H3C S9500 Series Routing Switches

Transcription

1 Operation Manual Hangzhou H3C Technologies Co., Ltd. Manual Version: T E C-1.24 Product Version: S9500-CMW310-R1648

2 Copyright , Hangzhou H3C Technologies Co., Ltd. and its licensors All Rights Reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. Trademarks H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. All other trademarks that may be mentioned in this manual are the property of their respective owners. Notice Technical Support The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied. customer_service@h3c.com

3 About This Manual Organization Configuration Manual is organized as follows: Part 00 Product Overview 01 Access Volume 02 IP Services Volume 03 IP Routing Volume 04 IP Multicast Volume 05 MPLS VPN Volume Contents includes Obtaining the Documentation, Product Features, and Features. includes Ethernet Port Configuration, POS Port Configuration, Link Aggregation Configuration, Port Isolation Configuration, VLAN Configuration, MAC Address Table Management Configuration, GVRP Configuration, QinQ Configuration, Ethernet Port Loopback Detection Configuration, DLDP Configuration, Ethernet OAM Configuration, Smart Link and Monitor Link Configuration, MSTP Configuration, BPDU Tunnel Configuration, HVRP Configuration, RRPP Configuration and RPR Configuration. includes ARP Configuration, IP Address Configuration, VRRP Configuration, DHCP Configuration, DNS Configuration, UDP Helper Configuration, NAT Configuration, IP Performance Configuration and URPF Configuration. includes IP Routing Protocol Overview, Static Route Configuration, RIP Configuration, OSPF Configuration, ISIS Configuration, BGP Configuration, IP Route Policy Configuration, Route Capacity Configuration and Recursive Routing Configuration. includes Multicast Overview, Common Multicast Configuration, IGMP Snooping Configuration, IGMP Configuration, PIM Configuration, Multicast VLAN Configuration, MSDP Configuration and MBGP Configuration. includes MPLS Configuration, MPLS VLL Configuration, MPLS VPLS Configuration, MPLS L3VPN Configuration, MPLS OAM Configuration and MPLS Hybrid Insertion Configuration. 06 QoS ACL Volume includes QoS Configuration and ACL Configuration. 07 Security Volume includes Protocol Port Security Configuration, 802.1X Configuration, AAA RADIUS HWTACACS Configuration,Password Control Configuration, SSH Configuration, IDS Linkage Configuration, Portal Configuration, VBAS Configuration and Traffic Accounting Configuration.

4 Part 08 System Volume Contents includes Command Line Interface Configuration, Login and User Interface Configuration, FTP and TFTP Configuration, HA Configuration, NQA Configuration, NetStream Configuration, NTP Configuration, RMON Configuration, SNMP Configuration, Packet Statistics Accounting Configuration, Device Management Configuration, Configuration File Management Configuration, File System Management Configuration, Cluster Management Configuration, System Maintenance and Debugging Configuration, Information Center Configuration, PoE Configuration, Clock Module Configuration, ACSEI Server Configuration and OAP Module Configuration. 09 Acronyms Offers the acronyms used in this manual. Conventions The manual uses the following conventions: I. Command conventions Convention Boldface italic [ ] { x y... } [ x y... ] { x y... } * [ x y... ] * &<1-n> Description The keywords of a command line are in Boldface. Command arguments are in italic. Items (keywords or arguments) in square brackets [ ] are optional. Alternative items are grouped in braces and separated by vertical bars. One is selected. Optional alternative items are grouped in square brackets and separated by vertical bars. One or none is selected. Alternative items are grouped in braces and separated by vertical bars. A minimum of one or a maximum of all can be selected. Optional alternative items are grouped in square brackets and separated by vertical bars. Many or none can be selected. The argument(s) before the ampersand (&) sign can be entered 1 to n times. # A line starting with the # sign is comments.

5 II. GUI conventions Convention Description < > [ ] / Button names are inside angle brackets. For example, click <OK>. Window names, menu items, data table and field names are inside square brackets. For example, pop up the [New User] window. Multi-level menus are separated by forward slashes. For example, [File/Create/Folder]. III. Symbols Convention Warning Caution Note Description Means reader be extremely careful. Improper operation may cause bodily injury. Means reader be careful. Improper operation may cause data loss or damage to equipment. Means a complementary description. Related Documentation In addition to this manual, each documentation set includes the following: Manual Installation Manual Command Manual Description It introduces the installation procedure, commissioning, maintenance and monitoring of the S9500 series routing switches. It includes Feature List and Command Index, Access Volume, IP Service Volume, IP Routing Volume, IP Multicast Volume, MPLS VPN Volume, QoS ACL Volume, Security Volume, and System Volume. Obtaining Documentation You can access the most up-to-date H3C product documentation on the World Wide Web at this URL: The following are the columns from which you can obtain different categories of product

6 documentation: [Products & Solutions]: Provides information about products and technologies. [Technical Support & Document > Technical Documents]: Provides several categories of product documentation, such as installation and operation. [Technical Support & Document > Product Support > Software]: Provides the documentation released with the software version. Documentation Feedback You can your comments about product documentation to We appreciate your comments.

7 Operation Manual IP Services Volume Organization Manual Version T E C-1.24 Product Version S9500-CMW310-R1648 Organization The IP Services Volume is organized as follows: ARP Features (operation manual) IP Address VRRP DHCP DNS Description Address Resolution Protocol (ARP) is used to resolve an IP address into a data link layer address. The volume describes: ARP configuration ARP table size configuration ARP attack prevention configuration IP packet attack prevention configuration An IP address is a 32-bit address allocated to a network interface on a device that is attached to the Internet. The volume describes: Introduction to IP addresses IP address configuration IP address protection configuration The Virtual Router Redundancy Protocol (VRRP) is a fault-tolerant protocol. The volume describes: Introduction to VRRP VRRP configuration DHCP is built on a client-server model, in which the client sends a configuration request and then the server returns a reply to send configuration parameters such as an IP address to the client. The volume describes: DHCP overview DHCP server configuration DHCP relay agent configuration DHCP snooping configuration Used in the TCP/IP application, Domain Name System (DNS) is a distributed database which provides the translation between domain name and the IP address. The volume describes: Introduction to DNS DNS configuration

8 Operation Manual IP Services Volume Organization Features (operation manual) UDP Helper NAT IP Performance URPF Description UDP Helper (UDPH) functions as a relay agent that converts UDP broadcast packets into unicast packets and forwards them to a specified server. The volume describes: UDP Helper overview UDP Helper configuration NAT is the procedure of translating the IP address in the header of an IP data packet into another IP address. The volume describes: NAT overview NAT configuration In some network environments, you need to adjust the IP parameters to achieve best network performance. The volume describes: IP performance configuration Unicast reverse path forwarding (URPF) serves as a safeguard against source address spoofing attacks. The volume describes: URPF overview URPF configuration

9 Operation Manual ARP Table of Contents Table of Contents Chapter 1 ARP Configuration Introduction to ARP Configuring ARP Enabling/Disabling ARP Entry Checking Adding/Deleting a Static ARP Entry Configuring the Dynamic ARP Aging Timer Adding/Deleting Multicast ARP Ports Proxy ARP Configuration Gratuitous ARP Learning Configuration Configuring ARP Packets Not to Broadcast in VLAN Displaying and Debugging ARP Chapter 2 ARP Table Size Configuration Introduction to ARP Table Size Configuration Configuring ARP Table Size Dynamically Configuration Tasks Configuring ARP Table Size Dynamically Displaying ARP Table Size Configuration ARP Table Size Configuration Example Chapter 3 ARP Attack Prevention Configuration ARP Spoofing Attack Prevention Introduction to ARP Spoofing Attack Prevention Configuring ARP Spoofing Attack Prevention ARP Duplicate Gateway Attack Prevention Introduction to ARP Duplicate Gateway Attack Prevention Configuring ARP Duplicate Gateway Attack Prevention ARP Packet Attack Prevention Introduction to ARP Packet Attack Prevention Configuring ARP Packet Attack Prevention ARP Attack Prevention Configuration Example Chapter 4 IP Packet Attack Prevention Configuration Introduction to IP Packet Attack Prevention Configuring IP Packet Attack Prevention i

10 Operation Manual ARP Chapter 1 ARP Configuration Chapter 1 ARP Configuration When configuring ARP, go to these sections for information you are interested in: Introduction to ARP Configuring ARP Displaying and Debugging ARP 1.1 Introduction to ARP Address resolution protocol (ARP) is used to resolve an IP address into a MAC address. I. Why ARP An IP address cannot be directly used for communication on an Ethernet because network devices can identify only MAC addresses. An IP address is a network layer address. To send datagrams through the network layer to the destination host, the MAC address of the host is required. Therefore, the IP address must be resolved into a MAC address. II. ARP address resolution process Figure 1-1 ARP address resolution process Suppose that Host A and Host B are on the same subnet and Host A sends a packet to Host B. The resolution process is as follows: 1) Host A checks its ARP table to see whether there is an ARP entry for Host B. If yes, Host A uses the MAC address in the entry to encapsulate the IP packet into a data link layer frame and sends the frame to Host B. 2) If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request, in which the sender IP address and sender MAC address are respectively the IP address and MAC address of Host A and the target IP address 1-1

11 Operation Manual ARP Chapter 1 ARP Configuration and target MAC address are respectively the IP address of Host B and an all-zero MAC address. Because the ARP request is broadcast, all hosts on this subnet can receive the request, but only the requested host (namely, Host B) will process the request. 3) Host B compares its own IP address with the target IP address in the ARP request. If they are the same, Host B saves the sender IP address and sender MAC address into its ARP table, encapsulates its MAC address into an ARP reply, and unicasts the reply to Host A. 4) After receiving the ARP reply, Host A adds the MAC address of Host B into its ARP table. If Host A and Host B are not on the same subnet, Host A first sends an ARP request to the gateway. The target IP address in the ARP request is the IP address of the gateway. After obtaining the MAC address of the gateway from an ARP reply, Host A sends the packet to the gateway. If the gateway maintains the ARP entry of Host B, it forwards the packet to Host B directly; if not, it broadcasts an ARP request, in which the target IP address is the IP address of Host B. After obtaining the MAC address of Host B, the gateway sends the packet to Host B. III. ARP concepts ARP entries used in S9500 series routing switches include dynamic ARP entries and static ARP entries. Dynamic ARP entries are automatically created and maintained by the ARP protocol through ARP packets. They can be discarded after the aging time expires, and updated by new ARP packets. They can also be overwritten by permanent static ARP entries and non-permanent static ARP entries. When the aging time expires, a port is disabled or a VLAN interface is disabled, the corresponding dynamic ARP entry will be deleted. Static ARP entries are configured and maintained manually. Static entries are further divided into permanent static ARP entries and non-permanent static ARP entries. Permanent ARP entries contain all elements of an ARP entry. They can forward data directly. They cannot be aged, or overwritten by dynamic ARP entries. Non-permanent ARP entries are configured with only IP addresses and MAC addresses other than VLANs and output interfaces. They are generally used for users requiring IP-MAC bindings. Its initial state is non-resolution, so it cannot forward data directly. It can obtain VLANs and egresses dynamically through ARP packets. A resolved non-permanent static ARP entry can forward data and will not be aged. When a port or VLAN interface is disabled, the corresponding static ARP entry will be restored to the non-resolution state. 1-2

12 Operation Manual ARP Chapter 1 ARP Configuration 1.2 Configuring ARP The ARP table can be maintained dynamically or manually. Usually, the manually configured mappings are known as static ARP entries. The user can display, add or delete such entries with commands. The following sections describe static ARP configuration tasks: Enabling/Disabling ARP Entry Checking Adding/Deleting a Static ARP Entry Configuring the Dynamic ARP Aging Timer Adding/Deleting Multicast ARP Ports Proxy ARP Configuration Gratuitous ARP Learning Configuration Configuring ARP Packets Not to Broadcast in VLAN Enabling/Disabling ARP Entry Checking Perform the following configuration in system view to enable/disable ARP entry checking: To do Enable the ARP entry checking function so that the switch will not learn any ARP entry containing a multicast MAC address Disable the ARP entry checking function so that the switch can learn ARP entries containing multicast MAC addresses Use the command arp check enable undo arp check enable By default, the ARP entry checking function is enabled, that is, the switch is disabled from learning ARP entries for multicast MAC addresses Adding/Deleting a Static ARP Entry Perform the following configuration in system view to add/delete a static ARP mapping entry. To do Add a static ARP entry Delete a static ARP entry Use the command arp static ip-address [ mac-address [ vlan-id { interface-type interface-number } ] [ vpn-instance vpn-instance-name ] ] undo arp ip-address By default, the ARP table is empty and ARP entries are obtained through dynamic ARP. Note that: 1-3

13 Operation Manual ARP Chapter 1 ARP Configuration As long as a switch operates, its static ARP entries remain valid unless you change or remove a VLAN interface, remove a VLAN, or remove a port from a VLAN. These operations cause the corresponding static ARP mapping entries to be automatically removed. The vlan-id argument must be the ID of an existing VLAN, and the Ethernet port specified behind this argument must belong to the VLAN. The vpn-instance-name argument must be the VPN instance name of an existing MPLS VPN. The port specified in an ARP entry can be a manually aggregated port, instead of a statically or dynamically aggregated port. If the mac-address of an ARP entry is a multicast MAC address, the system will take this ARP entry as a multicast ARP entry. Automatic fill-in of MAC addresses is enabled only after IP address protection is enabled on the interface. After the first automatic fill-in, the corresponding ARP entries become common static ARP entries and cannot be filled in again Configuring the Dynamic ARP Aging Timer You can configure an age for dynamic ARP entries. Perform the following configuration in system view to configure the dynamic ARP aging timer. To do Configure the dynamic ARP aging timer Restore the default dynamic ARP aging time Use the command arp timer aging aging-time undo arp timer aging By default, the dynamic ARP aging timer is 20 minutes Adding/Deleting Multicast ARP Ports The multicast ARP feature allows you to associate a common unicast route to a Layer 2 multicast group by creating a static multicast ARP entry. In this way, a packet matching the entry can be forwarded out multiple ports. In brief, a multicast ARP entry is a static ARP entry with a multicast MAC address and corresponds to multiple ports. You can use the multi-port keyword in the following command to add a port for a multicast ARP entry. Only one port can be added every time the command is executed. If the multicast ARP entry does not exist, a new multicast ARP entry is generated. If the multicast ARP entry exists and the same port exists, the switch will not add the port. Follow these steps to add a port for a multicast ARP entry in system view: 1-4

14 Operation Manual ARP Chapter 1 ARP Configuration To do Use the command Remarks Enter system view system-view Add a port for the multicast ARP entry arp static ip-address mac-address vlan-id multi-port interface-type interface-number [ vpn-instance vpn-instance-name ] To remove the configuration, use the corresponding undo command. After the configuration, you can use the display arp multi-port command in any view to check the detailed information about multicast ARP entry configuration. Caution: Up to 64 multicast ARP entries are supported, with each entry having up to 100 outgoing ports. A manual port aggregation group is considered a single port. An outgoing port of a multicast ARP entry can be a manually aggregated port or a common port, but cannot be a statically or dynamically aggregated port. As specified in the IEEE 802.3ad standard, if a port is disabled but the dynamic port aggregation function is enabled, the port is not an aggregated port, but a common one. Therefore, the port can be configured as a port for a multicast ARP entry. After the port is enabled, the port becomes a dynamically aggregated port and will be removed from the multicast ARP entry. The IP addresses of multicast ARP entries are unicast IP addresses. For the MAC addresses of multicast ARP entries, well-known multicast MAC addresses are not recommended. Multicast static ARP entries overwrite dynamic, non-permanent static and permanent static ARP entries with the same IP addresses, but not vice versa. If a port with a number smaller than those in an aggregation group (for example, the port is on an interface card with a smaller slot number) is added into the group, the ports in this aggregation group will be removed from multicast ARP; while other ports will not be affected. For an aggregation of ports on different interface cards, if removing an interface card with a smaller slot number can cause primary port switchover, doing so will remove the ports of this aggregation group from multicast ARP; while other ports will not be affected. If an aggregation group is removed, ports in this group are removed from multicast ARP; while other ports are not affected. No matter the state of the primary port in an aggregation is up or down, ports in the aggregation group will not be removed from multicast ARP. 1-5

15 Operation Manual ARP Chapter 1 ARP Configuration Proxy ARP Configuration I. Enable proxy ARP for Sub-VLANs With the super VLAN function enabled, a device also needs to be enabled with the proxy ARP function for Layer 3 communications between sub-vlans. If you enable the proxy ARP function on a device that is connected to two sub-vlans, the device forwards packets between the sub-vlans at Layer 3. In this way, ports isolated at Layer 2 can communicate at Layer 3. Follow these steps to enable proxy ARP in VLAN view: To do Use the command Remarks Enter system view system-view Enter VLAN view vlan vlan-id Use the vlan-id argument to specify the ID of a sub-vlan. Enable ARP proxy arp proxy enable By default, proxy ARP is disabled. Use the undo form of the command to remove the configuration. II. Enable proxy ARP in VLAN interface view With proxy ARP enabled in VLAN interface view, upon receiving an ARP request, a device sends back an ARP response directly if the following conditions are met: The sender IP address of the ARP request is on the same network segment as the receiving VLAN interface. The target IP address of the ARP request is on another network segment. The route corresponding to the target IP address of the ARP request exists and the outgoing interface of the route is not the receiving interface of the ARP request. Follow these steps to enable proxy ARP in VLAN interface view: To do Use the command Remarks Enter system view system-view Enter VLAN interface view Enable proxy ARP vlan-interface vlan-id arp proxy enable Use the vlan-id argument to specify the ID of a common VLAN. By default, proxy ARP is disabled. 1-6

16 Operation Manual ARP Chapter 1 ARP Configuration III. Enable local proxy ARP With local proxy ARP enabled, the device directly sends back an ARP response if it receives an ARP request whose sender and target IP addresses are on the same network segment as the receiving VLAN interface. Follow these steps to enable local proxy ARP: To do Use the command Remarks Enter system view system-view Enter VLAN interface view Enable local proxy ARP vlan-interface vlan-id arp local-proxy enable Use the vlan-id argument to specify the ID of a common VLAN. By default, local proxy ARP is disabled Gratuitous ARP Learning Configuration I. Introduction to Gratuitous ARP Packets The following are the characteristics of gratuitous ARP packets: Both source and destination IP addresses carried in a gratuitous ARP packet are the local IP address, and the source MAC address carried in it is the local MAC address. If a device finds that the IP address carried in a received gratuitous packet is its IP address, it returns an ARP response to the sending device. By sending a gratuitous ARP packet, a network device can: Check whether its IP address conflicts with that of any other device; Trigger other network devices to update its hardware address stored in their caches. With the gratuitous ARP packet learning function enabled, a network device stores the source IP and MAC addresses of a received gratuitous ARP packet in its ARP table if it has no such an entry or updates the entry if it has. 1-7

17 Operation Manual ARP Chapter 1 ARP Configuration II. Gratuitous ARP packet learning configuration Follow these steps to configure the gratuitous ARP packet learning function: To do Use the command Remarks Enter system view system-view Enable the gratuitous ARP packet learning function gratuitous-arp-learning enable Required By default, the gratuitous ARP packet learning function is enabled Configuring ARP Packets Not to Broadcast in VLAN In order to disable any two hosts in the same network segment from access to each other, you can configure the device to forward ARP requests as trap packets to the CPU rather than broadcast in the VLAN. Thus, the two hosts cannot learn the addresses of each other through ARP packets. Follow these steps to limit the flooding of ARP request packets in a VLAN: To do Use the command Remarks Enter system view system-view Enter Ethernet port view Limit the flooding of ARP requests in a VLAN interface interface-type interface-number arp non-flooding enable The port specified by the interface-type argument can be an Ethernet port only Required This function is disabled by default. 1.3 Displaying and Debugging ARP To do Use the command Remarks Display ARP entry information Display the current setting of the dynamic ARP aging timer Display multicast ARP entry configuration information Display proxy ARP information display arp [ ip-address [ dynamic static vlan vlan-id interface interface-type interface-number ] [ { begin include exclude } text ] ] display arp timer aging display arp multi-port [ ip-address ] display arp proxy [ vlan vlan-id] Available in any view 1-8

18 Operation Manual ARP Chapter 1 ARP Configuration To do Use the command Remarks Clear specified ARP entries Enable ARP debugging Disable ARP debugging reset arp [ dynamic static interface { interface-type interface-number } all ] debugging arp { error info packet entry-check } undo debugging arp { error info packet entry-check } Available in user view 1-9

19 Operation Manual ARP Chapter 2 ARP Table Size Configuration Chapter 2 ARP Table Size Configuration When configuring the ARP table size, go to these sections for information you are interested in: Introduction to ARP Table Size Configuration Configuring ARP Table Size Dynamically Displaying ARP Table Size Configuration ARP Table Size Configuration Example 2.1 Introduction to ARP Table Size Configuration You can manually configure the maximum number of ARP entries (that is, the size of a ARP table) on an S9500 routing switch as needed. Table 2-1 lists the specifications and numbers of ARP entries on cards with different model suffixes. Table 2-1 Specifications and numbers of ARP entries on cards with different model suffixes Model suffix IP address format and number of FIB entries supported MPLS support Maximum number of ARP entries supported by the whole switch if the card exists in the system Maximum number of ARP entries supported by the card Maximum number of aggregation ARP entries supported by the card B IPv4-128K DA DB IPv4-128K/I Pv6-7K IPv4-128K/I Pv6-64K Not supported 4K 4K 0K, 1K, 3K DC IPv4-256K/I Pv6-128K C CA CB IPv4-128K IPv4-256K IPv4-512K Supported 4K, 64K 4K, 5K, 6K, 7K, 8K 0K, 1K, 3K, 7K, 8K 2-1

20 Operation Manual ARP Chapter 2 ARP Table Size Configuration Note: You can distinguish the model suffix of a card by the silkscreen at the upper right corner of the front panel. For example, the silkscreen of the LSB1GP12B0 card is GP12B, and so the suffix of this card is B. If the suffix of a card is "C" or "CA", you can configure the maximum ARP entries as 64 K only when only this type of cards exist in the system. Up to 8K of ARP entries can be configured for a card. Caution: After the configuration of a non-permanent static ARP entry, the system will include it into the number of non-aggregation ARP entries. If the non-permanent static ARP entry is resolved from a non-aggregated port, the number of non-aggregation ARP entries will remain unchanged; if the non-permanent static ARP entry is resolved from an aggregated port, it will be deducted from the number of non-aggregation ARP entries and included into the number of aggregation ARP entries. As a non-permanent static ARP entry is included into the number of normal ARP entries like a normal permanent static ARP entry, if a card is configured to support up to 8K aggregation ARP entries, the card does not support the configuration of neither kind. 2.2 Configuring ARP Table Size Dynamically Configuration Tasks Configuring the maximum number of ARP entries supported by a card Configuring the maximum number of aggregation ARP entries supported by a card Configuring the maximum number of ARP entries supported by the switch Configuring ARP Table Size Dynamically Follow these steps to configure ARP table size dynamically: To do Use the command Remarks Enter system view system-view Configure the maximum number of ARP entries supported by a card arp max-entry slot-num max-num The maximum number of ARP entries supported by a card is 4K by default. 2-2

21 Operation Manual ARP Chapter 2 ARP Table Size Configuration To do Use the command Remarks Configure the maximum number of aggregation ARP entries supported by a card Configure the maximum number of ARP entries supported by the switch arp max-aggregation-entry max-aggnum arp enable size { 4 64 } The maximum number of aggregation ARP entries supported by a card is 1K by default. The maximum number of ARP entries supported by the whole switch is 4K by default. To remove the configurations, use the corresponding undo commands. Caution: Restart the system to make the above configurations effective. After the above configurations, do not change cards or slots before you restart the system. Otherwise, the configurations may fail to take effect. After the above configurations, do not perform active/standby switchover before you restart the system. Otherwise, the configurations will not take effect even if you restart the system. 2.3 Displaying ARP Table Size Configuration To do Use the command Remarks Display the maximum numbers of current ARP entries and entries that will take effect after the switch restarts display arp max-entry Available in any view 2.4 ARP Table Size Configuration Example I. Network requirements A host is connected to an S9500 series routing switch. The model names of all the cards in the switch system are suffixed with C, CA, or CB. 2-3

22 Operation Manual ARP Chapter 2 ARP Table Size Configuration II. Network diagram PC Switch Figure 2-1 Diagram for ARP table size configuration III. Configuration procedure # Configure the maximum number of ARP entries supported by the whole switch as 64K. <H3C> system-view System View: return to User View with Ctrl+Z. [H3C] arp enable size 64 The configuration won't be enabled until the system is rebooted # Configure the maximum number of ARP entries supported by the interface card in slot 2 as 8K. [H3C] arp max-entry 2 8 The configuration won't be enabled until the system is rebooted # Configure the maximum number of aggregation ARP entries supported by each interface card in the system as 8K. [H3C] arp max-aggregation-entry 8 The configuration won't be enabled until the system is rebooted Restart the system for the configurations to take effect. 2-4

23 Operation Manual ARP Chapter 3 ARP Attack Prevention Configuration Chapter 3 ARP Attack Prevention Configuration When configuring ARP attack prevention, go to these sections for information you are interested in: ARP Spoofing Attack Prevention ARP Duplicate Gateway Attack Prevention ARP Packet Attack Prevention ARP Attack Prevention Configuration Example There are diversified ARP attacks. We here only discuss the following three ARP attacks: ARP Spoofing Attack Prevention ARP Duplicate Gateway Attack Prevention ARP Packet Attack Prevention 3.1 ARP Spoofing Attack Prevention Introduction to ARP Spoofing Attack Prevention ARP provides no security mechanism, and a network using ARP is thus susceptible to attacks. If devices in the network are configured with static IP addresses, you can prevent illegal modification of ARP entries only by configuring static ARP entries. Such configuration is complex and difficult to maintain. If devices in the network obtain IP addresses dynamically, attackers may send ARP packets using forged source addresses, causing the gateway to modify the ARP entries and thus disconnecting legal users. Internet G: /24 ARP Packet: A: /24 B SIP: Smac:ErrMac Figure 3-1 ARP spoofing attack 3-1

24 Operation Manual ARP Chapter 3 ARP Attack Prevention Configuration As shown in Figure 3-1, A is a legal user connected to the Internet through the switch G. By forging the ARP packets from A, the attacker B changes the ARP entry of A on G, thereby disconnecting A from G. To prevent ARP source address spoofing attacks, the S9500 series switches provide the following methods. I. Fixed MAC addresses For a dynamic ARP entry already learned by the switch, the corresponding MAC address cannot be modified by learning a new MAC address through ARP. A new MAC address can be learned for this ARP entry only after this ARP entry ages out, ensuring that the ARP entries for legal users are not modified. This method can be divided into two modes: fixed-mac and fixed-all. In the fixed-mac mode, MAC addresses cannot be modified, but VLANs and ports can be modified. This mode applies to the condition where user addresses are assigned statically but redundant Layer 2 links exist. When link switching occurs, the ports in the ARP entry can be changed immediately. In the fixed-all mode, none of the dynamic, resolved non-permanent static ARP entries, MAC addresses, VLANs, or ports can be modified. This mode only applies to the condition where IP addresses are assigned statically, no redundant links exist, and a user with a fixed IP address will not access the switch through different ports. II. Sending acknowledgement (send-ack) Upon receiving an ARP packet with a modified MAC address, the switch sends a unicast acknowledgement to the corresponding user associated with the original ARP entry, instead of modifying the ARP entry directly. If a response is received from the original user within the specified period, the original user is still connected. In this case, no MAC address modification can be made for this ARP entry in the coming one minute (likewise, no MAC address modification is allowed within one minute after a new ARP entry is created). If no response is received from the original user within the specified period, a unicast request is sent to the new user. After a response is received, the ARP entry can be modified so that the new user becomes a legal user. This mode applies to the condition where IP addresses are assigned dynamically but redundant links exist. 3-2

25 Operation Manual ARP Chapter 3 ARP Attack Prevention Configuration Configuring ARP Spoofing Attack Prevention Follow these steps to configure ARP spoofing attack prevention: To do Use the command Remarks Enter system view system-view Configure ARP spoofing attack prevention Display the ARP spoofing attack prevention configuration arp entry-check { fixed-mac fixed-all send-ack } display arp entry-check Required Disabled by default. Available in any view 3.2 ARP Duplicate Gateway Attack Prevention Introduction to ARP Duplicate Gateway Attack Prevention G: /24 ARP Packet: SIP: ARP Packet: SIP: A: Figure 3-2 ARP duplicate gateway attack An attacker sends gratuitous ARP packets with the source IP address being the gateway within the LAN. The internal hosts will then change the address of the gateway to that of the attacker. As a result, the hosts are unable to access the network. Such an attack is called an ARP duplicate gateway attack. To prevent such attacks, S9500 series switches provide the duplicate gateway attack prevention function. If any of the following conditions occurs, the system generates an ARP attack prevention entry: The source IP address of the ARP packet is the same as the IP address of the receiving interface. The source IP address of the ARP packet belongs to the NAT address pool or is the same as one of the internal servers IP address. The source IP address of the ARP packet is the virtual IP address of the receiving interface, but the source MAC address of the ARP packet is not the virtual MAC address of the VRRP group. Based on this entry, the switch discards those packets with the same source MAC address within a certain period, thus preventing the ARP packets containing the duplicate gateway address from being broadcasted within the VLAN. 3-3

26 Operation Manual ARP Chapter 3 ARP Attack Prevention Configuration Configuring ARP Duplicate Gateway Attack Prevention Caution: The ARP duplicate gateway attack prevention function can detect and prevent VLAN interface address conflicts, VRRP virtual address conflicts, and NAT address pool conflicts. After detecting an address conflict on the console port, the switch only logs the event, without preventing the attack. If the VRRP group has a real MAC address, the switch logs the event after detecting an address conflict, without preventing the attack. Follow these steps to configure ARP duplicate gateway attack prevention: To do Use the command Remarks Enter system view system-view Configure ARP duplicate gateway attack prevention Display information about the ARP duplicate gateway attack prevention configuration of a specific slot anti-attack gateway-duplicate{ enable disable } display anti-attack gateway-duplicate slot slotid Required Disabled by default. Available in any view 3.3 ARP Packet Attack Prevention Introduction to ARP Packet Attack Prevention ARP provides no authentication mechanism, and a network using ARP is thus susceptible to various kinds of attacks. Sending a large amount of ARP packets with a fixed MAC address is just one kind of attacks, which affects ARP entry learning of the switch. S9500 series switches can detect and prevent such ARP packet attacks. If the number of ARP packets with a fixed source MAC address received by the switch CPU reaches the set threshold within a certain period, the user with this MAC address is considered an attacker. Then, the system generates an attack prevention entry to filter this user, who will then be unable to access the network. 3-4

27 Operation Manual ARP Chapter 3 ARP Attack Prevention Configuration Configuring ARP Packet Attack Prevention Follow these steps to configure ARP packet attack prevention: To do Use the command Remarks Enter system view system-view Configure ARP packet attack prevention Configure a threshold for ARP packet attack detection Configure the aging time for ARP packet attack prevention entries Specify a protected MAC address for ARP packet attack prevention Display ARP packet attack prevention information anti-attack arp { enable monitor disable } anti-attack arp threshold threshold-value anti-attack arp aging-time time anti-attack arp exclude-mac mac-address display anti-attack arp slot slotid Required By default, the ARP packet attack prevention function is in monitor state. Optional The threshold value ranges from 5 to 300 pps, and defaults to 30 pps. Optional 600 seconds by default. The aging time for duplicate gateway attack prevention entries is synchronized with that of the ARP packet attack prevention entries. Optional A protected MAC address will not be filtered out by the ARP attack prevention function. The system supports up to 16 protected MAC addresses. Available in any view Note: If the CPU of an interface card does not receive any packet, the ARP packet attack prevention entries of the interface card will not be aged out. If an ARP attack prevention entry is not aged out, the dynamic address entry with the same MAC address will not be aged out either. The ARP packet attack prevention function is not supported on the console port. 3-5

28 Operation Manual ARP Chapter 3 ARP Attack Prevention Configuration 3.4 ARP Attack Prevention Configuration Example I. Network requirements An S9500 switch (Switch 1) is connected to two low-end switches Switch 3 and Switch 2 through Ethernet 1/1/1 and Ethernet 1/1/2, respectively. PC 1 is attached to Switch 1; PC 2 and PC 3 on the same network segment are attached to Switch 2; PC 4 and PC 5 on another network segment are attached to Switch 3. PC 1 sends a large amount of ARP packets. Some have the source IP addresses changing constantly, while some share the same source IP address with the gateway. PC 4 generates a large amount of ARP packets with a fixed MAC address. Switch 1 can prevent attacks from PC 1 and PC 4. II. Network diagram Ethernet 1/1/3 PC1 Ethernet 1/1/2 Switch1 Ethernet 1/1/1 Switch2 Switch3 PC2 PC3 PC4 PC5 Figure 3-3 Network diagram for ARP packet attack prevention III. Configuration procedure # Enter system view. <Switch1> system-view # Specify the ARP spoofing attack prevention mode to send-ack, preventing ARP spoofing attacks from PC 1. [Switch1] arp entry-check send-ack # Enable ARP duplicate gateway attack prevention, preventing duplicate gateway attacks from PC 1. [Switch1] anti-attack gateway-duplicate enable # Enable ARP packet attack prevention, preventing ARP packet attacks from PC 4. [Switch1] anti-attack arp enable # Configure the threshold for ARP packet attack detection to 40 pps. 3-6

29 Operation Manual ARP Chapter 3 ARP Attack Prevention Configuration [Switch1] anti-attack arp threshold 40 # Configure the aging time for ARP packet attack prevention entries to 300 seconds. [Switch1] anti-attack arp aging-time 300 # Configure the protective MAC address for ARP packet attack prevention to [Switch1] anti-attack arp exclude-mac After the above configurations, you can use the display current command to view the ARP attack prevention configuration information, and use the display anti-attack command to view the information about duplicate gateway attacks and ARP packet attacks from a fixed MAC address. Note that: The implementation of ARP spoofing attack prevention may result in high CPU usage. The duplicate gateway attack prevention only ensures that attacking packets received on a port will not be forwarded to other ports, but the hosts attached to this port may still be attacked. With the duplicate gateway attack prevention and ARP packet attack prevention enabled, the switch can not only isolate attackers, but also prevent the attackers from accessing network resources. 3-7

30 Operation Manual ARP Chapter 4 IP Packet Attack Prevention Configuration Chapter 4 IP Packet Attack Prevention Configuration When configuring IP packet attack prevention, go to these sections for information you are interested in: Introduction to IP Packet Attack Prevention Configuring IP Packet Attack Prevention 4.1 Introduction to IP Packet Attack Prevention With the expansion of the Internet and the increase of Internet users, network devices are susceptible to attacks. You can configure the IP packet attack prevention function on S9500 series switches to defend against IP packet attacks or unknown multicast attacks. An IP packet attack occurs when an S9500 switch receives excessive IP packets. If the destination IP addresses of the packets and the IP address of a VLAN interface are on the same network segment, these packets will be delivered to the CPU for processing, which may affect normal packet forwarding due to high CPU usage. When an S9500 switch receives a large amount of IP packets with the TTL field being 1, a large amount of ICMP time exceeded packets will be generated, thus increasing the burden of CPU. 4.2 Configuring IP Packet Attack Prevention Follow these steps to configure IP packet attack prevention: To do Use the command Remarks Enter system view system-view Enable/disable IP packet attack prevention Configure the switch not to process the packets with the TTL field being 1 anti-attack ip { disable enable } anti-attack ttl1 enable slot slotid Required Enabled by default. By default, the switch processes the packets with the TTL field being

31 Operation Manual ARP Chapter 4 IP Packet Attack Prevention Configuration Note: Currently, the anti-attack ttl1 enable slot command is supported only on the cards suffixed with DB or DC. 4-2

32 Operation Manual IP Address Table of Contents Table of Contents Chapter 1 IP Address Configuration Introduction to IP Addresses IP Address Classification and Representation Subnet and Mask Configuring IP Addresses Associating a Hostname to an IP Address Configuring the IP Address of a VLAN Interface IP Address Protection Configuration Displaying and Maintaining IP Addresses IP Address Configuration Example Troubleshooting IP Address Configuration i

33 Operation Manual IP Address Chapter 1 IP Address Configuration Chapter 1 IP Address Configuration When configuring IP address, go to these sections for information you are interested in: Introduction to IP Addresses Configuring IP Addresses Displaying and Maintaining IP Addresses IP Address Configuration Example Troubleshooting IP Address Configuration 1.1 Introduction to IP Addresses IP Address Classification and Representation An IP address is a 32-bit address allocated to a network interface on a device that is attached to the Internet. It consists of two fields: net-id field and host-id field. The net IDs of IP addresses are allocated by Network Information Center (NIC) of American Defense Data Network (DDN). To manage IP addresses conveniently, IP addresses are classified into five types. See the following figure Class A 0 net-id host-id Class B 1 0 net-id host-id Class C net-id host-id Class D Multicast address Class E Reserved net-id: network ID host-id: Host ID Figure 1-1 Five classes of IP addresses Here, Class A, Class B and Class C addresses are unicast addresses, while Class D addresses are multicast ones and class E addresses are reserved for special applications in future. The first three types are commonly used. 1-1

34 Operation Manual IP Address Chapter 1 IP Address Configuration The IP address is in dotted decimal format. Each IP address contains four integers in dotted decimal notation. Each integer corresponds to one byte, for example, When using IP addresses, note that some of them are reserved for special uses, and are seldom used. The IP addresses you can use are listed in the following table. Table 1-1 IP address classes and ranges Network class Address range Note A B C to to to An all-zero host ID indicates the IP address is a network address, and is used for network routing. An all-one host ID indicates the IP address is a broadcast address, and is used to broadcast packets to all the hosts on the network. The IP address is used for the host that is not put into use after startup. The IP address with the network ID being 0 indicates the current network and its network can be cited by the router without knowing the network number. The IP addresses with the format of 127.X.Y.Z are reserved for self-loop test and the packets sent to these addresses are not output to the line. The packets are processed internally and regarded as input packets. An all-zero host ID indicates that the IP address is a network address, and is used for network routing. An all-one host ID indicates the IP address is a broadcast address, and is used to broadcast packets to all hosts on the network. An all-zero host ID indicates that the IP address is a network address, and is used for network routing. An all-one host ID indicates the IP address is a broadcast address, and is used to broadcast packets to all hosts on the network. 1-2

35 Operation Manual IP Address Chapter 1 IP Address Configuration Network class Address range Note D E Other addresses to to Addresses of class D are multicast addresses, among which: IP address is reserved and will not be allocated. Those from to are reserved for routing protocols and some protocols that are used to discover and maintain simple topologies. Those from to are used for local multicast management. Those from to are for users. The addresses are reserved for future use is used as a Local Area Network (LAN) broadcast address Subnet and Mask With rapid development of the Internet, IPv4 addresses are depleting in a few years. The traditional IP address allocation method wastes IP addresses greatly. In order to make full use of the available IP addresses, the concept of mask and subnet is proposed. A mask is a 32-bit number corresponding to an IP address. The number consists of contiguous 1s and 0s. In general, a mask is started with consecutive 1s. The mask divides the IP address into two parts: subnet address and host address. The part of an IP address that corresponds to the bits 1s in the mask indicates the subnet address and the other part of IP address indicate the host address. If there is no subnet division, then its subnet mask is the default value and the length of "1" indicates the net-id length. Therefore, for IP addresses of classes A, B and C, the default values of corresponding subnet mask are , and respectively. The mask can be used to divide a Class A network containing more than 16,000,000 hosts or a Class B network containing more than 60,000 hosts into multiple small networks. Each small network is called a subnet. For example, for the Class B network address , the mask can be used to divide the network into eight subnets: , , , , , , and (Refer to the following figure). Each subnet can contain more than 8000 hosts. Subnetting enhances flexibility in network construction. 1-3

36 Operation Manual IP Address Chapter 1 IP Address Configuration ClassB , , , Standard mask , , , Subnet mask , , , Subnet Host number number Subnet address: 000 Subnet address: Subnet address: Subnet address: Subnet address: Subnet address: Subnet address: Subnet address: Subnet address: Figure 1-2 Subnet division of an IP address 1.2 Configuring IP Addresses The following sections describe IP address configuration tasks: Associating a Hostname to an IP Address Configuring the IP Address of a VLAN Interface IP Address Protection Configuration Associating a Hostname to an IP Address Using this command, you can associate a host name with an IP address. After that, when using an application like telnet, you can use the host name instead of the IP address that is hard to memorize, and the system automatically translates the host name to the IP address. Perform the following configuration in system view to associate a hostname with an IP address: To do Associate a hostname with an IP address Use the command ip host hostname ip-address Remove the association undo ip host hostname [ ip-address ] By default, there is no host name associated to any host IP address Configuring the IP Address of a VLAN Interface You can configure an IP address for every VLAN interface of the switch. Generally, it is enough to configure one IP address for an interface. You can also configure 21 IP 1-4