HP 3600 v2 Layer 2 - LAN Switching Configuration Guide
HP 3600 v2 Switch Series
Layer 2 - LAN Switching
Configuration Guide
Part number: 5998-2350
Software version: Release 2101
Document version: 6W101-20130930
Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
Contents
Ethernet interface configuration ·································································································································· 1
Ethernet interface naming conventions ··························································································································· 1
General configuration ······················································································································································ 1
Configuring a combo interface ······························································································································· 1
Configuring basic settings of an Ethernet interface ······························································································ 2
Shutting down an Ethernet interface ······················································································································· 3
Configuring flow control on an Ethernet interface ································································································ 3
Configuring link change suppression on an Ethernet interface ··········································································· 4
Configuring loopback testing on an Ethernet interface ························································································ 5
Configuring the link mode of an Ethernet interface ······························································································ 5
Configuring jumbo frame support ·························································································································· 6
Enabling the auto power-down function on an Ethernet interface ······································································ 6
Configuring a Layer 2 Ethernet interface ······················································································································· 7
Layer 2 Ethernet interface configuration task list ·································································································· 7
Configuring a port group ········································································································································ 8
Setting speed options for auto negotiation on an Ethernet interface ·································································· 8
Configuring storm suppression ······························································································································· 9
Setting the statistics polling interval ····················································································································· 10
Enabling loopback detection on an Ethernet interface ····················································································· 11
Setting the MDI mode of an Ethernet interface ·································································································· 13
Enabling bridging on an Ethernet interface········································································································ 14
Testing the cable connection of an Ethernet interface ······················································································· 14
Configuring storm control on an Ethernet interface ··························································································· 15
Setting the MTU for a Layer 3 Ethernet interface ········································································································ 16
Displaying and maintaining an Ethernet interface ····································································································· 16
Loopback and null interface configuration ··············································································································· 18
Configuring a loopback interface ································································································································ 18
Introduction to the loopback interface················································································································· 18
Configuration procedure ······································································································································ 18
Configuring the null interface ······································································································································· 19
Introduction to the null interface ··························································································································· 19
Configuration procedure ······································································································································ 19
Displaying and maintaining loopback and null interfaces ························································································ 20
MAC address table configuration····························································································································· 21
Overview ········································································································································································· 21
How a MAC address table entry is created ······································································································· 21
Types of MAC address table entries ··················································································································· 21
MAC address table-based frame forwarding ···································································································· 22
Configuring the MAC address table ···························································································································· 22
Configuring static, dynamic, and blackhole MAC address table entries ······················································· 22
Disabling MAC address learning on a VLAN ···································································································· 23
Configuring the aging timer for dynamic MAC address entries ······································································ 23
Configuring the MAC learning limit on ports ····································································································· 24
Enabling MAC address roaming ························································································································· 24
Displaying and maintaining MAC address tables ····································································································· 26
MAC address table configuration example ················································································································ 26
i
MAC Information configuration ································································································································ 28
Overview ········································································································································································· 28
Introduction to MAC Information ························································································································· 28
How MAC Information works ······························································································································ 28
Configuring MAC Information ······································································································································ 28
Enabling MAC Information globally ··················································································································· 28
Enabling MAC Information on an interface ······································································································· 28
Configuring MAC Information mode ·················································································································· 29
Configuring the interval for sending Syslog or trap messages ········································································· 29
Configuring the MAC Information queue length ································································································ 29
MAC Information configuration example ···················································································································· 30
Ethernet link aggregation configuration ··················································································································· 31
Overview ········································································································································································· 31
Basic concepts ······················································································································································· 31
Aggregating links in static mode ························································································································· 34
Aggregating links in dynamic mode ··················································································································· 35
Load-sharing criteria for link aggregation groups ····························································································· 37
Ethernet link aggregation configuration task list ········································································································· 37
Configuring an aggregation group ····························································································································· 38
Configuration guidelines ······································································································································ 38
Configuring a static aggregation group ············································································································· 39
Configuring a dynamic aggregation group ······································································································· 40
Configuring an aggregate interface ···························································································································· 42
Configuring the description of an aggregate interface ····················································································· 42
Configuring the MTU of a Layer 3 aggregate interface ··················································································· 42
Enabling link state traps for an aggregate interface ························································································· 43
Setting the minimum number of Selected ports for an aggregation group ····················································· 43
Shutting down an aggregate interface ··············································································································· 44
Restoring the default settings for an aggregate interface ················································································· 44
Configuring load sharing for link aggregation groups ······························································································ 45
Configuring load-sharing criteria for link aggregation groups ········································································ 45
Enabling local-first load sharing for link aggregation ······················································································· 46
Enabling link-aggregation traffic redirection ··············································································································· 47
Displaying and maintaining Ethernet link aggregation ····························································································· 47
Ethernet link aggregation configuration examples ····································································································· 48
Layer 2 static aggregation configuration example ···························································································· 48
Layer 2 dynamic aggregation configuration example ······················································································ 50
Layer 3 static aggregation configuration example ···························································································· 52
Layer 3 dynamic aggregation configuration example ······················································································ 54
Port isolation configuration ········································································································································ 56
Introduction to port isolation ········································································································································· 56
Assigning a port to the isolation group ······················································································································· 56
Displaying and maintaining isolation groups ············································································································· 56
Port isolation configuration example ···························································································································· 57
Spanning tree configuration ······································································································································ 58
STP ··················································································································································································· 58
STP protocol packets ············································································································································· 58
Basic concepts in STP ············································································································································ 59
Calculation process of the STP algorithm ··········································································································· 60
RSTP ················································································································································································· 65
PVST ················································································································································································· 66
MSTP ················································································································································································ 66
STP, RSTP, and PVST limitations ·························································································································· 66
ii
MSTP features ························································································································································ 66
MSTP basic concepts ············································································································································ 66
How MSTP works ·················································································································································· 70
Implementation of MSTP on devices ···················································································································· 71
Protocols and standards ················································································································································ 71
Spanning tree configuration task list ···························································································································· 71
Configuring the spanning tree ······································································································································ 76
Setting the spanning tree mode ··························································································································· 76
Configuring an MST region ································································································································· 76
Configuring the root bridge or a secondary root bridge ·················································································· 77
Configuring the device priority ···························································································································· 78
Configuring the maximum hops of an MST region ··························································································· 79
Configuring the network diameter of a switched network ················································································ 79
Configuring spanning tree timers ························································································································ 80
Configuring the timeout factor ····························································································································· 81
Configuring the maximum port rate ···················································································································· 82
Configuring edge ports ········································································································································· 82
Configuring path costs of ports ···························································································································· 83
Configuring the port priority ································································································································ 85
Configuring the port link type ······························································································································ 86
Configuring the mode a port uses to recognize/send MSTP packets ····························································· 86
Enabling the output of port state transition information ···················································································· 87
Enabling the spanning tree feature ····················································································································· 87
Performing mCheck ··············································································································································· 89
Configuring Digest Snooping ······························································································································· 89
Configuring No Agreement Check······················································································································ 92
Configuring TC snooping ····································································································································· 94
Configuring protection functions ·························································································································· 95
Displaying and maintaining the spanning tree ··········································································································· 98
Spanning tree configuration examples ························································································································ 99
MSTP configuration example ······························································································································· 99
PVST configuration example ······························································································································ 103
BPDU tunneling configuration ································································································································ 107
Introduction to BPDU tunneling ··································································································································· 107
Background ·························································································································································· 107
BPDU tunneling implementation ························································································································· 108
Configuring BPDU tunneling ······································································································································· 109
Configuration prerequisites ································································································································ 109
Enabling BPDU tunneling ···································································································································· 110
Configuring destination multicast MAC address for BPDUs ··········································································· 110
BPDU tunneling configuration examples ···················································································································· 111
BPDU tunneling for STP configuration example ······························································································· 111
BPDU tunneling for PVST configuration example ····························································································· 112
VLAN configuration ················································································································································ 114
Overview ······································································································································································· 114
VLAN ···································································································································································· 114
VLAN fundamentals············································································································································· 114
VLAN types ·························································································································································· 115
Protocols and standards ····································································································································· 116
Configuring basic VLAN settings································································································································ 116
Configuring basic settings of a VLAN interface ······································································································· 117
VLAN interface overview ···································································································································· 117
Configuration procedure ···································································································································· 117
iii
VLAN interface configuration example ············································································································· 118
Port-based VLAN configuration ·································································································································· 119
Introduction to port-based VLAN ······················································································································· 119
Assigning an access port to a VLAN ················································································································ 120
Assigning a trunk port to a VLAN······················································································································ 121
Assigning a hybrid port to a VLAN ··················································································································· 122
Port-based VLAN configuration example ·········································································································· 123
MAC-based VLAN configuration ································································································································ 125
Introduction to MAC-based VLAN ····················································································································· 125
Configuring a MAC-based VLAN ······················································································································ 127
MAC-based VLAN configuration example ······································································································· 129
Protocol-based VLAN configuration ··························································································································· 132
Introduction to protocol-based VLAN ················································································································ 132
Configuring a protocol-based VLAN ················································································································· 132
Protocol-based VLAN configuration example ··································································································· 133
IP subnet-based VLAN configuration ·························································································································· 136
Introduction ·························································································································································· 136
Configuring an IP subnet-based VLAN ·············································································································· 136
IP subnet-based VLAN configuration example ································································································· 137
Displaying and maintaining VLAN ···························································································································· 139
Super VLAN configuration ······································································································································ 141
Overview ······································································································································································· 141
Configuring a super VLAN ·········································································································································· 141
Displaying and maintaining super VLAN ·················································································································· 143
Super VLAN configuration example ·························································································································· 143
Isolate-user-VLAN configuration ····························································································································· 146
Overview ······································································································································································· 146
Configuring an isolate-user-VLAN ······························································································································ 146
Displaying and maintaining isolate-user-VLAN ········································································································· 148
Isolate-user-VLAN configuration example ·················································································································· 149
Voice VLAN configuration ······································································································································ 152
Overview ······································································································································································· 152
OUI addresses ····················································································································································· 152
Voice VLAN assignment modes ························································································································· 152
Security mode and normal mode of voice VLANs ··························································································· 154
Configuring a voice VLAN ·········································································································································· 155
Configuration prerequisites ································································································································ 155
Configuring QoS priority settings for voice traffic on an interface ································································ 156
Configuring a port to operate in automatic voice VLAN assignment mode ················································· 156
Configuring a port to operate in manual voice VLAN assignment mode ····················································· 157
Displaying and maintaining voice VLAN ·················································································································· 158
Voice VLAN configuration examples ························································································································· 158
Automatic voice VLAN mode configuration example ····················································································· 158
Manual voice VLAN assignment mode configuration example ····································································· 160
GVRP configuration ················································································································································· 163
Introduction to GVRP ···················································································································································· 163
GARP ···································································································································································· 163
GVRP ····································································································································································· 166
Protocols and standards ····································································································································· 166
GVRP configuration task list ········································································································································ 167
Configuring GVRP functions ········································································································································ 167
Configuring the GARP timers ······································································································································ 168
iv
Displaying and maintaining GVRP ····························································································································· 169
GVRP configuration examples ···································································································································· 169
GVRP normal registration mode configuration example ················································································· 169
GVRP fixed registration mode configuration example ···················································································· 171
GVRP forbidden registration mode configuration example ············································································ 172
QinQ configuration················································································································································· 174
Introduction to QinQ ···················································································································································· 174
Background and benefits ···································································································································· 174
How QinQ works ················································································································································ 174
QinQ frame structure ·········································································································································· 175
Implementations of QinQ ··································································································································· 176
Modifying the TPID in a VLAN tag ···················································································································· 176
Protocols and standards ····································································································································· 177
QinQ configuration task list ········································································································································ 178
Configuring basic QinQ ············································································································································· 178
Enabling basic QinQ ·········································································································································· 178
Configuring VLAN transparent transmission ···································································································· 179
Configuring selective QinQ ········································································································································ 179
Configuring an outer VLAN tagging policy ····································································································· 179
Configuring an inner-outer VLAN 802.1p priority mapping ·········································································· 180
Configuring inner VLAN ID substitution ············································································································ 182
Configuring the TPID value in VLAN tags ·················································································································· 183
QinQ configuration examples ···································································································································· 183
Basic QinQ configuration example ··················································································································· 183
Simple selective QinQ configuration example ································································································· 186
Comprehensive selective QinQ configuration example ·················································································· 188
VLAN mapping configuration ································································································································ 193
VLAN mapping overview ············································································································································ 193
Application scenario of one-to-one and many-to-one VLAN mapping ·························································· 193
Application scenario of two-to-two VLAN mapping ························································································ 194
Concepts and terms ············································································································································ 195
VLAN mapping implementations ······················································································································· 196
Configuring VLAN mapping ······································································································································· 198
Configuring one-to-one VLAN mapping············································································································ 198
Configuring many-to-one VLAN mapping········································································································· 200
Configuring two-to-two VLAN mapping ············································································································ 203
VLAN mapping configuration examples ··················································································································· 206
One-to-one and many-to-one VLAN mapping configuration example ··························································· 206
Two-to-two VLAN mapping configuration example ························································································· 212
LLDP configuration ··················································································································································· 215
Overview ······································································································································································· 215
Background ·························································································································································· 215
Basic concepts ····················································································································································· 215
How LLDP works ·················································································································································· 219
Protocols and standards ····································································································································· 220
LLDP configuration task list ·········································································································································· 220
Performing basic LLDP configuration ·························································································································· 221
Enabling LLDP ······················································································································································ 221
Setting the LLDP operating mode ······················································································································· 221
Setting the LLDP re-initialization delay··············································································································· 221
Enabling LLDP polling·········································································································································· 222
Configuring the advertisable TLVs ····················································································································· 222
Configuring the management address and its encoding format ···································································· 223
v
Setting other LLDP parameters ···························································································································· 224
Setting an encapsulation format for LLDPDUs··································································································· 224
Configuring CDP compatibility ··································································································································· 225
Configuration prerequisites ································································································································ 225
Configuring CDP compatibility ·························································································································· 225
Configuring LLDP trapping ·········································································································································· 226
Displaying and maintaining LLDP ······························································································································· 227
LLDP configuration examples ······································································································································ 227
Basic LLDP configuration example ····················································································································· 227
CDP-compatible LLDP configuration example ··································································································· 230
Service loopback group configuration ·················································································································· 232
Overview ······································································································································································· 232
Service types of service loopback groups ········································································································ 232
Requirements on service loopback ports··········································································································· 232
States of service loopback ports ························································································································ 232
Configuring a service loopback group ······················································································································ 233
Displaying and maintaining service loopback groups ····························································································· 234
Service loopback group configuration example ······································································································· 234
Support and other resources ·································································································································· 236
Contacting HP ······························································································································································ 236
Subscription service ············································································································································ 236
Related information ······················································································································································ 236
Documents ···························································································································································· 236
Websites ······························································································································································· 236
Conventions ·································································································································································· 237
Index ········································································································································································ 239
vi
Ethernet interface configuration
Ethernet interface naming conventions
The GE and 10-GE interfaces on the 3600 v2 switches are named in the format of interface-type A/B/C,
where the following definitions apply:
• A represents the ID of the switch in an IRF fabric. If the switch is not assigned to any IRF fabric, A
uses 1.
• B represents a slot number on the switch. It takes 0.
• C represents the number of an interface on a slot.
General configuration
This section describes the attributes and configurations common to Layer 2 and Layer 3 Ethernet
interfaces.
• For more information about the attributes and configuration of Layer 2 Ethernet interfaces, see
“Configuring a Layer 2 Ethernet interface.”
• F
or more information about the attributes and configuration of Layer 3 Ethernet interfaces, see
“Setting the MTU for a Layer 3 Ethernet interface.”
Configuring a combo interface
Introduction to combo interfaces
A combo interface is a logical interface that comprises one optical (fiber) port and one electrical (copper)
port. The two ports share one forwarding interface, so they cannot work simultaneously. When you
enable either port, the other port is automatically disabled.
The fiber combo port and the copper combo port share one interface view, in which you can activate the
fiber or copper combo port and configure other port attributes such as the interface rate and duplex
mode.
Configuration prerequisites
Before you configure combo interfaces, complete the following tasks:
• An 3600 v2 switch provides two combo interfaces. The fiber port and copper port of a combo
interface have the same port number. For more information about the combo interface numbers, see
the installation guide of a specific model.
• Use the display interface command to determine which port (fiber or copper) of the combo
interface is active. If the current port is the copper port, the output will include “Media type is
twisted pair, Port hardware type is 1000_BASE_T”. If the current port is the fiber port, the output will
not include the information mentioned above. You can also use the display this command in the
view of the combo interface to view the combo interface configuration. If the combo enable fiber
command exists, the fiber port is active, if the command does not exist, the copper fiber is active.
1
Changing the active port of a combo interface
Follow these steps to change the active port of a combo interface:
To do… Use the command…
Enter system view system-view —
Enter the Ethernet interface view
Activate the copper combo port or
fiber combo port
interface interface-type
interface-number
combo enable { copper | fiber }
Remarks
—
Optional
By default, the copper combo port
is active.
Configuring basic settings of an Ethernet interface
You can set an Ethernet interface to operate in one of the following duplex modes:
• Full-duplex mode (full)—Interfaces that operate in this mode can send and receive packets
simultaneously.
• Half-duplex mode (half)—Interfaces that operate in this mode cannot send and receive packets
simultaneously.
• Auto-negotiation mode (auto)—Interfaces that operate in this mode negotiate a duplex mode with
their peers.
You can set the speed of an Ethernet interface or enable it to automatically negotiate a speed with its
peer. For a 100-Mbps or 1000-Mbps Layer 2 Ethernet interface, you can also set speed options for auto
negotiation. The two ends can select a speed only from the available options. For more information, see
“Setting speed options for auto negotiation on an Ethernet interface.”
F
ollow these steps to configure an Ethernet interface:
To do… Use the command…
Enter system view system-view —
Enter Ethernet interface
view
Set the interface
description
Set the duplex mode of
the interface
Set the port speed
interface interface-type
interface-number
description text
duplex { auto | full |
half }
speed { 10 | 100 | 1000
| auto }
Remarks
—
Optional
By default, the description of an interface is in the format
of interface-name Interface. For example,
Ethernet1/0/1 Interface.
Optional
Fiber ports and combo interfaces do not support the half
keyword.
By default, the duplex mode is auto for Ethernet
interfaces.
Optional
By default, an Ethernet interface automatically
negotiates a speed with the peer.
The 10 and 1000 keywords are not applicable to
100-Mbps fiber ports.
The 10 and 100 keywords are not applicable to GE
fiber ports and copper combo port.
2
To do… Use the command… Remarks
g
Restore the default
settings for the interface
default Optional
NOTE:
Make sure that the fiber port speed matches the speed requirement of the inserted transceiver module. For
example, after you insert a 1000-Mbps transceiver module into a fiber port, confi
the speed 1000 or speed auto command.
Shutting down an Ethernet interface
You might need to shut down and then bring up an Ethernet interface to activate some configuration
changes, for example, the speed or duplex mode changes.
Follow these steps to shut down an Ethernet interface or a group of Ethernet interfaces:
To do… Use the command…
Enter system view system-view —
• Enter Ethernet interface view:
Enter Ethernet interface
view or port group view
interface interface-type interface-number
• Enter port group view:
port-group manual port-group-name
ure the port speed with
Remarks
Use any command.
To shut down an Ethernet interface,
enter Ethernet interface.
To shut down all Ethernet interfaces in
a port group, enter port group view.
Shut down the Ethernet
interface or interfaces
CAUTION:
shutdown
Required
By default, Ethernet interfaces are up.
Use this command with caution. After you manually shut down an Ethernet interface, the Ethernet interface
cannot forward packets even if it is physically connected.
Configuring flow control on an Ethernet interface
To avoid packet drops on a link, you can enable flow control at both ends of the link. When traffic
congestion occurs at the receiving end, the receiving end sends a flow control (Pause) frame to ask the
sending end to suspend sending packets
• With the flow-control command configured, an interface can both send and receive flow control
frames: When congested, the interface sends a flow control frame to its peer. Upon receiving a flow
control frame from the peer, the interface suspends sending packets.
• With the flow-control receive enable command configured, an interface can receive, but not send
flow control frames. When the interface receives a flow control frame from its peer, it suspends
sending packets to the peer. When congested, the interface cannot send flow control frames to the
peer.
To handle unidirectional traffic congestion on a link, configure the flow-control receive enable command
at one end, and the flow-control command at the other. To enable both ends of the link to handle traffic
congestion, configure the flow-control command at both ends.
Follow these steps to enable flow control on an Ethernet interface:
3
To do… Use the command… Remarks
Enter system view system-view —
Enter Ethernet interface view
Enable flow control
interface interface-type
interface-number
• Enable TxRx flow control:
flow-control
• Enable Rx flow control:
flow-control receive enable
—
Required
Use either command.
By default, Rx flow control is disabled
on an Ethernet interface.
Configuring link change suppression on an Ethernet interface
An Ethernet interface has two physical link states: up and down. Each time the physical link of an
interface goes up or comes down, the physical layer reports the change to the upper layers, and the
upper layers handle the change, resulting in increased overhead.
To prevent physical link flapping from affecting system performance, configure link change suppression
to delay the reporting of physical link state changes. When the delay expires, the interface reports any
detected change.
Link change suppression does not suppress administrative up or down events. When you shut down or
bring up an interface by using the shutdown or undo shutdown command, the interface reports the event
to the upper layers immediately.
Link-down event suppression enables an interface to suppress link-down events and start a delay timer
each time the physical link goes down. During this delay, the interface does not report the link-down
event, and the display interface brief or display interface command displays the interface state as UP. If
the physical link is still down when the timer expires, the interface reports the link-down event to the upper
layers.
Link-up event suppression enables an interface to suppress link-up events and start a delay timer each
time the physical link goes up. During this delay, the interface does not report the link-up event, and the
display interface brief or display interface command displays the interface state as DOWN. If the
physical link is still up when the timer expires, the interface reports the link-up event to the upper layers.
Configuring link-down event suppression
Follow these steps to enable an Ethernet interface to suppress link-down events:
To do… Use the command…
Enter system view system-view —
Enter Ethernet interface view
Set a link-down event
suppression interval
interface interface-type
interface-number
link-delay delay-time
Configuring link-up event suppression
Follow these steps to configure link-up event suppression on an Ethernet interface:
Remarks
—
Required
Link-down event suppression is disabled by
default.
4
To do… Use the command…
Enter system view system-view —
Remarks
Enter Ethernet interface view
Set a link-up event
suppression interval
interface interface-type
interface-number
link-delay delay-time mode up
—
Required
Link-up event suppression is disabled by
default.
NOTE:
The link-delay mode up command and the link-delay
command supersedes each other, and whichever is
configured last takes effect.
Configuring loopback testing on an Ethernet interface
If an Ethernet interface does not work normally, you can enable loopback testing on it to identify the
problem. Loopback testing has the following types:
• Internal loopback testing—Tests all on-chip functions related to Ethernet interfaces.
• External loopback testing—Tests hardware of Ethernet interfaces. To perform external loopback
testing on an Ethernet interface, connect a loopback plug to the Ethernet interface. The switch sends
test packets out the interface, which are expected to loop over the plug and back to the interface.
If the interface fails to receive any test packet, the hardware of the interface is faulty.
An Ethernet interface in a loopback test does not forward data traffic.
Follow these steps to enable loopback testing on an Ethernet interface:
To do… Use the command…
Enter system view system-view —
Enter Ethernet interface view
Enable loopback testing
interface interface-type
interface-number
loopback { external | internal }
Remarks
—
Optional
Disabled by default.
NOTE:
• On an interface that is physically down, you can only perform internal loopback testing. On an interface
administratively shut down, you can perform neither internal nor external loopback testing.
• The speed, duplex, mdi, and shutdown commands are not available during loopback testing.
• During loopback testing, the Ethernet interface operates in full duplex mode. When you disable
loopback testing, the port returns to its duplex setting.
• Loopback testing is a one-time operation, and is not recorded in the configuration file.
Configuring the link mode of an Ethernet interface
An Ethernet interface operates either in Layer 2 (bridge) or Layer 3 (route) mode. To meet networking
requirements, you can use a command to set the link mode of an Ethernet interface to bridge or route.
Follow these steps to change the link mode of an Ethernet interface:
5
To do… Use the command…
Enter system view system-view —
• In system view:
Change the link
mode of Ethernet
interfaces
CAUTION:
port link-mode { bridge | route } interface-list
• In Ethernet interface view:
interface interface-type interface-number
port link-mode { bridge | route }
• After you change the link mode of an Ethernet interface, all the settings of the Ethernet interface are
restored to their defaults under the new link mode.
• The link mode configuration for an Ethernet interface in system view and in interface view supersedes
each other.
Configuring jumbo frame support
An Ethernet interface might receive some frames larger than the standard Ethernet frame size (called
"jumbo frames") during high-throughput data exchanges such as file transfers. Usually, an Ethernet
interface discards jumbo frames. With jumbo frame support enabled, the interface can process frames
larger than the standard Ethernet frame size yet within the specified range.
Remarks
Required
Use either approach.
In interface configuration mode (Ethernet interface view or port group view), you can set the length of
jumbo frames that are allowed to pass through the Ethernet interface.
• If you execute the command in Ethernet interface view, the configuration takes effect only on the
interface.
• If you execute the command in port group view, the configuration takes effect on all ports in the port
group.
Follow these steps to configure jumbo frame support in interface view or port group view:
To do… Use the command…
Enter system view system-view —
Enter Ethernet interface
view
Configure jumbo frame
support
interface interface-type
interface-number
jumboframe enable [ value ]
Remarks
—
Required
By default, the switch allows jumbo frames within
10000 bytes to pass through Ethernet interfaces.
If you set the value argument multiple times, the
latest configuration takes effect.
Enabling the auto power-down function on an Ethernet interface
To save power, enable the auto power-down function on Ethernet interfaces. An interface enters the
power save mode if it has not received any packet for a certain period of time (this interval depends on
6
the specifications of the chip, and is not configurable). When a packet arrives later, the interface enters
W
its normal state.
Follow these steps to enable auto power-down on an Ethernet interface:
To do… Use the command…
Enter system view system-view —
Enter Ethernet interface
view
Enable auto power-down
on an Ethernet interface
interface interface-type
interface-number
port auto-power-down
Remarks
Required
Required
Disabled by default.
NOTE:
hen you connect an interface enabled with auto power-down to a device, if the link cannot go up
properly, disable auto power-down on the interface and try again.
Configuring a Layer 2 Ethernet interface
Layer 2 Ethernet interface configuration task list
Complete these tasks to configure an Ethernet interface operating in bridge mode:
Task Remarks
Configuring a port group
Optional
Applicable to Layer 2 Ethernet interfaces
Setting speed options for auto negotiation on an
Ethernet interface
Configuring storm suppression
Setting the statistics polling interval
Enabling loopback detection on an Ethernet interface
Setting the MDI mode of an Ethernet interface
Enabling bridging on an Ethernet interface
Testing the cable connection of an Ethernet interface
Configuring storm control on an Ethernet interface
Optional
Applicable to Layer 2 Ethernet interfaces
Optional
Applicable to Layer 2 Ethernet interfaces
Optional
Applicable to Layer 2 Ethernet interfaces
Optional
Applicable to Layer 2 Ethernet interfaces
Optional
Applicable to Layer 2 Ethernet interfaces
Optional
Applicable to Layer 2 Ethernet interfaces
Optional
Applicable to Layer 2 Ethernet interfaces
Optional
Applicable to Layer 2 Ethernet interfaces
7
Configuring a port group
Some interfaces on your switch might use the same set of settings. To configure these interfaces in bulk
rather than one by one, you can assign them to a port group.
You create port groups manually. All settings made for a port group apply to all the member ports of the
group.
Even though the settings are made on the port group, they are saved on each interface basis rather than
on a port group basis. You can only view the settings in the view of each interface by using the display
current-configuration or display this command.
Follow these steps to configure a manual port group:
To do… Use the command…
Enter system view system-view —
Create a manual port group and
enter manual port group view
Assign Ethernet interfaces to the
manual port group
Configure jumbo frame support
Enable auto power-down port auto-power-down
port-group manual
port-group-name
group-member
interface-list
jumboframe enable
[ value ]
Remarks
Required
Required
If you use the group-member interface-type
interface-start-number to interface-type
interface-end-number command to add multiple
ports in batch to the specified port group, make
sure that the interface-end-number argument
must be greater than the interface-start-number
argument.
Required
By default, the switch allows jumbo frames
within 10000 bytes to pass through Ethernet
interfaces.
If you set the value argument multiple times, the
latest configuration takes effect.
Required
Disabled by default.
Setting speed options for auto negotiation on an Ethernet interface
Speed auto negotiation enables an Ethernet interface to negotiate with its peer for the highest speed that
both ends support by default. You can narrow down the speed option list for negotiation.
8
Figure 1 Speed auto negotiation application scenario
IP network
Eth1/0/4
h1/0/1
Et
Server 1 Server 2 Server 3
Switch A
Eth1
/0
/3
As shown in Figure 1, all ports on Switch A are operating in speed auto negotiation mode, with the
highest speed of 1000 Mbps. If the transmission rate of each server in the server cluster is 1000 Mbps,
their total transmission rate will exceed the capability of port Ethernet 1/0/4, the port providing access
to the Internet for the servers.
To avoid congestion on Ethernet 1/0/4, set 100 Mbps as the only option available for speed
negotiation on port Ethernet 1/0/1, Ethernet 1/0/2, and Ethernet 1/0/3. As a result, the transmission
rate on each port connected to a server is limited to 100 Mbps.
Follow these steps to set speed options for auto negotiation on an Ethernet interface:
To do… Use the command…
Remarks
Enter system view system-view —
Enter Ethernet interface view interface interface-type interface-number —
Set speed options for auto negotiation speed auto { 10 | 100 } * Optional
NOTE:
• This function is available only for Layer 2 copper ports that support speed auto negotiation, and is
unavailable for combo interfaces.
• The speed and speed auto commands supersede each other, and whichever is configured last takes
effect.
Configuring storm suppression
You can use the storm suppression function to limit the size of a particular type of traffic (broadcast,
multicast, or unknown unicast traffic) as a whole globally in system view or on a per-interface basis in
Ethernet interface view or port group view.
NOTE:
The storm suppression thresholds configured for an Ethernet interface might become invalid if you enable
the storm control function for the interface. For information about the storm control function, see
“Configuring storm control on an Ethernet interface.”
9
In interface or port group view, you set the maximum size of broadcast, multicast or unknown unicast
traffic allowed to pass through an interface or each interface in a port group. When the broadcast,
multicast, or unknown unicast traffic on the interface exceeds this threshold, the system discards packets
until the traffic drops below this threshold.
Follow these steps to set storm suppression thresholds on one or multiple Ethernet interfaces:
To do… Use the command… Remarks
Enter system view system-view —
Use either command.
To configure storm suppression
on an Ethernet interface, enter
Ethernet interface view.
To configure storm suppression
on a group of Ethernet interfaces,
enter port group view.
Optional
By default, all broadcast traffic is
allowed to pass through.
Optional
By default, all multicast traffic is
allowed to pass through.
Optional
By default, all unknown unicast
traffic is allowed to pass through.
Enter Ethernet interface view or
port group view
Set the broadcast suppression
threshold ratio
Set the multicast suppression
threshold ratio
Set the unknown unicast
suppression threshold ratio
• Enter Ethernet interface view:
interface interface-type
interface-number
• Enter port group view:
port-group manual port-group-name
broadcast-suppression { ratio | pps
max-pps | kbps max-kbps }
multicast-suppression { ratio | pps
max-pps | kbps max-kbps }
unicast-suppression { ratio | pps
max-pps | kbps max-kbps }
NOTE:
For an Ethernet interface that belongs to a port group, if you set a traffic suppression threshold for the
interface in both Ethernet interface view and port group view, the threshold configured last takes effect.
Setting the statistics polling interval
Follow these steps to set the statistics polling interval globally or on an Ethernet interface:
To do… Use the command…
Enter system view system-view —
Enter Ethernet interface view
Set the statistics polling interval on
the Ethernet interface
To display the interface statistics collected in the last polling interval, use the display interface command.
To clear interface statistics, use the reset counters interface command.
interface interface-type
interface-number
flow-interval interval
10
Remarks
—
Optional
The default interface statistics
polling interval is 300 seconds.
Enabling loopback detection on an Ethernet interface
A p
If a switch receives a packet that it sent, a loop has occurred to the switch. Loops might cause broadcast
storms, which degrade network performance. You can use this feature to detect whether a loop has
occurred.
Depending on whether the receiving interface is the same as the sending interface, loops fall into the
following type: single-port loopback and multi-port loopback.
• Single-port loopback occurs when an interface receives a packet that it sent out and the receiving
interface is the same as the sending interface, as shown in Figure 2.
• Multi-por
t
loopback occurs when a switch receives a packet that it sent out but the receiving
interface might not be the sending interface, as shown in Figure 3.
Figure 2 Single-port loopback
Figure 3 Multi-port loopback
You can enable loopback detection to detect loops on an interface and, if the interface supports the
loopback-detection action command, configure the protective action to take on the receiving interface
when a loop is detected, for example, to shut down the interface. Depending on whether a protective
action is configured, the switch takes the actions in Table 1 to
Table 1 Actions to take upon detection of
a loop condition
alleviate the impact of the loop condition.
Actions
Port type
Access port
No protective action is configured
• Place the receiving interface in controlled mode.
The interface does not receive or send packets.
• Generate traps.
• Delete all MAC address entries of the interface.
11
rotective action is configured
• Perform the configured protective
action.
• Generate traps and log messages.
• Delete all MAC address entries of the
interface.
Port type
A p
Actions
No protective action is configured
• Generate traps.
Hybrid or
trunk port
• If loopback detection control is enabled, place
the receiving interface in controlled mode. The
interface does not receive or send packets.
• Delete all MAC address entries of the interface.
Follow these steps to configure loopback detection:
rotective action is configured
• Create traps and log messages.
• If loopback detection control is
enabled, take the configured
protective action on the interface.
• Delete all MAC address entries of the
interface.
To do… Use the command…
Enter system view system-view —
Enable global loopback
detection
Enable multi-port loopback
detection
Set the loopback detection
interval
loopback-detection enable
loopback-detection
multi-port-mode enable
loopback-detection interval-time
time
• Enter Ethernet interface view
interface interface-type
Enter Ethernet interface
view or port group view
Enable loopback detection
on the interface
Enable loopback detection
control on a trunk port or a
hybrid port
interface-number
• Enter port group view
port-group manual
port-group-name
loopback-detection enable
loopback-detection control
enable
Remarks
Required
Disabled by default.
Optional
By default, multi-port loopback detection is
disabled, and the switch can only detect
single-port loopback.
Optional
30 seconds by default.
Use either command.
To configure loopback detection on one
interface, enter Ethernet interface view.
To configure loopback detection on a group
of Ethernet interfaces, enter port group view.
Required
Disabled by default.
Optional
Disabled by default.
Enable loopback detection
in all the VLANs on the
trunk or hybrid port
Set the protective action to
take on the interface when
a loop is detected
loopback-detection per-vlan
enable
loopback-detection action
{ no-learning | semi-block |
shutdown }
12
Optional
By default, a trunk or hybrid port performs
loopback detection only in its port VLAN ID
(PVID).
Optional
By default, a looped interface does not
receive or send packets; the system
generates traps and deletes all MAC
address entries of the looped interface.
With the shutdown keyword specified, the
switch shuts down the looped ports and set
their physical state to Loop down. When a
looped port recovers, you must use the undo
shutdown command to restore its forwarding
capability.
g
NOTE:
• To use loopback detection on an Ethernet interface, you must enable the function both
the interface.
• To disable loopback detection on all interfaces, run the undo loopback-detection enable command in
system view.
• To enable a hybrid or trunk port to take the administratively specified protective action, you must use the
loopback-detection control enable command on the port.
• When you change the link t ype of an Ethernet interface by us ing the port link-type command, the switch
removes the protective action configured on the interface. For more information about the port link-type
command, see
Layer 2—LAN Switching Command Reference
.
Setting the MDI mode of an Ethernet interface
NOTE:
Fiber ports do not support the MDI mode setting.
You can use both crossover and straight-through Ethernet cables to connect copper Ethernet interfaces.
To accommodate these types of cables, a copper Ethernet interface can operate in one of the following
Medium Dependent Interface (MDI) modes:
• Across mode
• Normal mode
lobally and on
• Auto mode
A copper Ethernet interface uses an RJ-45 connector, which comprises eight pins, each of which plays a
dedicated role. For example, pins 1 and 2 transmit signals, and pins 3 and 6 receive signals. The pin
role varies by the MDI modes as follows:
• In normal mode, pins 1 and 2 are transmit pins, and pins 3 and 6 are receive pins.
• In across mode, pins 1 and 2 are receive pins, and pins 3 and 6 are transmit pins.
• In auto mode, the interface negotiates pin roles with its peer.
To enable the interface to communicate with its peer, make sure that its transmit pins are connected to the
remote receive pins. If the interface can detect the connection cable type, set the interface in auto MDI
mode. If not, set its MDI mode by using the following guidelines:
• When a straight-through cable is used, set the interface to work in the MDI mode different than its
peer.
• When a crossover cable is used, set the interface to work in the same MDI mode as its peer, or set
either end to work in auto mode.
Follow these steps to set the MDI mode of an Ethernet interface:
To do… Use the command…
Enter system view system-view —
Enter Ethernet interface view
interface interface-type
interface-number
Remarks
—
13
To do… Use the command…
Set the MDI mode of the Ethernet
interface
mdi { across | auto | normal }
Enabling bridging on an Ethernet interface
When an incoming packet arrives, the device looks up the destination MAC address of the packet in the
MAC address table. If an entry is found, but the outgoing interface is the same as the receiving interface,
the device discards the packet.
To enable the device to forward such packets rather than drop them, enable the bridging function on the
Ethernet interface.
Follow these steps to enable bridging on an Ethernet interface:
To do… Use the command… Remarks
Enter system view system-view —
Remarks
Optional
By default, a copper Ethernet
interface operates in auto mode to
negotiate pin roles with its peer.
Enter Ethernet interface view
Enable bridging on the Ethernet
interface
interface interface-type
interface-number
port bridge enable
—
Required
Disabled by default.
Testing the cable connection of an Ethernet interface
NOTE:
• Fiber ports do not support this feature.
• If the link of an Ethernet port is up, testing its cable connection will cause the link to come down and then
go up.
You can test the cable connection of an Ethernet interface for a short or open circuit. The switch displays
cable test results within five seconds. If any fault is detected, the test results include the length of the faulty
cable segment.
Follow these steps to test the cable connection of an Ethernet interface:
To do… Use the command…
Enter system view system-view —
Remarks
Enter Ethernet interface view interface interface-type interface-number —
Test the cable connected to the
Ethernet interface
virtual-cable-test Required
14
Configuring storm control on an Ethernet interface
A
t
t
Storm control compares broadcast, multicast, and unknown unicast traffic regularly with their respective
traffic thresholds on an Ethernet interface. For each type of traffic, storm control provides a lower
threshold and a higher threshold.
For management purposes, you can configure the interface to send threshold event traps and log
messages when monitored traffic exceeds the upper threshold or drops below the lower threshold from
the upper threshold.
When a particular type of traffic exceeds its upper threshold, the interface does either of the following,
depending on your configuration:
• Blocks this type of traffic, while forwarding other types of traffic. Even though the interface does not
forward the blocked traffic, it still counts the traffic. When the blocked traffic drops below the lower
threshold, the port begins to forward the traffic.
• Shuts down automatically. The interface shuts down automatically and stops forwarding any traffic.
When the blocked traffic drops below the lower threshold, the port does not forward the traffic. To
bring up the interface, use the undo shutdown command or disable the storm control function.
CAUTION:
lternatively, you can configure the storm suppression function to control a specific type of traffic. Do no
enable them both on an Ethernet interface at the same time because the storm suppression and storm
control functions are mutually exclusive. For example, with an unknown unicast suppression threshold se
on an Ethernet interface, do not enable storm control for unknown unicast traffic on the interface. For more
information about storm suppression, see “Configuring storm suppression.”
Follow these steps to configure storm control on an Ethernet interface:
To do… Use the command…
Enter system view system-view —
Set the traffic polling interval of the
storm control module
Enter Ethernet interface view
Enable storm control, and set the
lower and upper thresholds for
broadcast, multicast, or unknown
unicast traffic
Set the control action to take when
monitored traffic exceeds the
upper threshold
Enable the interface to send storm
control threshold event traps.
storm-constrain interval seconds
interface interface-type
interface-number
storm-constrain { broadcast |
multicast | unicast } { pps | kbps |
ratio } max-pps-values
min-pps-values
storm-constrain control { block |
shutdown }
storm-constrain enable trap
Remarks
Optional
10 seconds by default.
—
Required
Disabled by default.
Optional
Disabled by default.
Optional
By default, the interface sends
traps when monitored traffic
exceeds the upper threshold or
drops below the lower threshold
from the upper threshold.
15
To do… Use the command…
Enable the interface to log storm
control threshold events.
storm-constrain enable log
Remarks
Optional
By default, the interface outputs log
messages when monitored traffic
exceeds the upper threshold or
drops below the lower threshold
from the upper threshold.
NOTE:
• For network stability, use the default or set a higher traffic polling interval.
• Storm control uses a complete polling cycle to collect traffic data, and analyzes the data in the next cycle.
An interface takes one to two polling intervals to take a storm control action.
• The storm control function allows you to set the upper and lower thresholds for all three types of packets
respectively on the same interface.
Setting the MTU for a Layer 3 Ethernet interface
The maximum transmission unit (MTU) affects the fragmentation and re-assembly of IP packets.
Follow these steps to set the MTU for a Layer 3 Ethernet interface:
To do… Use the command…
Enter system view system-view —
Enter Ethernet interface view interface interface-type interface-number —
Set the MTU
mtu size
Remarks
Optional
1500 bytes by default.
Displaying and maintaining an Ethernet interface
To do… Use the command…
display interface [ interface-type ] brief [ down ] [ | { begin
Display Ethernet interface
information
Display traffic statistics for the
specified interfaces
Display traffic rate statistics over
the last sampling interval
| exclude | include } regular-expression ]
display interface interface-type interface-number [ brief ]
[ | { begin | exclude | include } regular-expression ]
display counters { inbound | outbound } interface
[ interface-type ] [ | { begin | exclude | include }
regular-expression ]
display counters rate { inbound | outbound } interface
[ interface-type ] [ | { begin | exclude | include }
regular-expression ]
Remarks
Available in
any view
Available in
any view
Available in
any view
Display information about
discarded packets on the
specified interfaces
Display summary information
about discarded packets on all
interfaces
display packet-drop interface [ interface-type
[ interface-number ] ] [ | { begin | exclude | include }
regular-expression ]
display packet-drop summary [ | { begin | exclude |
include } regular-expression ]
16
Available in
any view
Available in
any view
To do… Use the command…
Remarks
Display information about a
manual port group or all manual
port groups
Display information about the
loopback function
Display information about storm
control
Clear the interface statistics
Clear the statistics of discarded
packets on the specified
interfaces
display port-group manual [ all | name port-group-name ]
[ | { begin | exclude | include } regular-expression ]
display loopback-detection [ | { begin | exclude | include }
regular-expression ]
display storm-constrain [ broadcast | multicast | unicast ]
[ interface interface-type interface-number ] [ | { begin |
exclude | include } regular-expression ]
reset counters interface [ interface-type
[ interface-number ] ]
reset packet-drop interface [ interface-type
[ interface-number ] ]
Available in
any view
Available in
any view
Available in
any view
Available in
user view
Available in
user view
17
Loopback and null interface configuration
Configuring a loopback interface
Introduction to the loopback interface
A loopback interface is a software-only virtual interface. It delivers the following benefits.
• The physical layer state and link-layer protocols of a loopback interface are always up unless the
loopback interface is manually shut down.
• To save IP address resources, you can assign an IP address with an all-F mask to a loopback
interface. When you assign an IPv4 address whose mask is not 32-bit, the system automatically
changes the mask into a 32-bit mask. When you assign an IPv6 address whose mask is not 128-bit,
the system automatically changes the mask into a 128-bit mask.
• You can enable routing protocols on a loopback interface, and a loopback interface can send and
receive routing protocol packets.
Because of the benefits mentioned above, loopback interfaces are widely used in the following
scenarios.
• You can configure a loopback interface address as the source address of the IP packets that the
device generates. Because loopback interface addresses are stable unicast addresses, they are
usually used as device identifications. When you configure a rule on an authentication or security
server to permit or deny packets generated by a device, you can simplify the rule by configuring it
to permit or deny packets that carry the loopback interface address identifying the device. When
you use a loopback interface address as the source address of IP packets, be sure to perform any
necessary routing configuration to make sure that the route from the loopback interface to the peer
is reachable. All data packets sent to the loopback interface are treated as packets sent to the
device itself, so the device does not forward these packets.
• Because a loopback interface is always up, it can be used in dynamic routing protocols. For
example, if you do not configure a router ID for a dynamic routing protocol, the highest loopback
interface IP address is selected as the router ID. In BGP, to prevent physical port failure from
interrupting BGP sessions, you can use a loopback interface as the source interface of BGP packets.
Configuration procedure
Follow these steps to configure a loopback interface:
To do… Use the command…
Enter system view system-view —
Remarks
Create a loopback interface and
enter loopback interface view
Set the interface description description text
interface loopback
interface-number
18
—
Optional
By default, the description of a loopback
interface is interface name Interface.
To do… Use the command…
Shut down the loopback interface shutdown
Restore the default settings for the
loopback interface
default Optional
NOTE:
You can configure settings such as IP addresses and IP routes on loopback interfaces. For more
information, see
Layer 3—IP Services Configuration Guide
Configuring the null interface
Introduction to the null interface
A null interface is a completely software-based logical interface, and is always up. However, you cannot
use it to forward data packets or configure an IP address or link-layer protocol on it. With a null interface
specified as the next hop of a static route to a specific network segment, any packets routed to the
network segment are dropped. The null interface provides a simpler way to filter packets than ACL. You
can filter uninteresting traffic by transmitting it to a null interface instead of applying an ACL.
Remarks
Optional
By default, a loopback interface is up.
and
Layer 3—IP Routing Configuration Guide
.
For example, by executing the ip route-static 92.101.0.0 255.255.0.0 null 0 command (which configures
a static route that leads to null interface 0), you can have all the packets destined to the network segment
92.101.0.0/16 discarded.
Only one null in terface, N ull 0, is sup ported on your switch. You cannot rem ove or create a null i nterfac e.
Configuration procedure
Follow these steps to enter null interface view:
To do… Use the command…
Enter system view system-view —
Enter null interface view interface null 0
Set the interface
description
Restore the default settings
for the null interface
description text
default Optional
Remarks
Required
The Null 0 interface is the default null interface on
your switch. It cannot be manually created or
removed.
Optional
By default, the description of a null interface is
interface name Interface.
19
Displaying and maintaining loopback and null interfaces
To do… Use the command…
display interface [ loopback ] [ brief [ down ] ] [ |
Display information about
loopback interfaces
Display information about
the null interface
Clear the statistics on a
loopback interface
Clear the statistics on the
null interface
{ begin | exclude | include } regular-expression ]
display interface loopback interface-number [ brief ]
[ | { begin | exclude | include } regular-expression ]
display interface [ null ] [ brief [ down ] ] [ | { begin |
exclude | include } regular-expression ]
display interface null 0 [ brief ] [ | { begin | exclude
| include } regular-expression ]
reset counters interface [ loopback
[ interface-number ] ]
reset counters interface [ null [ 0 ] ] Available in user view
Remarks
Available in any view
Available in any view
Available in user view
20
MAC address table configuration
Overview
An Ethernet device uses a MAC address table for forwarding frames through unicast instead of
broadcast. This table describes from which port a MAC address (or host) can be reached. When
forwarding a frame, the device first looks up the MAC address of the frame in the MAC address table for
a match. If the switch finds an entry, it forwards the frame out of the outgoing port in the entry. If the switch
does not find an entry, it broadcasts the frame out of all but the incoming port.
How a MAC address table entry is created
The switch automatically obtains entries in the MAC address table, or you can add them manually.
MAC address learning
The device can automatically populate its MAC address table by obtaining the source MAC addresses
(called “MAC address learning”) of incoming frames on each port.
When a frame arrives at a port, Port A for example, the device performs the following tasks:
1. Verifies the source MAC address (for example, MAC-SOURCE) of the frame.
2. Looks up the source MAC address in the MAC address table.
{ If an entry is found, the device updates the entry.
{ If no entry is found, the device adds an entry for MAC-SOURCE and Port A.
3. After obtaining this source MAC address, when the device receives a frame destined for
MAC-SOURCE, the device finds the MAC-SOURCE entry in the MAC address table and forwards
the frame out Port A.
The device performs the learning process each time it receives a frame from an unknown source MAC
address, until the MAC address table is fully populated.
Manually configuring MAC address entries
With dynamic MAC address learning, a device does not distinguish between illegitimate and legitimate
frames, which can invite security hazards. For example, when a hacker sends frames with a forged
source MAC address to a port different from the one that the real MAC address is connected, the device
creates an entry for the forged MAC address, and forwards frames destined for the legal user to the
hacker instead.
To improve the port security, you can bind specific user devices to the port by manually adding MAC
address entries to the MAC address table of the switch.
Types of MAC address table entries
A MAC address table can contain the following types of entries:
• Static entries, which are manually added and never age out.
• Dynamic entries, which can be manually added or dynamically obtained and might age out.
21
A
• Blackhole entries, which are manually configured and never age out. Blackhole entries are
configured for filtering out frames with specific source or destination MAC addresses. For example,
to block all packets destined for a specific user for security concerns, you can configure the MAC
address of this user as a blackhole MAC address entry.
To adapt to network changes and prevent inactive entries from occupying table space, an aging
mechanism is adopted for dynamic MAC address entries. Each time a dynamic MAC address entry is
obtained or created, an aging time starts. If the entry has not updated when the aging timer expires, the
device deletes the entry. If the entry has updated before the aging timer expires, the aging timer restarts.
NOTE:
static or blackhole MAC address entry can overwrite a dynamic MAC address entry, but not vice versa.
MAC address table-based frame forwarding
When forwarding a frame, the device adopts the following forwarding modes based on the MAC
address table:
• Unicast mode: If an entry is available for the destination MAC address, the device forwards the
frame out of the outgoing interface indicated by the MAC address table entry.
• Broadcast mode: If the device receives a frame with the destination address as all-ones, or no entry
is available for the destination MAC address, the device broadcasts the frame to all the interfaces
except the receiving interface.
Configuring the MAC address table
The configuration tasks discussed in the following sections are all optional and can be performed in any
order.
NOTE:
• The MAC address table can contain only Layer 2 Ethernet ports and Layer 2 aggregate interfaces.
• This document covers the configuration of unicast MAC address table entries, including static, dynamic,
and blackhole MAC address table entries. For more information about configuring static multicast MAC
address table entries for IGMP snooping and MLD snooping, see
Configuring static, dynamic, and blackhole MAC address table entries
To help prevent MAC address spoofing attacks and improve port security, you can manually add MAC
address table entries to bind ports with MAC addresses. You can also configure blackhole MAC address
entries to filter out packets with certain source or destination MAC addresses.
Adding or modifying a static, dynamic, or blackhole MAC address table entry globally
Follow these steps to add or modify a static, dynamic, or blackhole MAC address table entry in system
view:
IP Multicast Configuration Guide
.
To do… Use the command…
Enter system view system-view —
22
Remarks
Loading...