Nortel Networks 5510, 5520, 5530 manual ERS5500 Enable ARP-Inspection for VLAN’s 110

Page 53

Filters and QoS Configuration for ERS 5500
Technical Configuration Guide	v2.0	NN48500-559

ERS5500: Step 2 – Enable Rate Limiting to 10% of total traffic for both broadcast and multicast traffic

5500(config)#interface fastEthernet all

5500(config-if)#rate-limit port 1-10both 10

5500(config-if)#exit

Please note that the rate limit parameter on the ERS5500 is expressed as percentage of total traffic. The values used in this example are just a suggestion and may vary depending on your needs.

12.3.1.6 Enable DHCP-Snooping and ARP-Inspection

ERS5500: Step 1 – Enable DHCP-Snooping for VLAN’s 110 and 220 and enable DHCP- Snooping globally

5500(config)#ip dhcp-snooping vlan 110 5500(config)#ip dhcp-snooping vlan 220 5500(config)#ip dhcp-snooping enable

ERS5500: Step 1 – Enable ARP-Inspection for VLAN’s 110 and 220

5500(config)# ip arp-inspection vlan 110

5500(config)# ip arp-inspection vlan 220

12.3.1.7 Enable IP Source Guard

ERS5500: Step 1 – Enable IP Source Guard on access port members from VLAN 110 and 220

5500(config)#interface fastEthernet 3-6,8-10

5500(config-if)#ip verify source

5500(config-if)#exit

12.3.1.8 Create ACL’s for VLAN 110 Port Members

ERS5500: Step 1 – Create IP-ACL’s pertaining to VLAN 110 VLAN port members

5500(config)#qos ip-acl name one dst-ip 172.30.30.50/32 protocol 1

5500(config)#qos ip-acl name one dst-ip 172.30.30.50/32 protocol 17 dst- port-min 67 dst-port-max 67

5500(config)#qos ip-acl name one dst-ip 10.10.30.0/24 block b1 5500(config)#qos ip-acl name one dst-ip 10.62.32.0/24 block b1

5500(config)#qos ip-acl name one dst-ip 10.0.0.0/8 drop-action enable block b2

___________________________________________________________________________________________________________________________

Nortel Confidential Information Copyright © 2008 Nortel Networks. All Rights Reserved.
External Distribution	52

Image 53

Contents Ethernet Routing Switch NN48500-559 Abstract Table of Contents List of Tables List of FiguresSymbols Document UpdatesConventions TextOverview Ethernet Routing Switch 5500 QoS and Filtering Untrusted Ports ClassificationUnrestricted Ports ƒ Layer 2 Classifier ElementsStatistics Actions SupportedQoS Flow Chart Classifier Block Functionality Filter FunctionalityOverall Classification Functionality 7, 15, 31, 63 255, 511, 1025 4095, 8191 32762, or Min = Port Range FunctionalityPolicies Default Policy Drop ActionNN48500-559 Queue Sets 5520-24T-PWRconfig#qos agent buffer large maximum regular5520-24T-PWRconfig#default qos agent buffer Egress CoS Queuing Ethernet Routing Switch 5500 Egress CoS QueuingCoS 5520-24T-PWRconfig#qos agent queue set 5520-24T-PWRconfig#show qos queue-set-assignmentEgress Queue Recommendations 5520-24T-PWRconfig#default qos agent queue-set5520-24T-PWRconfig#qos agent reset-default Bucket Size Traffic Meter and ShapingPolicing Traffic Actual Bucket SizeActual Bucket Size in Bytes Actual size in bytes Interface Parameter DescriptionExample Bucket Size Max burst rate Committed rate Duration MSec Interface ShaperMeter Bucket Size and Duration 5530-24TFDconfig#show qos if-shaper port Default Nortel CoS Markings Default Nortel Class of ServiceBinary Hex DecimalACL Configuration QoS Access Lists ACLIP-ACL Configuration Config#qos ip-acl name 1..16 character string ?ACL-Assign Configuration 2 L2-ACL ConfigurationACL Configuration Example Config#qos l2-acl name 1..16 character string ?5530H-24TFD#show qos ip-acl Verification5530H-24TFD#show qos acl-assign 5530H-24TFD#show qos policy 5500config#no qos acl-assign 1 port 1/19 5500config#no qos acl-assign5500config#no qos ip-acl Changing ACLDhcp Snooping Configuration IP Security FeaturesDynamic ARP Inspection Configuration Dhcp SnoopingIP Source Guard IP Source Guard ConfigurationBpdu Filtering Bpdu Filtering ConfigurationQoS Interface Applications QoS Applications Number of Classifiers Used FeatureARP Spoofing Configuration ExampleDhcp Snooping Dhcp Attacks10.3 DoS Bpdu Blocking Role Combination Configuration Steps Policy ConfigurationERS5500-48T#show qos if-assign ERS5500-48T#show qos if-groupClassification ERS5500-48Tconfig#qos ip-element 1-64000?Adding IP and L2 Element IP ElementAdding a Classifier Block Adding a ClassifierParameters and variables Description MetersAdd a New Policy QoS Action Configuration ExamplesPre-defined Values 12.2.1 ERS5500 Configuration Using Policies Configuration Example 1 Traffic Meter Using PoliciesConfigure the Interface Role Combination Configure the IP elementsERS5500 Create the classifier block Configure MetersConfigure the Classifier Block Verify Operations Configure the PolicyERS5500 Create the policy Verify the Role CombinationName m1 Verify Classifier and Classifier Block ConfigurationERS5500-24T#show qos classifier-block Verify Policy Configuration Verify that the QoS Policy IP ACL, Dhcp Snooping, ARP Inspection, and Source Guard 12.3.1 ERS5500 ConfigurationERS5500 Add IP address to Vlan 700 and enable Ospf ERS5500 Enable ARP-Inspection for VLAN’s 110 Verify DHCP-Snooping ERS5500 Assign the IP-ACL’s to portsVID Verify ARP InspectionVerify IP Source Guard Verify ACL ConfigurationNN48500-559 NN48500-559 ERS5500-24T#show qos acl-assign TCP Port Range Configuration Example 3 Port Range Using ACL or PolicyERS5500 Create IP elements for UDP port range Configuration Using PoliciesConfigure the Policies ERS5500 Remark all other traffic to Bronze Configuration Using IP-ACL’sCreate Policy 12.5.1 ERS5500 Configuration Using PoliciesERS5500 Assign the L2-ACL’s to ports 12.5.2 ERS5500 Configuration Using IP-ACL’sERS5500 Pass all other traffic with standard CoS 12.6.1 ERS5500 Configuration Using Policies Configuration Example 5 L2 and L3 ClassificationERS5500 Add L2 elements for Vlan 110 Configure Classifier and Classifier BlocksDscp Mapping via Un-restricted Port Role 12.7.1 ERS5500 ConfigurationPolicy Configuration ACL ConfigurationID ID View the Queue AssignmentsVerify Shape Rate Configuration Configuration Example 7 Interface ShapingEnable Shaping on Port Reference Documentation Software BaselineContact us