H3C SR6600 Routers. Layer 3 IP Services. Command Reference. Hangzhou H3C Technologies Co., Ltd.

Transcription

1 H3C SR6600 Routers Layer 3 IP Services Command Reference Hangzhou H3C Technologies Co., Ltd. Document Version: C-1.08 Product Version: SR6600-CMW520-R2420

2 Copyright , Hangzhou H3C Technologies Co., Ltd. and its licensors All Rights Reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. Trademarks H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. All other trademarks that may be mentioned in this manual are the property of their respective owners. Notice The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.

3 Preface The H3C SR6600 documentation set includes 13 command references, which describe the commands and command syntax options available for the H3C SR6600 Routers. The Layer 3 IP Services Command Reference describes Layer 3 IPv4/IPv6 configuration commands This preface includes: Audience Conventions About the H3C SR6600 Documentation Set Obtaining Documentation Documentation Feedback Audience This documentation is intended for: Network planners Field technical support and servicing engineers Network administrators working with the SR6600 Conventions This section describes the conventions used in this documentation set. Command conventions Convention Boldface italic [ ] { x y... } [ x y... ] { x y... } * [ x y... ] * &<1-n> Bold text represents commands and keywords that you enter literally as shown. Italic text represents arguments that you replace with actual values. Square brackets enclose syntax choices (keywords or arguments) that are optional. Braces enclose a set of required syntax choices separated by vertical bars, from which you select one. Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none. Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one. Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you may select multiple choices or none. The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times. # A line that starts with a pound (#) sign is comments.

4 Symbols Convention Means reader be extremely careful. Improper operation may cause bodily injury. Means reader be careful. Improper operation may cause data loss or damage to equipment. Means an action or information that needs special attention to ensure successful configuration or good performance. Means a complementary description. Means techniques helpful for you to make configuration with ease. About the H3C SR6600 Documentation Set The H3C SR6600 documentation set includes: Category Documents Purposes Product description and specifications Hardware specifications and installation Software configuration Operations and maintenance Marketing brochures Technology white papers Card datasheets Compliance and safety manual Installation guide Card manuals H3C N68 Cabinet Installation and Remodel Introduction Configuration guides Command references H3C SR6608 Release notes H3C SR6602 Release notes Describe product specifications and benefits. Provide an in-depth description of software features and technologies. Describe card specifications, features, and standards. Provides regulatory information and the safety instructions that must be followed during installation. Provides a complete guide to hardware installation and hardware specifications. Provide the hardware specifications of cards. Guides you through installing and remodeling H3C N68 cabinets. Describe software features and configuration procedures. Provide a quick reference to all available commands. Provide information about the product release, including the version history, hardware and software compatibility matrix, version upgrade information, technical support information, and software upgrading. Obtaining Documentation You can access the most up-to-date H3C product documentation on the World Wide Web at Click the links on the top navigation bar to obtain different categories of product documentation: [Technical Support & Documents > Technical Documents] Provides hardware installation, software upgrading, and software feature configuration and maintenance documentation. [Products & Solutions] Provides information about products and technologies, as well as solutions.

5 [Technical Support & Documents > Software Download] Provides the documentation released with the software version. Technical Support Documentation Feedback You can your comments about product documentation to We appreciate your comments.

6 Table of Contents 1 ARP Configuration Commands 1-1 ARP Configuration Commands 1-1 arp check enable 1-1 arp max-learning-num 1-1 arp static 1-2 arp timer aging 1-3 display arp 1-3 display arp ip-address 1-5 display arp timer aging 1-6 display arp vpn-instance 1-6 naturemask-arp enable 1-7 reset arp Gratuitous ARP Configuration Commands 2-1 Gratuitous ARP Configuration Commands 2-1 arp send-gratuitous-arp 2-1 gratuitous-arp-sending enable 2-2 gratuitous-arp-learning enable Proxy ARP Configuration Commands 3-1 Proxy ARP Configuration Commands 3-1 proxy-arp enable 3-1 display proxy-arp GRE Configuration Commands 4-1 GRE Configuration Commands 4-1 gre checksum 4-1 gre key 4-1 keepalive IP Addressing Configuration Commands 5-1 IP Addressing Configuration Commands 5-1 display ip interface 5-1 display ip interface brief 5-3 ip address 5-4 ip address unnumbered DHCP Server Configuration Commands 6-1 DHCP Server Configuration Commands 6-1 bims-server 6-1 bootfile-name 6-2 dhcp enable 6-2 dhcp server apply ip-pool 6-3 dhcp select server global-pool 6-4 i

7 dhcp server detect 6-4 dhcp server forbidden-ip 6-5 dhcp server ip-pool 6-6 dhcp server ping packets 6-6 dhcp server ping timeout 6-7 dhcp server relay information enable 6-8 display dhcp server conflict 6-8 display dhcp server expired 6-9 display dhcp server free-ip 6-10 display dhcp server forbidden-ip 6-10 display dhcp server ip-in-use 6-11 display dhcp server statistics 6-12 display dhcp server tree 6-13 dns-list 6-15 domain-name 6-16 expired 6-16 forbidden-ip 6-17 gateway-list 6-18 nbns-list 6-18 netbios-type 6-19 network 6-20 network ip range 6-20 network mask 6-21 option 6-22 reset dhcp server conflict 6-22 reset dhcp server ip-in-use 6-23 reset dhcp server statistics 6-23 static-bind client-identifier 6-24 static-bind ip-address 6-25 static-bind mac-address 6-26 tftp-server domain-name 6-26 tftp-server ip-address 6-27 voice-config DHCP Relay Agent Configuration Commands 7-1 DHCP Relay Agent Configuration Commands 7-1 dhcp relay address-check 7-1 dhcp relay information circuit-id format-type 7-2 dhcp relay information circuit-id string 7-2 dhcp relay information enable 7-3 dhcp relay information format 7-4 dhcp relay information remote-id format-type 7-5 dhcp relay information remote-id string 7-5 dhcp relay information strategy 7-6 dhcp relay release ip 7-7 ii

8 dhcp relay security static 7-7 dhcp relay security refresh enable 7-8 dhcp relay security tracker 7-9 dhcp relay server-detect 7-10 dhcp relay server-group 7-10 dhcp relay server-select 7-11 dhcp select relay 7-12 display dhcp relay 7-12 display dhcp relay information 7-13 display dhcp relay security 7-14 display dhcp relay security statistics 7-15 display dhcp relay security tracker 7-16 display dhcp relay server-group 7-16 display dhcp relay statistics 7-17 reset dhcp relay statistics DHCP Client Configuration Commands 8-1 DHCP Client Configuration Commands 8-1 display dhcp client 8-1 ip address dhcp-alloc DHCP Snooping Configuration Commands 9-1 DHCP Snooping Configuration Commands 9-1 dhcp-snooping 9-1 dhcp-snooping information circuit-id format-type 9-2 dhcp-snooping information circuit-id string 9-2 dhcp-snooping information enable 9-3 dhcp-snooping information format 9-4 dhcp-snooping information remote-id format-type 9-5 dhcp-snooping information remote-id string 9-5 dhcp-snooping information strategy 9-6 dhcp-snooping trust 9-7 display dhcp-snooping 9-8 display dhcp-snooping information 9-9 display dhcp-snooping packet statistics 9-10 display dhcp-snooping trust 9-10 reset dhcp-snooping 9-11 reset dhcp-snooping packet statistics IPv4 DNS Configuration Commands 10-1 IPv4 DNS Configuration Commands 10-1 display dns domain 10-1 display dns dynamic-host 10-1 display dns server 10-2 display ip host 10-3 dns domain 10-4 dns proxy enable 10-5 iii

9 dns resolve 10-5 dns server 10-6 dns spoofing 10-6 ip host 10-7 reset dns dynamic-host IPv6 DNS Configuration Commands 11-1 IPv6 DNS Configuration Commands 11-1 display dns ipv6 dynamic-host 11-1 display dns ipv6 server 11-2 display ipv6 host 11-2 dns server ipv ipv6 host 11-4 reset dns ipv6 dynamic-host NAT Configuration Commands 12-1 NAT Configuration Commands 12-1 display nat address-group 12-1 display nat all 12-2 display nat bound 12-3 display nat dns-map 12-4 display nat server 12-5 display nat server-group 12-6 display nat session 12-7 display nat static 12-8 display nat statistics 12-9 display userlog export inside ip nat address-group nat dns-map nat outbound nat outbound static nat server (for extended nat server) nat server (for normal nat server) nat server-group nat static IP Performance Optimization Configuration Commands 13-1 IP Performance Optimization Configuration Commands 13-1 display fib 13-1 display fib ip-address 13-3 display icmp statistics 13-4 display ip socket 13-5 display ip statistics 13-8 display ip virtual-reassembly 13-9 display tcp statistics display udp statistics iv

10 ip forward-broadcast (interface view) ip redirects enable ip ttl-expires enable ip unreachables enable ip virtual-reassembly reset ip statistics reset tcp statistics reset udp statistics tcp mss tcp timer fin-timeout tcp timer syn-timeout tcp window Flow Classification Configuration Commands 14-1 Flow Classification Configuration Commands 14-1 display forwarding policy 14-1 forwarding policy Adjacency Table Configuration Commands 15-1 IPv4 Adjacency Table Configuration Commands 15-1 display adjacent-table 15-1 IPv6 Adjacency Table Configuration Commands 15-2 display ipv6 adjacent-table UDP Helper Configuration Commands 16-1 UDP Helper Configuration Commands 16-1 display udp-helper server 16-1 reset udp-helper packet 16-1 udp-helper enable 16-2 udp-helper port 16-2 udp-helper server IPv6 Basics Configuration Commands 17-1 IPv6 Basics Configuration Commands 17-1 display ipv6 fib 17-1 display ipv6 fibcache 17-2 display ipv6 interface 17-3 display ipv6 neighbors 17-6 display ipv6 neighbors count 17-8 display ipv6 pathmtu 17-9 display ipv6 socket 17-9 display ipv6 statistics display tcp ipv6 statistics display tcp ipv6 status display udp ipv6 statistics ipv ipv6 address v

11 ipv6 address anycast ipv6 address auto link-local ipv6 address eui ipv6 address link-local ipv6 fibcache ipv6 icmp-error ipv6 icmpv6 multicast-echo-reply enable ipv6 mtu ipv6 nd autoconfig managed-address-flag ipv6 nd autoconfig other-flag ipv6 nd dad attempts ipv6 nd hop-limit ipv6 nd ns retrans-timer ipv6 nd nud reachable-time ipv6 nd ra halt ipv6 nd ra interval ipv6 nd ra no-advlinkmtu ipv6 nd ra prefix ipv6 nd ra router-lifetime ipv6 neighbor ipv6 neighbors max-learning-num ipv6 pathmtu ipv6 pathmtu age ipv6 unreachables enable reset ipv6 fibcache reset ipv6 neighbors reset ipv6 pathmtu reset ipv6 statistics reset tcp ipv6 statistics reset udp ipv6 statistics tcp ipv6 timer fin-timeout tcp ipv6 timer syn-timeout tcp ipv6 window DHCPv6 Configuration Commands 18-1 DHCPv6 Common Commands 18-1 display ipv6 dhcp duid 18-1 DHCPv6 Server Configuration Commands 18-1 display ipv6 dhcp pool 18-1 display ipv6 dhcp prefix-pool 18-3 display ipv6 dhcp server 18-4 display ipv6 dhcp server pd-in-use 18-5 display ipv6 dhcp server statistics 18-6 dns-server 18-8 domain-name 18-8 vi

12 ipv6 dhcp pool 18-9 ipv6 dhcp prefix-pool ipv6 dhcp server apply pool ipv6 dhcp server enable prefix-pool reset ipv6 dhcp server pd-in-use reset ipv6 dhcp server statistics sip-server static-bind prefix DHCPv6 Relay Agent Configuration Commands display ipv6 dhcp relay server-address display ipv6 dhcp relay statistics ipv6 dhcp relay server-address reset ipv6 dhcp relay statistics NAT-PT Configuration Commands 19-1 NAT-PT Configuration Commands 19-1 display natpt address-group 19-1 display natpt address-mapping 19-1 display natpt all 19-2 display natpt statistics 19-4 natpt address-group 19-5 natpt enable 19-6 natpt prefix 19-6 natpt turn-off tos 19-7 natpt turn-off traffic-class 19-7 natpt v4bound dynamic 19-8 natpt v4bound static 19-9 natpt v4bound static v6server natpt v6bound dynamic natpt v6bound static reset natpt statistics Tunneling Configuration Commands 20-1 Tunneling Configuration Commands 20-1 description 20-1 destination 20-1 display interface tunnel 20-2 display ipv6 interface tunnel 20-4 interface tunnel 20-8 mtu 20-9 reset counters interface 20-9 service slot shutdown source tunnel-protocol vii

13 21 Command Index 21-1 viii

14 1 ARP Configuration Commands ARP Configuration Commands arp check enable arp check enable undo arp check enable System view None Use the arp check enable command to enable ARP entry check. With this function enabled, the device cannot learn any ARP entry with a multicast MAC address. Configuring such a static ARP entry is not allowed either; otherwise, the system displays error messages. Use the undo arp check enable command to disable the function. After the ARP entry check is disabled, the router can learn the ARP entry with a multicast MAC address, and you can also configure such a static ARP entry on the router. By default, ARP entry check is enabled. # Enable ARP entry check. [Sysname] arp check enable arp max-learning-num arp max-learning-num number undo arp max-learning-num Ethernet interface view, VLAN interface view, Layer 2 aggregate interface view, Layer 3 aggregate interface view 1-1

15 number: Maximum number of dynamic ARP entries that an interface can learn, in the range 1 to The default value is Use the arp max-learning-num command to set the maximum number of dynamic ARP entries that an interface can learn. Use the undo arp max-learning-num command to restore the default. When the number argument is set to 0, the interface is disabled from learning dynamic ARP entries. # Specify VLAN-interface 40 to learn up to 500 dynamic ARP entries. [Sysname] vlan-interface 40 [Sysname-Vlan-interface40] arp max-learning-num 500 # Specify GigabitEthernet 2/1/0 to learn up to 1000 dynamic ARP entries. [Sysname] interface gigabitethernet 2/1/0 [Sysname-GigabitEthernet2/1/0] arp max-learning-num 1000 # Specify Layer 2 aggregate interface Bridge-aggregation 1 to learn up to 1000 dynamic ARP entries. [Sysname] interface bridge-aggregation 1 [Sysname-Bridge-Aggregation1] arp max-learning-num 1000 # Specify Layer 3 aggregate interface Route-aggregation 1 to learn up to 1000 dynamic ARP entries. [Sysname] interface route-aggregation 1 [Sysname-Route-Aggregation1] arp max-learning-num 1000 arp static arp static ip-address mac-address [ vpn-instance vpn-instance-name ] undo arp ip-address [ vpn-instance-name ] System view ip-address: IP address in an ARP entry. mac-address: MAC address in an ARP entry, in the format H-H-H. vpn-instance vpn-instance-name: Name of a VPN instance, a case-sensitive string of 1 to 31 characters. Use the arp static command to configure a static ARP entry in the ARP mapping table. 1-2

16 Use the undo arp command to remove an ARP entry. Note that: A static ARP entry is effective when the router works normally. However, when the VLAN or VLAN interface to which an ARP entry corresponds is deleted, the entry will become unresolved if it is short and resolved. If no VPN instance is specified in the undo arp command, corresponding ARP entries of all VPN instances are removed. Related commands: reset arp and display arp. # Configure a static ARP entry, with the IP address being , and the MAC address being 00e0-fc [Sysname] arp static e0-fc arp timer aging arp timer aging aging-time undo arp timer aging System view aging-time: Age timer for dynamic ARP entries in minutes, in the range 1 to 1,440. Use the arp timer aging command to set the age timer for dynamic ARP entries. Use the undo arp timer aging command to restore the default. By default, the age timer for dynamic ARP entries is 20 minutes. Related commands: display arp timer aging. # Set the age timer for dynamic ARP entries to 10 minutes. [Sysname] arp timer aging 10 display arp On the SR6602 router: display arp [ [ all dynamic static ] interface interface-type interface-number [ [ verbose ] [ { begin exclude include } regular-expression ] count ] On the SR6604/6608/6616 router: 1-3

17 display arp [ [ all dynamic static ] [ slot slot-number ] vlan vlan-id interface interface-type interface-number ] [ [ verbose ] [ { begin exclude include } regular-expression ] count ] Any view 1: Monitor level all: Displays all ARP entries. dynamic: Displays dynamic ARP entries. static: Displays static ARP entries. slot slot-number: Displays the ARP entries of the specified card. The slot-number argument specifies the slot number of the card. vlan vlan-id: Displays the ARP entries of the specified VLAN. The vlan-id argument ranges from 1 to interface interface-type interface-number: Displays the ARP entries of the interface specified by the argument interface-type interface-number. verbose: Displays detailed information about ARP entries. : Uses a regular expression to specify the ARP entries to be displayed. For more information about regular expressions, see CLI in the Fundamentals Configuration Guide. begin: Displays ARP entries from the first one containing the specified string. exclude: Displays the ARP entries that do not contain the specified string. include: Displays the ARP entries containing the specified string. regular-expression: A case-sensitive string for matching, consisting of 1 to 256 characters. count: Displays the number of ARP entries. Use the display arp command to display ARP entries in the ARP mapping table. If no parameter is specified, all ARP entries are displayed. Related commands: arp static and reset arp. # Display the detailed information of all ARP entries. <Sysname> display arp all verbose Type: S-Static D-Dynamic A-Authorized IP Address MAC Address VLAN ID Interface Aging Type Vpn-instance Name e0-fc N/A N/A N/A S test e0-fe N/A GE2/1/0 14 D [No Vrf] d-88f7-9f7d N/A GE2/1/1 18 D [No Vrf] a N/A GE2/1/2 20 D [No Vrf] 1-4

18 Table 1-1 display arp command output description Field IP Address MAC Address VLAN ID Interface Aging Type Vpn-instance Name IP address in an ARP entry MAC address in an ARP entry VLAN ID contained a static ARP entry Outbound interface in an ARP entry Age timer for a dynamic ARP entry in minutes ("DIS" or N/A means unknown age timer or no age timer.) ARP entry type: "D" stands for dynamic, "S" for static, and "A" for authorized. Name of VPN instance. [No Vrf] means no VPN instance is configured for the corresponding ARP. # Display the number of all ARP entries <Sysname> display arp all count Total Entry(ies): 4 display arp ip-address On the SR6602 router: display arp ip-address [ verbose ] [ { begin exclude include } regular-expression ] On the SR6604/6608/6616 router: display arp ip-address [ slot slot-number ] [ verbose ] [ { begin exclude include } regular-expression ] Any view 1: Monitor level ip-address: Displays the ARP entry for the specified IP address. slot slot-number: Displays the ARP entries of the specified card. The slot-number argument specifies the slot number of the card. verbose: Displays the detailed information about ARP entries. : Uses a regular expression to specify the ARP entries to be displayed. For detailed information about regular expressions, see CLI in the Fundamentals Configuration Guide. begin: Displays the ARP entries from the first one containing the specified string. exclude: Displays the ARP entries that do not contain the specified string. Include: Displays the ARP entries that contain the specified string. regular-expression: A case-sensitive string for matching, consisting of 1 to 256 characters. Use the display arp ip-address command to display the ARP entry for a specified IP address. 1-5

19 Related commands: arp static and reset arp. # Display the corresponding ARP entry for the IP address <Sysname> display arp Type: S-Static D-Dynamic IP Address MAC Address VLAN ID Interface Aging Type e0-fc N/A N/A N/A S display arp timer aging display arp timer aging Any view None Use the display arp timer aging command to display the age timer for dynamic ARP entries. Related commands: arp timer aging. # Display the age timer for dynamic ARP entries. [Sysname] display arp timer aging Current ARP aging time is 10 minute(s) display arp vpn-instance display arp vpn-instance vpn-instance-name [ { begin exclude include } regular-expression count ] Any view 1: Monitor level vpn-instance-name: Name of VPN instance, a case-sensitive string of 1 to 31 characters excluding spaces. With this argument specified, the ARP entries for a specific VPN instance are displayed. : Uses a regular expression to specify the ARP entries to be displayed. For detailed information about regular expressions, see CLI in the Fundamentals Configuration Guide. begin: Displays the ARP entries from the first one that contains the specified string. 1-6

20 exclude: Displays the ARP entries that do not contain the specified string. include: Displays the ARP entries that contain the specified string. regular-expression: A case-sensitive character string for matching, consisting of 1 to 256 characters. count: Displays the number of ARP entries. Use the display arp vpn-instance command to display the ARP entries for a specified VPN instance. Related commands: arp static and reset arp. # Display ARP entries for the VPN instance named test. <Sysname> display arp vpn-instance test Type: S-Static D-Dynamic IP Address MAC Address VLAN ID Interface Aging Type e0-fc N/A N/A N/A S naturemask-arp enable naturemask-arp enable undo naturemask-arp enable System view None Use the naturemask-arp enable command to cancel the restriction that ARP requests must be from the same subnet. In this case, ARP requests from a natural network are supported. Use the undo naturemask-arp enable command to restore the default. By default, the support for ARP requests from a natural network is disabled. # Enable the support for ARP requests from a natural network. [Sysname] naturemask-arp enable reset arp On the SR6602 router: reset arp { all dynamic static interface interface-type interface-number } On the SR6604/6608/6616 router: 1-7

21 reset arp { all dynamic static slot slot-number interface interface-type interface-number } User view all: Clears all ARP entries except for authorized ones. dynamic: Clears all dynamic ARP entries. static: Clears all static ARP entries. slot slot-number: Clears the ARP entries of the specified card. The slot-number argument specifies the slot number of the card. interface interface-type interface-number: Clears the ARP entries for the interface specified by the argument interface-type interface-number. Use the reset arp command to clear ARP entries except for authorized ones from the ARP mapping table. With interface interface-type interface-number or slot slot-number specified, the command clears only dynamic ARP entries of the interface or the interface card. Related commands: arp static and display arp. # Clear all static ARP entries. <Sysname> reset arp static 1-8

22 2 Gratuitous ARP Configuration Commands Gratuitous ARP Configuration Commands arp send-gratuitous-arp arp send-gratuitous-arp [ interval milliseconds ] undo arp send-gratuitous-arp Layer 3 Ethernet interface view, Layer 3 Ethernet subinterface view, VLAN interface view interval milliseconds: Sets the interval at which gratuitous ARP packets are sent, in the range 200 to milliseconds. The default value is Use the arp send-gratuitous-arp command to enable periodic sending of gratuitous ARP packets and set the sending interval for the interface. Use the undo arp send-gratuitous-arp command to disable the interface from periodically sending gratuitous ARP packets. By default, an interface is disabled from sending gratuitous ARP packets periodically. Note that: This function takes effect only when the link of the enabled interface goes up and an IP address has been assigned to the interface. The IP address contained in a gratuitous ARP request can be the VRRP virtual IP address, the primary IP address or a manually configured secondary IP address of the sending interface only. The primary IP address can be configured manually or automatically, whereas the secondary IP address must be configured manually. If you change the interval for sending gratuitous ARP packets, the configuration is effective at the next sending interval. The frequency of sending gratuitous ARP packets may be much lower than is expected if this function is enabled on multiple interfaces, or each interface is configured with multiple secondary IP addresses, or a small sending interval is configured in the preceding cases. # Enable GigabitEthernet 2/1/1 to send gratuitous ARP packets at 300 millisecond intervals. [Sysname] interface gigabitethernet 2/1/1 [Sysname-GigabitEthernet2/1/1] arp send-gratuitous-arp

23 gratuitous-arp-sending enable gratuitous-arp-sending enable undo gratuitous-arp-sending enable System view None Use the gratuitous-arp-sending enable command to enable a router to send gratuitous ARP packets when receiving ARP requests from another network segment. Use the undo gratuitous-arp-sending enable command to restore the default. By default, a router cannot send gratuitous ARP packets when receiving ARP requests from another network segment. # Disable a router from sending gratuitous ARP packets. [Sysname] undo gratuitous-arp-sending enable gratuitous-arp-learning enable gratuitous-arp-learning enable undo gratuitous-arp-learning enable System view None Use the gratuitous-arp-learning enable command to enable the gratuitous ARP packet learning function. Use the undo gratuitous-arp-learning enable command to disable the function. By default, the function is disabled. With this function enabled, a router receiving a gratuitous ARP packet can add the source IP and MAC addresses carried in the packet to its own dynamic ARP table if it finds no ARP entry in the cache 2-2

24 corresponding to the source IP address of the ARP packet exists; if the corresponding ARP entry exists in the cache, the router updates the ARP entry regardless of whether this function is enabled. # Enable the gratuitous ARP packet learning function. [Sysname] gratuitous-arp-learning enable 2-3

25 3 Proxy ARP Configuration Commands Proxy ARP Configuration Commands proxy-arp enable proxy-arp enable undo proxy-arp enable VLAN interface view, Ethernet interface view None Use the proxy-arp enable command to enable proxy ARP. Use the undo proxy-arp enable command to disable proxy ARP. By default, proxy ARP is disabled. Related commands: display proxy-arp. # Enable proxy ARP on GigabitEthernet 2/1/0. [Sysname] interface GigabitEthernet 2/1/0 [Sysname-GigabitEthernet2/1/0] proxy-arp enable display proxy-arp display proxy-arp [ interface interface-type interface-number ] Any view interface interface-type interface-number: Displays the proxy ARP status of the interface specified by the argument interface-type interface-number. 3-1

26 Use the display proxy-arp command to display the proxy ARP status. If an interface is specified, proxy ARP status of the specified interface is displayed; if no interface is specified, proxy ARP status of all interfaces is displayed. Related commands: proxy-arp enable. # Display the proxy ARP status on GigabitEthernet 2/1/0. <Sysname> display proxy-arp interface gigabitethernet 2/1/0 Interface GigabitEthernet 2/1/0 Proxy ARP status: disabled 3-2

27 4 GRE Configuration Commands GRE Configuration Commands gre checksum gre checksum undo gre checksum Tunnel interface view None Use the gre checksum command to enable the GRE packet checksum function so as to verify the validity of packets and discard those invalid packets. Use the undo gre checksum command to disable the GRE packet checksum function. By default, the GRE packet checksum function is disabled. Related commands: interface tunnel and display interface tunnel (Tunneling in the Layer 3 IP Services Command Reference). # Enable the GRE packet checksum function for the tunnel between Sysname1 and Sysname2. <Sysname1> system-view [Sysname1] interface tunnel 3 [Sysname1-Tunnel3] gre checksum <Sysname2> system-view [Sysname2] interface tunnel 2 [Sysname2-Tunnel2] gre checksum gre key gre key key-number undo gre key Tunnel interface view 4-1

28 key-number: Key for the GRE tunnel interface, in the range 0 to 4,294,967,295. Use the gre key command to configure a key for a GRE tunnel interface. This weak security mechanism can prevent packets from being received mistakenly. Use the undo gre key command to remove the configuration. By default, no key is configured for a GRE tunnel interface. Related commands: interface tunnel and display interface tunnel (Tunneling in the Layer 3 IP Services Command Reference). # Set the key for the GRE tunnel interfaces to 123 on Sysname1 and Sysname2. <Sysname1> system-view [Sysname1] interface tunnel 3 [Sysname1-Tunnel3] gre key 123 <Sysname2> system-view [Sysname2] interface tunnel 2 [Sysname2-Tunnel2] gre key 123 keepalive keepalive [ seconds [ times ] ] undo keepalive Tunnel interface view seconds: Interval in seconds for transmitting keepalive packets, in the range 1 to 32,767. The default value is 10. times: Maximum number of attempts for transmitting a keepalive packet, in the range 1 to 255. The default value is 3. Use the keepalive command to enable the GRE keepalive function to detect the status of the tunnel interface and set the keepalive interval and the maximum number of attempts for transmitting a keepalive packet. Use the undo keepalive command to disable the keepalive function. By default, the GRE keepalive function is disabled. 4-2

29 With the GRE keepalive function enabled on a tunnel interface, the router sends GRE keepalive packets from the tunnel interface periodically. If no response is received from the peer within the specified interval, the router retransmits a keepalive packet. If the router still receives no response from the peer after sending the keepalive packet for the maximum number of attempts, the local tunnel interface goes down and stays down until it receives a keepalive acknowledgement packet from the peer. Related commands: interface tunnel and display interface tunnel (Tunneling in the Layer 3 IP Services Command Reference) # Set the GRE keepalive interval to 20 seconds and the maximum number of attempts for transmitting a keepalive packet to 5. [Sysname] interface tunnel 0 [Sysname-Tunnel0] keepalive

30 5 IP Addressing Configuration Commands IP Addressing Configuration Commands display ip interface display ip interface [ interface-type interface-number ] Any view 1: Monitor level interface-type interface-number: Specifies an interface by its type and number. Use the display ip interface command to display IP configuration information for a specified Layer 3 interface or all Layer 3 interfaces. # Display IP configuration information for interface GigabitEthernet 2/1/0. <Sysname> display ip interface gigabitethernet 2/1/0 GigabitEthernet2/1/0 current state : DOWN Line protocol current state : DOWN Internet Address is /8 Primary Broadcast address : The Maximum Transmit Unit : 1500 bytes input packets : 0, bytes : 0, multicasts : 0 output packets : 0, bytes : 0, multicasts : 0 ARP packet input number: 0 Request packet: 0 Reply packet: 0 Unknown packet: 0 TTL invalid packet number: 0 ICMP packet input number: 0 Echo reply: 0 Unreachable: 0 Source quench: 0 Routing redirect: 0 Echo request: 0 Router advert: 0 Router solicit: 0 Time exceed: 0 5-1

31 IP header bad: 0 Timestamp request: 0 Timestamp reply: 0 Information request: 0 Information reply: 0 Netmask request: 0 Netmask reply: 0 Unknown type: 0 DHCP packet deal mode: global Table 5-1 display ip interface command output description Field current state Line protocol current state Internet Address Broadcast address The Maximum Transmit Unit input packets, bytes, multicasts output packets, bytes, multicasts ARP packet input number Request packet Reply packet Unknown packet TTL invalid packet number Current physical state of an interface, which can be Administrative DOWN: Indicates that the interface is administratively down; that is, the interface is shut down with the shutdown command. DOWN: Indicates that the interface is administratively up but its physical state is down, which may be caused by a connection or link failure. UP: Indicates that both the administrative and physical states of the interface are up. Current state of the link layer protocol, which can be DOWN: Indicates that the protocol state of the interface is down, which is usually because that no IP address is assigned to the interface. UP: Indicates that the protocol state of the interface is up. UP (spoofing): Indicates that the protocol state of the interface pretends to be up; however, no corresponding link is present, or the corresponding link is not present permanently but is established as needed. IP address of an interface followed by: Primary: Identifies a primary IP address, or Sub: Identifies a secondary IP address. negotiated: Identifies a PPP negotiated IP address. unnumbered: Identifies an unnumbered IP address. acquired via DHCP: Identifies an IP address obtained through DHCP. Broadcast address of the subnet attached to an interface Maximum transmission units on an interface, in bytes Unicast packets, bytes, and multicast packets received on an interface (the statistics start at the router startup) Unicast packets, bytes, and multicast packets sent on an interface (the statistics start at the router startup) Total number of ARP packets received on an interface (the statistics start at the router startup), including ARP request packets ARP reply packets Unknown packets Number of TTL-invalid packets received on an interface (the statistics start at the router startup) 5-2

32 Field ICMP packet input number Echo reply Unreachable Source quench Routing redirect Echo request Router advert Router solicit Time exceed IP header bad Timestamp request Timestamp reply Information request Information reply Netmask request Netmask reply Unknown type Total number of ICMP packets received on an interface (the statistics start at the router startup), including the following packets: Echo reply packet Unreachable packets Source quench packets Routing redirect packets Echo request packets Router advertisement packets Router solicitation packets Time exceeded packets IP header bad packets Timestamp request packets Timestamp reply packets Information request packets Information reply packets Netmask request packets Netmask reply packets Unknown type packets display ip interface brief display ip interface brief [ interface-type [ interface-number ] ] Any view 1: Monitor level interface-type: Interface type. interface-number: Interface number. Use the display ip interface brief command to display brief IP configuration information for a specified Layer 3 interface or all layer 3 interfaces. Note that: Without the interface type and interface number specified, the IP configuration information for all layer 3 interfaces is displayed; with only the interface type specified, the IP configuration information for all layer 3 interfaces of the specified type is displayed; with both the interface type and interface number specified, only the IP configuration information for the specified interface is displayed. If you have configured the timeslots of a CE1/PRI or CT1/PRI interface as an ISDN PRI group using the pri-set command, then executing the display ip interface brief command only displays the timeslot used by the control channel (D channel), instead of the ones used by the user channels 5-3

33 (B channels). For more information about CE1/PRI and CT1/PRI interfaces, see WAN Interface in the Interface Configuration Guide. Related commands: display ip interface. # Display brief IP configuration information for GigabitEthernet interfaces. <Sysname> display ip interface brief GigabitEthernet *down: administratively down (s): spoofing Interface Physical Protocol IP Address GigabitEthernet2/1/0 up up GigabitEt... GigabitEthernet2/1/1 up up GigabitEt... GigabitEthernet2/1/2 down down unassigned GigabitEt... GigabitEthernet2/1/3 down down unassigned GigabitEt... Table 5-2 display ip interface brief command output description Field *down: administratively down (s): spoofing Interface Physical Protocol IP Address The interface is administratively shut down with the shutdown command. Spoofing attribute of the interface. It indicates that an interface whose link layer protocol is displayed up may have no link present or the link is set up only on demand. Interface name Physical state of interface, which can be *down: Indicates that the interface is administratively down; that is, the interface is shut down with the shutdown command. down: Indicates that the interface is administratively up but its physical state is down, which may be caused by a connection or link failure. up: Indicates that both the administrative and physical states of the interface are up. Link layer protocol state of the interface, which can be down: Indicates that the protocol state of the interface is down, which is usually because that no IP address is assigned to the interface. up: Indicates that the protocol state of the interface is up. up(s): Indicates that the protocol state of the interface is up (spoofing). IP address of interface (If no IP address is configured, unassigned is displayed.) Interface description information, for which at most 12 characters can be displayed. If there are more that 12 characters, only the first 9 characters are displayed. ip address ip address ip-address { mask-length mask } [ sub ] undo ip address [ ip-address { mask-length mask } [ sub ] ] Interface view 5-4

34 ip-address: IP address of interface, in dotted decimal notation. mask-length: Subnet mask length, the number of consecutive ones in the mask. mask: Subnet mask in dotted decimal notation. sub: Secondary IP address for the interface. Use the ip address command to assign an IP address and mask to the interface. Use the undo ip address command to remove all IP addresses. Use the undo ip address ip-address { mask mask-length } command to remove the primary IP address. Use the undo ip address ip-address { mask mask-length } sub command to remove a secondary IP address. By default, no IP address is assigned to any interface. When assigning IP addresses to an interface, consider the following: You can assign only one primary IP address to an interface. The primary and secondary IP addresses can be located in the same network segment. Before removing the primary IP address, remove all secondary IP addresses. You can assign a secondary IP address only when the interface is not configured to borrow an IP address through IP unnumbered or obtain one through DHCP or PPP negotiation. Related commands: display ip interface. Assign GigabitEthernet 2/1/0 a primary IP address and a secondary IP address, with the subnet masks both being [Sysname] interface gigabitethernet 2/1/0 [Sysname-GigabitEthernet2/1/0] ip address [Sysname-GigabitEthernet2/1/0] ip address sub ip address unnumbered ip address unnumbered interface interface-type interface-number undo ip address unnumbered Interface view 5-5

35 interface interface-type interface-number: Specifies an interface from which the current interface can borrow an IP address. Use the ip address unnumbered command to configure the current interface as IP unnumbered to borrow an IP address from another interface. Use the undo ip address unnumbered command to disable IP unnumbered on the interface. By default, the interface does not borrow IP addresses from other interfaces. # Configure the interface Serial 2/2/2 supporting PPP-encapsulation to borrow the IP address of the interface GigabitEthernet 2/1/0. [Sysname] interface serial 2/2/2 [Sysname-Serial2/2/2] ip address unnumbered interface gigabitethernet 2/1/0 5-6

36 6 DHCP Server Configuration Commands The DHCP server configuration is supported only on Layer 3 Ethernet interfaces (or subinterfaces), VLAN interfaces, Layer 3 aggregate interfaces, serial interfaces, ATM interfaces, MP-group interfaces, and loopback interfaces. The subaddress pool configuration is not supported on serial, MP-group and loopback interfaces. DHCP Server Configuration Commands bims-server bims-server ip ip-address [ port port-number ] sharekey key undo bims-server DHCP address pool view ip ip-address: Specifies an IP address for the BIMS server. port port-number: Specifies a port number for the BIMS server in the range 1 to sharekey key: Specifies a shared key for the BIMS server, which is a string of 1 to 16 characters. Use the bims-server command to specify the IP address, port number, and shared key of the BIMS server in the DHCP address pool for the client. Use the undo bims-server command to remove BIMS server information assigned from the DHCP address pool to the DHCP client. By default, no BIMS server information is specified. If you execute the bims-server command repeatedly, the latest configuration will overwrite the previous one. Related commands: dhcp server ip-pool and display dhcp server tree. 6-1

37 # Specify the IP address , port number 80, shared key aabbcc of the BIMS server in DHCP address pool 0 for the client. [Sysname] dhcp server ip-pool 0 [Sysname-dhcp-pool-0] bims-server ip port 80 sharekey aabbcc bootfile-name bootfile-name bootfile-name undo bootfile-name DHCP address pool view bootfile-name: Boot file name, a string of 1 to 63 characters. Use the bootfile-name command to specify a bootfile name in the DHCP address pool for the client. Use the undo bootfile-name command to remove the specified bootfile name assigned from the DHCP address pool to the DHCP client. By default, no bootfile name is specified. If you execute the bootfile-name command repeatedly, the latest configuration will overwrite the previous one. Related commands: dhcp server ip-pool and display dhcp server tree. # Specify the bootfile name aaa.cfg in DHCP address pool 0. [Sysname] dhcp server ip-pool 0 [Sysname-dhcp-pool-0] bootfile-name aaa.cfg dhcp enable dhcp enable undo dhcp enable System view 6-2

38 None Use the dhcp enable command to enable DHCP. Use the undo dhcp enable command to disable DHCP. By default, DHCP is disabled. You need to enable DHCP before performing DHCP server and relay agent configurations. # Enable DHCP. [Sysname] dhcp enable dhcp server apply ip-pool dhcp server apply ip-pool pool-name undo dhcp server apply ip-pool [ pool-name ] Interface view pool-name: DHCP address pool name, a case-insensitive string in the range of 1 to 35 characters. Use the dhcp server apply ip-pool command to apply an extended address pool on an interface. Use the undo dhcp server apply ip-pool command to remove the configuration. By default, no extended address pool is applied on an interface, and the server assigns an IP address from a common address pool to a client when the client's request arrives at the interface. Note that: If you execute the dhcp server apply ip-pool command on an interface, when a client's request arrives at the interface, the server attempts to assign the client the statically bound IP address first and then an IP address from this extended address pool. Only an extended address pool can be applied on an interface. The address pool to be referenced must already exist. Related commands: dhcp server ip-pool. 6-3

39 # Apply extended DHCP address pool 0 on VLAN-interface 1. [Sysname] interface vlan-interface 1 [Sysname-Vlan-interface1] dhcp server apply ip-pool 0 dhcp select server global-pool dhcp select server global-pool [ subaddress ] undo dhcp select server global-pool [ subaddress ] Interface view subaddress: Supports subaddress allocation. That is, the DHCP server and clients are on the same network segment, and the server allocates IP addresses from the address pool containing the network segment of the first subaddress if several subaddresses exist. Use the dhcp select server global-pool command to enable the DHCP server on specified interface(s). After the interface receives a DHCP request, the DHCP server will allocate an IP address from the address pool. Use the undo dhcp select server global-pool command to remove the configuration. In other words, upon receiving a DHCP request from a client, the interface will neither assign an IP address to the client, nor serve as a DHCP relay agent to forward the request. Use the undo dhcp select server global-pool subaddress command to cancel the support for subaddress allocation. By default, the DHCP server is enabled on an interface. # Enable the DHCP server on GigabitEthernet 2/1/0. [Sysname] interface gigabitethernet 2/1/0 [Sysname-GigabitEthernet2/1/0] dhcp select server global-pool dhcp server detect dhcp server detect undo dhcp server detect System view 6-4

40 None Use the dhcp server detect command to enable unauthorized DHCP server detection. Use the undo dhcp server detect command to disable the function. By default, the function is disabled. With this function enabled, upon receiving a DHCP request, the DHCP server will record the IP addresses of DHCP servers which ever offered IP addresses to the DHCP client and the receiving interface. Each server detected is recorded only once. The administrator can get this information from logs to check out unauthorized DHCP servers. # Enable unauthorized DHCP server detection. [Sysname] dhcp server detect dhcp server forbidden-ip dhcp server forbidden-ip low-ip-address [ high-ip-address ] undo dhcp server forbidden-ip low-ip-address [ high-ip-address ] System view low-ip-address: Start IP address of the IP address range to be excluded from dynamic allocation. high-ip-address: End IP address of the IP address range to be excluded from dynamic allocation. The end IP address must have a higher sequence than the start one. Use the dhcp server forbidden-ip command to exclude IP addresses from dynamic allocation. Use the undo dhcp server forbidden-ip command to remove the configuration. By default, all IP addresses in a DHCP address pool are assignable except IP addresses of the DHCP server interfaces. Note that: When you use the dhcp server forbidden-ip command to exclude an IP address that is bound to a user from dynamic assignment, the address can be still assigned to the user. When you use the undo dhcp server forbidden-ip command to remove the configuration, the specified address/address range must be consistent with the one specified with the dhcp server forbidden-ip command. If you have configured to exclude an address range from dynamic 6-5

41 assignment, you need to specify an address range in the undo dhcp server forbidden-ip command instead of specifying one IP address. Using the dhcp server forbidden-ip command repeatedly can exclude multiple IP address ranges from allocation. Related commands: display dhcp server forbidden-ip, dhcp server ip-pool, and network, static-bind ip-address. # Exclude the IP address range to from dynamic allocation. [Sysname] dhcp server forbidden-ip dhcp server ip-pool dhcp server ip-pool pool-name [ extended ] undo dhcp server ip-pool pool-name System view pool-name: Global address pool name, which is a unique pool identifier, a string of 1 to 35 characters. extended: Specifies the address pool as an extended address pool. If this keyword is not specified, the address pool is a common address pool. Use the dhcp server ip-pool command to create a DHCP address pool and enter its view. If the pool was created, you will directly enter its view. Use the undo dhcp server ip-pool command to remove specified DHCP address pool. By default, no DHCP address pool is created. Related commands: dhcp enable and display dhcp server tree. # Create the common address pool identified by 0. [Sysname] dhcp server ip-pool 0 [Sysname-dhcp-pool-0] dhcp server ping packets dhcp server ping packets number undo dhcp server ping packets 6-6