H3C S9500 Series Routing Switches

Transcription

1 Operation Manual Hangzhou H3C Technologies Co., Ltd. Manual Version: T E C-1.24 Product Version: S9500-CMW310-R1648

2 Copyright , Hangzhou H3C Technologies Co., Ltd. and its licensors All Rights Reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. Trademarks H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. All other trademarks that may be mentioned in this manual are the property of their respective owners. Notice Technical Support The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied. customer_service@h3c.com

3 About This Manual Organization Configuration Manual is organized as follows: Part 00 Product Overview 01 Access Volume 02 IP Services Volume 03 IP Routing Volume 04 IP Multicast Volume 05 MPLS VPN Volume Contents includes Obtaining the Documentation, Product Features, and Features. includes Ethernet Port Configuration, POS Port Configuration, Link Aggregation Configuration, Port Isolation Configuration, VLAN Configuration, MAC Address Table Management Configuration, GVRP Configuration, QinQ Configuration, Ethernet Port Loopback Detection Configuration, DLDP Configuration, Ethernet OAM Configuration, Smart Link and Monitor Link Configuration, MSTP Configuration, BPDU Tunnel Configuration, HVRP Configuration, RRPP Configuration and RPR Configuration. includes ARP Configuration, IP Address Configuration, VRRP Configuration, DHCP Configuration, DNS Configuration, UDP Helper Configuration, NAT Configuration, IP Performance Configuration and URPF Configuration. includes IP Routing Protocol Overview, Static Route Configuration, RIP Configuration, OSPF Configuration, ISIS Configuration, BGP Configuration, IP Route Policy Configuration, Route Capacity Configuration and Recursive Routing Configuration. includes Multicast Overview, Common Multicast Configuration, IGMP Snooping Configuration, IGMP Configuration, PIM Configuration, Multicast VLAN Configuration, MSDP Configuration and MBGP Configuration. includes MPLS Configuration, MPLS VLL Configuration, MPLS VPLS Configuration, MPLS L3VPN Configuration, MPLS OAM Configuration and MPLS Hybrid Insertion Configuration. 06 QoS ACL Volume includes QoS Configuration and ACL Configuration. 07 Security Volume includes Protocol Port Security Configuration, 802.1X Configuration, AAA RADIUS HWTACACS Configuration,Password Control Configuration, SSH Configuration, IDS Linkage Configuration, Portal Configuration, VBAS Configuration and Traffic Accounting Configuration.

4 Part 08 System Volume Contents includes Command Line Interface Configuration, Login and User Interface Configuration, FTP and TFTP Configuration, HA Configuration, NQA Configuration, NetStream Configuration, NTP Configuration, RMON Configuration, SNMP Configuration, Packet Statistics Accounting Configuration, Device Management Configuration, Configuration File Management Configuration, File System Management Configuration, Cluster Management Configuration, System Maintenance and Debugging Configuration, Information Center Configuration, PoE Configuration, Clock Module Configuration, ACSEI Server Configuration and OAP Module Configuration. 09 Acronyms Offers the acronyms used in this manual. Conventions The manual uses the following conventions: I. Command conventions Convention Boldface italic [ ] { x y... } [ x y... ] { x y... } * [ x y... ] * &<1-n> Description The keywords of a command line are in Boldface. Command arguments are in italic. Items (keywords or arguments) in square brackets [ ] are optional. Alternative items are grouped in braces and separated by vertical bars. One is selected. Optional alternative items are grouped in square brackets and separated by vertical bars. One or none is selected. Alternative items are grouped in braces and separated by vertical bars. A minimum of one or a maximum of all can be selected. Optional alternative items are grouped in square brackets and separated by vertical bars. Many or none can be selected. The argument(s) before the ampersand (&) sign can be entered 1 to n times. # A line starting with the # sign is comments.

5 II. GUI conventions Convention Description < > [ ] / Button names are inside angle brackets. For example, click <OK>. Window names, menu items, data table and field names are inside square brackets. For example, pop up the [New User] window. Multi-level menus are separated by forward slashes. For example, [File/Create/Folder]. III. Symbols Convention Warning Caution Note Description Means reader be extremely careful. Improper operation may cause bodily injury. Means reader be careful. Improper operation may cause data loss or damage to equipment. Means a complementary description. Related Documentation In addition to this manual, each documentation set includes the following: Manual Installation Manual Command Manual Description It introduces the installation procedure, commissioning, maintenance and monitoring of the S9500 series routing switches. It includes Feature List and Command Index, Access Volume, IP Service Volume, IP Routing Volume, IP Multicast Volume, MPLS VPN Volume, QoS ACL Volume, Security Volume, and System Volume. Obtaining Documentation You can access the most up-to-date H3C product documentation on the World Wide Web at this URL: The following are the columns from which you can obtain different categories of product

6 documentation: [Products & Solutions]: Provides information about products and technologies. [Technical Support & Document > Technical Documents]: Provides several categories of product documentation, such as installation and operation. [Technical Support & Document > Product Support > Software]: Provides the documentation released with the software version. Documentation Feedback You can your comments about product documentation to We appreciate your comments.

7 Operation Manual IP Multicast Volume Organization Manual Version T E C-1.24 Product Version S9500-CMW310-R1648 Organization The IP Multicast Volume is organized as follows: Features (operation manual) Multicast Overview Common Multicast IGMP Snooping IGMP PIM Description The volume describes the main concepts in multicast: Multicast basics Introduction to IP multicast address IP multicast protocols RPF mechanism for IP multicast packets The volume describes: Enable multicast routing Configure capacity threshold for a multicast routing table Configuring broadcast/multicast suppression Running at the data link layer, IGMP Snooping is a multicast control mechanism on the Layer 2 Ethernet switch and it is used for multicast group management and control. The volume describes: IGMP snooping overview IGMP snooping configuration Internet Group Management Protocol (IGMP) is a protocol in the TCP/IP suite responsible for management of IP multicast members. The volume describes: IGMP overview IGMP proxy overview and configuration IGMP configuration PIM is widely used multicast routing protocols. It discovers multicast source and delivers information to the receivers. The volume describes: Introduction to PIM-DM and PIM-SM PIM-DM configuration PIM-SM configuration

8 Operation Manual IP Multicast Volume Organization Features (operation manual) Multicast VLAN MSDP MBGP Description When users in different VLANs request the service, multicast flow is duplicated in each VLAN and thus a great deal of bandwidth is wasted. To solve this problem, you can add switch ports to a multicast VLAN and enable IGMP Snooping to allow users in different VLANs to share the same multicast VLAN. The volume describes: Multicast VLAN overview Multicast VLAN configuration Multicast VLAN plus configuration Multicast source discovery protocol (MSDP) describes interconnection mechanism of multiple PIM-SM domains. It is used is to discover multicast source information in other PIM-SM domains. The volume describes: MSDP overview MSDP configuration MBGP enables unicast and multicast routing information to be exchanged through the same process but stored in different routing tables. The volume describes: MBGP extension overview MBGP extension configuration

9 Operation Manual Multicast Overview Table of Contents Table of Contents Chapter 1 Multicast Overview IP Multicast Overview Comparison of Three Information Transmission Technologies Application of Multicast Implementation of IP Multicast IP Multicast Addresses IP Multicast Protocols RPF Mechanism for IP Multicast Packets i

10 Operation Manual Multicast Overview Chapter 1 Multicast Overview Chapter 1 Multicast Overview Note: An Ethernet switch functions as a router when it runs IP multicast protocol. The term router in this document refers to a router in a generic sense or a Layer 3 Ethernet switch that running the IP multicast protocol. 1.1 IP Multicast Overview Compared with unicast and broadcast, multicast effectively addresses the issue of point-to-multipoint data transmission. By allowing high-efficiency point-to-multipoint data transmission, multicast greatly saves network bandwidth and reduces network load. With the multicast technology, a service provider can easily provide new value-added services, such as live Webcasting, Web TV, Tele-education, Tele-medicine, Web radio, online videoconferencing, and other bandwidth- and time-sensitive information services Comparison of Three Information Transmission Technologies With the development of the Internet, more and more data, voice, and video information services are running on the Internet. In addition, bandwidth and time sensitive data services, such as e-business, Web conferencing, Web auction, video on demand, and distance learning, have ever higher security and privacy requirements. I. Unicast In unicast mode, the sender has to send a separate copy of information to each user. See Figure

11 Operation Manual Multicast Overview Chapter 1 Multicast Overview Host A Receiver Host B Source Host C Server Receiver Host D Packets for Host B Packets for Host D Packets for Host E Receiver Host E Figure 1-1 Data transmission in unicast mode Suppose that Host B, Host D and Host E need the information, the information source (Server in the figure) establishes a separate transmission channel for each of them. Since the traffic in unicast transmission increases with the number of users, excessive copies of the information would spread over the network if there are a large number of users in need of this information. This means a tremendous pressure on the information source and the network bandwidth. As we can see from the information transmission process, unicast is not suitable for batch transmission of information. II. Broadcast In broadcast mode, every user on the network receives the information regardless of their needs. See Figure

12 Operation Manual Multicast Overview Chapter 1 Multicast Overview Figure 1-2 Data transmission in broadcast mode Suppose Host B, Host D and Host E need the information and the information source Server broadcasts the information through the router. User A and User C can also receive the information. In addition to information security issues, this also causes traffic flooding on the same subnet. Therefore, broadcast is disadvantageous in transmitting data to specific hosts; moreover, broadcast transmission is a significant waste of network resources. In short, the unicast mode is useful in networks with scattered users, and the broadcast mode is suitable for networks with dense users. When the number of users is uncertain, the adoption of unicast or broadcast mode results in low efficiency. III. Multicast IP multicast technology solves those problems. When some users on the network need the information, the multicast information sender (namely, the multicast source) sends only one copy of the information. With a distribution tree established through a multicast routing protocol, multicast packets are duplicated and distributed only where the tree branches. See Figure

13 Operation Manual Multicast Overview Chapter 1 Multicast Overview Figure 1-3 Data transmission in multicast mode Assume that Host B, Host D and Host E need the information. To receive the information, these users need to join a receiver group. The multicast source sends only one copy of the information to the multicast group. The routers on the network duplicate and forward the information based on the distribution of the group members. Finally, the information is correctly delivered to Host B, Host D and Host E. In multicast mode, an information sender is called a multicast source, a receiver group is called a multicast group, and the routers that deliver the multicast information are called multicast routers. Members of a multicast group can scatter around the Internet without any geographical restrictions. It should be noted that a multicast source does not necessarily belong to a multicast group. Multiple sources can send multicast streams to the same multicast group simultaneously. IV. Advantages of multicast The main advantages of multicast are: Enhanced efficiency: It reduces network traffic and relieves the server and CPU of loads. Optimized performance: It eliminates traffic redundancy. Distributed application: It allows point-to-multipoint application Application of Multicast IP multicast technology effectively implements point to multi-point forwarding with high speed, as saves network bandwidth a lot and can relieve network loads. It also facilitates the development of new value-added services in the Internet information 1-4

14 Operation Manual Multicast Overview Chapter 1 Multicast Overview service area, such as online live show, Web TV, tele-education, telemedicine, network radio station and real-time audio/video conferencing. Multicast applications mainly include: Multimedia and streaming media application Occasional communication for training and cooperation Data storage and finance (stock) operation Point-to-multipoint data distribution With the increasing popularity of multimedia services over IP network, multicast is gaining its marketplace. In addition, the multicast service becomes popular and prevalent gradually. 1.2 Implementation of IP Multicast IP Multicast Addresses In multicast mode, there are questions about where to send the information, how to locate the destination or know the receiver. All these questions can be narrowed down to multicast addressing. To guarantee the communication between a multicast source and a multicast group, a network layer multicast address (namely an IP multicast address is required for the group, and a technique is needed to map the IP multicast address to a MAC multicast address. Following is the introduction to these two kinds of multicast addresses. I. IP Multicast addresses According to the definition by Internet Assigned Number Authority (IANA), IP addresses fall into five classes: Class A, Class B, Class C, Class D, and Class E. Unicast packets use IP addresses of Class A, Class B, and Class C addresses. Destination addresses of multicast packets use IP addresses of Class D. A Class D address must not appear in the source address field of IP packets, while all Class E addresses are reserved for future use.. During unicast data transmission, a packet is routed "hop-by-hop" from the source address to the destination address. However, in IP multicast environment, the destination address of a packet is not a unicast IP address but a multicast address that identifies a group of users. All the receivers that need this information need to join the group. Group memberships are dynamic. A host can join or leave a group at any time. A multicast group can be permanent or temporary. Some multicast group addresses are allocated by IANA, called permanent multicast group. The IP address of a permanent multicast group is unchangeable, but its memberships are changeable, and the number of members is not fixed. Addresses not reserved for permanent multicast groups can be used by temporary multicast groups. Class D multicast addresses range from to More information is listed in Table

15 Operation Manual Multicast Overview Chapter 1 Multicast Overview Table 1-1 Ranges and meanings of Class D addresses Class D address range to to to Description Reserved multicast addresses (permanent multicast addresses). All but are assigned to routing protocols. Multicast addresses available for users (addresses for temporary groups). They are valid in the entire Internet. Administratively scoped multicast addresses. They are valid only in the specified local range. Reserved multicast addresses that are commonly used are described in the following table. Table 1-2 Reserved multicast addresses Address range Description All systems in the local subnet, including hosts and routers All multicast routers in the local subnet Unassigned DVMRP routers OSPF routers OSPF DRs/backup OSPF DRs ST routers ST hosts RIP-2 routers Mobile agents DHCP server/relay agent All PIM routers RSVP encapsulation All CBT routers Specified SBM All SBMS VRRP 1-6

16 Operation Manual Multicast Overview Chapter 1 Multicast Overview II. Ethernet multicast MAC addresses When a unicast IP packet is transmitted on an Ethernet, the destination MAC address is the MAC address of the receiver. However, for a multicast packet, the destination is no longer a specific receiver but a group with unspecific members. Therefore, the multicast MAC address should be used. As Internet Assigned Number Authority (IANA) provisions, the high 24 bits of a multicast MAC address are 0x01005e and the low 23 bits of a MAC address are the low 23 bits of a multicast IP address. The high twenty-fifth bit is 0, a fixed value. Figure 1-4 Mapping between a multicast IP address and an Ethernet MAC address The first four bits of the multicast address are 1110, representing the multicast identifier. Among the rest 28 bits, only 23 bits are mapped to the MAC address, and the other five bits are lost. This may results in that 32 IP multicast addresses are mapped to the same MAC address IP Multicast Protocols Typically, the IP multicast protocols working at the network layer are called Layer 3 multicast protocols, including IGMP, PIM, MBGP, and MSDP; while the IP multicast protocols working at the data link layer are called Layer 2 multicast protocols, including IGMP Snooping and multicast VLAN. I. Layer 3 multicast protocols Layer 3 multicast protocols mainly include multicast group management protocols and multicast routing protocols. Figure 1-5 shows where they work in the network. 1-7

17 Operation Manual Multicast Overview Chapter 1 Multicast Overview Figure 1-5 Positions of Layer 3 multicast protocols 1) Multicast group management protocols Internet Group Management Protocol (IGMP) is the IPv4 multicast group management protocol, which runs between receiver hosts and routers directly connected with receivers. IGMP defines the membership establishment and maintenance mechanism between them. 2) Multicast routing protocols A multicast routing protocol runs between Layer 3 multicast devices to create and maintain multicast routes for correct and efficient forwarding of multicast packet. The multicast routing creates a loop-free data transmission path from one source to multiple receivers, namely, a multicast distribution tree. For the ASM model, multicast routing falls into intra-domain and inter-domain routing. Intra-domain multicast routing is to discover multicast sources in an autonomous system (AS), establish a multicast forwarding tree, and deliver multicast traffic through the forward tree to receivers. Among multiple inter-domain multicast routing protocols, Protocol Independent Multicast (PIM) is the most prevalent one. PIM delivers multicast data to receivers on the basis of source discovery and forwarding path establishment. Depending on the forwarding mechanisms, PIM can be further divided into PIM dense mode (PIM-DM) and PIM sparse mode (PIM-SM). Inter-domain multicast routing implements multicast transmission among ASs. Mature solutions include the Multicast Source Discovery Protocol (MSDP) and the Multicast Border Gateway Protocol (MBGP). MSDP is to communicate multicast source information among ASs, while MBGP is to propagate multicast routing information among ASs. 1-8

18 Operation Manual Multicast Overview Chapter 1 Multicast Overview For the SSM model, multicast routes are not divided into inter-domain routes and intra-domain routes. Because receivers are aware of the position of the multicast source, dedicated multicast forwarding paths are established through PIM-SM for multicast transmission. II. Layer 2 Multicast Protocols Layer 2 multicast protocols include IGMP Snooping and multicast VLAN. Figure 1-6 shows where they work in the network. Source Multicast VLAN IGMP Snooping Receiver Receiver IPv4 Multicast packets Figure 1-6 Positions of Layer 2 multicast protocols 1) IGMP Snooping IGMP Snooping is a multicast constraining mechanism running on Layer 2 devices. By listening to and analyzing IGMP messages exchanged between hosts and Layer 3 multicast devices, IGMP Snooping manages and controls multicast groups, thus effectively suppressing flooding of multicast data in Layer 2 networks. 2) Multicast VLAN In the traditional multicast-on-demand mode, when users in different VLANs on a Layer 2 device need multicast information, the upstream Layer 3 device needs to deliver a separate copy of the multicast data to each VLAN on the Layer 2 device. With the multicast VLAN feature enabled on the Layer 2 device, the Layer 3 device needs to send only one copy of multicast data to the multicast VLAN on the Layer 2 device. This avoids waste of network bandwidth and extra burden on the Layer 3 device. 1.3 RPF Mechanism for IP Multicast Packets To ensure that multicast packets reach a router along the shortest path, the multicast router must check the receiving interface of multicast packets depending on the unicast routing table or a unicast routing table independently provided for multicast. This check 1-9

19 Operation Manual Multicast Overview Chapter 1 Multicast Overview mechanism is the basis for most multicast routing protocols to perform multicast forwarding, and is known as Reverse Path Forwarding (RPF) check. A multicast router uses the source address of a received multicast packet to query the unicast routing table or the independent multicast routing table to determine that the receiving interface is on the shortest path from the receiving station to the source. If a source tree is used, the source address is the address of the source host sending the multicast packet. If a shared tree is used, the source address is the RP address of the shared tree. A multicast packet arriving at the router will be forwarded according to the multicast forwarding entry if it passes the RPF check, or else, it will be discarded. 1-10

20 Operation Manual Common Multicast Table of Contents Table of Contents Chapter 1 Common Multicast Configuration Introduction to Common Multicast Configuration Common Multicast Configuration Enabling Multicast Routing Configuring the Capacity Threshold for a Multicast Routing Table Clearing MFC Forwarding Entries or Its Statistic Information Clearing Route Entries from the Core Multicast Routing Table Configuring Broadcast/Multicast Suppression Displaying and Maintaining Common Multicast Configuration i

21 Operation Manual Common Multicast Chapter 1 Common Multicast Configuration Chapter 1 Common Multicast Configuration 1.1 Introduction to Common Multicast Configuration The multicast common configuration is for both the multicast group management protocol and the multicast routing protocol. The configuration includes enabling IP multicast routing, displaying multicast routing table and multicast forwarding table, etc. 1.2 Common Multicast Configuration Common multicast configuration includes: Enabling Multicast Routing Configuring the Capacity Threshold for a Multicast Routing Table Clearing MFC Forwarding Entries or Its Statistic Information Clearing Route Entries from the Core Multicast Routing Table Configuring Broadcast/Multicast Suppression Enabling Multicast Routing You must enable Layer 3 multicast routing in system view before configuring a multicast routing protocol. Perform the following configuration in system view to enable/disable multicast routing: To do... Enable multicast routing Disable multicast routing Use the command... multicast routing-enable undo multicast routing-enable By default, multicast routing is disabled. Caution: Multicast routing must be enabled before other Layer 3 multicast configurations can take effect. 1-1

22 Operation Manual Common Multicast Chapter 1 Common Multicast Configuration Configuring the Capacity Threshold for a Multicast Routing Table A limit setting to the capacity of a multicast routing table can prevent the router memory from being exhausted by overuse. Follow these steps to configure the capacity threshold for a multicast routing table: To do... Use the command... Remarks Enter system view system-view Set the capacity threshold for a multicast routing table multicast route-limit limit By default, the capacity threshold for a multicast routing table is 512. Note: A newly inserted interface board will not work if it does not support the current system configuration on multicast routing table capacity. When the command is used repeatedly, the latest configuration will overwrite the previous configuration. Caution: While configuring the capacity threshold for a multicast routing table, be aware of the following aspects: If the new threshold setting is smaller than the current capacity of a multicast routing table, the system will prompt: Modifying the limit will delete all multicast routing tables. Do you want to continue? [Y/N] Y. If the user types Y, all the entries in the current multicast routing table will be deleted and the new capacity threshold will take effect. If the new threshold setting is greater than the current capacity for a multicast routing table, and the system has an interface board that does not support the threshold setting, the system will prompt: Slot X does not support the limit, configuration failed. Otherwise, the new capacity threshold can be configured successfully Clearing MFC Forwarding Entries or Its Statistic Information Perform the following configuration in user view to clear MFC forwarding entries or its statistic information: 1-2

23 Operation Manual Common Multicast To do... Chapter 1 Common Multicast Configuration Use the command... Clear MFC forwarding entries or its statistic information reset multicast forwarding-table [ statistics ] { all { group-address [ mask { group-mask group-mask-length } ] source-address [ mask { source-mask source-mask-length } ] incoming-interface { null null-interface-number interface-type interface-number } } * } Clearing Route Entries from the Core Multicast Routing Table Perform the following configuration in user view to clear route entries from the core multicast routing table: To do... Clear route entries from the core multicast routing table Use the command... reset multicast routing-table { all { group-address [ mask { group-mask group-mask-length } ] source-address [ mask { source-mask source-mask-length } ] incoming-interface vlan-interface interface-number } * } The corresponding MFC forwarding entries are cleared when routing entries are cleared from the core multicast routing table Configuring Broadcast/Multicast Suppression To prevent port congestion resulting from broadcast/multicast packet flooding, the switch supports broadcast/multicast suppression. You can enable broadcast/multicast suppression by setting the speed percentage or bandwidth values. Follow these steps to configure broadcast/multicast suppression: To do... Use the command... Remarks Enter system view system-view Enter Ethernet port view Configure multicast suppression ration Ethernet port Configure broadcast suppression ration Ethernet port interface interface-type interface-number multicast-suppressi on { ratio bandwidth bandwidth } broadcast-suppress ion { ratio bandwidth bandwidth } Required interface-type is Ethernet or GigabitEthernet. Optional By default, the multicast suppression ratio is 100% The bandwidth argument is in Mbps. Optional By default, the broadcast suppression ratio is 50% The bandwidth argument is in Mbps. 1-3

24 Operation Manual Common Multicast Chapter 1 Common Multicast Configuration Caution: You cannot enable both broadcast suppression and multicast suppression simultaneously on the same card (broadcast suppression is enabled by default). Namely, once you have enabled broadcast suppression on some ports of a card, you cannot enable multicast suppression on the other ports of the card, and vice versa. If multicast suppression is enabled, broadcast packets are also suppressed at the same time, while broadcast suppression does not work on multicast suppression. No distinction is made between known multicast and unknown multicast for multicast suppression. 1.3 Displaying and Maintaining Common Multicast Configuration To do... Use the command... Remarks Display the multicast routing table Display the multicast forwarding table Display port-specific multicast forwarding table Display information about the IP multicast groups or MAC multicast groups in a specified VLAN or all VLANs. Enable multicast packet forwarding debugging Disable multicast packet forwarding debugging display multicast routing-table [ group-address [ mask { mask mask-length } ] source-address [ mask { mask mask-length } ] incoming-interface { vlan-interface vlan-interface-number register } ] * display multicast forwarding-table [ group-address [ mask { mask mask-length } ] source-address [ mask { mask mask-length } ] incoming-interface { interface-type interface-number null null-interface-number register } ] * display mpm forwarding-table [ group-address source-address ] display mpm group [ vlan vlan-id [ ip-address ] ] debugging multicast forwarding undo debugging multicast forwarding Available in any view Available in any view Available in any view Available in any view Available in user view Available in user view 1-4

25 Operation Manual Common Multicast Chapter 1 Common Multicast Configuration To do... Use the command... Remarks Enable multicast forwarding status debugging Disable multicast forwarding status debugging Enable core multicast routing debugging Disable core multicast routing debugging debugging multicast status-forwarding undo debugging multicast status-forwarding debugging multicast kernel-routing undo debugging multicast kernel-routing Available in user view Available in user view Available in user view Available in user view The multicast routing tables can be layered as follows: Each multicast routing protocol has a multicast routing table of itself. All the multicast routing tables can be summarized into the core multicast routing tables. The core multicast routing tables should keep consistent with the multicast forwarding tables which actually control the forwarding of the multicast data packets. The multicast forwarding tables are mainly used for debugging. Usually, users can view the core multicast routing tables to get the required information. 1-5

26 Operation Manual IGMP Snooping Table of Contents Table of Contents Chapter 1 IGMP Snooping Configuration IGMP Snooping Overview IGMP Snooping Principle IGMPv3 Snooping Implementing IGMP Snooping IGMP Snooping Configuration Tasks Enabling IGMP Snooping Configuring IGMP Snooping Parameters Disabling Flooding of Unknown Multicast Packets in the VLAN Configuring an ACL for Filtering Multicast Groups Configuring the Fast Leave Function Configuring the Host Port Function Static Router Port Configuration Configuring IGMP Snooping Multicast Data Load Balancing Configuring an IGMP Snooping Querier Configuring IGMP Report Replay Suppression Configuring IGMP Leave Relay Suppression Multicast Forwarding on Demand Displaying and Maintaining IGMP Snooping IGMP Snooping Configuration Example Troubleshooting IGMP Snooping i

27 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration Chapter 1 IGMP Snooping Configuration When configuring IGMP Snooping, go to the following sections for the information you are interested in: IGMP Snooping Overview IGMP Snooping Configuration Tasks Displaying and Maintaining IGMP Snooping IGMP Snooping Configuration Example Troubleshooting IGMP Snooping 1.1 IGMP Snooping Overview IGMP Snooping Principle Running at the data link layer, IGMP Snooping is a multicast control mechanism on the Layer 2 Ethernet switch and it is used for multicast group management and control. When receiving IGMP messages transmitted between the host and router, the Layer 2 Ethernet switch uses IGMP Snooping to analyze the information carried in the IGMP messages. If the switch hears IGMP host report message from an IGMP host, it will add the host to the corresponding multicast table. If the switch hears IGMP leave message from an IGMP host, it will remove the host from the corresponding multicast table. The switch creates and maintains a MAC multicast address table at Layer 2 by continuously listening to IGMP messages. After that, the switch can forward the multicast packets transmitted from the upstream router according to the MAC multicast address table. When IGMP Snooping is disabled, packets are broadcasted at Layer 2; with IGMP Snooping enabled, multicast packets are delivered to the receivers through multicast rather than being broadcast at Layer 2. See the following figure: 1-1

28 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration Figure 1-1 Comparison of multicast transmission before and after IGMP Snooping is enabled IGMPv3 Snooping I. IGMPv3 overview In addition to compatibility with and inheritance from IGMPv1 and IGMPv2, IGMPv3 provides an enhanced host control capability. A host can not only join a designated multicast group but also specify to receive information from a designated multicast source. Note: S9500 series switches support IGMPv1 and IGMPv2, but they do not support IGMPv3 currently. IGMP queries fall into general queries and group-specific queries. This section mainly introduces IGMPv3 messages that are different from in IGMPv2. 1) Query messages The following figure shows the differences between IGMPv2 and IGMPv3 query messages: The size of an IGMPv2 general query is eight bytes and that of an IGMPv3 general query is twelve bytes. 1-2

29 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration The size of an IGMPv2 group-specific query is eight bytes and that of an IGMPv3 general query is equal to or greater than twelve bytes. The size of an IGMPv3 source-and-group-specific query is greater than twelve bytes. type = 0x11 Max Resp Time Checksum Group Address IGMPv2 query type = 0x11 Max Resp Code Checksum Group Address Resv S QRV QQIC Number of Source(N) Source Address[1]... Source Address[N] IGMPv3 query Figure 1-2 Message formats of IGMPv2 and IGMPv3 queries 2) Membership report message The following figure shows the differences between IGMPv2 and IGMPv3 membership report messages: The type field of an IGMPv2 membership report is set to 0x16. IGMPv2 cannot recognize IGMPv3 membership report messages. Upon receiving an IGMPv3 report, the device transmits the IGMPv3 query transparently in the VLAN and converts it into an IGMPv2 report for further processing. 1-3

30 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration type = 0x16 0x00 Checksum Group Address IGMPv2 membership report type = 0x22 Reserved Checksum Reserved Number of Group Records(M) Group Recoed[1]... Group Record[M] IGMPv3 membership report Record Type Aux Data Len Number of Sources(N) Multicast Address Source Record[1]... Source Record[N] Auxiliary Data Figure 1-3 Message formats of IGMPv2 and IGMPv3 membership reports II. Message processing in IGMPv3 Snooping on an S9500 switch Note: Currently, the device supports only the INCLUDE mode of source filtering in IGMPv3 reports, that is, IGMPv3 report messages are converted to IGMPv2 reports except those with the filtering mode set to include { NULL }, which are converted to IGMPv2 leave messages. With IGMPv3 Snooping enabled, upon receiving an IGMPv3 query, the device transmits the IGMPv3 query transparently in the VLAN and then converts it into an IGMPv2 report for further processing Implementing IGMP Snooping I. Concepts related to IGMP Snooping To facilitate the description, this section first introduces some concepts related to IGMP Snooping. Router Port: The port that connects the switch to a multicast router and resides on the switch, instead of the router. Multicast member port: The Ethernet switch port connected to a multicast member. The multicast member refers to a host joined a multicast group. 1-4

31 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration MAC multicast group: The multicast group is identified by MAC multicast address and maintained by the Ethernet switch. Router port aging time: Time set on the router port aging timer. If the switch has not received any IGMP general query message when the timer expires, it considers the port no longer as a router port. Multicast group member port aging time: When a port joins an IP multicast group, the aging timer of the port is started. The multicast group member port aging time is set on this aging timer. If no IGMP report or PIM hello message reaches the port when the timer expires the switch sends a multicast group-specific query message. When the maximum response time expires, if no IGMP report reaches the port, the switch judges that the port is no longer a member port. Maximum response time: When the switch transmits IGMP group-specific query message to the multicast member port, the Ethernet switch starts a response timer. The maximum response time refers to the timer length. If the switch has not received any IGMP report message before the timer expires, it will remove the port from the multicast member ports. II. Implementing Layer 2 multicast with IGMP Snooping The Ethernet switch runs IGMP Snooping to listen to IGMP messages and map the host and its ports to the corresponding multicast group address. 1) IGMP general query message: Transmitted by the multicast router to the multicast group members to query which multicast group contains a member. When an IGMP general query message arrives at the router port, the Ethernet switch will reset the aging timer of the port. When a port other than the router port receives the IGMP general query message, the Ethernet switch will start the aging timer for the port. 2) IGMP group-specific query message: IGMP group-specific query messages are used to find out whether a particular group still has members on the local subnet. Upon hearing an IGMP group-specific query message, the switch sends the group-specific query message only to the multicast group being queried. 3) IGMP report message: IGMP report messages are sent by hosts to the multicast router to join multicast groups or report their group memberships in response to IGMP query messages. Upon hearing an IGMP report message, the switch checks whether the MAC multicast group corresponding to the reported IP multicast group exists and proceeds accordingly. If the MAC multicast group does not exist, the switch notifies the router that a member is ready to join the reported multicast group, creates a new MAC-based forwarding entry, adds the port that received the report message to the entry, starts an aging timer for the port, and then adds all the router ports in the native VLAN of the port into the MAC multicast forwarding table. 1-5

32 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration If the corresponding MAC multicast group exists but does not contain the port received the report message, the switch adds the port into the multicast group and starts the port aging timer. If the MAC multicast group exists and contains the port that received the message, the switch will only reset the aging timer of the port. 4) IGMP leave message: Transmitted from the multicast group member to the multicast router to notify that a host left the multicast group. Upon hearing a leave message for an IP multicast group, the Ethernet switch sends a group-specific query message for that group to the port on which it heard the message, to check whether any other active members for that group are attached to the port, and meanwhile starts a maximum response timer. If the switch receives no report message for that multicast group before the timer expires, the port will be removed from the corresponding MAC-based forwarding table entry. If the switch has no more member ports for that MAC multicast group, the switch will notify the upstream multicast router to prune the branch off the multicast distribution tree. Note: You can configure a port of a Layer 2 switch as a multicast group member to respond to an IGMP query message of a multicast router, so as to prevent the multicast router from canceling the corresponding path if there is no multicast member in the current network segment. For details, refer to IGMP Configuration in the IP Multicast Volume. By default, ports of a Layer 2 switch do not belong to any multicast group. Note that, the specified port must belong to an IGMP Snooping-enabled VLAN. Otherwise, the configuration will not work. 1.2 IGMP Snooping Configuration Tasks Enabling IGMP Snooping Configuring IGMP Snooping Parameters Disabling Flooding of Unknown Multicast Packets in the VLAN Configuring an ACL for Filtering Multicast Groups Configuring the Fast Leave Function Configuring the Host Port Function Static Router Port Configuration Configuring IGMP Snooping Multicast Data Load Balancing Configuring an IGMP Snooping Querier Configuring IGMP Report Replay Suppression Configuring IGMP Leave Relay Suppression Multicast Forwarding on Demand 1-6

33 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration Enabling IGMP Snooping You can control the creation and maintenance of MAC multicast tables at Layer 2 by enabling IGMP Snooping. I. Configuration prerequisites Make sure Layer 2 and Layer 3 multicast protocols are not enabled in the same VLAN or on the same VLAN interface. VLAN VPN is disabled in the VLAN. II. Configuration procedure Follow these steps to enable IGMP Snooping: To do... Use the command... Remarks Enter system view system-view Enable IGMP Snooping igmp-snooping { enable disable } Required IGMP Snooping is disabled by default. Enter VLAN view vlan vlan-id Enable IGMP Snooping Display IGMP Snooping configuration igmp-snooping { enable disable } display igmp-snooping configuration Required IGMP Snooping is disabled by default. The display command can be executed in any view. Caution: Before configuring IGMP Snooping, first enable it globally in system view and then enable it in VLAN view. Otherwise, the configuration will not work. IGMP Snooping is applicable to isolate-user VLANs. If IGMP Snooping is enabled in an isolate-user VLAN, it is enabled in all the secondary VLANs. Therefore, enabling IGMP Snooping in a secondary VLAN is not necessary. The IGMP packets in a secondary VLAN are processed in the isolate-user VLAN. That is, for a user-isolate VLAN, all the multicast services are processed in the isolate-user VLAN. A port in a secondary VLAN cannot be used for receiving multicast traffic. 1-7

34 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration Configuring IGMP Snooping Parameters IGMP Snooping parameters include: Router port aging time Maximum response time Multicast group member port aging time I. Configuration prerequisites IGMP Snooping is enabled globally. II. Configuration procedure Perform the following operations to configure IGMP Snooping parameters: To do... Use the command... Remarks Enter system view system-view Configure router port aging time Configure maximum response time Configure multicast group member port aging time igmp-snooping router-aging-time seconds igmp-snooping max-response-time seconds igmp-snooping host-aging-time seconds Optional By default, the route port aging time is 260 seconds Optional By default the maximum response time is 1 second Optional By default, the multicast group member port aging time is 260 seconds Disabling Flooding of Unknown Multicast Packets in the VLAN If neither IGMP Snooping nor Layer 3 multicast is enabled in a VLAN, unknown multicast packets are flooded in the VLAN. Therefore, to disable unknown multicast packets from being flooded in a VLAN, you need to enable IGMP Snooping in the VLAN and execute the igmp-snooping nonflooding-enable command. I. Configuration prerequisites IGMP Snooping is enabled in the VLAN. 1-8

35 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration II. Configuration procedure Follow these steps to disable flooding of unknown multicast packets in the VLAN on a general board: To do... Use the command... Remarks Enter system view system-view Disable flooding of unknown multicast packets in the VLAN igmp-snooping nonflooding-enable By default, multicast packets are flooded in a VLAN Configuring an ACL for Filtering Multicast Groups I. Configuration prerequisites IGMP Snooping is enabled globally. II. Configuration procedure Follow these steps to configure an ACL for filtering multicast groups: To do... Use the command... Remarks Enter system view system-view Enter VLAN view vlan vlan-id Apply an ACL for filtering multicast groups in the VLAN igmp-snooping group-policy acl-number Required By default, the ACL for filtering multicast groups is not configured in a VLAN. In this case, a host can join any multicast group. After the ACL for filtering multicast groups is configured, the multicast groups that are not permitted by the ACL cannot be created. 1-9

36 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration Caution: If the ACL applied to a VLAN does not exist or contain any rule, the host cannot join any multicast group. The rules of the ACL for filtering multicast groups are not limited by the ACL. This function applies to all the members in the specified VLAN. The rules for filtering multicast groups take effect only when the configuration policy bound to the ACL number exists. The rules for filtering multicast groups have no effect on locally configured static multicast groups Configuring the Fast Leave Function I. Configuration prerequisites IGMP Snooping is enabled globally. II. Configuration procedure Follow these steps to configure the fast leave function: To do... Use the command... Remarks Enter system view system-view Enable the fast leave function Enter Ethernet port view Enable the fast leave function igmp-snooping fast-leave [ vlan { vlan-id [ to vlan-id ] } &<1-10> ] interface interface-type interface-number igmp-snooping fast-leave [ vlan { vlan-id [ to vlan-id ] } &<1-10> ] This function is disabled by default. This function is disabled by default Note: The fast leave configuration performed in system view and that performed in port view are independent of each other. That is, the configuration performed in system view is effective to all the ports in the specified VLAN, whereas the configuration performed in port view is effective for the port in the specified VLAN. For example, a trunk port belongs to multiple VLANs. 1-10

37 Operation Manual IGMP Snooping Chapter 1 IGMP Snooping Configuration Caution: The fast leave function cannot take effect if the specified VLAN does not exist, the port does not belong to the specified VLAN, or IGMP Snooping is not enabled in the VLAN. If you enable IGMP Snooping again, the original configuration of fast leave will be cleared. You cannot configure this command when IGMP Snooping is not enabled globally. (You can use the igmp-snooping enable command in system view to enable IGMP Snooping globally.) For an aggregation port, the fast leave function only takes effects on the master aggregation port. If an IGMPv1 host in the same group joins the port, even if fast leave is enabled on the port, it does not take effect Configuring the Host Port Function In a healthy multicast network, devices receive IGMP queries and PIM hello packets only on their router ports. However, in actual applications, devices may be attacked by malicious packets received on normal ports (such as malicious IGMP queries), and as a result, a device takes a normal port as a router port by mistake. Figure 1-4 Network diagram for host-port configuration As shown in Figure 1-4, upon receiving malicious IGMP query messages sent by the attacker, Switch A identifies Ethernet 3/1/2 as a router port and sends IGMP reports and other multicast packets through Ethernet 3/1/2. Moreover, because those malicious 1-11