Table of Contents 1 IP Addressing Configuration IP Performance Configuration 2-1

Transcription

1 Table of Contents 1 IP Addressing Configuration 1-1 IP Addressing Overview 1-1 IP Address Classes 1-1 Special Case IP Addresses 1-2 Subnetting and Masking 1-2 Configuring IP Addresses 1-3 Displaying IP Addressing Configuration 1-4 IP Address Configuration Examples 1-4 IP Address Configuration Example I 1-4 IP Address Configuration Example II IP Performance Configuration 2-1 IP Performance Overview 2-1 Introduction to IP Performance Configuration 2-1 Introduction to FIB 2-1 Configuring IP Performance 2-1 IP Performance Configuration Task List 2-1 Configuring TCP Attributes 2-1 Enabling Reception of Directed Broadcasts to a Directly Connected Network 2-2 Disabling ICMP to Send Error Packets 2-2 Displaying and Maintaining IP Performance Configuration 2-3 IP Performance Configuration Example 2-4 Enabling the Reception of Directed Broadcasts to a Directly Connected Network 2-4 i

2 1 IP Addressing Configuration When configuring IP addressing, go to these sections for information you are interested in: IP Addressing Overview Configuring IP Addresses Displaying IP Addressing Configuration IP Address Configuration Examples IP Addressing Overview IP Address Classes IP addressing uses a 32-bit address to identify each host on a network. An example is in binary. To make IP addresses in 32-bit form easier to read, they are written in dotted decimal notation, each being four octets in length, for example, for the address just mentioned. Each IP address breaks down into two parts: Net ID: The first several bits of the IP address defining a network, also known as class bits. Host ID: Identifies a host on a network. For administration sake, IP addresses are divided into five classes, as shown in the following figure (in which the blue parts represent the address class). Figure 1-1 IP address classes Table 1-1 describes the address ranges of these five classes. Currently, the first three classes of IP addresses are used in quantity. 1-1

3 Table 1-1 IP address classes and ranges Class Address range Description A to Address means this host no this network. This address is used by a host at bootstrap when it does not know its IP address. This address is never a valid destination address. Addresses starting with 127 are reserved for loopback test. Packets destined to these addresses are processed locally as input packets rather than sent to the link. B to C to D to Multicast address. E to Reserved for future use except for the broadcast address Special Case IP Addresses The following IP addresses are for special use, and they cannot be used as host IP addresses: IP address with an all-zeros net ID: Identifies a host on the local network. For example, IP address indicates the host with a host ID of 16 on the local network. IP address with an all-zeros host ID: Identifies a network. IP address with an all-ones host ID: Identifies a directed broadcast address. For example, a packet with the destination address of will be broadcasted to all the hosts on the network Subnetting and Masking Subnetting was developed to address the risk of IP address exhaustion resulting from fast expansion of the Internet. The idea is to break a network down into smaller networks called subnets by using some bits of the host ID to create a subnet ID. To identify the boundary between the host ID and the combination of net ID and subnet ID, masking is used. Each subnet mask comprises 32 bits related to the corresponding bits in an IP address. In a subnet mask, the part containing consecutive ones identifies the combination of net ID and subnet ID whereas the part containing consecutive zeros identifies the host ID. Figure 1-2 shows how a Class B network is subnetted. Figure 1-2 Subnet a Class B network 1-2

4 While allowing you to create multiple logical networks within a single Class A, B, or C network, subnetting is transparent to the rest of the Internet. All these networks still appear as one. As subnetting adds an additional level, subnet ID, to the two-level hierarchy with IP addressing, IP routing now involves three steps: delivery to the site, delivery to the subnet, and delivery to the host. In the absence of subnetting, some special addresses such as the addresses with the net ID of all zeros and the addresses with the host ID of all ones, are not assignable to hosts. The same is true of subnetting. When designing your network, you should note that subnetting is somewhat a tradeoff between subnets and accommodated hosts. For example, a Class B network can accommodate 65,534 ( Of the two deducted Class B addresses, one with an all-ones host ID is the broadcast address and the other with an all-zeros host ID is the network address) hosts before being subnetted. After you break it down into 512 (2 9 ) subnets by using the first 9 bits of the host ID for the subnet, you have only 7 bits for the host ID and thus have only 126 (2 7 2) hosts in each subnet. The maximum number of hosts is thus 64,512 ( ), 1022 less after the network is subnetted. Class A, B, and C networks, before being subnetted, use these default masks (also called natural masks): , , and respectively. Configuring IP Addresses S3600 Series Ethernet Switches support assigning IP addresses to VLAN interfaces and loopback interfaces. Besides directly assigning an IP address to a VLAN interface, you may configure a VLAN interface to obtain an IP address through BOOTP or DHCP as alternatives. If you change the way an interface obtains an IP address, from manual assignment to BOOTP for example, the IP address obtained from BOOTP will overwrite the old one manually assigned. This chapter only covers how to assign an IP address manually. For the other two approaches to IP address assignment, refer to the part discussing DHCP in this manual. Follow these steps to configure an IP address to an interface: To do Use the command Remarks Enter system view system-view Enter interface view Assign an IP address to the Interface interface interface-type interface-number ip address ip-address { mask mask-length } [ sub ] Required No IP address is assigned by default. 1-3

5 You can assign at most five IP address to an interface, among which one is the primary IP address and the others are secondary IP addresses. A newly specified primary IP address overwrites the previous one if there is any. The primary and secondary IP addresses of an interface cannot reside on the same network segment; the IP address of a VLAN interface must not be on the same network segment as that of a loopback interface on a device. A VLAN interface cannot be configured with a secondary IP address if the interface has been configured to obtain an IP address through BOOTP or DHCP. Displaying IP Addressing Configuration To do Use the command Remarks Display information about a specified or all Layer 3 interfaces Display brief configuration information about a specified or all Layer 3 interfaces display ip interface [ interface-type interface-number ] display ip interface brief [ interface-type [ interface-number ] ] Available in any view IP Address Configuration Examples IP Address Configuration Example I Network requirement Assign IP address with mask to VLAN-interface 1 of the switch. Network diagram Figure 1-3 Network diagram for IP address configuration Configuration procedure # Configure an IP address for VLAN-interface 1. <Switch> system-view [Switch] interface Vlan-interface 1 [Switch-Vlan-interface1] ip address

6 IP Address Configuration Example II Network requirements As shown in Figure 1-4 VLAN-interface 1 on a switch is connected to a LAN comprising two segments: /24 and /24. To enable the hosts on the two network segments to communicate with the external network through the switch, and the hosts on the LAN can communicate with each other, do the following: Assign two IP addresses to VLAN-interface 1 on the switch. Set the switch as the gateway on all PCs of the two networks. Network diagram Figure 1-4 Network diagram for IP address configuration Configuration procedure # Assign a primary IP address and a secondary IP address to VLAN-interface 1. <Switch> system-view [Switch] interface Vlan-interface 1 [Switch-Vlan-interface1] ip address [Switch-Vlan-interface1] ip address sub # Set the gateway address to on the PCs attached to the subnet /24, and to on the PCs attached to the subnet /24. # Ping a host on the subnet /24 from the switch to check the connectivity. <Switch> ping PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=255 time=25 ms Reply from : bytes=56 Sequence=2 ttl=255 time=27 ms Reply from : bytes=56 Sequence=3 ttl=255 time=26 ms Reply from : bytes=56 Sequence=4 ttl=255 time=26 ms Reply from : bytes=56 Sequence=5 ttl=255 time=26 ms ping statistics

7 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/26/27 ms The output information shows the switch can communicate with the hosts on the subnet /24. # Ping a host on the subnet /24 from the switch to check the connectivity. <Switch> ping PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=255 time=25 ms Reply from : bytes=56 Sequence=2 ttl=255 time=26 ms Reply from : bytes=56 Sequence=3 ttl=255 time=26 ms Reply from : bytes=56 Sequence=4 ttl=255 time=26 ms Reply from : bytes=56 Sequence=5 ttl=255 time=26 ms ping statistics packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 25/25/26 ms The output information shows the switch can communicate with the hosts on the subnet /

8 2 IP Performance Configuration When configuring IP performance, go to these sections for information you are interested in: IP Performance Overview Configuring IP Performance Displaying and Maintaining IP Performance Configuration IP Performance Configuration Example IP Performance Overview Introduction to IP Performance Configuration In some network environments, you need to adjust the IP parameters to achieve best network performance. The IP performance configuration supported by S3600 Series Ethernet Switches includes: Configuring TCP attributes Enabling reception of directed broadcasts to a directly connected network Disabling ICMP to send error packets Introduction to FIB Every switch stores a forwarding information base (FIB). FIB is used to store the forwarding information of the switch and guide Layer 3 packet forwarding. You can know the forwarding information of the switch through the FIB table. Each FIB entry includes: destination address/mask length, next hop, current flag, timestamp, and outbound interface. When the switch is running normally, the contents of the FIB and the routing table are the same. Configuring IP Performance IP Performance Configuration Task List Complete the following tasks to configure IP performance: Task Remarks Configuring TCP Attributes Enabling Reception of Directed Broadcasts to a Directly Connected Network Disabling ICMP to Send Error Packets Optional Optional Optional Configuring TCP Attributes TCP optional parameters that can be configured include: 2-1

9 synwait timer: When sending a SYN packet, TCP starts the synwait timer. If no response packets are received before the synwait timer times out, the TCP connection is not successfully created. finwait timer: When the TCP connection is changed into FIN_WAIT_2 state, finwait timer will be started. If no FIN packets are received within the timer timeout, the TCP connection will be terminated. If FIN packets are received, the TCP connection state changes to TIME_WAIT. If non-fin packets are received, the system restarts the timer from receiving the last non-fin packet. The connection is broken after the timer expires. Size of TCP receive/send buffer Follow these steps to configure TCP attributes: To do Use the command Remarks Enter system view system-view Configure TCP synwait timer s timeout value Configure TCP finwait timer s timeout value Configure the size of TCP receive/send buffer tcp timer syn-timeout time-value tcp timer fin-timeout time-value tcp window window-size Optional 75 seconds by default. Optional 675 seconds by default. Optional 8 kilobytes by default. Enabling Reception of Directed Broadcasts to a Directly Connected Network Directed broadcasts refer to broadcast packets sent to a specific network. In the destination IP address of a directed broadcast, the network ID is the ID of network where the receiving interface resides and the host ID is all-ones. Enabling the device to receive directed broadcasts will give hackers an opportunity to attack the network, thus bringing forth great potential dangers to the network. Therefore, the reception of directed broadcasts to a directly connected network is disabled on S3600 series Ethernet switches by default. However, you should enable the feature when: Using the UDP Helper function to convert broadcasts to unicasts and forward them to a specified server. Using the Wake on LAN function to forward directed broadcasts to a host on the remote network. Follow these steps to enable the switch to receive directed broadcasts: To do Use the command Remarks Enter system view system-view Enable the device to receive directed broadcasts ip forward-broadcast Required Disabled by default. Disabling ICMP to Send Error Packets Sending error packets is a major function of ICMP protocol. In case of network abnormalities, ICMP packets are usually sent by the network or transport layer protocols to notify corresponding devices so as to facilitate control and management. Although sending ICMP error packets facilitate control and management, it still has the following disadvantages: 2-2

10 Sending a lot of ICMP packets will increase network traffic. If receiving a lot of malicious packets that cause it to send ICMP error packets, the device s performance will be reduced. As the ICMP redirection function increases the routing table size of a host, the host s performance will be reduced if its routing table becomes very large. If a host sends malicious ICMP destination unreachable packets, end users may be affected. You can disable the device from sending such ICMP error packets for reducing network traffic and preventing malicious attacks. Follow these steps to disable sending ICMP error packets: To do Use the command Remarks Enter system view system-view Disable sending ICMP redirects Disable sending ICMP destination unreachable packets undo icmp redirect send undo icmp unreach send Required Enabled by default. Required Enabled by default. Displaying and Maintaining IP Performance Configuration To do Use the command Remarks Display TCP connection status display tcp status Display TCP connection statistics display tcp statistics Display UDP traffic statistics display udp statistics Display IP traffic statistics display ip statistics Display ICMP traffic statistics Display the current socket information of the system Display the forwarding information base (FIB) entries Display the FIB entries matching the destination IP address Display the FIB entries filtering through a specific ACL Display the FIB entries in the buffer which begin with, include or exclude the specified character string. Display the FIB entries filtering through a specific prefix list Display the total number of the FIB entries display icmp statistics display ip socket [ socktype sock-type ] [ task-id socket-id ] display fib display fib ip_address1 [ { mask1 mask-length1 } [ ip_address2 { mask2 mask-length2 } longer ] longer ] display fib acl number display fib { begin include exclude } regular-expression display fib ip-prefix ip-prefix-name display fib statistics Available in any view 2-3

11 To do Use the command Remarks Clear IP traffic statistics Clear TCP traffic statistics Clear UDP traffic statistics reset ip statistics reset tcp statistics reset udp statistics Available in user view IP Performance Configuration Example Enabling the Reception of Directed Broadcasts to a Directly Connected Network Network requirements As shown in Figure 2-1, the host s interface and VLAN-interface 3 of Switch A are on the same network segment ( /24). VLAN-interface 2 of Switch A and VLAN-interface 2 of Switch B are on another network segment ( /24). The default gateway of the host is VLAN-interface 3 (IP address /24) of Switch A. Configure a static route on Switch B to the host. Network diagram Figure 2-1 Network diagram for enabling the reception of directed broadcast Configuration procedure 1) Configure Switch A # Enable Switch A to receive directed broadcasts. <SwitchA> system-view [SwitchA] ip forward-broadcast # Configure IP addresses for VLAN-interface 3 and VLAN-interface 2. [SwitchA] interface vlan-interface 3 [SwitchA-Vlan-interface3] ip address [SwitchA-Vlan-interface3] quit [SwitchA] interface vlan-interface 2 [SwitchA-Vlan-interface2] ip address ) Configure Switch B # Enable Switch B to receive directed broadcasts. <SwitchB> system-view [SwitchB] ip forward-broadcast # Configure a static route to Host. [SwitchB] ip route-static # Configure an IP address for VLAN-interface 2. [SwitchB] interface vlan-interface 2 2-4

12 [SwitchB-Vlan-interface2] ip address After the above configurations, if you ping the subnet broadcast address on Host, the ping packets can be received by VLAN-interface 2 of Switch B. However, if you disable the ip forward-broadcast command, the ping packets cannot be received by the VLAN-interface 2 of Switch B. 2-5