within the absolute time
range. If yes, the function is effective or ineffective at the current time depending on specific configuration.

3.3.2 Using Periodic Time
Working Principle
When a time-based application enables a certain function, it determines whether current time is within the period time. Ifyes, the function is effective or ineffective at the current time depending on specific configuration.

3.4 Configuration Details
Configuration

Description and Command

3-2

Configuration Guide

Configuring Time Range

Mandatory configuration. Time range configuration is required so as to use the time
range function.
time-range time-range-name

Configures a time range.

Optional configuration. You can configure various parameters as necessary.

Configuring Time Range

absolute { [start time date] | [end timedate] }
periodic day-of-the-week time to[day-of-the-week] time

Configures an absolute time range.

Configures periodic time.

3.4.1 Configuring Time Range
Configuration EffectConfigure a time range, which may be an absolute time range or a periodic time interval, so that atime-range-based application can enable a certain function within the time range.

Configuration
MethodConfiguring Time Range

Mandatory configuration.



Perform the configuration on a device to which a time range applies.



Configuring Absolute Time Range

Optional configuration.

Configuring Periodic Time

Optional configuration.

Verification


Use the show time-range [time-range-name] command to check time range configuration information.

Related Commands

Configuring Time Range

Commandtime-range time-range-nameParametertime-range-name: name of the time range to be created.

Description
Command

Global configuration mode

Mode
Usage Guide

Some applications (such as ACL) may run based on time. For example, an ACL can be effective withincertain time ranges of a week. To this end, first you must configure a time range, then you can configure
relevant time control in time range configuration mode.

3-3Configuration GuideConfiguring Time Range

Configuring Absolute Time Range

Commandabsolute { [start time date] | [end time date] }Parameter

start time date: start time of the range.

Description

end time date: end time of the range.

CommandTime range configuration mode

Mode
Usage Guide

Use the absolute command to configure a time absolute time range between a start time and an end
time to allow a certain function to take effect within the absolute time range.

Configuring Periodic Time

Command

periodic day-of-the-week time to [day-of-the-week] time

Parameter

day-of-the-week: the week day when the periodic time starts or ends

Description

time: the exact time when the periodic time starts or ends

CommandTime range configuration mode

Mode
Usage Guide

Use the periodic command to configure a periodic time interval to allow a certain function to take effectwithin the periodic time.

3.5 Monitoring
Displaying
Function

Command

Displays time range configuration.

show time-range [ time-range-name ]3-4

Configuration Guide

Configuring HTTP Service

4 Configuring HTTP Service
4.1 Overview
Hypertext Transfer Protocol (HTTP) is used to transmit Web page information on the Internet. It is at the application
layer of the TCP/IP protocol stack. The transport layer adopts connection-oriented Transmission Control Protocol(TCP).
Hypertext Transfer Protocol Secure (HTTPS) is an HTTP supporting the Secure Sockets Layer (SSL) protocol. HTTPS
is mainly used to create a secure channel on an insecure network, ensure that information can hardly be intercepted,
and provide certain reasonable protection against main-in-the-middle attacks. At present, HTTPS is widely used for
secure and sensitive communication on the Internet, for example, electronic transactions.

Protocols andStandards


RFC1945: Hypertext Transfer Protocol -- HTTP/1.0



RFC2616: Hypertext Transfer Protocol -- HTTP/1.1



RFC2818: Hypertext Transfer Protocol Over TLS -- HTTPS

4.2 Applications
Application

Description

HTTP Application Service

Users manage devices based on Web.

4.2.1 HTTP Application Service
Scenario
After the HTTP service is enabled, users can access the Web management page after passing authentication by only
entering http://IP address of a device in the browser of a PC. On the Web page, users you can monitor the device
status, configure devices, upload and download files.
Take the following figure as an example to describe Web management.

Users can remotely access devices on the Internet or configure and manage devices on the Local Area Network(LAN) by logging in to the Web server.



According to actual conditions, users can choose to enable the HTTPS or HTTP service or enable the HTTPS andHTTP services at the same time.

Users can also access the HTTP service of devices by setting and using HTTP/1.0 or HTTP/1.1 in the browser.

4-1

Configuration Guide

Configuring HTTP Service

Figure 4-1

A is a Ruijie device.
Remarks

User 1 accesses the device through the Internet.
User 2 accesses the device through a LAN.

Deployment
When a device runs HTTP, users can access the device by entering http://IP address of the device in thebrowser of a PC.

When a device runs HTTPS, users can access the device by entering https://IP address of the device in thebrowser of a PC.

4.3 Features
Basic Concepts



HTTP Service

The HTTP service refers to transmission of Web page information on the Internet by using HTTP. HTTP/1.0 is currently
an HTTP version that is the most widely used. As one Web server may receive thousands or even millions of accessrequests, HTTP/1.0 adopts the short connection mode to facilitate connection management. One TCP connection isestablished for each request. After a request is completed, the TCP connection is released. The server does not needto record or trace previous requests. Although HTTP/1.0 simplifies connection management, HTTP/1.0 introduces
performance defects.
For example, a web page my need lots of pictures. However, the web page contains not real picture contents but URL
connection addresses of the pictures. In this case, the browser sends multiple requests during access. Each request
requires establishing an independent connection and each connection is completely isolated. Establishing andreleasing connections is a relatively troublesome process, which severely affects the performance of the client andserver, as shown in the following figure:

4-2

Configuration Guide

Configuring HTTP Service

Figure 4-2

HTTP/1.1 overcomes the defect. It supports persistent connection, that is, one connection can be used to transmit
multiple requests and response messages. In this way, a client can send a second request without waiting forcompletion of the previous request. This reduces network delay and improves performance. See the following figure:
Figure 4-3

At present, Ruijie devices support both HTTP/1.0 and HTTP/1.1.
Which HTTP version will be used by a device is decided by the Web browser.



HTTPS Service

The HTTPS service adds the SSL based on the HTTP service. Its security basis is the SSL. To run HTTPS properly, a
server must have a Public Key Infrastructure (PKI) certificate while a client may not necessarily need one. The SSL
protocol provides the following services:

Authenticating users and servers and ensuring that data is sent to the correct client and server.

Encrypting data to prevent data from being stolen midway.



Maintaining data integrity and ensuring that data is not changed during transmission.

4-3

Configuration Guide

Configuring HTTP Service

Figure 4-4During a local upgrade, a device serves as an HTTP server. Users can log in to the device through a Web browser
and upload upgrade files to the device to realize file upgrade on the device.

FeaturesFeatureDescription

HTTP Service

Users log in to devices through Web pages to configure and manage devices.

Local HTTP UpgradeUpgrade files are uploaded to a device to realize file upgrade on the device.

Service

4.3.1 HTTP Service
HTTP is a service provided for Web management. Users log in to devices through Web pages to configure and manage
devices.

Working Principle
Web management covers Web clients and Web servers. Similarly, the HTTP service also adopts the client/server mode.
The HTTP client is embedded in the Web browser of the Web management client. It can send HTTP packets andreceive HTTP response packets. The Web server (namely HTTP server) is embedded in devices. The informationexchange between the client and the server is as follows:

A TCP connection is established between the client and the server. The default port ID of the HTTP service is 80
and the default port ID of the HTTPS service is 443.

The client sends a request message to the server.

The server resolves the request message sent by the client. The request content includes obtaining a Web page,
executing a CLI command, and uploading a file.

After executing the request content, the server sends a response message to the client.

RelatedConfiguration

Enabling the HTTP Service

By default, the HTTP service is disabled.

4-4

Configuration Guide

Configuring HTTP Service

The enable service web-server command can be used to enable HTTP service functions, including the HTTP service
and HTTPS service.
The HTTP service must be enabled so that users can log in to devices through Web pages to configure and manage
devices.

Configuring HTTP Authentication Information

By default, the system creates the admin account. The account cannot be deleted and only the password of theaccount can be changed. The administrator account is the admin account, which corresponds to the level 0 permission.
The administrator account owns all permissions on the Web client and can edit other management accounts andauthorize the accounts to access pages. The new accounts that are added correspond to the level 1 permission.
The webmaster level command can be used to configure an authenticated user name and a password.
After this command is run, you need to enter the configured user name and password to log in to the Web page.

Configuring an HTTP Service Port

By default, the HTTP service port ID is 80.
The http port command can be used to configure an HTTP service port ID. The value range of the port ID is 80 and1025 to 65535.
By configuring an HTTP service port ID, you can reduce the number of attacks initiated by illegal users on the HTTP
service.

Configuring an HTTPS Service Port

By default, the HTTPS service port ID is 443.
The http secure-port command can be used to configure an HTTPS service port ID. The value range of the port ID is
443 and 1025 to 65535.
By configuring an HTTPS service port ID, you can reduce the number of attacks initiated by illegal users on the HTTPS
service.

4.3.2 Local HTTP Upgrade Service
When a device serves as the HTTP server, users can log in to the device through a Web browser and upload upgrade
files (including component package and Web package) to the device or directly upload files to the device through Trivial
File Transfer Protocol (TFTP).

Working Principle

A component package or Web package is uploaded through the local upgrade function provided by Web.



After successfully receiving a file, the device checks the version for its validity.

After the file check is successful, if the file is a Web package, perform the upgrade directly; if the file is acomponent package, decide whether to perform the upgrade in the browser by restarting the device.

RelatedConfigurationUpdating a Web Package

4-5Configuration Guide

Configuring HTTP Service

Run the upgrade web download command to download a Web package from the TFTP server.
After the command is run, download a Web package from the TFTP server. After the package passes the validity check,directly use the Web package for upgrade without restarting the device.
You can also run the upgrade web command to directly upgrade a Web package stored locally.

Updating a Subsystem Component

By default, a device does not upgrade subsystem components uploaded through a browser or TFTP.
To upgrade a subsystem component, you must restart the device.

4.4 Configuration
Configuration

Description and Command(Mandatory) It is used to enable the HTTP service.
enable service web-server

Configuring the HTTP
Service

Enables the HTTP service.
Configures HTTP authentication

webmaster level

information.

http port

Configures an HTTP service port.

http secure-port

Configures an HTTPS service port.

(Mandatory) It is used to realize a local HTTP upgrade.
Configuring a Local HTTP

Upgrades a Web package stored on a

upgrade web

device.

UpgradeAutomatically downloads a Web package
from a server and automatically upgrades

upgrade web download

the package.

4.4.1 Configuring the HTTP Service
Configuration Effect
After the HTTP service is enabled on a device, users can log in to the Web management page after passing
authentication and monitor the device status, configure devices, upload and download files.

Configuration Steps

Enabling the HTTP Service



Mandatory

If there is no special requirement, enable the HTTP service on Ruijie devices. Otherwise, the Web service isinaccessible.

Configuring HTTP Authentication Information



By default, the user name admin and the password admin are configured.

4-6

Configuration GuideConfiguring HTTP Service

If there is no special requirement, you can log in to the Web page by using the default user name and directly
update authentication information through the Web browser. If you always use the default account, security risks
may exist because unauthorized personnel can obtain device configuration information once the IP address isdisclosed.



Configuring an HTTP Service Port

If an HTTP service port needs to be changed, the HTTP service port must be configured.



If there is no special requirement, the default HTTP service port 80 can be used for access.

Configuring an HTTPS Service Port

If an HTTPS service port needs to be changed, the HTTPS service port must be configured.



If there is no special requirement, the default HTTPS service port 443 can be used for access.

Verification
Enter http://IP address of the device: service port to check whether the browser skips to the authentication
page.



Enter https://IP address of the device: service port to check whether the browser skips to the authentication
page.

Related Commands

Enabling the HTTP Service

Commandenable service web-server [ http | https | all ]Parameter

http | https | all: Enables the corresponding service. http indicates enabling the HTTP service, https

Description

indicates enabling the HTTPS service, and all indicates enabling the HTTP and HTTPS services at thesame time. By default, the HTTP and HTTPS services are enabled at the same time.

Command

Global configuration mode.

Mode
Usage Guide

If no key word or all is put at the end of the command when the command is run, the HTTP and HTTPS
services are enabled at the same time. If the key word http is put at the end of the command, only the HTTP
service is enabled; if the key word https is put at the end of the command, only the HTTPS service isenabled.
The no enable service web-server or default enable service web-server command is used to disable thecorresponding HTTP service. If no key word is put at the end of the no enable service web-server ordefault enable service web-server command, the HTTP and HTTPS services are disabled.

Configuring HTTP Authentication Information.

Commandwebmaster level privilege-level username name password { password | [ 0 | 7 ] encrypted-password }Parameter

privilege-level: Permission level bound to a user.

Description

name: User name.
password: User password.
0 | 7: Password encryption type. 0: no encryption; 7: simple encryption. The default value is 0.
encrypted-password: Password text.

4-7

Configuration Guide
Command

Configuring HTTP Service

Global configuration mode.

Mode
Usage Guide

When the HTTP server is used, you need to be authenticated before logging in to the Web page. The
webmaster level command is used to configure a user name and a password for logging in to the Web
page.
Run the no webmaster level privilege-level command to delete all user names and passwords of thespecified permission level.
Run the no webmaster level privilege-level username name command to delete the specified user nameand password.
User names and passwords involve three permission levels: Up to 10 user names and passwords canbe configured for each permission level.
By default, the system creates the admin account. The account cannot be deleted and only the
password of the account can be changed. The administrator account is the admin account, whichcorresponds to the level 0 permission. The administrator account owns all permissions on the Webclient and can edit other management accounts and authorize the accounts to access pages. The new
accounts that are added correspond to the level 1 permission.

Configuring an HTTP Service Port

Commandhttp port port-number

Parameter

port-number: Configures an HTTP service port. The value range is 80 and 1025 to 65535.

Description
Command

Global configuration mode.

Mode
Usage GuideRun the command to set an HTTP service port.

Configuring an HTTPS Service Port

Commandhttp secure-port port-number

Parameter

port-number: Configures an HTTPS service port. The value range is 443 and 1025 to 65535.

Description
Command

Global configuration mode.

Mode
Usage Guide

Run the command to set an HTTPS service port.

Configuration
ExampleManaging one Ruijie Device by Using Web and Logging in to the Device through a Web Browser to
Configure Related Functions



Log in to the device by using the admin account configured by default.



To improve security, the Web browser is required to support both HTTP and HTTPS for access.



The user is required to configure an HTTP service port to reduce the number of attacks initiated by illegal users on
HTTP.

4-8

Configuration Guide

Configuring HTTP Service

Scenario
Figure 4-5

Configuration

Enable the HTTP and HTTPS services at the same time.

Steps



Set the HTTP service port ID to 8080 and the HTTPS service port ID to 4430.

A

A#configure terminalA(config)# enable service web-serverA(config)# http port 8080
A(config)# http secure-port 4430

Verification

Check HTTP configurations.

A

A# show web-server status
http server status: enabled
http server port: 8080
https server status:enabled
https server port: 4430

Common Errors


If the HTTP service port is not the default port 80 or 443, you must enter a specific configured service port in thebrowser. Otherwise, you cannot access devices on the Web client.

4.4.2 Configuring a Local HTTP Upgrade
Configuration Effect
Perform an HTTP upgrade through the browser or the upgrade web command.

Notes


So long as a Web package is uploaded successfully and passes the version check, the device directly performs an
upgrade based on the latest Web package.

The upgrade web download command is used to automatically download files from the TFTP server andautomatically perform an upgrade.



The upgrade web command is used to automatically upgrade the Web package in the local file system.

Configuration Steps
N/A

Verification

Access and view the latest Web page through the browser.

4-9Configuration Guide

Configuring HTTP Service

Related Commands



Downloading a Web Package from the TFTP Server

Command

upgrade download tftp: path

Parameter

tftp: Connects the FTFP server through a common data port and downloads a Web package.

Description

path: Path of a Web package on the TFTP server.

CommandPrivileged EXEC mode

Mode
Usage Guide

This command is used to download a Web package from the TFTP server and automatically perform an
upgrade.

Upgrading a Web Package Stored on a Local Device

Command

upgrade web uri

Parameter

uri: Local path for storing a Web package.

Description
CommandPrivileged EXEC mode

Mode
Usage Guide

This command is used to upgrade a Web package stored on a device and automatically perform an
upgrade.



Download the Web Package from the TFTP Server and Upgrade the Package Automatically.

Command

upgrade web download tftp: path

Parameter

tftp: path path indicates the storage path of the Web package on the TFTP server.

Description

tftp indicates the system downloads the Web package from the TFTP server through the physical port andupgrades the Web package automatically.

Command

Global configuration mode.

Mode
Usage Guide

N/A

Configuration
Example

Obtaining the Latest Web Package from the Official Website and Running the Web Package

Scenario
Figure 4-6

Configuration



Steps

same network segment to the device.
A

Connect to a local PC whose IP address is 10.10.10.13 and assign an IP address 10.10.10.131 in the

Log in to the device through Web and upload the latest Web package to the device.

A#configure terminalA(config)# vlan 1

4-10

Configuration Guide

Configuring HTTP Service

A(config-vlan)# exit
A(config)# interface vlan 1A(config-VLAN 1)# ip address 10.10.10.131 255.255.255.0
A(config-VLAN 1)# exit
A(config)# enable service web-server
On a PC, use the local upgrade function on the Web page to upload a Web package for upgrade.
VerificationOn the PC, log in to the device through Web again and check whether the latest Web page is displayed.

Upgrading a Web Package by Running the upgrade web download Command

Scenario
Figure 4-7

Configuration



Steps

same network segment to the device.
A

Connect to a local PC whose IP address is 10.10.10.13 and assign an IP address 10.10.10.131 in theStart the TFTP server.

A#configure terminalA(config)# vlan 1A(config-vlan)# exit
A(config)# interface vlan 1A(config-VLAN 1)# ip address 10.10.10.131 255.255.255.0
A(config-VLAN 1)# end
A#upgrade web download tftp:// 10.10.10.13/web.upd
Press Ctrl+C to quit!!!!!!!!
download 3896704 bytes
Begin to upgrade the web package...
Web package upgrade successfully.

VerificationOn the PC, log in to the device through Web again and check whether the latest Web page is displayed.

Upgrading a Web Package by Running the upgrade web Command

Scenario
Figure 4-8

Configuration



Steps

Connect to a local PC whose IP address is 10.10.10.13 and assign an IP address 10.10.10.131 in thesame network segment to the device.

Start the TFTP server.

4-11

Configuration Guide
A

Configuring HTTP Service

A#configure terminalA(config)# vlan 1A(config-vlan)# exit
A(config)# interface vlan 1A(config-VLAN 1)# ip address 10.10.10.131 255.255.255.0
A(config-VLAN 1)# end
A#copy tftp://10.10.10.13/web.upd flash:/web.upd
Press Ctrl+C to quit!!!!!!!!
Accessing tftp:// 10.10.10.13/web.upd finished, 3896704 bytes prepared
Flushing data to flash:/web.upd...
Flush data done
A #upgrade web flash:/web.upd
Web package upgrade successfully.
A #Verification

On the PC, log in to the device through Web again and check whether the latest Web page is displayed.

Common Errors
Access to the web page through the browser shows that the web page is not updated based on the latest Web
package. This is possibly because the local browser has a cache. Clear the cache of the local browser and accessthe Web page again.

4.5 Monitoring
Displaying
Description

Command

Displays the configuration and statusshow web-server statusof the Web service.

4-12Configuration Guide

Configuring Syslog

5 Configuring Syslog
5.1 Overview
Status changes (such as link up and down) or abnormal events may occur anytime. Ruijie products provide the syslog
mechanism to automatically generate messages (log packets) in fixed format upon status changes or occurrence of
events. These messages are displayed on the related windows such as the Console or monitoring terminal, recorded
on media such as the memory buffer or log files, or sent to a group of log servers on the network so that theadministrator can analyze network performance and identify faults based on these log packets. Log packets can be
added with the timestamps and sequence numbers and classified by severity level so that the administrator canconveniently read and manage log packets.

Protocols andStandards


RFC3164: The BSD syslog Protocol



RFC5424: The_Syslog_Protocol

5.2 Applications
Application

Description

Sending Syslogs to the Console

Monitor syslogs through the Console.

Sending Syslogs to the Log Server

Monitor syslogs through the server.

5.2.1 Sending Syslogs to the Console
Scenario
Send syslogs to the Console to facilitate the administrator to monitor the performance of the system. The requirements
are as follows:1.

Send logs of Level 6 or higher to the Console.

2.

Send logs of only the ARP and IP modules to the Console.

Figure 5-1 Network topology

Deployment
Configure the device as follows:1.

Set the level of logs that can be sent to the Console to informational (Level 6).

2. Set the filtering direction of logs to terminal.
5-1

Configuration Guide

Configuring Syslog

3. Set log filtering mode of logs to contains-only.
4.

Set the filtering rule of logs to single-match. The module name contains only ARP or IP.

5.2.2 Sending Syslogs to the Log Server
Scenario
Send syslogs to the log server to facilitate the administrator to monitor the logs of devices on the server. The
requirements are as follows:
1. Send syslogs to the log server 10.1.1.1.
2.

Send logs of Level 7 or higher to the log server.

3.

Send syslogs from the source interface Loopback 0 to the log server.

Figure 5-2 shows the network topology.
Figure 5-2 Network topology

Deployment
Configure the device as follows:
1. Set the IPv4 address of the server to 10.1.1.1.
2.

Set the level of logs that can be sent to the log server to debugging (Level 7).

3.

Set the source interface of logs sent to the log server to Loopback 0.

5.3 Features
Basic Concepts

Classification of Syslogs

Syslogs can be classified into two types:

Log typeDebug type

Levels of Syslogs

Eight severity levels of syslogs are defined in descending order, including emergency, alert, critical, error, warning,
notification, informational, and debugging. These levels correspond to eight numerical values from 0 to 7. A smaller
value indicates a higher level.
Only logs with a level equaling to or higher than the specified level can be output. For example, if the level of logs is set
to informational (Level 6), logs of Level 6 or higher will be output.
5-2

Configuration Guide

Configuring Syslog

The following table describes the log levels.
Level

Numerical Value

Description

emergencies

0

Indicates that the system cannot run normally.

alerts1

Indicates that the measures must be taken immediately.

critical2

Indicates a critical condition.

errors3

Indicates an error.

warnings

4

Indicates a warning.

notifications

5

Indicates a notification message that requires attention.

informational

6

Indicates an informational message.

debugging

7

Indicates a debugging message.



Output Direction of Syslogs

Output directions of syslogs include Console, monitor, server, buffer, and file. The default level and type of logs varywith the output direction. You can customize filtering rules for different output directions.
The following table describes output directions of syslogs.
Output Direction

Description

Default Output Level

Description

ConsoleConsoleDebugging (Level 7)

Logs and debugging information are output.

Monitoring

Debugging (Level 7)monitorterminal

serverLog server

buffer

Log buffer

Informational (Level 6)

Logs and debugging information are output.

Debugging (Level 7)

Logs and debugging information are output.
The log buffer is used to store syslogs.

Informational (Level 6)
file

Logs and debugging information are output.

Log file

Logs and debugging information are output.
Logs in the log buffer are periodically written
into files.



RFC3164 Log Format

Formats of syslogs may vary with the syslog output direction.



If the output direction is the Console, monitor, buffer, or file, the syslog format is as follows:

seq no: *timestamp: sysname %module-level-mnemonic: content
For example, if you exit configuration mode, the following log is displayed on the Console:001233: *May 22 09:44:36: Ruijie %SYS-5-CONFIG_I: Configured from console by console

If the output direction is the log server, the syslog format is as follows:<priority>seq no: *timestamp: sysname %module-level-mnemonic: content
For example, if you exit configuration mode, the following log is displayed on the log server:<189>001233: *May 22 09:44:36: Ruijie %SYS-5-CONFIG_I: Configured from console by console
The following describes each field in the log in details:
1.

PriorityThis field is valid only when logs are sent to the log server.

5-3

Configuration Guide

Configuring Syslog

The priority is calculated using the following formula: Facility x 8 + Level

Level indicates the numerical code of the log

level and Facility indicates the numerical code of the facility. The default facility value is local7 (23). The following tablelists the value range of the facility.
Numerical CodeFacility Keyword

Facility Description

0

kern

kernel messages

1

user

user-level messages

2

mail

mail system3daemonsystem daemons

4

auth1

security/authorization messages

5

syslogmessages generated internally by syslogs

6

lpr

line printer subsystem

7

news

network news subsystem

8

uucp

UUCP subsystem

9clock1clock daemon

10

auth2

security/authorization messages

11

ftp

FTP daemon

12

ntp

NTP subsystem

13

logauditlog audit

14

logalert

log alert

15

clock2

clock daemon

16

local0local use 0(local0)17

local1

local use 1(local1)

18

local2

local use 2(local2)

19

local3

local use 3(local3)

20

local4

local use 4(local4)

21

local5

local use 5(local5)

22

local6

local use 6(local6)

23

local7

local use 7(local7)

2.

Sequence Number

The sequence number of a syslog is a 6-digit integer, and increases sequentially. By default, the sequence number is
not displayed. You can run a command to display or hide this field.
3.

Timestamp

The timestamp records the time when a syslog is generated so that you can display and check the system event
conveniently. Ruijie devices support two syslog timestamp formats: datetime and uptime.
If the device does not have the real time clock (RTC), which is used to record the system absolute time, thedevice uses its startup time (uptime) as the syslog timestamp by default. If the device has the RTC, the device
uses its absolute time (datetime) as the syslog timestamp by default.
The two timestamp formats are described as follows:

Datetime format

The datetime format is as follows:
Mmm dd yyyy hh:mm:ss.msec

5-4

Configuration Guide

Configuring Syslog

The following table describes each parameter of the datetime.
Timestamp Parameter

Parameter Name

Description
Mmm refers to abbreviation of the current month. The 12

Mmm

Month

months in a year are written as Jan, Feb, Mar, Apr, May, Jun,
Jul, Aug, Sep, Oct, Nov, and Dec.

dd

Day

dd indicates the current date.

yyyy

Year

hh

Hour

hh indicates the current hour.

mm

Minutemm indicates the current minute.

ss

Secondss indicates the current second.

msec

Millisecond

msec indicates the current millisecond.

yyyy indicates the current year, and is not displayed bydefault.

By default, the datetime timestamp displayed in the syslog does not contain the year and millisecond. You can run acommand to display or hide the year and millisecond of the datetime timestamp.

Uptime format

The uptime format is as follows:
dd:hh:mm:ss
The timestamp string indicates the accumulated days, hours, minutes, and seconds since the system is started.
4.

SysnameThis field indicates the name of the device that generates the log so that the log server can identify the host that sends
the log. By default, this field is not displayed. You can run a command to display or hide this field.
5.

ModuleThis field indicates the name of the module that generates the log. The module name is an upper-case string of 2 to 20
characters, which contain upper-case letters, digits, or underscores. The module field is mandatory in the log-type
information, and optional in the debug-type information.
6.

Level

Eight syslog levels from 0 to 7 are defined. The level of syslogs generated by each module is fixed and cannot be
modified.
7.

Mnemonic

This field indicates the brief information about the log. The mnemonic is an upper-case string of 4 to 32 characters,
which may include upper-case letters, digits, or underscore. The mnemonic field is mandatory in the log-type
information, and optional in the debug-type information.
8.

Content

This field indicates the detailed content of the syslog.



RFC5424 Log Format

The syslog format in the output direction is as follows:<priority>version timestamp sysname MODULE LEVEL MNEMONIC [structured-data] description
For example, if you exit configuration mode, the following log is displayed on the Console:

5-5Configuration Guide

Configuring Syslog<133>1 2013-07-24T12:19:33.130290Z ruijie SYS 5 CONFIG - Configured from console by console
The following describes each field in the log in details:
1.

Priority

The priority is calculated using the following formula: Facility x 8 + Level. Level indicates the numerical code of the log
level and Facility indicates the numerical code of the facility. When the RFC5424 format is enabled, the default value ofthe facility field is local0 (16).
2.

VersionAccording to RFC5424, the version is always 1.
3.

Timestamp

The timestamp records the time when a syslog is generated so that you can display and check the system event
conveniently. Ruijie devices use the following uniformed timestamp format when the RFC5424 logging function isenabled:YYYY-MM-DDTHH:MM:SS.SECFRACZ
The following table describes each parameter of the timestamp.
Timestamp Parameter

Description

RemarkYYYY

YearYYYY indicates the current year.

MM

Month

MM indicates the current month.

DD

Day

DD indicates the current date.

T

Separator

The date must end with "T".

HH

Hour

HH indicates the current hour.

MM

MinuteMM indicates the current minute.

SS

SecondSS indicates the current second.

SECFRAC

Millisecond

SECFRAC indicates the current millisecond (1–6 digits).

Z

End mark

The time must end with "Z".

4.

SysnameThis field indicates the name of the device that generates the log so that the log server can identify the host that sends
the log.
5.

ModuleThis field indicates the name of the module that generates the log. The module name is an upper-case string of 2 to 20
characters, which contain upper-case letters, digits, or underscores. The module field is mandatory in the log-type
information, and optional in the debug-type information.
6.

Level

Eight syslog levels from 0 to 7 are defined. The level of syslogs generated by each module is fixed and cannot be
modified.
7.

Mnemonic

This field indicates the brief information about the log. The mnemonic is an upper-case string of 4 to 32 characters,
which contain upper-case letters, digits, or underscores. The Mnemonic field is mandatory in the log-type information,and optional in the debug-type information.
8.

Structured-Data

5-6

Configuration Guide

Configuring Syslog

Structured-data introduced in RFC5424 is parsed as a whole string containing parameter information. Each log may
contain 0 or multiple parameters. If a parameter is null, replace this parameter with a placeholder (-). The format of thisfield is as follows:[SD_ID@enterpriseID PARAM-NAME=PARAM-VALUE]
The following table describes each parameter of the structured-data field.
Parameter in structured-data
SD_ID

Description

Remarks

Parameter

The parameter information name is capitalized, and must

information namebe unique in a log.
"@enterpriseID" is added only to the customized parameter@

Separator

information, not to the parameter information defined in
RFC5424.
The enterprise ID is maintained by the Internet Assigned
Numbers Authority (IANA). Ruijie Networks’ enterprise ID isenterpriseID

Enterprise ID

4881. You can query the enterprise ID on the official website
of IANA.
http://www.iana.org/assignments/enterprise-numbers

PARAM-NAME

Parameter name

The parameter name is capitalized, and must be unique inthe structured-data of a log.
The parameter value must be enclosed in double quotation

PARAM-VALUE

Parameter valuemarks. Values of the IP address or MAC address must be
capitalized, and other types of values are capitalized as
required.

9.

description

This field indicates the content of the syslog.

Overview
FeatureDescription

Logging

Enable or disable the system logging functions.

Syslog Format

Configure the syslog format.

Logging Direction

Configure the parameters to send syslogs in different directions.

Syslog Filtering

Configure parameters of the syslog filtering function.

Featured Logging

Configure parameters of the featured logging function.

Syslog Monitoring

Configure parameters of the syslog monitoring function.

5.3.1 Logging
Enable or disable the logging, log redirection, and log statistics functions.

RelatedConfiguration

Enable Logging

By default, logging is enabled.

5-7Configuration Guide

Configuring Syslog

Run the logging on command to enable logging in global configuration mode. After logging is enabled, logs generated
by the system are sent in various directions for the administrator to monitor the performance of the system.

Enabling Log Redirection

By default, log redirection is enabled on the Virtual Switching Unit (VSU).
Run the logging rd on command to enable log redirection in global configuration mode. After log redirection is enabled,
logs generated by the standby device or standby supervisor module are redirected to the active device or active
supervisor module on the VSU to facilitate the administrator to manage logs.

Enabling Log Statistics

By default, log statistics is disabled.
Run the logging count command to enable log statistics in global configuration mode. After log statistics is enabled,
the system records the number of times a log is generated and the last time when the log is generated.

5.3.2 Syslog Format
Configure the syslog format, including the RFC5424 log format, timestamp format, sysname, and sequence number.

RelatedConfiguration

Enabling the RFC5424 Log Format

By default, the RFC5424 log format is disabled.
After the new format (RFC5424 log format) is enabled, the service sequence-numbers, service sysname, service
timestamps, service private-syslog, and service standard-syslog that are applicable only to the old format(RFC3164 log format) lose effect and are hidden.
After the old format (RFC3164 log format) is enabled, the logging delay-send, logging policy, and logging statisticcommands that are applicable only to the RFC5424 log format lose effect and are hidden.
After log format switchover, the outputs of the show logging and show logging config commands change
accordingly.

Configuring the Timestamp Format

By default, the syslog uses the datetime timestamp format, and the timestamp does not contain the year andmillisecond.
Run the service timestamps command in global configuration mode to use the datetime timestamp format that
contains the year and millisecond in the syslog, or change the datetime format to the uptime format.

Adding Sysname to the Syslog

By default, the syslog does not contain sysname.
Run the service sysname command in global configuration mode to add sysname to the syslog.

Adding the Sequence Number to the Syslog

By default, the syslog does not contain the sequence number.

5-8

Configuration Guide

Configuring Syslog

Run the service sequence-numbers command in global configuration mode to add the sequence number to thesyslog.



Enabling the Standard Log Format

By default, logs are displayed in the following format:*timestamp: %module-level-mnemonic: content
Run the service standard-syslog command in global configuration mode to enable the standard log format and logs
are displayed in the following format:
timestamp %module-level-mnemonic: content
Compared with the default log format, an asterisk (*) is missing in front of the timestamp, and a colon (:) is missing at
the end of the timestamp in the standard log format.

Enabling the Private Log Format

By default, logs are displayed in the following format:*timestamp: %module-level-mnemonic: content
Run the service private-syslog command in global configuration mode to enable the private log format and logs are
displayed in the following format:
timestamp module-level-mnemonic: content
Compared with the default log format, an asterisk (*) is missing in front of the timestamp, a colon (:) is missing at theend of the timestamp, and a percent sign (%) is missing at the end of the module name in the private log format.

5.3.3 Logging Direction
Configure parameters for sending syslogs in different directions, including the Console, monitor terminal, buffer, the log
server, and log files.

RelatedConfiguration

Synchronizing User Input with Log Output

By default, this function is disabled.
Run the logging synchronous command in line configuration mode to synchronize user input with log output. After thisfunction is enabled, user input will not be interrupted.

Configuring the Log Rate Limit

By default, no log rate limit is configured.
Run the logging rate-limit { number | all number | console {number | all number } } [ except [ severity ] ] command inglobal configuration mode to configure the log rate limit.

Configuring the Log Redirection Rate Limit

By default, a maximum of 200 logs are redirected from the standby device to the active device of VSU per second.

5-9

Configuration Guide

Configuring Syslog

Run the logging rd rate-limit number [ except severity ] command in global configuration mode to configure the log
redirection rate limit, that is, the maximum number of logs that are redirected from the standby device to the active
device or from the standby supervisor module to the active supervisor module per second.



Configuring the Level of Logs Sent to the Console

By default, the level of logs sent to the Console is debugging (Level 7).
Run the logging console [ level ] command in global configuration mode to configure the level of logs that can be sent
to the Console.



Sending Logs to the Monitor Terminal

By default, it is not allowed to send logs to the monitor terminal.
Run the terminal monitor command in the privileged EXEC mode to send logs to the monitor terminal.

Configuring the Level of Logs Sent to the Monitor Terminal

By default, the level of logs sent to the monitor terminal is debugging (Level 7).
Run the logging monitor [ level ] command in global configuration mode to configure the level of logs that can be sent
to the monitor terminal.



Writing Logs into the Memory Buffer

By default, logs are written into the memory buffer, and the default level of logs is debugging (Level 7).
Run the logging buffered [ buffer-size ] [ level ] command in global configuration mode to configure parameters forwriting logs into the memory buffer, including the buffer size and log level.

Sending Logs to the Log Server

By default, logs are not sent to the log server.
Run the logging server { ip-address | ipv6 ipv6-address } [ udp-port port ] command in global configuration mode tosend logs to a specified log server.

Configuring the Level of Logs Sent to the Log Server

By default, the level of logs sent to the log server is informational (Level 6).
Run the logging trap [ level ] command in global configuration mode to configure the level of logs that can be sent to
the log server.

Configuring the Facility Value of Logs Sent to the Log Server

If the RFC5424 log format is disabled, the facility value of logs sent to the log server is local7 (23) by default. If the
RFC5424 log format is enabled, the facility value of logs sent to the log server is local0 (16) by default.
Run the logging facility facility-type command in global configuration mode to configure the facility value of logs sent to
the log server.

Configuring the Source Address of Logs Sent to the Log Server

By default, the source address of logs sent to the log server is the IP address of the interface sending logs.

5-10Configuration Guide

Configuring Syslog

Run the logging source [ interface ] interface-type interface-number command to configure the source interface oflogs. If this source interface is not configured, or the IP address is not configured for this source interface, the source
address of logs is the IP address of the interface sending logs.
Run the logging source { ip ip-address | ipv6 ipv6-address } command to configure the source IP address of logs. If
this IP address is not configured on the device, the source address of logs is the IP address of the interface sending
logs.



Writing Logs into Log Files

By default, logs are not written into log files. After the function of writing logs into log files is enabled, the level of logs
written into log files is informational (Level 6) by default.
Run the logging file {flash:filename } [ max-file-size ] [ level ] command in global configuration mode to configure
parameters for writing logs into log files, including the type of device where the file is stored, file name, file size, and log
level.

Configuring the Number of Log Files

By default, the number of log files is 16.
Run the logging file numbers numbers command in global configuration mode to configure the number of log files.

Configuring the Interval at Which Logs Are Written into Log Files

By default, logs are written into log files at the interval of 3600s (one hour).
Run the logging flash interval seconds command in global configuration mode to configure the interval at which logs
are written into log files.

Configuring the Storage Time of Log Files

By default, the storage time is not configured.
Run the logging life-time level level days command in global configuration mode to configure the storage time of logs.
The administrator can specify different storage days for logs of different levels.



Immediately Writing Logs in the Buffer into Log Files

By default, syslogs are stored in the syslog buffer and then written into log files periodically or when the buffer is full.
Run the logging flash flush command in global configuration mode to immediately write logs in the buffer into log files
so that you can collect logs conveniently.

5.3.4 Syslog Filtering
By default, logs generated by the system are sent in all directions.

Working Principle

Filtering Direction

Five log filtering directions are defined:

buffer: Filters out logs sent to the log buffer, that is, logs displayed by the show logging command.



file: Filters out logs written into log files.

5-11

Configuration Guide

Configuring Syslog

server: Filters out logs sent to the log server.



terminal: Filters out logs sent to the Console and monitor terminal (including Telnet and SSH).

The four filtering directions can be used either in combinations to filter out logs sent in various directions, or separately
to filter out logs sent in a single direction.

Filtering Mode

Two filtering modes are available:

contains-only: Indicates that only logs that contain keywords specified in the filtering rules are output. You may
be interested in only a specified type of logs. In this case, you can apply the contains-only mode on the device todisplay only logs that match filtering rules on the terminal, helping you check whether any event occurs.

filter-only: Indicates that logs that contain keywords specified in the filtering rules are filtered out and will not be
output. If a module generates too many logs, spamming may occur on the terminal interface. If you do not careabout this type of logs, you can apply the filter-only mode and configure related filtering rules to filter out logs that
may cause spamming.

The two filtering modes are mutually exclusive, that is, you can configure only one filtering mode at a time.

Filter RuleTwo filtering rules are available:

exact-match: If exact-match is selected, you must select all the three filtering options (module, level, andmnemonic). If you want to filter out a specified log, use the exact-match filtering rule.



single-match: If exact-match is selected, you only need to select one of the three filtering options (module, level,
and mnemonic). If you want to filter out a specified type of logs, use the single-match filtering rule.

If the same module, level, or mnemonic is configured in both the single-match and exact-match rules, the single-match
rule prevails over the exact-match rule.

RelatedConfiguration

Configuring the Log Filtering Direction

By default, the log filtering direction is all, that is, logs sent in all directions are filtered.
Run the logging filter direction { all | buffer | file | server | terminal } command in global configuration mode toconfigure the log filtering direction to filter out logs in the specified directions.



Configuring the Log Filtering Mode

By default, the log filtering mode is filter-only.
Run the logging filter type { contains-only | filter-only } command in global configuration mode to configure the log
filtering mode.

Configuring the Log Filtering Rule

By default, no log filtering rule is configured on a device, that is, logs are not filtered out.
Run the logging filter rule exact-match module module-name mnemonic mnemonic-name level level command inglobal configuration mode to configure the exact-match rule.

5-12

Configuration Guide

Configuring Syslog

Run the logging filter rule single-match { level level | mnemonic mnemonic-name | module module-name }command in global configuration mode to configure the single-match rule.

5.3.5 Featured Logging
The featured logging functions include level-based logging, delayed logging, and periodical logging. If the RFC5424 log
format is enabled, logs can be sent in all directions, delayed logging is enabled, and periodical logging is disabled bydefault. If the RFC5424 log format is disabled, level-based logging, delayed logging, and periodical logging are
disabled.

Working PrincipleLevel-based Logging

You can use the level-based logging function to send syslogs to different destinations based on different module andseverity level. For example, you can configure commands to send WLAN module logs of Level 4 or lower to the log
server, and WLAN module logs of Level 5 or higher to local log files.

Delayed Logging

After generated, logs are not directly sent to the log server, and instead they are buffered in the log file. The device
sends the log file to the syslog server through FTP at a certain interval. This function is called delayed logging.
If the device generates too many logs, sending all logs to the server in real time may deteriorate the performance of thedevice and the syslog server, and increase the burden of the network. In this case, the delayed logging function can beused to reduce the packet interaction.
By default, the log file sent to the remote server is named File size_Device IP address_Index.txt. If the prefix of thelog file name is modified, the log file sent to the remote server is named Configured file name prefix_File size_Device
IP address_Index.txt. The file stored on the local Flash of the device is named Configured file nameprefix_Index.txt. By default, the file name prefix is syslog_ftp_server, the delayed logging interval is 3600s (one hour),and the log file size is 128 KB.
The maximum value of the delayed logging interval is 65535s, that is, 18 hours. If you set the delayed logging interval tothe maximum value, the amount of logs generated in this period may exceed the file size (128 KB). To prevent loss oflogs, logs will be written into a new log file, and the index increases by 1. When the timer expires, all log files buffered inthis period will be sent to the FTP or TFTP server at a time.
The Flash on the device that is used to buffer the local log files is limited in size. A maximum of eight log files can bebuffered on the device. If the number of local log files exceeds eight before the timer expires, all log files that are
generated earlier will be sent to the FTP or TFTP server at a time.



Periodical Logging

Logs about performance statistics are periodically sent. All periodical logging timers are managed by the syslog module.
When the timer expires, the syslog module calls the log processing function registered with each module to output theperformance statistic logs and send logs in real time to the remote syslog server. The server analyzes these logs toevaluate the device performance.
By default, the periodical logging interval is 15 minutes. To enable the server to collect all performance statistic logs at atime, you need to set the log periodical logging intervals of different statistic objects to a common multiple of them.
Currently, the interval can be set to 0, 15, 30, 60, or 120. 0 indicates that periodical logging is disabled.

5-13

Configuration Guide

Configuring Syslog

RelatedConfiguration

Configuring the Level-based Logging Policy

By default, device logs are sent in all directions.
Run the logging policy module module-name [ not-lesser-than ] level direction { all | server | file | console |monitor | buffer } command in global configuration mode to configure the level-based logging policy.

Enabling Delayed Display of Logs on the Console and Remote Terminal

By default, delayed display of logs on the Console and remote terminal is disabled.
Run the logging delay-send terminal command in global configuration mode to enable delayed display of logs on theConsole and remote terminal.

Configuring the Name of the File for Delayed Logging

By default, the log file sent to the remote server is named File size_Device IP address_Index.txt. If the prefix of thelog file name is modified, the log file sent to the remote server is named Configured file name prefix_File size_Device
IP address_Index.txt. The file stored on the local Flash of the device is named Configured file nameprefix_Index.txt. The default file name prefix is syslog_ftp_server.
Run the logging delay-send file flash:filename command in global configuration mode to configure the name of thelog file that is buffered on the local device.

Configuring the Delayed Logging Interval

By default, the delayed logging interval is 3600s (one hour).
Run the logging delay-send interval seconds command in global configuration mode to configure the delayed logging
interval.

Configuring the Server Address and Delayed Logging Mode

By default, logs are not sent to any FTP or TFTP server.
Run the logging delay-send server { ip-address | ipv6 ipv6-address }mode { ftp user username password [ 0 | 7 ]password | tftp } command in global configuration mode to configure the server address and delayed logging mode.

Enabling Periodical Logging

By default, periodical logging is disabled.
Run the logging statistic enable command in global configuration mode to enable periodical uploading of logs. After
this function is enabled, the system outputs a series of performance statistics at a certain interval so that the log server
can monitor the system performance.

Enabling Periodical Display of Logs on the Console and Remote Terminal

By default, periodical display of logs on the Console and remote terminal is disabled.
Run the logging statistic terminal command in global configuration mode to enable periodical display of logs on theConsole and remote terminal.

Configuring the Periodical Logging Interval

5-14Configuration Guide

Configuring Syslog

By default, the periodical logging interval is 15 minutes.
Run the logging statistic mnemonic mnemonic interval minutes command in global configuration mode to configure
the periodical logging interval.

5.3.6 Syslog Monitoring
After syslog monitoring is enabled, the system monitors the access attempts of users and generates the related logs.

Working Principle
After logging of login/exit attempts is enabled, the system records the access attempts of users. The log contains username and source address.
After logging of operations is enabled, the system records changes in device configurations, The log contains user
name, source address, and operation.

RelatedConfiguration

Enabling Logging of Login or Exit Attempts

By default, a device does not generate logs when users access or exit the device.
Run the logging userinfo command in global configuration mode to enable logging of login/exit attempts. After thisfunction is enabled, the device displays logs when users access the devices through Telnet, SSH, or HTTP so that theadministrator can monitor the device connections.



Enabling Logging of Operations

By default, a device does not generate logs when users modify device configurations.
Run the logging userinfo command-log command in global configuration mode to enable logging of operations. After
this function is enabled, the system displays related logs to notify the administrator of configuration changes.

5.4 Configuration
Configuration

Description and Command(Optional) It is used to configure the syslog format.
service timestamps [log |debug][ message-type [ uptime|
datetime [ msec ] [ year ] ] ]Configuring Syslog Format

Sending Syslogs to theConsoleConfigures the timestamp format ofsyslogs.

service sysname

Adds the sysname to the syslog.

service sequence-numbers

Adds the sequence number to the syslog.

service standard-syslog

Enables the standard syslog format.

service private-syslog

Enables the private syslog format.

service log-format rfc5424

Enables the RFC5424 syslog format.

(Optional) It is used to configure parameters for sending syslogs to the Console.
Enables logging.

logging on

5-15

Configuration Guide
Configuration

Configuring Syslog
Description and Command
Enables log statistics.

logging countConfigures the level of logs displayed on

logging console [ level ]the Console.

logging rate-limit { number | all number |console {number | all number } } [ except

Configures the log rate limit.

[ severity ] ](Optional) It is used to configure parameters for sending syslogs to the monitor
terminal.
Sending Syslogs to theMonitor Terminal

Enables the monitor terminal to display

terminal monitor

logs.
Configures the level of logs displayed on

logging monitor [ level ]the monitor terminal.

(Optional) It is used to configure parameters for writing syslogs into the memory
Writing Syslogs into thebuffer.
Configures parameters for writing syslogs

Memory Buffer
logging buffered [ buffer-size ] [ level ]into the memory buffer, including the buffer
size and log level.

(Optional) It is used to configure parameters for sending syslogs to the log server.
logging server{ ip-address | ipv6

ipv6-address } [ udp-port port ]Configures the level of logs sent to the log

logging trap [ level ]server.

Sending Syslogs to the Log
ServerSends logs to a specified log server.

logging facility facility-type

Configures the facility value of logs sent to
the log server.

logging source [ interface ] interface-type

Configures the source interface of logs sentinterface-number

to the log server.

logging source { ip ip-address | ipv6

Configures the source address of logs sent

ipv6-address }to the log server.

(Optional) It is used to configure parameters for writing syslogs into a file.
logging file { flash:filename }[ max-file-size ] [ level ]into a file, including the file storage type, file
name, file size, and log level.

Writing Syslogs into Log
Files

Configures parameters for writing syslogs

logging file numbers numbers

Configures the number of files which logs
are written into. The default value is 16.
Configures the interval at which logs are

logging flash interval seconds

written into log files. The default value is3600.

logging life-time level level days
Configuring Syslog

Configures the storage time of log files.

(Optional) It is used to enable the syslog filtering function.

5-16

Configuration Guide

Configuring Syslog

Configuration

Description and Command

Filtering

logging filter direction { all | buffer | file |server | terminal }logging filter type { contains-only |filter-only }Configures the log filtering direction.

Configures the log filtering mode.

logging filter rule exact-match module
module-name mnemonic mnemonic-name

Configures the exact-match filtering rule.

level level
logging filter rule single-match { level
level | mnemonic mnemonic-name |Configures the single-match filtering rule.

module module-name }Configuring Syslog
Monitoring

Synchronizing User Input
with Log Output(Optional) It is used to configure parameters of the syslog monitoring function .
logging userinfo

Enables logging of login/exit attempts.

logging userinfo command-log

Enables logging of operations.

(Optional) It is used to synchronize the user input with log output.
Synchronizes user input with log output.

logging synchronous

5.4.1 Configuring Syslog Format
Configuration EffectConfigure the format of syslogs.

Notes



RFC3164 Log Format



If the device does not have the real time clock (RTC), which is used to record the system absolute time, the device
uses its startup time (uptime) as the syslog timestamp by default. If the device has the RTC, the device uses its
absolute time (datetime) as the syslog timestamp by default.



The log sequence number is a 6-digit integer. Each time a log is generated, the sequence number increases by
one. Each time the sequence number increases from 000000 to 1,000,000, or reaches 2^32, the sequencenumber starts from 000000 again.



RFC5424 Log Format

After the RFC5424 log format is enabled, the timestamp is uniform.

In the RFC5424 log format, the timestamp may or may not contain the time zone. Currently, only the timestamp
without the time zone is supported.

Configuration Steps

Configuring the Timestamp Format of Syslogs

(Optional) By default, the datetime timestamp format is used.



Unless otherwise specified, perform this configuration on the device to configure the timestamp format.

5-17Configuration Guide

Configuring Syslog

Adding the Sysname to the Syslog

(Optional) By default, the syslog does not contain the sysname.



Unless otherwise specified, perform this configuration on the device to add the sysname to the syslog.

Adding the Sequence Number to the Syslog

(Optional) By default, the syslog does not contain the sequence number.



Unless otherwise specified, perform this configuration on the device to add the sequence number to the syslog.

Enabling the Standard Log Format

(Optional) By default, the default log format is used.



Unless otherwise specified, perform this configuration on the device to enable the standard log format.

Enabling the Private Log Format

(Optional) By default, the default log format is used.



Unless otherwise specified, perform this configuration on the device to enable the private log format.

Enabling the RFC5424 Log Format

(Optional) By default, the RFC5424 log format is disabled.



Unless otherwise specified, perform this configuration on the device to enable the RFC5424 log format.

Verification


Generate a syslog, and check the log format.

Related Commands

Configuring the Timestamp Format of Syslogs

Commandservice timestamps [ message-type [ uptime | datetime [ msec ] [ year ] ] ]Parameter

message-type: Indicates the log type. There are two log types: log and debug.

Description

uptime: Indicates the device startup time in the format of dd:hh:mm:ss, for example, 07:00:10:41.
datetime: Indicates the current device time in the format of MM DD hh:mm:ss, for example, Jul 27
16:53:07.
msec: Indicates that the current device time contains millisecond.
year: Indicates that the current device time contains year.

Command

Global configuration mode

Mode
Configuratio

Two syslog timestamp formats are available, namely, uptime and datetime. You can select a timestampn Usageformat as required.

Adding the Sysname to the Syslog

Commandservice sysname

Parameter

N/A

Description

5-18

Configuration Guide
Command

Configuring Syslog

Global configuration mode

Mode
Configuratio

This command is used to add the sysname to the log to enable you to learn about the device that sends

n Usagesyslogs to the server.

Adding the Sequence Number to the Syslog

Commandservice sequence-numbers

Parameter

N/A

Description
Command

Global configuration mode

Mode
Configuratio

This command is used to add the sequence number to the log. The sequence number starts from 1.

n Usage

After the sequence number is added, you can learn clearly whether any log is lost and the generation
sequence of logs.

Enabling the Standard Syslog Format

Commandservice standard-syslog

Parameter

N/A

Description
Command

Global configuration mode

Mode
Configuratio

By default, logs are displayed in the following format (default format):n Usage*timestamp: %module-level-mnemonic: content
If the standard syslog format is enabled, logs are displayed in the following format:
timestamp %module-level-mnemonic: content
Compared with the default format, an asterisk (*) is missing in front of the timestamp, and a colon (:) is
missing at the end of the timestamp in the standard log format.

Enabling the Private Syslog Format

Commandservice private-syslog

Parameter

N/A

Description
Command

Global configuration mode

Mode
Configuratio

By default, logs are displayed in the following format (default format):n Usage*timestamp: %module-level-mnemonic: content
If the private syslog format is enabled, logs are displayed in the following format:
timestamp module-level-mnemonic: content
Compared with the default format, an asterisk (*) is missing in front of the timestamp, a colon (:) is
missing at the end of the timestamp, and a percent sign (%) is missing in front of the module name in theprivate log format.

5-19

Configuration GuideConfiguring Syslog

Enabling the RFC5424 Syslog Format

Commandservice log-format rfc5424

Parameter

N/A

Description
Command

Global configuration mode

Mode
Configuration Usage

After the new format (RFC5424 log format) is enabled, the service sequence-numbers, service
sysname, service timestamps, service private-syslog, and service standard-syslog commands
that are applicable only to the old format (RFC3164 log format) loss effect and are hidden.
After the old format (RFC3164 log format) is enabled, the logging delay-send, logging policy, andlogging statistic commands that are applicable only to the RFC5424 log format loss effect and are
hidden.
After log format switchover, the outputs of the show logging and show logging config commands
change accordingly.

Configuration
Example

Enabling the RFC3164 Log Format

Scenario

It is required to configure the timestamp format as follows:
1. Enable the RFC3164 format.
2. Change the timestamp format to datetime and add the millisecond and year to the timestamp.
3. Add the sysname to the log.
4. Add the sequence number to the log.

Configuratio

Configure the syslog format.

n StepsRuijie# configure terminal
Ruijie(config)# no service log-format rfc5424
Ruijie(config)# service timestamps log datetime year msec
Ruijie(config)# service timestamps debug datetime year msec
Ruijie(config)# service sysname
Ruijie(config)# service sequence-numbers
Verification

After the timestamp format is configured, verify that new syslogs are displayed in the RFC3164 format.
Run the show logging config command to display the configuration.

Enter or exit global configuration mode to generate a new log, and check the format of thetimestamp in the new log.

Ruijie(config)#exit
001302: *Jun 14 2013 19:01:40.293: Ruijie %SYS-5-CONFIG_I: Configured from console by admin on
consoleRuijie#show logging config

5-20

Configuration Guide

Configuring Syslog

Syslog logging: enabled
Console logging: level informational, 1306 messages logged
Monitor logging: level informational, 0 messages logged
Buffer logging: level informational, 1306 messages logged
File logging: level informational, 121 messages logged
File name:syslog_test.txt, size 128 Kbytes, have written 5 files
Standard format:false
Timestamp debug messages: datetime
Timestamp log messages: datetime
Sequence-number log messages: enable
Sysname log messages: enable
Count log messages: enable
Trap logging: level informational, 121 message lines logged,0 failEnabling the RFC5424 Log Format

Scenario

It is required to enable the RFC5424 format.

Configuratio

Configure the syslog format.

n StepsRuijie# configure terminal
Ruijie(config)# service log-format rfc5424
Verification

Verify that new syslogs are displayed in the RFC5424 format.
Run the show logging config command to display the configuration.

Enter or exit global configuration mode to generate a new log, and check the format of the new log.

Ruijie(config)#exit<133>1 2013-07-24T12:19:33.130290Z ruijie SYS 5 CONFIG - Configured from console by console
Ruijie#show logging config
Syslog logging: enabled
Console logging: level debugging, 4740 messages logged
Monitor logging: level debugging, 0 messages logged
Buffer logging: level debugging, 4745 messages logged
Statistic log messages: disable
Statistic log messages to terminal: disable
Delay-send file name:syslog_ftp_server, Current write index:3, Current send index:3, Cycle:10
seconds
Count log messages: enable

5-21Configuration Guide

Configuring Syslog

Trap logging: level informational, 2641 message lines logged,4155 faillogging to

192.168.23.89

logging to

2000::1

Delay-send logging: 2641 message lines logged
logging to

192.168.23.89

by tftp

5.4.2 Sending Syslogs to the Console
Configuration EffectSend syslogs to the Console to facilitate the administrator to monitor the performance of the system.

Notes


If too many syslogs are generated, you can limit the log rate to reduce the number of logs displayed on theConsole.

Configuration Steps

Enabling Logging

(Optional) By default, the logging function is enabled.

Enabling Log Statistics(Optional) By default, log statistics is disabled.



Unless otherwise specified, perform this configuration on the device to enable log statistics.

Configuring the Level of Logs Displayed on the Console(Optional) By default, the level of logs displayed on the Console is debugging (Level 7).

Unless otherwise specified, perform this configuration on the device to configure the level of logs displayed on theConsole.



Configuring the Log Rate Limit(Optional) By default, the no rate limit is configured.



Unless otherwise specified, perform this configuration on the device to limit the log rate.

Verification


Run the show logging config command to display the level of logs displayed on the Console.

Related Commands

Enabling Logging

Commandlogging on

Parameter

N/A

Description

5-22

Configuration Guide
Command

Configuring Syslog

Global configuration mode

Mode
Configuratio

By default, logging is enabled. Do not disable logging in general cases. If too many syslogs aren Usagegenerated, you can configure log levels to reduce the number of logs.

Enabling Log Statistics

Commandlogging countParameter

N/A

Description
Command

Global configuration mode

Mode
Configuratio

By default, log statistics is disabled. If log statistics is enabled, syslogs will be classified and counted.

n Usage

The system records the number of times a log is generated and the last time when the log is generated.

Configuring the Level of Logs Displayed on the Console

Commandlogging console [ level ]Parameterlevel: Indicates the log level.

Description
Command

Global configuration mode

Mode
Configuratio

By default, the level of logs displayed on the Console is debugging (Level 7). You can run the shown Usagelogging config command in privileged EXEC mode to display the level of logs displayed on theConsole.



Configuring the Log Rate Limit

Commandlogging rate-limit { number | all number | console {number | all number } } [ except [ severity ] ]Parameter

number: Indicates the maximum number of logs processed per second. The value ranges from 1 to

Description

10,000.
all: Indicates that rate limit is applied to all logs ranging from Level 0 to Level 7.
console: Indicates the number of logs displayed on the Console per second.
except severity: Rate limit is not applied to logs with a level equaling to or lower than the specified
severity level. By default, the severity level is error (Level 3), that is, rate limit is not applied to logs ofLevel 3 or lower.

Command

Global configuration mode

Mode
Configuratio

By default, no rate limit is configured.

n Usage

Configuration
Example

Sending Syslogs to the Console

5-23Configuration Guide
Scenario

Configuring Syslog

It is required to configure the function of displaying syslogs on the Console as follows:
1. Enable log statistics.
2. Set the level of logs that can be displayed on the Console to informational (Level 6).
3. Set the log rate limit to 50.

Configuratio

Configure parameters for displaying syslogs on the Console.

n StepsRuijie# configure terminal
Ruijie(config)# logging countRuijie(config)# logging console informational
Ruijie(config)# logging rate-limit console 50
Verification



Run the show logging config command to display the configuration.

Ruijie(config)#show logging config
Syslog logging: enabled
Console logging: level informational, 1303 messages logged
Monitor logging: level debugging, 0 messages logged
Buffer logging: level debugging, 1303 messages logged
File logging: level informational, 118 messages logged
File name:syslog_test.txt, size 128 Kbytes, have written 5 files
Standard format:false
Timestamp debug messages: datetime
Timestamp log messages: datetime
Sequence-number log messages: enable
Sysname log messages: enable
Count log messages: enable
Trap logging: level informational, 118 message lines logged,0 fail5.4.3 Sending Syslogs to the Monitor Terminal
Configuration EffectSend syslogs to a remote monitor terminal to facilitate the administrator to monitor the performance of the system.

Notes


If too many syslogs are generated, you can limit the log rate to reduce the number of logs displayed on the monitor
terminal.



By default, the current monitor terminal is not allowed to display logs after you access the device remotely. You
need to manually run the terminal monitor command to allow the current monitor terminal to display logs.

Configuration Steps

5-24

Configuration Guide

Configuring Syslog

Allowing the Monitor Terminal to Display Logs



(Mandatory) By default, the monitor terminal is not allowed to display logs.



Unless otherwise specified, perform this operation on every monitor terminal connected to the device.

Configuring the Level of Logs Displayed on the Monitor Terminal(Optional) By default, the level of logs displayed on the monitor terminal is debugging (Level 7).

Unless otherwise specified, perform this configuration on the device to configure the level of logs displayed on themonitor terminal.

Verification


Run the show logging config command to display the level of logs displayed on the monitor terminal.

Related Commands

Allowing the Monitor Terminal to Display Logs

Commandterminal monitor

Parameter

N/A

Description
CommandPrivileged EXEC mode

Mode
Configuratio

By default, the current monitor terminal is not allowed to display logs after you access the devicen Usageremotely. You need to manually run the terminal monitor command to allow the current monitor
terminal to display logs.

Configuring the Level of Logs Displayed on the Monitor Terminal

Commandlogging monitor [ level ]Parameterlevel: Indicates the log level.

Description
Command

Global configuration mode

Mode
Configuratio

By default, the level of logs displayed on the monitor terminal is debugging (Level 7).

n Usage

You can run the show logging config command in privileged EXEC mode to display the level of logs
displayed on the monitor terminal.

Configuration
Example

Sending Syslogs to the Monitor Terminal

Scenario

It is required to configure the function of displaying syslogs on the monitor terminal as follows:
1. Display logs on the monitor terminal.
2. Set the level of logs that can be displayed on the monitor terminal to informational (Level 6).

Configuratio

Configure parameters for displaying syslogs on the monitor terminal.

n Steps

5-25

Configuration Guide

Configuring Syslog

Ruijie# configure terminal
Ruijie(config)# logging monitor informational
Ruijie(config)# line vty 0 4
Ruijie(config-line)# monitor
Verification



Run the show logging config command to display the configuration.

Ruijie#show logging config
Syslog logging: enabled
Console logging: level informational, 1304 messages logged
Monitor logging: level informational, 0 messages logged
Buffer logging: level debugging, 1304 messages logged
File logging: level informational, 119 messages logged
File name:syslog_test.txt, size 128 Kbytes, have written 5 files
Standard format:false
Timestamp debug messages: datetime
Timestamp log messages: datetime
Sequence-number log messages: enable
Sysname log messages: enable
Count log messages: enable
Trap logging: level informational, 119 message lines logged,0 failCommon Errors
To disable this function, run the terminal no monitor command, instead of the no terminal monitor command.

5.4.4 Writing Syslogs into the Memory Buffer
Configuration Effect

Write syslogs into the memory buffer so that the administrator can view recent syslogs by running the show
logging command.

Notes


If the buffer is full, old logs will be overwritten by new logs that are written into the memory buffer.

Configuration Steps

Writing Logs into the Memory Buffer(Optional) By default, the system writes logs into the memory buffer, and the default level of logs is debugging(Level 7).

Unless otherwise specified, perform this configuration on the device to write logs into the memory buffer.

5-26

Configuration Guide

Configuring Syslog

Verification


Run the show logging config command to display the level of logs written into the memory buffer.

Run the show logging command to display the level of logs written into the memory buffer.

Related Commands



Writing Logs into the Memory Buffer

Commandlogging buffered [ buffer-size ] [ level ]Parameter

buffer-size: Indicates the size of the memory buffer.

Description

level: Indicates the level of logs that can be written into the memory buffer.

Command

Global configuration mode

Mode
Configuratio

By default, the level of logs written into the memory buffer is debugging (Level 7).

n Usage

Run the show logging command in privileged EXEC mode to display the level of logs written into thememory buffer and the buffer size.

Configuration
Example

Writing Syslogs into the Memory Buffer

Scenario

It is required to configure the function of writing syslogs into the memory buffer as follows:
1. Set the log buffer size to 128 KB (131,072 bytes).
2. Set the information level of logs that can be written into the memory buffer to informational (Level 6).

Configuratio

Configure parameters for writing syslogs into the memory buffer.

n StepsRuijie# configure terminal
Ruijie(config)# logging buffered 131072 informational
Verification



Run the show logging config command to display the configuration and recent syslogs.

Ruijie#show logging
Syslog logging: enabled
Console logging: level informational, 1306 messages logged
Monitor logging: level informational, 0 messages logged
Buffer logging: level informational, 1306 messages logged
File logging: level informational, 121 messages logged
File name:syslog_test.txt, size 128 Kbytes, have written 5 files
Standard format:false
Timestamp debug messages: datetime
Timestamp log messages: datetime
Sequence-number log messages: enable

5-27Configuration Guide
Scenario

Configuring Syslog

It is required to configure the function of writing syslogs into the memory buffer as follows:
1. Set the log buffer size to 128 KB (131,072 bytes).
2. Set the information level of logs that can be written into the memory buffer to informational (Level 6).

Configuratio

Configure parameters for writing syslogs into the memory buffer.

n StepsRuijie# configure terminal
Ruijie(config)# logging buffered 131072 informational
Verification



Run the show logging config command to display the configuration and recent syslogs.
Sysname log messages: enable
Count log messages: enable
Trap logging: level informational, 121 message lines logged,0 failLog Buffer (Total 131072 Bytes): have written 4200
001301: *Jun 14 2013 19:01:09.488: Ruijie %SYS-5-CONFIG_I: Configured from console by admin on
console001302: *Jun 14 2013 19:01:40.293: Ruijie %SYS-5-CONFIG_I: Configured from console by admin on
console//Logs displayed are subject to the actual output of the show logging command.

5.4.5 Sending Syslogs to the Log Server
Configuration EffectSend syslogs to the log server to facilitate the administrator to monitor logs on the server.

Notes


To send logs to the log server, you must add the timestamp and sequence number to logs. Otherwise, the logs are
not sent to the log server.

Configuration Steps

Sending Logs to a Specified Log Server(Mandatory) By default, syslogs are not sent to any log server.



Unless otherwise specified, perform this configuration on every device.

Configuring the Level of Logs Sent to the Log Server(Optional) By default, the level of logs sent to the log server is informational (Level 6).

Unless otherwise specified, perform this configuration on the device to configure the level of logs sent to the log
server.



Configuring the Facility Value of Logs Sent to the Log Server(Optional) If the RFC5424 format is disabled, the facility value of logs sent to the log server is local7 (23) by default.
If the RFC5424 format is enabled, the facility value of logs sent to the log server is local0 (16) by default.

5-28

Configuration GuideConfiguring Syslog

Unless otherwise specified, perform this configuration on the device to configure the facility value of logs sent to
the log server.

Configuring the Source Interface of Logs Sent to the Log Server(Optional) By default, the source interface of logs sent to the log server is the interface sending the logs.



Unless otherwise specified, perform this configuration on the device to configure the source interface of logs sent
to the log server.

Configuring the Source Address of Logs Sent to the Log Server(Optional) By default, the source address of logs sent to the log server is the IP address of the interface sending
the logs.

Unless otherwise specified, perform this configuration on the device to configure the source address of logs sent
to the log server.

Verification


Run the show logging config command to display the configurations related to the log server.

Related Commands



Sending Logs to a Specified Log Server

Commandlogging server{ ip-address | ipv6 ipv6-address } [ udp-port port ]Or logging { ip-address | ipv6 ipv6-address } [ udp-prot port ]Parameter

ip-address: Specifies the IP address of the host that receives logs.

Description

ipv6 ipv6-address: Specifies the IPv6 address of the host that receives logs.
udp-port port: Specifies the port ID of the log server. The default port ID is 514.

Command

Global configuration mode

Mode
Configuratio

This command is used to specify the address of the log server that receives logs. You can specify

n Usagemultiple log servers, and logs will be sent simultaneously to all these log servers.
You can configure up to five log servers on a Ruijie product.

Configuring the Level of Logs Sent to the Log Server

Commandlogging trap [ level ]Parameterlevel: Indicates the log level.

Description
Command

Global configuration mode

Mode
Configuratio

By default, the level of logs sent to the log server is informational (Level 6).

n Usage

You can run the show logging config command in privileged EXEC mode to display the level of logs
sent to the log server.

Configuring the Facility Value of Logs Sent to the Log Server

Commandlogging facility facility-type

5-29

Configuration Guide
Parameter

Configuring Syslog

facility-type: Indicates the facility value of logs.

Description
Command

Global configuration mode

Mode
Configuratio

If the RFC5424 format is disabled, the facility value of logs sent to the server is local7 (23) by default. If

n Usagethe RFC5424 format is enabled, the facility value of logs sent to the server is local0 (16) by default.



Configuring the Source Interface of Logs Sent to the Log Server

Commandlogging source [ interface ] interface-type interface-number

Parameterinterface-type: Indicates the interface type.

Description

interface-number: Indicates the interface number.

Command

Global configuration mode

Mode
Configuratio

By default, the source interface of logs sent to the log server is the interface sending the logs.

n Usage

To facilitate management, you can use this command to set the source interface of all logs to aninterface so that the administrator can identify the device that sends the logs based on the uniqueaddress.

Configuring the Source Address of Logs Sent to the Log Server

Commandlogging source { ip ip-address | ipv6 ipv6-address }Parameter

ip ip-address: Specifies the source IPv4 address of logs sent to the IPv4 log server.

Description

ipv6 ipv6-address: Specifies the source IPv6 address of logs sent to the IPv6 log server.

Command

Global configuration mode

Mode
Configuratio

By default, the source IP address of logs sent to the log server is the IP address of the interface sendingn Usagethe logs.
To facilitate management, you can use this command to set the source IP address of all logs to the IP
address of an interface so that the administrator can identify the device that sends the logs based on theunique address.

Configuration
Example

Sending Syslogs to the Log Server

Scenario

It is required to configure the function of sending syslogs to the log server as follows:
1. Set the IPv4 address of the log server to 10.1.1.100.
2. Set the level of logs that can be sent to the log server to debugging (Level 7).
3. Set the source interface to Loopback 0.

Configuratio

Configure parameters for sending syslogs to the log server.

n Steps

5-30

Configuration Guide

Configuring Syslog

Ruijie# configure terminal
Ruijie(config)# logging server 10.1.1.100
Ruijie(config)# logging trap debugging
Ruijie(config)# logging source interface Loopback 0
Verification



Run the show logging config command to display the configuration.

Ruijie#show logging config
Syslog logging: enabled
Console logging: level informational, 1307 messages logged
Monitor logging: level informational, 0 messages logged
Buffer logging: level informational, 1307 messages logged
File logging: level informational, 122 messages logged
File name:syslog_test.txt, size 128 Kbytes, have written 5 files
Standard format:false
Timestamp debug messages: datetime
Timestamp log messages: datetime
Sequence-number log messages: enable
Sysname log messages: enable
Count log messages: enable
Trap logging: level debugging, 122 message lines logged,0 faillogging to

10.1.1.100

5.4.6 Writing Syslogs into Log Files
Configuration Effect

Write syslogs into log files at the specified interval so that the administrator can view history logs anytime on thelocal device.

Notes


Sylsogs are not immediately written into log files. They are first buffered in the memory buffer, and then written into
log files either periodically (at the interval of one hour by default) or when the buffer is full.

Configuration Steps

Writing Logs into Log Files(Mandatory) By default, syslogs are not written to any log file.



Unless otherwise specified, perform this configuration on every device.

Configuring the Number of Log Files

5-31

Configuration Guide

Configuring Syslog

(Optional) By default, syslogs are written to 16 log files.



Unless otherwise specified, perform this configuration on the device to configure the number of files which logs are
written into.

Configuring the Interval at Which Logs Are Written into Log Files(Optional) By default, syslogs are written to log files every hour.



Unless otherwise specified, perform this configuration on the device to configure the interval at which logs are
written into log files.

Configuring the Storage Time of Log Files(Optional) By default, no storage time is configured.



Unless otherwise specified, perform this configuration on the device to configure the storage time of log files.



Immediately Writing Logs in the Buffer into Log Files(Optional) By default, syslogs are stored in the buffer and then written into log files periodically or when the buffer
is full.



Unless otherwise specified, perform this configuration to write logs in the buffer into log files immediately. This
command takes effect only once after it is configured.

Verification


Run the show logging config command to display the configurations related to the log server.

Related Commands



Writing Logs into Log Files

Commandlogging file { flash:filename } [ max-file-size ] [ level ]Parameter

flash: Indicates that log files will be stored on the extended Flash.

Description

filename: Indicates the log file name, which does not contain a file name extension. The file nameextension is always txt.
max-file-size: Indicates the maximum size of a log file. The value ranges from 128 KB to 6 MB. The
default value is 128 KB.
level: Indicates the level of logs that can be written into a log file.

Command

Global configuration mode

Mode
Configuratio

This command is used to create a log file with the specified file name on the specified file storage device.

n Usage

The file size increases with the amount of logs, but cannot exceed the configured maximum size. If not
specified, the maximum size of a log file is 128 KB by default.
After this command is configured, the system saves logs to log files. A log file name does not contain any
file name extension. The file name extension is always txt, which cannot be changed.
After this command is configured, logs will be written into log files every hour. If you run the logging flie
flash:syslog command, a total of 16 log files will be created, namely, syslog.txt, syslog_1.txt,
syslog_2.txt, …, syslog_14.txt, and syslog_15.txt. Logs are written into the 16 log files in sequence.
For example, the system writes logs into syslog_1.txt after syslog.txt is full. When syslog_15.txt is full,

5-32

Configuration Guide

Configuring Syslog

logs are written into syslog.txt again,Configuring the Number of Log Files

Commandlogging file numbers numbers

Parameter

numbers: Indicates the number of log files. The value ranges from 2 to 32.

Description
Command

Global configuration mode

Mode
Configuratio

This command is used to configure the number of log files.

n Usage

If the number of log files is modified, the system will not delete the log files that have been generated.
Therefore, you need to manually delete the existing log files to save the space of the extended flash.
(Before deleting existing log files, you can transfer these log files to an external server through TFTP.)
For example, after the function of writing logs into log files is enabled, 16 log files will be created bydefault. If the device has generated 16 log files and you change the number of log files to 2, new logs will
be written into syslog.txt and syslog_1.txt by turns. The existing log files from syslog_2.txt tosyslog_15.txt will be preserved. You can manually delete these log files.

Configuring the Interval at Which Logs Are Written into Log Files

Commandlogging flash interval seconds

Parameterseconds: Indicates the interval at which logs are written into log files. The value ranges from 1s to

Description

51,840s.

Command

Global configuration mode

Mode
Configuratio

This command is used to configure the interval at which logs are written into log files. The countdown

n Usagestarts after the command is configured.

Configuring the Storage Time of Log Files

Commandlogging life-time level level days

Parameterlevel: Indicates the log level.

Description

days: Indicates the storage time of log files. The unit is day. The storage time is not less than sevendays.

Command

Global configuration mode

Mode
Configuratio

After the log storage time is configured, the system writes logs of the same level that are generated in

n Usagethe same day into the same log file. The log file is named yyyy-mm-dd_filename_level.txt, whereyyyy-mm-dd is the absolute time of the day when the logs are generated, filename is the log file named
configured by the logging file flash command, and level is the log level.
After you specify the storage time for logs of a certain level, the system deletes the logs after the storage
time expires. Currently, the storage time ranges from 7days to 365 days.
If the log storage time is not configured, logs are stored based on the file size to ensure compatibility withold configuration commands.



Immediately Writing Logs in the Buffer into Log Files

Commandlogging flash flush

5-33

Configuration Guide
Parameter

Configuring Syslog

N/A

Description
Command

Global configuration mode

Mode
Configuratio

After this command is configured, syslogs are stored in the buffer and then written into log files

n Usageperiodically or when the buffer is full. You can run this command to immediately write logs into log files.
The logging flash flush command takes effect once after it is configured. That is, after thiscommand is configured, logs in the buffer are immediately written to log files.

Configuration
Example

Writing Syslogs into Log Files

Scenario

It is required to configure the function of writing syslogs into log files as follows:
1. Set the log file name to syslog.
2. Set the level of logs sent to the Console to debugging (Level 7).
3. Set the interval at which device logs are written into files to 10 minutes (600s).

Configuratio

Configure parameters for writing syslogs into log files.

n StepsRuijie# configure terminal
Ruijie(config)# logging file flash:syslog debugging
Ruijie(config)# logging flash interval 600
Verification



Run the show logging config command to display the configuration.

Ruijie(config)#show logging config
Syslog logging: enabled
Console logging: level informational, 1307 messages logged
Monitor logging: level informational, 0 messages logged
Buffer logging: level informational, 1307 messages logged
File logging: level debugging, 122 messages logged
File name:syslog.txt, size 128 Kbytes, have written 1 files
Standard format:false
Timestamp debug messages: datetime
Timestamp log messages: datetime
Sequence-number log messages: enable
Sysname log messages: enable
Count log messages: enable
Trap logging: level debugging, 122 message lines logged,0 faillogging to

10.1.1.100

5-34

Configuration Guide

Configuring Syslog

5.4.7 Configuring Syslog Filtering
Configuration EffectFilter out a specified type of syslogs if the administrator does not want to display these syslogs.



By default, logs generated by all modules are displayed on the Console or other terminals. You can configure log
filtering rules to display only desired logs.

Notes


Two filtering modes are available: contains-only and filter-only. You can configure only one filtering mode at a
time.



If the same module, level, or mnemonic is configured in both the single-match and exact-match rules, thesingle-match rule prevails over the exact-match rule.

Configuration Steps

Configuring the Log Filtering Direction

(Optional) By default, the filtering direction is all, that is, all logs are filtered out.



Unless otherwise specified, perform this configuration on the device to configure the log filtering direction.

Configuring the Log Filtering Mode

(Optional) By default, the log filtering mode is filter-only.



Unless otherwise specified, perform this configuration on the device to configure the log filtering mode.

Configuring the Log Filtering Rule

(Mandatory) By default, no filtering rule is configured.



Unless otherwise specified, perform this configuration on the device to configure the log filtering rule.

Verification


Run the show running command to display the configuration.

Related Commands

Configuring the Log Filtering Direction

Commandlogging filter direction { all | buffer | file | server | terminal }Parameter

all: Filters out all logs.

Description

buffer: Filters out logs sent to the log buffer, that is, the logs displayed by the show logging command.
file: Filters out logs written into log files.
server: Filters out logs sent to the log server.
terminal: Filters out logs sent to the Console and VTY terminal (including Telnet and SSH).

Command

Global configuration mode

Mode
Configuratio

The default filtering direction is all, that is, all logs are filtered out.

n Usage

Run the default logging filter direction command to restore the default filtering direction.

5-35

Configuration GuideConfiguring Syslog

Configuring the Log Filtering Mode

Commandlogging filter type { contains-only | filter-only }Parameter

contains-only: Indicates that only logs that contain keywords specified in the filtering rules are

Description

displayed.
filter-only: Indicates that logs that contain keywords specified in the filtering rules are filtered out and will
not be displayed.

Command

Global configuration mode

Mode
Configuratio

Log filtering modes include contains-only and filter-only. The default filtering mode is filter-only.

n UsageConfiguring the Log Filtering Rule

Commandlogging filter rule { exact-match module module-name mnemonic mnemonic-name level level |single-match { level level | mnemonic mnemonic-name | module module-name } }Parameter

exact-match: If exact-match is selected, you must specify all three filtering options.

Description

single-match: If single-match is selected, you may specify only one of the three filtering options.
module module-name: Indicates the module name. Logs of this module will be filtered out.
mnemonic mnemonic-name: Indicates the mnemonic. Logs with this mnemonic will be filtered out.
level level: Indicates the log level. Logs of this level will be filtered out.

Command

Global configuration mode

Mode
Configuratio

Log filtering rules include exact-match and single-match.

n Usage

The no logging filter rule exact-match [ module module-name mnemonic mnemonic-name level
level ] command is used to delete the exact-match filtering rules. You can delete all exact-match filteringrules at a time or one by one.
The no logging filter rule single-match [ level level | mnemonic mnemonic-name | module
module-name ] command is used to delete the single-match filtering rules. You can delete all
single-match filtering rules at a time or one by one.

Configuration
Example

Configuring Syslog Filtering

Scenario

It is required to configure the syslog filtering function as follows:
1. Set the filtering directions of logs to terminal and server.
2. Set the log filtering mode to filter-only.
3. Set the log filtering rule to single-match to filter out logs that contain the module name "SYS".

Configuratio

Configure the syslog filtering function.

n Steps

5-36

Configuration Guide

Configuring Syslog

Ruijie# configure terminal
Ruijie(config)# logging filter direction server
Ruijie(config)# logging filter direction terminal
Ruijie(config)# logging filter type filter-only
Ruijie(config)# logging filter rule single-match module SYS
Verification



Run the show running-config | include loggging command to display the configuration.

Enter and exit global configuration mode, and verify that the system displays logs accordingly.

Ruijie#configure
Enter configuration commands, one per line.

End with CNTL/Z.

Ruijie(config)#exit
Ruijie#Ruijie#show running-config | include logging
logging filter direction server
logging filter direction terminal
logging filter rule single-match module SYS

5.4.8 Configuring Syslog Monitoring
Configuration EffectRecord login/exit attempts. After logging of login/exit attempts is enabled, the related logs are displayed on thedevice when users access the device through Telnet or SSH. This helps the administrator monitor the device
connections.



Record modification of device configurations. After logging of operations is enabled, the related logs are displayedon the device when users modify the device configurations. This helps the administrator monitor the changes indevice configurations.

Notes


If both the logging userinfo command and the logging userinfo command-log command are configured on thedevice, only the configuration result of the logging userinfo command-log command is displayed when you run
the show running-config command.

Configuration Steps

Enabling Logging of Login/Exit Attempts

(Optional) By default, logging of login/exit attempts is disabled.



Unless otherwise specified, perform this configuration on every line of the device to enable logging of login/exit
attempts.

Enabling logging of Operations

(Optional) By default, logging of operations is disabled.
5-37

Configuration GuideConfiguring Syslog

Unless otherwise specified, perform this configuration on every line of the device to enable logging of operations.

Verification


Run the show running command to display the configuration.

Related Commands

Enabling Logging of Login/Exit Attempts

Commandlogging userinfo

Parameter

N/A

Description
Command

Global configuration mode

Mode
Configuratio

By default, a device does not generate related logs when users log into or exit the device.

n UsageEnabling Logging of Operations

Commandlogging userinfo command-log

Parameter

N/A

Description
Command

Global configuration mode

Mode
Configuratio

The system generates related logs when users run configuration commands. By default, a device doesn Usage

not generate logs when users modify device configurations.

Configuration
Example

Configuring Syslog Monitoring

Scenario

It is required to configure the syslog monitoring function as follows:
1. Enable logging of login/exit attempts.
2. Enable logging of operations.

Configuratio

Configure the syslog monitoring function.

n StepsRuijie# configure terminal
Ruijie(config)# logging userinfo
Ruijie(config)# logging userinfo command-log
Verification



Run the show running-config | include logging command to display the configuration.

Run a command in global configuration mode, and verify that the system generates a log.

Ruijie#configure terminal
Enter configuration commands, one per line.
Ruijie(config)#interface gigabitEthernet 0/1

5-38

End with CNTL/Z.

Configuration Guide
Scenario

Configuring Syslog

It is required to configure the syslog monitoring function as follows:
1. Enable logging of login/exit attempts.
2. Enable logging of operations.

Configuratio

Configure the syslog monitoring function.

n StepsRuijie# configure terminal
Ruijie(config)# logging userinfo
Ruijie(config)# logging userinfo command-log
Verification



Run the show running-config | include logging command to display the configuration.

Run a command in global configuration mode, and verify that the system generates a log.

*Jun 16 15:03:43: %CLI-5-EXEC_CMD: Configured from console by admin command: interface
GigabitEthernet 0/1
Ruijie#show running-config | include logging
logging userinfo command-log

5.4.9 Synchronizing User Input with Log Output
Configuration Effect

By default, the user input is not synchronized with the log output. After this function is enabled, the content input
during log output is displayed after log output is completed, ensuring integrity and continuity of the input.

Notes


This command is executed in line configuration mode. You need to configure this command on every line as
required.

Configuration Steps

Synchronizing User Input with Log Output

(Optional) By default, the synchronization function is disabled.



Unless otherwise specified, perform this configuration on every line to synchronize user input with log output.

Verification


Run the show running command to display the configuration.

Related Commands



Synchronizing User Input with Log Output

Commandlogging synchronous

Parameter

N/A

Description
CommandLine configuration mode

Mode

5-39

Configuration Guide

Configuring Syslog

Configuratio

This command is used to synchronize the user input with log output to prevent interrupting the usern Usage

input.

Configuration
Example

Synchronizing User Input with Log Output

Scenario

It is required to synchronize the user input with log output as follows:
1. Enable the synchronization function.

Configuratio

Configure the synchronization function.

n StepsRuijie# configure terminal
Ruijie(config)# line console 0
Ruijie(config-line)# logging synchronous
Verification



Run the show running-config | begin line command to display the configuration.

Ruijie#show running-config | begin line
line con 0
logging synchronous
login local
As shown in the following output, when a user types in "vlan", the state of interface 0/1 changes and therelated log is output. After log output is completed, the log module automatically displays the user input"vlan" so that the user can continue typing.
Ruijie(config)#vlan*Aug 20 10:05:19: %LINK-5-CHANGED: Interface GigabitEthernet 0/1, changed state to up*Aug 20 10:05:19: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet 0/1, changed
state to up
Ruijie(config)#vlan

5.5 Monitoring
Clearing
Running the clear commands may lose vital information and thus interrupt services.
Description

CommandClears logs in the memory buffer.

clear logging

Displaying
Description

Command

Displays log statistics and logs in the memory buffer basedon the timestamp from oldest to latest.

5-40

show logging

Configuration Guide

Configuring Syslog

Displays log statistics and logs in the memory buffer basedon the timestamp from latest to oldest.

show logging reverse

Displays syslog configurations and statistics.

show logging config

Displays log statistics of each module in the system.

show logging count5-41

Configuration Guide

Configuring Monitoring

6 Configuring Monitoring
6.1 Overview
Intelligent monitoring is the intelligent hardware management of Ruijie Network devices, including intelligent fan speed
adjustment, and intelligent temperature monitoring. The intelligent monitoring performs the following tasks:

Automatic fan speed adjustment based on ambient temperature changes

Real-time temperature monitoring of boards to alert users

By default, the intelligent monitoring function is enabled after the device is powered on. It does not require any manual
configuration.

Protocol Specification
N/A

6.2 Features
Basic Concepts
N/A

FeaturesFeatureFunctionIntelligent Speed

The rotating speed of fans is automatically adjusted as the temperature changes to address the

Adjustment of Fansheat dissipation needs of the system.

Intelligent

The system automatically monitors the temperature. When the temperature exceeds a certain

Temperaturethreshold, the system automatically generates an alarm.

Monitoring
Power monitoring

The system automatically monitors the power. When the power is insufficient or cannot be
identified, the system automatically generates an alarm.

6.2.1 Intelligent Speed Adjustment of FansAs the ambient temperature rises or drops, the fans automatically raise or reduce their rotating speed to dissipate heatand ensure that the noise is low.

Working Principle
The system automatically specifies default start rotating speed for the fans according to the current operating mode of
the fans. As the ambient temperature rises or drops, the fans automatically raise or reduce their rotating speed todissipate heat and ensure that the noise is low.

6-1

Configuration Guide

Configuring Monitoring

6.2.2 Intelligent Temperature Monitoring
The system automatically monitors the temperature. When the temperature changes, the system automatically notifies
users.

Working Principle
The system monitors the temperature once per minute. When the temperature exceeds a certain threshold, the systemtakes a certain action. The temperature and action vary with different devices.

Verification
Use the show temperature command to check the temperature thresholds and the current temperature of each linecard.

6.2.3 Run the show temperature command to display system temperature. Power
Monitoring
The system automatically monitors the power. When the power is insufficient or cannot be identified, the system
automatically generates an alarm.

Working Principle
The system monitors the power once per minutes. If the system finds the power insufficient, the alarm LED becomesyellow and a Syslog message is generated. Once the alarm event is resolved, the system recovers. If the systemcannot identify the inserted power, the alarm LED becomes yellow. After you remove the power, the system recovers.

6.3 Monitoring
Displaying
Description

Command

Displays power information including that of its

show power

basic condition, redundancy, allocation andversion and etc.
Displays board temperature, thresholdshow temperature

configuration and other information.
Displays fan statusshow fan

Displays the current fan speed and speed levelshow fan speed

6-2