EAD Configuration Example, Security-policy-server

After the client is patched and compliant with the required security standard, the security policy server reissues an ACL to the device, which then assigns access right to the client so that the client can access more network resources.

EAD Configuration

The EAD configuration includes:

z z z

Configuring the attributes of access users (such as user name, user type, and password). For local authentication, you need to configure these attributes on the device; for remote authentication, you need to configure these attributes on the AAA sever.

Configuring a RADIUS scheme.

Configuring the IP address of the security policy server. Associating the ISP domain with the RADIUS scheme.

EAD is commonly used in RADIUS authentication environment.

This section mainly describes the configuration of security policy server IP address. For other related configuration, refer to AAA Overview.

Follow these steps to configure EAD:

To do…	Use the command…	Remarks
Enter system view	system-view	—

Enter RADIUS scheme view	radius scheme	—
Enter RADIUS scheme view	radius-scheme-name	—
	radius-scheme-name

Configure the RADIUS server	server-type extended	Required
type to extended	server-type extended	Required
type to extended

		Required
Configure the IP address of a	security-policy-server	Each RADIUS scheme
Configure the IP address of a	security-policy-server	supports up to eight IP
security policy server	ip-address	supports up to eight IP
security policy server	ip-address	addresses of security policy
		addresses of security policy
		servers.

EAD Configuration Example

Network requirements

In Figure 3-2:

A user is connected to GigabitEthernet 1/0/1 on the device.

The user adopts iNode client supporting EAD extended function.

You are required to configure the device to use RADIUS server for remote user authentication and use security policy server for EAD control on users.

The following are the configuration tasks:

z z

Connect the RADIUS authentication server 10.110.91.164 and the device, and configure the device to use port number 1812 to communicate with the server.

Configure the authentication server type to extended.

Configure the encryption password for exchanging messages between the device and RADIUS server to “expert”.

Configure the IP address 10.110.91.166 of the security policy server.

3-2

Page 291

Image 291

3Com WX3000 operation manual EAD Configuration Example, Security-policy-server, Ip-address

Contents

Manual Version 6W100 3Com WX3000 Series Unified Switches Switching Engine Environmental Statement Part Contents About This ManualOrganization Conventions Convention Description BoldfaceItalic Manual Description Related DocumentationConvention Description Create Folder Obtaining Documentation Table of Contents CLI Configuration Command HierarchyIntroduction to the CLI Switching User Levels Setting a user level switching passwordSwitching to a specific user level Setting the Level of a Command in a Specific View Configuration exampleSetting the level of a command in a specific view Quit or return CLI ViewsDisplay Execute Operation Quit Peer-public-key command Gigabitethernet commandVlan-interface command Region-configuration Execute the radius scheme Public-key-cOde end Public-key-code begin Online Help CLI FeaturesVlan-vpn enable Execute Command should be first Press Ctrl+C Command HistoryTerminal Display Partial online help Command Edit Error Prompts Tab Press… To… Table of Contents Page Supported User Interfaces Logging In to the Switching EngineLogging In to the Switching Engine Introduction to the User Interface User Interface Index Common User Interface Configuration Display web users Display users allDisplay user-interface Type number number OAP Overview Logging In to the Switching Engine Through OAPPress Enter to enter user view of the switching engine Logging In Through OAP Address of an OAP module Configure the management IPNot configured by default Oap management-ip Resetting the OAP Software System Reset the OAP softwareOap reboot slot Introduction Common ConfigurationConfiguration Description Logging In Through Telnet Authentication Telnet configuration Description Mode Telnet Configurations for Different Authentication Modes Configuration Procedure Telnet Configuration with Authentication Mode Being None Configuration Example Configuration procedureNetwork requirements User privilege level level Password Set authenticationPassword cipher Auto-execute command Commands by default Set the history command bufferDefault history command Command buffer can store up to Telnet Configuration with Authentication Mode Being Scheme Protocol inbound all ssh Scheme commandAuthorization History-command max-size Service-type User privilege level level command is Level levelPrivilege # Create a local user named guest and enter local user view Telnetting to the Switching Engine from a Terminal Telnetting to the Switching Engine Deviceoap connect slot Connected to OAP Page Device telnet Logging In from the Web-Based Network Management System Vlan interface of the switching engine is assigned an IPUser name and password for logging in to the Web-based Network management system are configured Setting Up a Web Configuration Environment 3The login page of the Web-based network management system Configuring the Login Banner Header login text By default, no login banner isThrough Web Configured Ip http shutdown Follow these steps to enable/disable the WEB serverEnable the Web server Enabling/Disabling the WEB Server Connection Establishment Using NMS Logging In from NMSRelated information Configuration in system view Configuring Source IP Address for Telnet Service PacketsConfiguring Source IP Address for Telnet Service Packets Configuration in user view Interface-number Displaying Source IP Address Configuration Prerequisites Login mode Control method Implementation ReferenceUser Control Controlling Telnet Users Acl acl-number inbound Match-order config autoAcl number acl-number Rule rule-id deny permit Controlling Telnet Users by Source MAC Addresses Rule rule-id denyPermit rule-string Controlling Network Management Users by Source IP Addresses Controlling Network Management Users by Source IP Addresses Controlling Web Users by Source IP Address 2Network diagram for controlling Snmp users using ACLs Free web-users all user-id Disconnecting a Web User by ForceControlling Web Users by Source IP Addresses Ip http acl acl-number Device ip http acl Table of Contents Format of configuration file Configuration File ManagementIntroduction to Configuration File Types of configuration Modes in saving the configuration Management of Configuration FileSaving the Current Configuration Startup with the configuration file Three attributes of the configuration file Erasing the Startup Configuration File Startup saved-configuration Specifying a Configuration File for Next StartupAssign main attribute to the startup configuration file Assign backup attribute to the startup configuration file Displaying and Maintaining Device Configuration Table of Contents Vlan Overview Vlan OverviewIntroduction to Vlan Advantages of VLANs How Vlan WorksVlan tag 2Encapsulation format of traditional Ethernet frames MAC address learning mechanism of VLANs Port-Based Vlan Vlan InterfaceVlan Classification Ethernet II and 802.2/802.3 encapsulation Protocol-Based VlanIntroduction to Protocol-Based Vlan Encapsulation Format of Ethernet Data 6802.3 raw encapsulation format Extended encapsulation formats of 802.2/802.3 packets Encapsulation Ethernet 802.3 raw 802.2 LLC Snap Protocol Procedure for the Switch to Judge Packet ProtocolEncapsulation Formats Implementation of Protocol-Based VlanPage Basic Vlan Configuration Vlan ConfigurationVlan Configuration Configuration Task List Basic Vlan Interface Configuration Configuration prerequisitesDisplaying and Maintaining Vlan Port interface-list Configuring a Port-Based VlanConfiguring a Port-Based Vlan Protocol-Based Vlan Configuration Example # Configure GigabitEthernet 1/0/10 of Switch B # Create Vlan 201, and add GigabitEthernet 1/0/2 to Vlan# Create Vlan 201, and add GigabitEthernet 1/0/12 to Vlan Configuring a Protocol Template for a Protocol-Based Vlan Configuring a Protocol-Based Vlan Vlan vlan-id protocol-index Associating a Port with a Protocol-Based VlanInterface interface-type Interface-number Port hybrid protocol-vlan Display protocol-vlan vlan vlan id Displaying and Maintaining Protocol-Based VlanDisplay vlan vlan-id to vlan-id all Dynamic static Vlan Protocol-Type Table of Contents Introduction to the Auto Detect Function Auto Detect Configuration Auto Detect Basic Configuration Auto Detect Configuration Preference-value reject blackhole Auto Detect Implementation in Vlan Interface BackupAuto Detect Implementation in Static Routing Ip route-static ip-address mask Auto Detect Configuration Examples Vlan -idStandby detect-group # Configure a static route to Switch a Is reachable# Create auto detected group Table of Contents Voice Vlan Configuration Voice Vlan OverviewHow an IP Phone Works Agent 1Network diagram for IP phones Configuring Operation Mode for Voice Vlan How the Device Identifies Voice TrafficNumber OUI address Vendor Support for Voice Vlan on Various Ports Processing mode of tagged packets sent by IP voice devices Security Mode of Voice Vlan Port type Supported or not Traffic type ModePort voice Voice Voice Vlan Configuration Configuration PrerequisitesConfiguring a Voice Vlan to Operate in Automatic Mode Voice vlan security Configuring a Voice Vlan to Operate in Manual ModeEnable Undo voice vlan mode Port trunk pvid vlan Port trunk permit vlanPort hybrid vlan vlan-id Tagged untagged Voice Vlan Configuration Example Voice Vlan Configuration Example Automatic ModeDisplaying and Maintaining Voice Vlan # Enable the voice Vlan function on GigabitEthernet 1/0/1 Voice Vlan Configuration Example Manual Mode# Enable the voice Vlan function globally # Configure GigabitEthernet 1/0/1 as a hybrid port # Display the status of the current voice Vlan # Create Vlan 2 and configure it as a voice Vlan# Configure GigabitEthernet 1/0/1 to operate in manual mode Verification Table of Contents Gvrp Configuration Garp messages and timersIntroduction to Gvrp Operating mechanism of Garp Garp message formatGarp packets are in the following format Field Description Value 1Format of Garp packets Enabling Gvrp Gvrp ConfigurationProtocol Specifications Configuration Prerequisite Gvrp Configuring Gvrp TimersGarp timer leaveall Garp timer hold join Displaying and Maintaining Gvrp Configuring Gvrp Port Registration Mode # Enable Gvrp on GigabitEthernet 1/0/1 Gvrp Configuration ExampleGvrp Configuration Example Configure Switch a # Enable Gvrp globally # Enable Gvrp on GigabitEthernet 1/0/3 SwitchE-GigabitEthernet1/0/1 gvrp registration fixed Table of Contents Combo Ports Mapping Relations Basic Port ConfigurationEthernet Port Overview Types and Numbers of Ethernet Ports Link Types of Ethernet Ports Configuring the Default Vlan ID for an Ethernet Port Vlan tag Configuring Ethernet PortsMaking Basic Port Configuration Adding an Ethernet Port to Specified VLANs Configuring Port Auto-Negotiation Speed Broadcast-suppression Setting the Ethernet Port Broadcast Suppression RatioEnabling Flow Control on a Port Speed auto 10 100 Configuring Access Port Attribute Configuring Hybrid Port AttributeConfiguring Trunk Port Attribute Disabling Up/Down Log Output on a Port Configuration tasks Aggregation-group destination-agg-id Copying Port Configuration to Other PortsConfiguring a Port Group System-view Copy configuration source interface-type Setting Loopback Detection for an Ethernet Port Loopback detection only on VLANs for the trunk and hybrid Configuring the Ethernet Port to Run Loopback TestConfigure the Ethernet port to run Loopback-detection per-vlan Enabling the System to Test Connected Cable Virtual-cable-testFlow-interval interval Displaying and Maintaining Ethernet Ports Ethernet Port Configuration Example # Configure the default Vlan ID of GigabitEthernet 1/0/1 as Troubleshooting Ethernet Port Configuration Table of Contents Link Aggregation Configuration Introduction to Link AggregationIntroduction to Lacp Port status in manual aggregation group Operation KeyManual Aggregation Group Introduction to manual aggregation group Static Lacp Aggregation Group Introduction to static Lacp aggregationPort status of static aggregation group Port status of dynamic aggregation group Configuring system priorityDynamic Lacp Aggregation Group Introduction to dynamic Lacp aggregation group Aggregation Group Categories Configuring port priority Configuring a Manual Aggregation Group Link Aggregation Configuration Agg-id Configuring a Static Lacp Aggregation GroupDescription agg-name Port link-aggregation group Configuring a Dynamic Lacp Aggregation Group Lacp system -prioritySystem-priority Displaying and Maintaining Link Aggregation Link Aggregation Configuration Example Switch a Link aggregation Switch B Page Table of Contents Introduction to Port Isolation Port Isolation ConfigurationPort Isolation Configuration Port Isolation Overview Displaying and Maintaining Port Isolation Port Isolation Configuration Example Device-GigabitEthernet1/0/4 quit device Table of Contents Introduction Port Security ConfigurationPort Security Features Port Security Overview Neither Security mode Description FeatureThis mode Port Security Modes Security mode Description Feature Enabling Port Security Port Security ConfigurationComplete the following tasks to configure port security Follow these steps to enable port security Count-value Setting the Port Security ModePort-security oui OUI-value UserLoginWithOUI mode, a Port-security max-mac-count Configuring the NTK feature Configuring Port Security Features Configuring the Trap feature Configuring intrusion protection Configuring Security MAC Addresses Port Security Configuration Example Displaying and Maintaining Port Security Configuration # Enter GigabitEthernet 1/0/1 port view HostSwitch# Enable port security # Set the port security mode to autolearn Port Binding Overview Port Binding ConfigurationDisplaying and Maintaining Port Binding Configuration Configuring Port Binding Configure switch a as follows # Enter system view Port Binding Configuration Example Table of Contents Dldp Overview Dldp Configuration Dldp Fundamentals Dldp statusStatus Description Interval of sending advertisement packets, which can be Dldp timersDldp works with the following timers 2DLDP timers Timer Description Entry aging Timer expire Dldp operating modeEnhanced timer then sends one probe packets every one Mode During neighbor Dldp status Packet types Packet type Processing procedureNo Echo packet received from Processing procedure Neighbor 4Types of packets sent by Dldp Dldp neighbor state Dldp ConfigurationPrecautions During Dldp Configuration Dldp Configuration Tasks Resetting Dldp Status Reset the Dldp status of a port Dldp reset This command only applies to the ports in Dldp down statusDldp Network Example # Display the Dldp status # Enable Dldp globally# Configure Dldp to work in enhanced mode # Set the interval of sending Dldp packets to 15 seconds Table of Contents MAC Address Table Management Introduction to MAC Address TableIntroduction to MAC Address Learning 1MAC address learning diagram Aging of MAC address table Managing MAC Address Table Entries in a MAC address table Configuring MAC Address Table Management System-view Mac-address static dynamic Configuring a MAC Address EntryAdding a MAC address entry in system view Adding a MAC address entry in Ethernet port view Setting the Aging Time of MAC Address Entries Mac-address timer agingAge no-aging Max-mac-count Disabling MAC Address learning for a VlanMac-address Max-mac-count count Display mac-address Configuration ExampleDisplaying and Maintaining MAC Address Table Adding a Static MAC Address Entry Manually Table of Contents Page Mstp Configuration STP OverviewSTP Overview All the ports on the root bridge are designated ports Classification Designated bridge Designated port Step Description How STP works Step Description Device Port name Bpdu of port Device Comparison process Bpdu of port after 5Comparison process and result on each device Device Comparison process Bpdu of port after 3The final calculated spanning tree Disadvantages of STP and Rstp Features of MstpMstp Overview Background of Mstp MST region Basic Mstp Terminologies Port role Vlan mapping tableRegion root Common root bridge MSTP, a port can be in one of the following three states Port state Implement STP algorithm Principle of MstpCalculate the Cist Calculate an Msti Mstp Implementation on the Device Bpdu guard Loop guard TC-BPDU attack guard Bpdu packet drop Configuring Root BridgeComplete the following tasks to configure a root bridge STP-related Standards Configuring an MST Region # Verify the above configuration Stp instance instance-id root secondary Centi-seconds Stp instance instance-id Configuring the Bridge Priority of the Current DeviceRequired Default bridge priority of a Current device Set the bridge priority for Stp interface interface-type Interface-number complianceAuto dot1s legacy Legacy Configuring the Mstp Operation ModeStp mode stp rstp mstp Stp compliance auto dot1s Configuring the Maximum Hop Count of an MST Region Configuring the Network Diameter of the Switched NetworkStp max-hops hops Stp timer max-age Configuring the Mstp Time-related ParametersStp timer forward-delay Stp timer hello Configuring the Timeout Time Factor Stp interface interface-list Transmit-limit packetnumStp transmit-limit packetnum Edged-port enable Configuring the Current Port as an Edge PortConfigure a port as an edge port in system view Configure a port as an edge port in Ethernet port view Force-false auto Point-to-point force-true Stp point-to-point force-true Stp enableDisable Enabling Mstp Configuring Leaf Nodes Stp disableTask Remarks Configuring a Port as an Edge Port Configuring the MST Region Dot1d-1998 dot1t legacy Configuring the Path Cost for a PortStandards for calculating path costs of ports Stp pathcost-standard Configure the path cost for specific ports Configuration example aConfiguration example B Instance instance-id port Configuring Port PriorityConfigure port priority in system view Configure port priority in Ethernet port view Stp interface interface-list mcheck Performing mCheck OperationPerform the mCheck operation in system view Perform the mCheck operation in Ethernet port view Stp mcheck Configuring Guard FunctionsBpdu guard Root guard Loop guard TC-BPDU attack guardBpdu dropping Stp root-protection Configuring Bpdu GuardConfiguring Root Guard Root-protection Stp tc-protection Configuring Loop GuardConfiguring TC-BPDU Attack Guard Stp loop-protection Bpdu-drop any Configuring Digest SnoopingConfiguring Bpdu Dropping Interface interface-name Stp config-digest-snooping Configuring Digest Snooping Configuring Rapid Transition 6The Rstp rapid transition mechanism Configuring Rapid Transition No-agreement-checkStp no-agreement-check Configuring VLAN-VPN Tunnel Configuring VLAN-VPN tunnelVlan-vpn tunnel Portlog STP Maintenance ConfigurationEnabling Log/Trap Output for Ports of Mstp Instance Stp instance instance id Displaying and Maintaining Mstp Enabling Trap Messages Conforming to 802.1d Standard Mstp Configuration Example Configure Switch a # Enter MST region view# Activate the settings of the MST region manually Configure Switch D # Enter MST region view Configure Switch B # Enter MST region viewConfigure Switch C # Enter MST region view # Configure the MST region Configure Switch C # Enable Mstp VLAN-VPN tunnel Configuration ExampleConfigure Switch a # Enable Mstp Configure Switch B # Enable Mstp # Configure GigabitEthernet 1/0/1 as a trunk port # Enable the VLAN-VPN tunnel function# Configure GigabitEthernet 1/0/2 as a trunk port Configure Switch D # Enable Mstp Table of Contents 802.1x Configuration Architecture of 802.1x AuthenticationIntroduction to Valid direction of a controlled port Port access entityPort access control method Controlled port and uncontrolled port Mechanism of an 802.1x Authentication System Encapsulation of EAPoL MessagesFormat of an EAPoL packet Format of an EAP packet 802.1x Authentication Procedure Fields added for EAP authenticationEAP relay mode Describes the basic EAP-MD5 authentication procedure EAP terminating mode 9802.1x authentication procedure in EAP terminating mode Timers Used Checking the supplicant system Additional 802.1x Features Implemented Guest Vlan function Checking the client version Enabling 802.1x re-authentication Introduction to 802.1x Configuration Basic 802.1x Configuration Configuring Basic 802.1x FunctionsDot1x Dot1x port-control authorized-force Dot1x authentication-method chapDot1x handshake enable Dot1x interface interface-list Timer and Maximum User Number Configuration Dot1x max-user user-numberDot1x retry max-retry-value Configuring Proxy Checking Advanced 802.1x Configuration Configuring Client Version Checking Dot1x port-method portbased Enabling DHCP-triggered AuthenticationConfiguring Guest Vlan Dot1x dhcp-launch Configuring 802.1x Re-Authentication Configuring the 802.1x Re-Authentication TimerDot1x re-authenticate Displaying and Maintaining 802.1x Configuration Example # Enable 802.1x on GigabitEthernet 1/0/1 port # Enable 802.1x globally # Set the default user domain to be aabbcc.net # Create a local access user account# Create the domain named aabbcc.net and enter its view Quick EAD Deployment Overview Quick EAD Deployment ConfigurationConfiguring Quick EAD Deployment Introduction to Quick EAD Deployment Dot1x free-ip ip-address Configuring a free IP rangeSetting the ACL timeout period Dot1x url url-string Quick EAD Deployment Configuration Example Displaying and Maintaining Quick EAD DeploymentPeriod is 30 minutes Solution Troubleshooting System-Guard Overview System-Guard ConfigurationConfiguring the System-Guard Feature Configuring the System-Guard Feature Displaying and Maintaining System-Guard Table of Contents Page Introduction to AAA AuthenticationAuthorization AAA Overview Introduction to ISP Domain Introduction to AAA ServicesWhat is Radius Accounting 1Databases in a Radius server Basic message exchange procedure in Radius Client transmits this message to the server to determine if Radius message formatCode Message type Message description Direction client-server Type field value Attribute type Introduction to Hwtacacs What is Hwtacacs 5Network diagram for a typical Hwtacacs application Basic message exchange procedure in Hwtacacs 6AAA implementation procedure for a telnet user Page AAA Configuration AAA Configuration Task ListConfiguration Introduction Creating an ISP Domain and Configuring Its Attributes Self-service-url disable Configuring an AAA Scheme for an ISP DomainConfiguring a combined AAA scheme Messenger time enable limit Hwtacacs-scheme Configuring separate AAA schemesDomain isp-name Radius-scheme-name local Configuring Dynamic Vlan Assignment Local local none Authorization noneAccounting none Integer string Configuring the Attributes of a Local UserDomain isp-name Vlan-assignment-mode Access-limit Password-display-modeService-type ftp lan-access Authorization vlan string Cut down user Radius Configuration Task ListCutting Down User Connections Forcibly Follow these steps to cut down user connections forcibly Servers Configuring Radius scheme Configuring Radius Authentication/Authorization ServersRadius client enable Creating a Radius Scheme Ip-address port-number Configuring Radius Accounting ServersPrimary authentication Secondary authentication Retry stop-accounting Configuring Shared Keys for Radius MessagesSecondary accounting Stop-accounting-buffer Configuring the Type of Radius Servers to be Supported Key authentication stringKey accounting string Configuring the Status of Radius Servers Server-type extendedOptional Servers to be supported Block active State primary authenticationAuthentication block Calling-station-id mode Local-server nas-ip ip-address Configuring the Local Radius Authentication Server FunctionLocal-server enable Key password Configuring Timers for Radius Servers Enabling the User Re-Authentication at Restart Function Hwtacacs Configuration Task List Accounting-on enable sendTimes interval interval Configuring Tacacs Authentication Servers Creating a Hwtacacs SchemeHwtacacs scheme Ip-address port Configuring Tacacs Authorization ServersPrimary authorization Secondary authorization Function is enabled Number of transmission Configuring Tacacs Accounting ServersConfiguring Shared Keys for Hwtacacs Messages Follow these steps to configure Tacacs accounting servers Data-flow-format packet Authentication stringKey accounting Mega-byte Optional By default, the real-time Interval Configuring the Timers Regarding Tacacs ServersScheme exists Set the response timeout time Optional By default, the response timeout Tacacs servers Displaying and Maintaining AAA Displaying and maintaining AAA informationDisplaying and maintaining Radius protocol information AAA Configuration Examples Remote Radius Authentication of Telnet/SSH UsersDisplaying and maintaining Hwtacacs protocol information # Associate the ISP domain with the Radius scheme # Adopt AAA authentication for Telnet users# Configure an ISP domain # Configure a Radius scheme # Create and configure a local user named telnet Local Authentication of FTP/Telnet Users # Configure the domain name of the Hwtacacs scheme to hwtac Hwtacacs Authentication and Authorization of Telnet Users Possible reasons and solutions Troubleshooting AAATroubleshooting Radius Configuration Troubleshooting Hwtacacs Configuration EAD Configuration Introduction to EADTypical Network Application of EAD Ip-address EAD ConfigurationEAD Configuration Example Security-policy-server # Associate the domain with the Radius scheme # Configure the IP address of the security policy server Table of Contents Performing MAC Authentication Locally MAC Authentication ConfigurationMAC Authentication Overview Performing MAC Authentication on a Radius Server Related Concepts Configuring Basic MAC Authentication FunctionsMAC Authentication Timers Mac-authentication Uppercase fixedpassword password Mac-authentication interfaceMac-authentication Quit Mac-authentication authmode Configuring a Guest Vlan MAC Address Authentication Enhanced Function Configuration Mac-authentication timer Guest-vlan vlan-idGuest-vlan-reauth interval Configure the maximum number MAC address authentication Number of MAC addressMax-auth-num user-number Reset mac-authentication statistics Displaying and Maintaining MAC AuthenticationMAC Authentication Configuration Example Display mac-authentication # Add an ISP domain named aabbcc.net # Add a local user Specify the username and passwordSet the service type to lan-access # Specify to perform local authentication Table of Contents Net-id IP Addressing ConfigurationIP Addressing Overview IP Address Classes Special Case IP Addresses Subnetting and MaskingClass Address range Remarks Configuring IP Addresses Ip address ip-address maskMask-length sub Network requirement IP Address Configuration ExamplesIP Address Configuration Example Displaying and Maintaining IP Addressing 4Network diagram for IP address configuration Page IP Performance Configuration Configuring IP PerformanceIP Performance Overview Disabling Sending of Icmp Error Packets Displaying and Maintaining IP Performance Configuration Table of Contents IP Address Assignment Policy Dhcp OverviewIntroduction to Dhcp Dhcp IP Address Assignment Obtaining IP Addresses Dynamically Updating IP Address Lease Dhcp Packet Format Protocols and Standards Dhcp Relay Agent Fundamentals Dhcp Relay Agent ConfigurationIntroduction to Dhcp Relay Agent Usage of Dhcp Relay Agent Padding content of Option Dhcp Relay Agent Support for OptionIntroduction to Option Mechanism of Option 82 supported on Dhcp relay agent 2Padding contents for sub-option 1 of Option Ip-address &1-8 Configuring the Dhcp Relay AgentDhcp Relay Agent Configuration Task List Dhcp-server groupNo ip Configuring address checking Configuring Dhcp Relay Agent Security Functions Mac-address Address-check enableDhcp relay hand enable Dhcp-security static ip-address Prerequisites Configuring the Dhcp Relay Agent to Support OptionConfiguring the Dhcp relay agent to support Option Enabling unauthorized Dhcp server detection Dhcp Relay Agent Configuration Example Displaying and Maintaining Dhcp Relay Agent Configuration Analysis Troubleshooting Dhcp Relay Agent ConfigurationSymptom SolutionPage Dhcp Snooping Configuration Dhcp Snooping OverviewFunction of Dhcp Snooping Overview of Dhcp Snooping Option Padding content and frame format of Option 2Extended format of the circuit ID sub-option Mechanism of DHCP-snooping Option Overview of IP Filtering Dhcp-snooping information format command orSub-option configuration Dhcp snooping device will… Dhcp-snooping information format command or the default HEX IP static binding table Dhcp Snooping ConfigurationConfiguring Dhcp Snooping DHCP-snooping table Required Specify the current port as a Configuring Dhcp Snooping to Support OptionDHCP-Snooping Option 82 Support Configuration Task List Enable DHCP-snooping Option 82 support Strategy drop keep replace Configure a handling policy for Dhcp packets with OptionConfigure the storage format of Option Dhcp-snooping information String Configure the circuit ID sub-optionConfigure the remote ID sub-option Vlan vlan-id circuit-id string Vlan vlan-id remote-id Configuring IP FilteringConfigure the padding format for Option Remote-id sysname string DHCP-Snooping Option 82 Support Configuration Example Dhcp Snooping Configuration Example # Specify GigabitEthernet 1/0/5 as the trusted port IP Filtering Configuration Example# Enable Dhcp snooping on Switch # Enable DHCP-snooping Option 82 support # Specify GigabitEthernet 1/0/1 as the trusted port 7Network diagram for IP filtering configuration Display ip source static Displaying and Maintaining Dhcp Snooping ConfigurationDisplay dhcp-snooping Trust Follow these steps to configure a DHCP/BOOTP client DHCP/BOOTP Client ConfigurationIntroduction to Bootp Client Configuring a DHCP/BOOTP Client Dhcp Client Configuration Example Ip address bootp-allocDhcp-alloc Display related information on a Displaying and Maintaining DHCP/BOOTP Client ConfigurationDisplay bootp client interface Bootp client Table of Contents ACL Configuration ACL OverviewACL Matching Order Being applied to the hardware directly Ways to Apply an ACL on a DeviceDepth-first match order for rules of a basic ACL Depth-first match order for rules of an advanced ACL ACL Configuration Configuring Time RangeTypes of ACLs Supported by Devices End-time end-date to end-time end-date Time-range time-name start-time to end-timeDays-of-the-week from start-time start-date to End-time end-date from start-time start-date to Configuring Basic ACL Auto configRule-string Rule-string , refer to ACL Command Rule rule-id permit deny Configuring Advanced ACLMatch-order auto config Rule-string , refer to ACL Command Rule-string Refer to ACL Command Configuring Layer 2 ACL ACL Assignment Packet-filter inbound acl-rule Configure procedureAssigning an ACL Globally Assigning an ACL to a Vlan Assigning an ACL to a Port Group System-view Packet-filter vlan vlan-idInbound acl-rule Assigning an ACL to a Port Displaying and Maintaining ACL Examples for Upper-layer Software Referencing ACLs Example for Controlling Telnet Login Users by Source IPExample for Controlling Web Login Users by Source IP SwitchPC Basic ACL Configuration Example Advanced ACL Configuration ExampleExamples for Applying ACLs to Hardware # Apply ACL 3000 on GigabitEthernet 1/0/1 Layer 2 ACL Configuration Example # Apply ACL 4000 on GigabitEthernet 1/0/1 Example for Applying an ACL to a Vlan # Apply ACL 3000 to Vlan Table of Contents Page New Applications and New Requirements QoS ConfigurationTraditional Packet Forwarding Service Introduction to QoS QoS Supported by Devices Major Traffic Control TechniquesTraffic Classification Precedence IP precedence, ToS precedence, and Dscp precedenceIP Precedence decimal IP Precedence binary Description Dscp value decimal Dscp value binary Description 802.1p priority 802.1p priority decimal 802.1p priority binary Description Priority Trust Mode Trusting the Dscp precedence Trusting the 802.1p precedence Dscp precedence Target Dscp precedence Token bucket Protocol PriorityPriority Marking Traffic Policing and Traffic Shaping Evaluating the traffic with the token bucket Traffic policingTraffic shaping Traffic Redirecting Vlan MappingQueue Scheduling SP queuing 7Diagram for SP queuing Sdwrr Burst QoS ConfigurationQoS Configuration Task List Flow-based Traffic Accounting Priority-trust dscp automap Configuring Priority Trust ModePriority priority-level Priority-trust cos automap Configuring Priority Mapping Qos cos-local-precedence-mapQos cos-drop-precedence-map Qos dscp-cos-map dscp-list cos-value Qos cos-dscp-map cos0-map-dscpQos dscp-local-precedence-map dscp-list Qos dscp-drop-precedence-map dscp-listPage Ip-precedence Setting the Priority of Protocol PacketsSystem-view Protocol-priority Protocol-type Traffic-priority vlan vlan-id inbound acl-rule Marking Packet PriorityTraffic-priority inbound acl-rule dscp Dscp-value cos cos-value Required Matching specific ACL rules Configuring Traffic Policing Conform con-action exceed Reset traffic-limit inbound acl-ruleReset traffic-limit vlan vlan-id inbound Traffic-limit inbound acl-rule target-rate Disabled Clear the traffic Configuring Traffic ShapingView Configure traffic By default, traffic policing is Policing Traffic-redirect inbound acl-rule interface Configuring Traffic RedirectingConfiguration examples Traffic-shape queue Traffic-redirect vlan vlan-id inbound acl-rule Acl-rule remark-vlan vlan-id Configuring Vlan MappingConfiguring Queue Scheduling Traffic-remark-vlanid inbound Queue-scheduler wrr group1 Queue-id queue-weight &1-8Group2 queue-id queue-weight Undo queue-scheduler queue-id Traffic-statistic inbound acl-rule Reset traffic-statistic inboundCollecting/Clearing Traffic Statistics Collect the statistics on Packets matching specific ACL Reset traffic-statistic vlan vlan-id Reset traffic-statistic inbound acl-ruleTraffic-statistic vlan vlan-id Refer to Burst for information about the burst function Configuring Traffic MirroringFollow these steps to enable the burst function Enabling the Burst Function Mirrored-to vlan vlan-id Monitor-portMirrored-to inbound acl-rule Monitor-interface Traffic mirroring configuration Required Destination port Exit current viewRequired Mirroring for packets that Displaying and Maintaining QoS Configuration Example of Traffic Policing QoS Configuration ExamplePage Manual application mode QoS Profile ConfigurationQoS Profile Application Mode Dynamic application mode Applying a QoS Profile QoS Profile ConfigurationQoS Profile Configuration Task List Configuring a QoS Profile System-view Apply qos-profile Displaying and Maintaining QoS ProfileQos-profile port-based Undo qos-profile port-based 1Network diagram for QoS profile configuration QoS Profile Configuration Example # Enable Table of Contents Mirroring Overview Mirroring Configuration Remote Port Mirroring Local Port Mirroring 1Ports involved in the mirroring operation Switch Ports involved FunctionMAC-Based Mirroring VLAN-Based Mirroring Configuring Local Port Mirroring Mirroring Configuration Configuration on the device acting as a source switch Configuring Remote Port Mirroring Configuration on the device acting as a destination switch Monitor-port monitor-port Configuring MAC-Based MirroringRemote-probe-vlan-id Remote-destination Configuring VLAN-Based Mirroring Local remote-sourceMirroring-group group-id Mirroring-mac mac vlan Mirroring-group group-id Mirroring-vlan vlan-id Mirroring Configuration ExampleLocal Port Mirroring Configuration Example Displaying and Maintaining Port Mirroring Configure Switch C # Create a local mirroring group Remote Port Mirroring Configuration Example # Configure Vlan 10 as the remote-probe Vlan 4Network diagram for remote port mirroring # Configure Vlan 10 as the remote-probe Vlan Page Table of Contents ARP Message Format ARP ConfigurationIntroduction to ARP ARP Function Proteon ProNET Token Ring Field DescriptionValue Description Experimental Ethernet Chaos ARP entry Generation Method Maintenance ModeARP Table ARP Process Introduction to ARP Attack Detection Man-in-the-middle attackARP attack detection Introduction to Gratuitous ARP Configuring ARPConfiguring ARP Basic Functions Arp timer aging aging-time Arp detection trust Configuring ARP Attack DetectionArp check enable Arp detection enable Configuring Gratuitous ARP Arp restricted-forwardingGratuitous-arp-learning Displaying and Maintaining ARP ARP Configuration ExampleARP Basic Configuration Example ARP Attack Detection Configuration Example # Enable ARP attack detection on all ports in Vlan # Enable Dhcp snooping on Switch a Table of Contents Snmp Versions Snmp ConfigurationSnmp Overview Snmp Operation Mechanism Public MIB MIB attribute MIB content Related RFCSupported MIBs MIB II based on TCP/IP network device RFC Snmp-agent sys-info Configuring Basic Snmp FunctionsConfiguring basic Snmp functions for SNMPv1 or SNMPv2c Snmp-agent Configuring basic Snmp functions for SNMPv3 Configuring Basic Trap Configuring Trap Parameters Configuring Extended Trap Displaying and Maintaining Snmp Snmp Configuration ExamplesSnmp Configuration Examples Enabling Logging for Network Management 2Network diagram for Snmp configuration Network procedure Configuring the NMS Rmon Configuration Introduction to RmonWorking Mechanism of Rmon Commonly Used Rmon Groups Rmon Configuration Rmon Configuration Examples Configuration proceduresDisplaying and Maintaining Rmon # Display the Rmon extended alarm entry numbered Table of Contents Information Transmission in the Unicast Mode Multicast OverviewMulticast Overview 1Information transmission in the unicast mode Information Transmission in the Broadcast Mode 2Information transmission in the broadcast mode Information Transmission in the Multicast Mode Roles in Multicast 3Information transmission in the multicast mode Application of multicast Multicast ModelsAdvantages and Applications of Multicast Advantages of multicast SSM model Multicast ArchitectureASM model SFM model IP multicast address Class D address range DescriptionReserved multicast addresses IP addresses for permanent Ethernet multicast MAC address Layer 3 multicast protocols Multicast Protocols 5Positions of Layer 3 multicast protocols Layer 2 multicast protocols Implementation of the RPF Mechanism Multicast Packet Forwarding Mechanism 7RPF check process RPF CheckPage Basic Concepts in Igmp Snooping Igmp Snooping ConfigurationIgmp Snooping Overview Principle of Igmp Snooping Work Mechanism of Igmp Snooping Timer Description Message before Action after expiry Expiry When receiving a general query When receiving a membership reportWhen receiving a leave message Igmp Snooping Configuration Igmp Snooping Configuration Task ListComplete the following tasks to configure Igmp Snooping Igmp-snooping version Configuring the Version of Igmp SnoopingIgmp-snooping enable Enabling Igmp Snooping Configuring Timers Configuring Fast Leave ProcessingEnabling fast leave processing in system view Enabling fast leave processing in Ethernet port view Configuring a Multicast Group FilterEnable fast leave processing Required By default, the fast leave For specific VLANs Acl-number vlan vlan-list Configuring a multicast group filter in system viewConfiguring a multicast group filter in Ethernet port view Igmp -snooping group -policy Configuring Igmp Querier Igmp-snooping group-limit limitVlan vlan list overflow-replace Suppressing Flooding of Unknown Multicast Traffic in a Vlan Configuring Static Member Port for a Multicast Group Multicast static-group Configuring a Static Router PortEthernet port view Vlan interface view Source-ip source-address Configuring a Port as a Simulated Group MemberVlan view Igmp host-join group-address Configuring a Vlan Tag for Query Messages Configuring Multicast VlanVlan-mapping vlan Port trunk permit vlan vlan-list Igmp enableService-type multicast Hybrid Port hybrid vlan vlan-id-list Igmp Snooping Configuration Examples Configuring Igmp SnoopingDisplaying and Maintaining Igmp Snooping Configure Switch a # Enable Igmp Snooping globally 3Network diagram for Igmp Snooping configuration Device Device description Networking description Interface IP address of Vlan 20 isGigabitEthernet 1/0/1 is connected to the workstation # Configure Vlan 4Network diagram for multicast Vlan configuration Symptom Multicast function does not work on the device Troubleshooting Igmp Snooping Mac-address multicast Common Multicast ConfigurationCommon Multicast Configuration Configuring a Multicast MAC Address Entry Display mac-address multicast Displaying and Maintaining Common Multicast ConfigurationConfiguring Dropping Unknown Multicast Packets Unknown-multicast drop Table of Contents NTP Configuration Introduction to NTPApplications of NTP Implementation Principle of NTP 1Implementation principle of NTP NTP Implementation Modes Server/client mode Symmetric peer modeBroadcast mode NTP implementation Configuration on the device Mode Multicast mode Complete the following tasks to configure NTP NTP Configuration Task ListConfiguring NTP Implementation Modes Configuring NTP Server/Client Mode Configuring the NTP Symmetric Peer Mode NTP broadcast server Configuring NTP Broadcast ModeConfigure the device to work Ntp-service broadcast-server Configuring NTP Multicast Mode Configuring the device to work in the multicast server modeConfiguring the device to work in the multicast client mode Server synchronization Configuring Access Control RightConfiguring NTP Authentication Ntp-service access peer Role of device Working mode Configuring NTP authentication on the client Configuring NTP authentication on the server While Configuring Configuring Optional NTP ParametersConfigure on NTP Broadcast Server Mode and NTP multicast Broadcast Max-dynamic-sessions Displaying and Maintaining NTP ConfigurationNTP Configuration Examples Disabling an Interface from Receiving NTP messages # Set Device a as the NTP server of Device B Configuring NTP Symmetric Peer Mode Configure Device C # Set Device a as the NTP server# Set Device C as the peer of Device B 8Network diagram for the NTP broadcast mode configuration # Set Device a as a broadcast client Configure Device C # Enter system view 9Network diagram for NTP multicast mode configuration Configuring NTP Server/Client Mode with Authentication Configure Device B # Enter system view# Enable the NTP authentication function # Specify the key 42 as a trusted key Table of Contents Algorithm and Key SSH ConfigurationSSH Overview Introduction to SSH Asymmetric Key Algorithm SSH Operating ProcessStages Description Authentication negotiation Version negotiationKey negotiation Configuring the SSH Server Session requestData exchange Command-authorization SSH Server Configuration TasksConfiguring the Protocol Support for the User Interface Authentication-mode scheme Generating/Destroying a RSA or DSA Key Pair Exporting the RSA or DSA Public Key Creating an SSH User and Specify an Authentication Type Stelnet sftp all Specifying a Service Type for an SSH UserConfiguring SSH Management Ssh user username service-type Configuring the Client Public Key on the Server Public-key-code end Peer-public-key endRsa peer-public-key keyname Publickey rsa-key keyname Assigning a Public Key to an SSH UserSpecifying a Source IP Address/Interface for the SSH Server Ssh user username assign Configuring the SSH Client SSH Client Configuration TasksConfiguring the SSH Client Using an SSH Client Software 2Generate a client key Generate a client key 4Generate the client keys Launch PuTTY.exe. The following window appears Specify the IP address of the Server Select a protocol for remote connection Select an SSH versionAs shown in -7, select SSH under Protocol 8SSH client configuration interface Open an SSH connection with publickey authentication 10SSH client interface Configuring the SSH Client on an SSH2-Capable Device Open an SSH connection with password authenticationConfigure whether first-time authentication is supported Establish the connection between the SSH client and server Ssh2 source-interface Displaying and Maintaining SSH ConfigurationSpecifying a Source IP address/Interface for the SSH client Ssh2 source-ip ip-address SSH Configuration Examples # Enable the user interfaces to support SSH# Generate RSA and DSA key pairs Page 14SSH client interface # Assign the public key Switch001 to client client001 # Set the client’s command privilege level toPage 18Generate a client key pair Page 22SSH client interface Device system-view Device interface vlan-interface # Establish a connection to the server # Set the user command privilege level to # Assign the public key Switch001 to user client001# Generate a DSA key pair 25Network diagram of SSH client configuration # Set AAA authentication on user interfaces # Configure the user interfaces to support SSH# Assign public key Switch001 to user client001 # Establish the SSH connection to server # Specify the host public key pair name of the server Table of Contents Introduction to File System File System Management ConfigurationFile System Configuration File System Configuration Tasks File Operations Format device Prompt Mode ConfigurationFlash Memory Operations Execute filename File prompt alert quiet File System Configuration Example File Attribute Configuration Attribute Description Feature IdentifierIntroduction to File Attributes Configuring File Attributes Table of Contents Description Remarks FTP and Sftp ConfigurationIntroduction to FTP and Sftp Introduction to FTP Introduction to Sftp FTP ConfigurationFTP Configuration The Device Operating as an FTP Server Service-type ftp Configuring connection idle time Ftp timeout minutesEnabling an FTP server Ftp disconnect user-name Disconnecting a specified userFtp-server source-interface Ftp-server source-ip ip-address Configuring the banner for an FTP server FTP Configuration The Device Operating as an FTP Client Basic configurations on an FTP clientDisplaying FTP server information Close CdupLcd Disconnect Configuration Example The Device Operating as an FTP Server # Upload the config.cfg file. ftp put config.cfg FTP Banner Display Configuration Example 4Network diagram for FTP banner display configuration # Enter the authorized directory on the FTP server Follow these steps to enable an Sftp server Sftp ConfigurationSftp Configuration The Device Operating as an Sftp Server Complete the following tasks to configure Sftp Time for the Sftp server Minutes by default Sftp Configuration The Device Operating as an Sftp ClientBasic configurations on an Sftp client Ftp timeout time-out-value Remove remote-file Help all command-nameSftp host-ip host-name Delete remotefile Display sftp source-ip Sftp Configuration ExampleSftp source-interface Sftp source-ip ip-address # Create a local user client001 # Specify the SSH authentication mode as AAA# Specify the service type as Sftp # Enable the Sftp server Sftp-client # Exit Sftp Introduction to Tftp Tftp ConfigurationTftp Configuration Complete the following tasks to configure Tftp Tftp-server acl acl-number Tftp Configuration The Device Operating as a Tftp ClientBasic configurations on a Tftp client Tftp ascii binary Display tftp source-ip Tftp Configuration ExampleTftp source-interface Tftp source-ip ip-address Device tftp 1.1.1.2 get config.cfg config.cfg Table of Contents Classification of system information Information CenterInformation Center Overview Introduction to Information Center Ten channels and six output directions of system information Module name Description Outputting system information by source module System Information Format Priority TimestampSysname Introduction to the Information Center Configuration Tasks Information Center Configuration Set for the system Configuring Synchronous Information Output Setting to output system information to the console Setting to Output System Information to the Console Terminal logging Enabling system information display on the consoleTerminal monitor Terminal debugging Info-center monitor channel Setting to Output System Information to a Monitor TerminalSetting to output system information to a monitor terminal Enabling system information display on a monitor terminal Setting to Output System Information to a Log Host Info-center loghostInfo-center loghost source Info-center source Setting to Output System Information to the Trap BufferSetting to Output System Information to the Log Buffer Info-center trapbuffer Setting to Output System Information to the Snmp NMS Info-center logbufferInfo-center snmp channel Information Center Configuration Examples Displaying and Maintaining Information CenterLog Output to a Unix Log Host # mkdir /var/log/Switch # touch /var/log/Switch/information Log Output to a Linux Log Host 2Network diagram for log output to a Linux log host Log Output to the Console 3Network diagram for log output to the console 4Network diagram # Enable terminal display Table of Contents Introduction to Loading Approaches Host Configuration File LoadingRemote Loading Using FTP Loading procedure using FTP client Restart Switch Loading procedure using FTP server 2Remote loading using FTP server Use the put command to upload the file config.cfg to Switch Remote Loading Using Tftp Basic System Configuration Basic System Configuration and Debugging Display clock Displaying the System StatusDebugging the System Enabling/Disabling System Debugging Displaying Operating Information about Modules in System Displaying Debugging Status Tracert Network Connectivity TestNetwork Connectivity Test Ping Device Management Device Management ConfigurationDevice Management Configuration Tasks Rebooting the Device Schedule reboot regularity Scheduling a Reboot on the DeviceSchedule reboot at hhmm Schedule reboot delay Identifying and Diagnosing Pluggable Transceivers Introduction to pluggable transceiversIdentifying pluggable transceivers Diagnosing pluggable transceivers Table of Contents VLAN-VPN Configuration VLAN-VPN OverviewIntroduction to VLAN-VPN Implementation of VLAN-VPN Adjusting the Tpid Values of VLAN-VPN Packets VLAN-VPN Configuration Enabling the VLAN-VPN Feature for a PortProtocol type Value Vlan-vpn tpid value Tpid Adjusting ConfigurationVlan-vpn uplink enable Displaying and Maintaining VLAN-VPN 4Network diagram for VLAN-VPN configuration VLAN-VPN Configuration Example Data transfer process SwitchA vlan-vpn tpidPage Selective QinQ Configuration Selective QinQ OverviewSelective QinQ Overview Vlan-vpn vid vlan-id Selective QinQ ConfigurationEnabling the Selective QinQ Feature for a Port Inner-to-Outer Tag Priority Mapping Vlan-vpn priority Selective QinQ Configuration ExampleConfiguring the Inner-to-Outer Tag Priority Mapping Feature Processing Private Network Packets by Their Types # Enable the VLAN-VPN feature on GigabitEthernet 1/0/3 2Network diagram for selective QinQ configuration SwitchA-GigabitEthernet1/0/3 vlan-vpn enable Page Table of Contents HWPing Configuration HWPing OverviewIntroduction to HWPing Test parameter Description Test Types Supported by HWPingHWPing Test Parameters Supported test types Description Username and password DnsDns-server HWPing Configuration Configuration on a HWPing ServerHWPing server configuration tasks HWPing Client Configuration HWPing server configurationHWPing client configuration Datasize size Timeout timeTest-enable Count times Test-type dhcp Source-port port-numberTest-type ftp Filename file-name Password passwordFtp-operation get put Username name Http-operation get post Destination-ip command toDns-server ip-address Test-type http Test-type jitter Destination-port Jitter-packetnum number Jitter-interval intervalTest-type snmpquery This IP address and the one Configure the destination Configured on the HWPingServer for listening services Operation- tag Tcppublic Hwping-serverTcpconnect ip-address7 Test-type tcpprivate Udppublic Test-type udpprivate Time Three seconds Optional Configure the service type Address is specifiedTest-type dns Configuring HWPing client to send Trap messages Icmp Test HWPing Configuration ExampleAdministrator-name operation-tag Displaying and Maintaining HWPing # Display test results Dhcp Test # Configure the test type as dhcp FTP Test # Configure the source IP address # Set the probe timeout time to 30 seconds # Configure the test type as http # Configure the IP address of the Http server asHttp Test Jitter Test # Configure the IP address of the HWPing server as Network diagramConfigure HWPing Client Switch a # Enable the HWPing client # Configure the test type as jitter Snmp Test # Configure the test type as snmp 7Network diagram for the Snmp test TCP Test Tcpprivate Test on the Specified Ports 8Network diagram for the Tcpprivate test # Configure the test type as tcpprivate UDP Test Udpprivate Test on the Specified Ports # Configure the test type as udpprivate DNS Test # Configure the IP address of the DNS server as # Configure the test type as dns Index Table of Contents Resolution procedure DNS ConfigurationStatic Domain Name Resolution Dynamic Domain Name Resolution Configuring Domain Name Resolution Configuring Static Domain Name ResolutionDNS suffixes DNS Configuration Example Configuring Dynamic Domain Name ResolutionStatic Domain Name Resolution Configuration Example 2Network diagram for static DNS configuration Dynamic Domain Name Resolution Configuration Example # Configure com as the DNS suffix # Configure the IP address 2.1.1.2 for the DNS server Displaying and Maintaining DNS Troubleshooting DNS Configuration Table of Contents Smart Link group Smart Link ConfigurationSmart Link Overview Basic Concepts in Smart Link Control Vlan for sending flush messages Master portSlave port Flush message Configuring Smart Link Complete the following tasks to configure Smart LinkOperating Mechanism of Smart Link Configuring a Smart Link Device Smart-link flush enable control-vlan vlan-id port Configuring Associated DevicesPrecautions Flush enable control-vlan Smart Link Configuration Example Implementing Link Redundancy BackupDisplaying and Maintaining Smart Link # Return to system view # Configure to send flush messages within Vlan SwitchD system-view Introduction to Monitor Link Monitor Link Configuration How Monitor Link Works 2Network diagram for a Monitor Link group implementation Configuring Monitor Link Configuring the Uplink PortCreating a Monitor Link Group Configuring a Downlink Port UplinkPort monitor-link group Displaying and Maintaining Monitor Link Monitor Link Configuration Example # Create Smart Link group 1 and enter Smart Link group view # Configure to send flush messages in Vlan SwitchC monitor-link group Table of Contents Advantages of PoE PoE ConfigurationPoE Overview Introduction to PoE Maximum Power Provided by Each Electrical Port PoE ConfigurationPoE Features Supported by the Device PoE Configuration Task List Poe max-power max-power Enabling the PoE Feature on a PortSetting the Maximum Output Power on a Port Poe enable Poe priority critical high Setting PoE Management Mode and PoE Priority of a PortSetting the PoE Mode on a Port Poe power-management Upgrading the PSE Processing Software Online Configuring the PD Compatibility Detection FunctionPoe legacy enable Poe update refresh Networking requirements PoE Configuration ExampleDisplaying and Maintaining PoE Configuration PoE Configuration Example # Upgrade the PSE processing software online 1Network diagram for PoE Introduction to PoE Profile PoE Profile ConfigurationPoE Profile Configuration Configuring PoE Profile All-profile interface Displaying and Maintaining PoE Profile ConfigurationPoE Profile to Port Display poe-profile PoE Profile Configuration Example PoE Profile Application Example# Create Profile1, and enter PoE profile view # Display detailed configuration information for Profile1 # Display detailed configuration information for Profile2# Create Profile2, and enter PoE profile view Table of Contents Page Routing Table IP Routing Protocol OverviewIntroduction to IP Route and Routing Table IP RoutePage Routing Protocols and Routing Priority Routing Protocol OverviewStatic Routing and Dynamic Routing Classification of Dynamic Routing Protocols Load sharing Load Sharing and Route BackupRoute backup Routing Information Sharing Displaying and Maintaining a Routing Table Static Route Configuration Introduction to Static RouteStatic Route Static Route Configuration Default RouteConfiguring a Static Route Displaying and Maintaining Static Routes Static Route Configuration Example # Approach 2 Configure a static route on Switch B Troubleshooting a Static Route# Approach 2 Configure a static route on Switch a # Approach 1 Configure static routes on Switch B RIP routing database RIP ConfigurationRIP Overview Basic Concepts RIP timers RIP Startup and OperationRouting loops prevention Rip RIP Configuration Task ListBasic RIP Configuration Configuring Basic RIP Functions Setting the RIP operating status on an interface RIP Route ControlSpecifying the RIP version on an interface Rip metricin value Configuring RIP Route ControlSetting the additional routing metrics of an interface Configuring RIP route summarization Disabling the router from receiving host routes Configuring RIP to filter incoming/outgoing routes Setting RIP preference RIP Network Adjustment and Optimization Configuring RIP-1 packet zero field check Configuration TasksConfiguring RIP timers Configuring split horizon Simple password md5 Setting RIP-2 packet authentication modeConfiguring RIP to unicast RIP packets Rip authentication-mode RIP Configuration Example Displaying and Maintaining RIP Configuration Configure Switch C # Configure RIP Troubleshooting RIP ConfigurationFailed to Receive RIP Updates Configure Switch B # Configure RIP Filters IP Route Policy ConfigurationIP Route Policy Overview Introduction to IP Route Policy Route policy IP Route Policy Configuration Task ListRoute Policy Configuration For ACL configuration, refer to the part discussing ACL Defining if-match Clauses and apply Clauses Defining a Route Policy Apply cost value IP Route Policy Configuration ExampleDisplaying and Maintaining IP Route Policy If-match ip next-hop acl Configuration considerations SwitchC-acl-basic-2000 quit SwitchC acl number Configuration verification Precautions Troubleshooting IP Route Policy Table of Contents UDP Helper Configuration Introduction to UDP HelperProtocol UDP port number Configuring UDP Helper Cross-Network Computer Search Through UDP Helper UDP Helper Configuration Example# Enable UDP Helper on Switch a Displaying and Maintaining UDP Helper Table of Contents Appendix a Acronyms Protocol Independent Multicast-Sparse Mode Medium Access ControlNon Broadcast MultiAccess Protocol Independent Multicast-Dense Mode

EAD Configuration

radius scheme

server-type extended

security-policy-server

ip-address

EAD Configuration Example

Network requirements