Troubleshooting - Access

Transcription

1 rtel Secure Router 8000 Series Release: Document Revision: NN A Rev01

2 rtel Secure Router 8000 Series Release: 5.3 Publication: NN Document Revision: Document status: Standard Document release date: 30 March 2009 Copyright 2009 rtel Networks All Rights Reserved. Printed in Canada, India, and the United States of America LEGAL NOTICE While the information in this document is believed to be accurate and reliable, except as otherwise expressly agreed to in writing NORTEL PROVIDES THIS DOCUMENT "AS IS" WITHOUT WARRANTY OR CONDITION OF ANY KIND, EITHER EXPRESS OR IMPLIED. The information and/or products described in this document are subject to change without notice. rtel, the rtel logo, and the Globemark are trademarks of rtel Networks. All other trademarks are the property of their respective owners. ATTENTION For information about the safety precautions, read "Safety messages" in this guide. For information about the software license, read "Software license" in this guide.

3 rtel Secure Router 8000 Series Contents About this document VLAN troubleshooting VLAN overview Format of a VLAN frame Port types How a switch processes frames Communication between VLANs VLAN aggregation VLAN troubleshooting (port-based VLAN) Typical networking Configuration notes Troubleshooting flowchart VLAN trunk troubleshooting Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure VLAN aggregation troubleshooting Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure Troubleshooting cases Communication between VLANIF interfaces fails FAQs Diagnostic tools Display commands Debugging commands Trunk troubleshooting Trunk overview Introduction Issue 5.3 (30 March 2009) rtel Networks Inc. i

4 rtel Secure Router 8000 Series Types of trunk interfaces Features supported by trunk interfaces Eth-Trunk troubleshooting Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure IP-Trunk troubleshooting Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure Troubleshooting cases Services on Eth-Trunk interfaces are interrupted Parts of POS interfaces are active FAQs Diagnostic tools Display commands Debugging commands Logs MSTP troubleshooting MSTP overview Basic MSPT concepts Roles of MSTP ports MSTP principles MSTP protection functions MSTP port status troubleshooting Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure MSTP fast convergence troubleshooting Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure Troubleshooting cases Fast convergence failure caused by the edge port FAQs Diagnostic tools Display commands ii rtel Networks Inc. Issue 5.3 (30 March 2009)

5 rtel Secure Router 8000 Series Debugging commands Ethernet interface troubleshooting Ethernet Ethernet concepts ARP Ethernet interface Troubleshooting Ethernet Networking environment Configuration notes Diagnostic flowchart Troubleshooting procedures Troubleshooting cases Data cannot be received and sent Packets are discarded on the Ethernet interface FAQs Diagnostic tools Display commands Debugging commands POS interface troubleshooting POS interface SDH HDLC PPP Troubleshooting the POS interface Networking environment Configuration notes Diagnostic flowcharts Troubleshooting procedures: The state of the physical layer cannot be Up Troubleshooting procedures: The state of the PPP cannot be Up Troubleshooting procedures: The state of HDLC cannot be Up Troubleshooting cases The state of the physical layer cannot be Up The state of the link cannot be Up Traffic on the interface is abnormal FAQs Diagnostic tools Display commands Debugging commands CPOS interface troubleshooting CPOS Troubleshooting the CPOS interface Issue 5.3 (30 March 2009) rtel Networks Inc. iii

6 rtel Secure Router 8000 Series Networking environment Configuration notes Diagnostic flowchart Troubleshooting procedure FAQs Diagnostic tools Display commands Debugging command E-carrier and T-carrier link troubleshooting E-carrier and T-carrier links Digital carrier system E-carrier and T-carrier Working mode E1/cE1 interface ct1 interface Troubleshooting E1/T Networking environment Configuration notes Diagnostic flowchart Troubleshooting procedures Troubleshooting cases FAQs Diagnostic tools ATM interface troubleshooting ATM interface Troubleshooting the ATM interface Networking environment Configuration notes Diagnostic flowchart Troubleshooting procedure Troubleshooting cases The state of the ATM interface is Down The local interface cannot ping through the remote interface The state of the ATM interface is Up and the state of the PVC is Down The status of the PVC is Up but the interfaces cannot ping through each other FAQs Diagnostic tools PPP and MP troubleshooting PPP and MP PPP MP iv rtel Networks Inc. Issue 5.3 (30 March 2009)

7 rtel Secure Router 8000 Series 9.2 Troubleshooting PPP Networking environment Configuration notes Diagnostic flowchart Troubleshooting procedure Troubleshooting MP Networking environment Configuration notes Diagnostic flowchart Troubleshooting procedures Troubleshooting cases The physical link cannot be Up LCP cannot be Up The CHAP authentication of PPP fails The status of the serial interface among the MP interfaces is unstable FAQs Diagnostic tools Display commands Debugging commands Index... i-1 Issue 5.3 (30 March 2009) rtel Networks Inc. v

8

9 rtel Secure Router 8000 Series Figures Figure 1-1 Format of the 802.1Q-compliant VLAN frame Figure 1-2 Communication between VLANs based on routers Figure 1-3 Communication between VLANs through VLANIF interfaces Figure 1-4 Networking diagram of port-based VLANs Figure 1-5 Port-based VLAN troubleshooting flowchart Figure 1-6 Networking diagram of VLAN trunk Figure 1-7 VLAN trunk troubleshooting flowchart Figure 1-8 Networking diagram of VLAN aggregation Figure 1-9 VLAN aggregation troubleshooting flowchart Figure 1-10 Networking diagram of VLANIF interface Figure 2-1 Networking diagram of Eth-Trunk Figure 2-2 Eth-Trunk troubleshooting flowchart Figure 2-3 Networking diagram of IP-Trunk Figure 2-4 IP-Trunk troubleshooting flowchart Figure 2-5 Networking diagram of Eth-Trunk Figure 2-6 Networking diagram of IP-Trunk Figure 3-1 Basic MSTP concepts Figure 3-2 Mapping table of the MSTI, IST, and VLAN Figure 3-3 Root port, designated port, alternate port, and backup port Figure 3-4 Master port and regional edge port Figure 3-5 Networking diagram of MSTP port status troubleshooting Figure 3-6 MSTP port status troubleshooting flowchart Figure 3-7 Networking diagram of MSTP fast convergence troubleshooting Figure 3-8 Troubleshooting flowchart of MSTP fast convergence Figure 3-9 Networking diagram of MSTP fast convergence Figure 4-1 Configuration of the Ethernet interface Issue 5.3 (30 March 2009) rtel Networks Inc. vii

10 rtel Secure Router 8000 Series Figure 4-2 Diagnostic flowchart for faults on the Ethernet interface Figure 5-1 Connecting routes through the POS interface Figure 5-2 Diagnostic flowchart Figure 5-3 Diagnostic flowchart Figure 5-4 Diagnostic flowchart Figure 6-1 Networking of the CPOS interface Figure 6-2 Diagnostic flowchart of faults on the CPOS interface Figure 7-1 E1/T1 interface configuration Figure 7-2 Diagnostic flowchart of faults on the E1/T Figure 8-1 Model of the ATM protocol Figure 8-2 Typical ATM networking environment Figure 8-3 Diagnostic flowchart of faults on the ATM interface Figure 9-1 PPP procedure Figure 9-2 PPP networking Figure 9-3 Diagnostic flowchart of faults on PPP Figure 9-4 MP networking Figure 9-5 Diagnostic flowchart of faults on the MP interface Figure 9-6 Networking of the troubleshooting instance on the MP interface viii rtel Networks Inc. Issue 5.3 (30 March 2009)

11 rtel Secure Router 8000 Series Tables Table 1-1 Comparison between ports Table 1-2 Description of indicators on the Ethernet interface Table 1-3 Description of indicators on the Ethernet interface Table 1-4 Description of indicators on the Ethernet interface Table 3-1 Port roles and port statuses Table 4-1 The description of the display interface ethernet command Table 5-1 Describes the output information of the display interface pos command Table 8-1 Description of the output of the display atm pvc-info command Table 8-2 Description of the output of the display atm map-info command Table 9-1 Description of the output of the display ppp mp command Issue 5.3 (30 March 2009) rtel Networks Inc. ix

12 rtel Secure Router 8000 Series Contents About this document...1 Issue 5.3 (30 March 2009) rtel Networks Inc. i

13

14 rtel Secure Router 8000 Series About this document About this document Overview This part describes the organization of this document, product version, intended audience, conventions, and update history. Related versions The following table lists the product versions related to this document. Product name rtel Secure Router 8000 Series Version V200R005 Intended audience This document is intended for the following audience: network operators network administrators network maintenance engineers Organization This document consists of three chapters and is organized as follows. Chapter Description 1 VLAN troubleshooting This chapter describes basic Virtual Local Area Network (VLAN) concepts, troubleshooting procedures for VLAN faults, troubleshooting cases, diagnostic tools, and frequently asked questions (FAQ). 2 Trunk troubleshooting This chapter describes basic trunk concepts, troubleshooting procedures for trunk faults, troubleshooting cases, diagnostic tools, and FAQs. Issue 5.3 (30 March 2009) rtel Networks Inc. 1

15 About this document rtel Secure Router 8000 Series Chapter Description 3 MSTP troubleshooting This chapter describes basic Multiple Spanning Tree Algorithm and Protocol (MSTP) concepts, troubleshooting procedures for MSTP faults, troubleshooting cases, diagnostic tools, and FAQs. 4 Ethernet interface troubleshooting 5 POS interface troubleshooting 6 CPOS interface troubleshooting 7 E-Carrier and T-Carrier link Troubleshooting 8 ATM interface troubleshooting 9 PPP and MP troubleshooting This chapter describes the roadmap and procedures for Ethernet interface troubleshooting, including the troubleshooting analysis. This chapter describes the roadmap and procedures for Packet Over SDH/SONET (POS) interface troubleshooting, including the troubleshooting analysis. This chapter describes the roadmap and procedures for channelized POS (CPOS) interface troubleshooting, including the troubleshooting analysis. This chapter describes the roadmap and procedures for E-Carrier and T-Carrier link troubleshooting, including the troubleshooting analysis. This chapter describes the roadmap and procedures for Asynchronous Transfer Mode (ATM) interface troubleshooting, including the troubleshooting analysis. This chapter describes the roadmap and procedures for Point-to-Point Protocol (PPP) and Multilink Protocol (MP) troubleshooting, including the troubleshooting analysis. Conventions Symbol conventions This section describes the symbol and text conventions used in this document. Symbol Description Indicates a hazard with a high level of risk that, if not avoided, can result in death or serious injury. Indicates a hazard with a medium or low level of risk that, if not avoided, can result in minor or moderate injury. Indicates a potentially hazardous situation that, if not avoided, can cause equipment damage, data loss, and performance degradation, or unexpected results. Indicates a tip that may help you solve a problem or save time. 2 rtel Networks Inc. Issue 5.3 (30 March 2009)

16 rtel Secure Router 8000 Series About this document Symbol Description Provides additional information to emphasize or supplement important points of the main text. General conventions Convention Times New Roman Boldface Italic Courier New Description rmal paragraphs are in Times New Roman font. Names of files, directories, folders, and users are in boldface. For example, log on as the user root. Book titles are in italics. Terminal display is in Courier New font. Command conventions Convention Boldface Italic Description The keywords of a command line are in boldface. Command arguments are in italics. [ ] Items (keywords or arguments) in square brackets [ ] are optional. { x y... } Alternative items are grouped in braces and separated by vertical bars. You can select one item. [ x y... ] Optional alternative items are grouped in square brackets and separated by vertical bars. You can select one item or no item. { x y... } * Alternative items are grouped in braces and separated by vertical bars. You can select a minimum of one item or a maximum of all items. [ x y... ] * &<1-n> Optional alternative items are grouped in square brackets and separated by vertical bars. You can select no item or multiple items. The parameter before the ampersand sign (&) can be repeated 1 to n times. # A line starting with the number sign (#) contains comments. Issue 5.3 (30 March 2009) rtel Networks Inc. 3

17 About this document rtel Secure Router 8000 Series GUI conventions Convention Boldface Description Buttons, menus, parameters, tabs, windows, and dialog box titles are in boldface. For example, click OK. > Multilevel menus are in boldface and separated by the right-angled bracket sign (>). For example, choose File > Create > Folder. Keyboard operation Format Key Key 1+Key 2 Key 1, Key 2 Description Press the key. For example, press Enter and press Tab. Press the keys concurrently. For example, Ctrl+Alt+A means press the three keys concurrently. Press the keys in sequence. For example, Alt, A means press the two keys in sequence. Mouse operation Action Click Double-click Drag Description Select and release the primary mouse button without moving the pointer. Press the primary mouse button twice quickly without moving the pointer. Press and hold the primary mouse button and move the pointer to a new position. Update history Updates between document versions are cumulative. Therefore, the latest document version contains all updates made to previous versions. Updates in Issue 1.0 (6 June 2008) This is the first commercial release of this document. 4 rtel Networks Inc. Issue 5.3 (30 March 2009)

18 rtel Secure Router 8000 Series Contents 1 VLAN troubleshooting VLAN overview Format of a VLAN frame Port types How a switch processes frames Communication between VLANs VLAN aggregation VLAN troubleshooting (port-based VLAN) Typical networking Configuration notes Troubleshooting flowchart VLAN trunk troubleshooting Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure VLAN aggregation troubleshooting Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure Troubleshooting cases Communication between VLANIF interfaces fails FAQs Diagnostic tools Display commands Debugging commands Issue 5.3 (30 March 2009) rtel Networks Inc. i

19

20 rtel Secure Router 8000 Series Figures Figure 1-1 Format of the 802.1Q-compliant VLAN frame Figure 1-2 Communication between VLANs based on routers Figure 1-3 Communication between VLANs through VLANIF interfaces Figure 1-4 Networking diagram of port-based VLANs Figure 1-5 Port-based VLAN troubleshooting flowchart Figure 1-6 Networking diagram of VLAN trunk Figure 1-7 VLAN trunk troubleshooting flowchart Figure 1-8 Networking diagram of VLAN aggregation Figure 1-9 VLAN aggregation troubleshooting flowchart Figure 1-10 Networking diagram of VLANIF interface Issue 5.3 (30 March 2009) rtel Networks Inc. iii

21

22 rtel Secure Router 8000 Series Tables Table 1-1 Comparison between ports Table 1-2 Description of indicators on the Ethernet interface Table 1-3 Description of indicators on the Ethernet interface Table 1-4 Description of indicators on the Ethernet interface Issue 5.3 (30 March 2009) rtel Networks Inc. v

23

24 rtel Secure Router 8000 Series 1 VLAN troubleshooting 1 VLAN troubleshooting About this chapter The following table shows the contents of this chapter. Section Description 1.1 VLAN overview This section describes the concepts you need to know before troubleshooting the Virtual Local Area Network (VLAN). 1.2 VLAN troubleshooting (port-based VLAN) 1.3 VLAN trunk troubleshooting This section contains VLAN configuration notes and provides the VLAN troubleshooting flowchart and procedure for typical VLAN networking. This section contains VLAN trunk configuration notes and provides the VLAN trunk troubleshooting flowchart and procedure for typical VLAN trunk networking. 1.4 VLAN aggregation This section contains VLAN aggregation configuration troubleshooting notes and provides the VLAN aggregation troubleshooting flowchart and procedure for typical VLAN aggregation networking. 1.5 Troubleshooting cases This section presents a troubleshooting case. 1.6 FAQ This section lists frequently asked questions (FAQs) and their answers. 1.7 Diagnostic tools This section describes common diagnostic tools: display commands and debugging commands. Issue 5.3 (30 March 2009) rtel Networks Inc. 1-1

25 1 VLAN troubleshooting rtel Secure Router 8000 Series 1.1 VLAN overview This section covers the following topics: Format of a VLAN frame Port types How a switch processes frames Communication between VLANs VLAN aggregation Format of a VLAN frame The IEEE 802.1Q standard modifies the format of the Ethernet frame. It adds a 4-byte 802.1Q tag between the source MAC address and the protocol type fields, as shown in Figure 1-1. Figure 1-1 Format of the 802.1Q-compliant VLAN frame 6 bytes 6 bytes 4 bytes 2 bytes bytes 4 bytes Destination Address Source Address 802.1Q Tag Length /Type Data FCS (CRC-32) Type PRI CFI VID 2 bytes 3 bit 1 bit 12 bit Port types An 802.1Q tag contains the following four fields: Type: Indicates the frame type. The value 0x8100 indicates an 802.1Q tag frame. Devices that do not support the 802.1Q standard discard the received 802.1Q tag frame. PRI: Indicates the priority of a frame. The value ranges from 0 to 7. When the switch is blocked, the packet with a higher priority is sent first. CFI (Canonical Format Indicator): Determines whether the MAC address is standard. The value 0 indicates the MAC address is canonical format; the value 1 indicates noncanonical format. It is also used to differentiate Ethernet frames, Fiber Distributed Digital Interface (FDDI) frames, and token ring frames. In the Ethernet frame, CFI is 0. VID: Specifies the VLAN to which this frame belongs. In the rtel, the VLAN ID ranges from 1 to By default, it is 1. After the 802.1Q standard defines VLAN frames, some ports of the device can identify VLAN frames. 1-2 rtel Networks Inc. Issue 5.3 (30 March 2009)

26 rtel Secure Router 8000 Series 1 VLAN troubleshooting The rtel supports port-based VLAN grouping (that is, grouping the ports on the switch to different VLANs based on the port number). The VLAN to which the port belongs determines the VLAN to which a PC belongs. According to their ability of identifying VLAN frames, the ports can be classified into four types: Access ports Trunk ports Hybrid ports Q-in-Q ports Table 1-1 shows the differences among the other three port types. Table 1-1 Comparison between ports Type Identification ability Frames with tags Function Access port Identifies only Ethernet frames. One access port belongs to one VLAN. Data frames output from the access port do not carry the VLAN tag. Access ports of different products process frames in a different way. Whether to directly discard frames with tags or transparently transmit them depends on the specification of products. Connects a switch and a host directly. Trunk port Identifies common VLAN frames and default VLAN frames, and allows frames from multiple VLANs to pass. Permits frames from the port that belongs to the default VLAN to pass without tags. Other frames can pass only when they have tags. Connects switches to ensure members of VLANs can communicate with each other. Hybrid port Identifies common VLAN frames and default VLAN frames, and allows frames from multiple VLANs to pass. Permits frames with or without tags. Connects switches or connects a switch and a host. NOTE Trunk ports have permission restrictions for incoming VLAN frames only. There is no limitation for outgoing VLAN frames. Hybrid ports allow either untagged VLAN frames or tagged VLAN frames for the outgoing frames. There is no limitation for the incoming frames. For example, Untagged VLAN ID : 2,3 indicates that frames sent from VLAN 2 and VLAN 3 are stripped of tags before being sent out by this hybrid port, while "tagged VLAN ID : 4,5" indicates that frames from VLAN 4 and VLAN 5 are not stripped of tags before being sent out by this hybrid port Q-in-802.1Q (short for Q-in-Q) ports are used by the Q-in-Q protocol, and are not mentioned in this chapter. Issue 5.3 (30 March 2009) rtel Networks Inc. 1-3

27 1 VLAN troubleshooting rtel Secure Router 8000 Series How a switch processes frames Access ports To improve the efficiency of processing frames, data frames within the switch have VLAN tags for uniform processing. When a data frame reaches a port of the switch, it is marked with the port VLAN ID (PVID) if it has no VLAN tag and the port is configured with a PVID. If the data frame has a VLAN tag, the switch does not mark a VLAN tag for the data frame although the port is configured with a PVID. PVID is the default VLAN ID of the port, specifying which default VLAN the port belongs to. The switch processes frames differently according to port types. The following sections describe packet processing on each type of port. Step 1 The switch receives a frame. Step 2 The switch checks whether the frame has a VLAN tag. If not, the frame is marked with the PVID of the access port first. If yes, the switch compares the tag with the PVID. If they are the same, the switch continues to process the frame; if they are different, the switch discards the frame. Step 3 Based on the destination MAC address and VLAN ID of the frame, the Layer 2 switch determines the port through which the frames should be sent out. Step 4 The switch searches for the outgoing port and sends the frames through this port. If the frame is sent out from an access port, the switch strips the VLAN tag of the frame before sending it out. If the frame is sent out from a trunk port, the switch compares the PVID of the outgoing port with the VLAN tag. If they are the same, the VLAN tag is stripped before the frame is sent out. If they are different, the frame is directly sent out. If the frame is sent out from a hybrid port, the switch checks the attribute of the VLAN on the local port. If the attribute is untagged, the VLAN tag is stripped before the frame is sent out. If the attribute is tagged, the frame is directly sent out. ----End Trunk ports Step 1 The switch receives a frame. Step 2 The switch checks whether the frame has a VLAN tag. If not, the frame is marked with the PVID of the trunk port. If yes, the switch checks whether the trunk port permits the frame. If the trunk port permits the frame, the switch continues to process the frame; otherwise, the switch discards the frame. Step 3 Based on the destination MAC address and VLAN ID of the frame, the Layer 2 switch determines the port through which the frames should be sent out. 1-4 rtel Networks Inc. Issue 5.3 (30 March 2009)

28 rtel Secure Router 8000 Series 1 VLAN troubleshooting Step 4 The switch searches for the outgoing the port and sends the frame to the Ethernet network segment through this port. If the frame is sent out from an access port, the switch strips the VLAN tag of the frame before sending it out. If the frame is sent out from a trunk port, the switch compares the PVID with the VLAN tag. If they are the same, the VLAN tag is stripped before the frame is sent out If they are different, the frame is directly sent out. If the frame is sent out from a hybrid port, the switch checks the attribute of the VLAN. If the attribute is untagged, the VLAN tag is stripped before the frame is sent out. If the attribute is tagged, the frame is directly sent out. ----End Hybrid ports Step 1 The switch receives a frame. Step 2 The switch checks whether the frame has a VLAN tag. If not, it is marked with the PVID of the hybrid port. If yes, the switch checks whether the trunk port allows the frame. If the trunk port allows the frame, the switch continues to process the frame; otherwise, the frame is discarded. Step 3 According to the destination MAC address and VLAN ID of the frame, the Layer 2 switch determines the port through which the frames should be sent out. Step 4 The switch searches for the outgoing port and sends the frames to the Ethernet network segment through this port. If the frame is sent out from an access port, the switch strips the VLAN tag before sending it out. If the frame is sent from a trunk port, the switch compares the PVID with the VLAN tag. If they are the same, the VLAN tag is stripped before the frame is sent out. If they are different, the frame is directly sent out. If the frame is sent from a hybrid port, the switch checks the attribute of the VLAN. If the attribute is untagged, the VLAN tag is stripped before the frame is sent out. If the attribute is tagged, the frame is directly sent out. ----End Communication between VLANs After VLANs are configured, the PCs in different VLANs cannot directly communicate with each other at Layer 2. To implement communication between VLANs, you need to create routes between VLANs. There are two implementation schemes. Issue 5.3 (30 March 2009) rtel Networks Inc. 1-5

29 1 VLAN troubleshooting rtel Secure Router 8000 Series Deploying routers Generally, VLANs are connected with the Ethernet interfaces of routers (routed Ethernet interface) through Ethernet interfaces of switches (switched Ethernet interface). Figure 1-2 shows the networking diagram. Figure 1-2 Communication between VLANs based on routers Subinterface Router VLAN Trunk Switch Access port VLAN2 VLAN3 If ports on the switch are grouped into VLAN 2 and VLAN 3, to establish communication between ports in VLAN 2 and those in VLAN 3, you need to do the following: On the router, create two subinterfaces for the Ethernet interface that connects the router and the switch, configure 802.1Q encapsulation on the subinterfaces, and assign IP addresses to them. On the switch, configure the type of the Ethernet port that connects to the router to hybrid, and allow frames of VLAN 2 and VLAN 3 to pass. Configuring VLANIF interfaces on switches If a routed switch is used, you can configure VLANIF interfaces on it to implement communication between VLANs. As shown in Figure 1-3, PCs attached to the switch are grouped to two VLANs (VLAN 2 and VLAN 3).You can create two VLANIF interfaces on the switch and configure IP addresses for them. 1-6 rtel Networks Inc. Issue 5.3 (30 March 2009)

30 rtel Secure Router 8000 Series 1 VLAN troubleshooting Figure 1-3 Communication between VLANs through VLANIF interfaces Switch VLANIF VLANIF VLAN2 VLAN3 After you configure a VLAN, you can create VLANIF interfaces through the interface vlanif command. VLANIF interfaces are virtual interfaces with Layer 3 attributes VLAN aggregation To achieve communication between VLANs, you need to configure an IP address for each VLANIF interface. When many VLANs are involved, a large number of IP addresses are occupied. VLAN aggregation can solve the problem of excessive resource occupation. In VLAN aggregation, multiple VLANs are aggregated into a super-vlan. Member VLANs of a super-vlan are called sub-vlans. You can create a VLANIF interface for a super-vlan. Then, you can configure an IP address for only this interface rather than for each sub-vlan. All sub-vlans share the same IP network segment; therefore, IP address utilization is improved. For details about VLAN aggregation, refer to RFC 3096 (VLAN Aggregation for Efficient IP Address Allocation). 1.2 VLAN troubleshooting (port-based VLAN) This section covers the following topics: Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure Issue 5.3 (30 March 2009) rtel Networks Inc. 1-7

31 1 VLAN troubleshooting rtel Secure Router 8000 Series Typical networking Figure 1-4 Networking diagram of port-based VLANs GE1/0/0 GE2/0/0 VLANIF /24 GE3/0/0 GE4/0/0 VLANIF /24 VLAN2 VLAN3 Figure 1-4 shows the following: GE 1/0/0 and GE 2/0/0 belong to VLAN 2. GE 3/0/0 and GE 4/0/0 belong to VLAN 3. VLANIF interfaces are configured to implement communication between VLAN 2 and VLAN 3. The IP address of the VLANIF2 interface is /24, and the IP address of the VLANIF3 interface is / Configuration notes Item Sub-item tes Configuring ports Configuring VLANs Configuring VLANIF Switch the port Add the port to the VLAN Create VLANIF interfaces Ports added to the VLAN must be switched ports. If the port is a routed port, run the portswitch command to change it to a switched port. The port added to the VLAN must not be configured with any service. The two methods are as follows: Run the port default vlan command in the interface view to specify the default VLAN for the port. Run the port command in the VLAN view to add the port to the VLAN. Ports added to a VLAN must be of the same type. Fast Ethernet (FE) and Gigabit Ethernet (GE) interfaces cannot be added to the same VLAN. The associated VLAN must exist when you create VLANIF interfaces. 1-8 rtel Networks Inc. Issue 5.3 (30 March 2009)

32 rtel Secure Router 8000 Series 1 VLAN troubleshooting Item Sub-item tes interfaces Configure IP IP addresses of different VLANIF interfaces should addresses be in different network segments. Configuration on VLAN 2 As an example, the network environment shown in Figure 1-4 illustrates the VLAN configuration notes. # Switch the port to a switched port. <rtel> system-view [rtel] interface gigabitethernet 1/0/0 [rtel-gigabitethernet1/0/0] portswitch [rtel-gigabitethernet1/0/0] quit [rtel] interface gigabitethernet 2/0/0 [rtel-gigabitethernet2/0/0] portswitch [rtel-gigabitethernet2/0/0] quit # Create VLAN 2. [rtel] vlan 2 # Add GE 1/0/0 and GE 2/0/0 to VLAN 2. [rtel-vlan2] port gigabitethernet 1/0/0 2/0/0 [rtel-vlan2] quit # Configure the VLANIF interface. [rtel] interface vlanif 2 [rtel-vlanif2] ip address [rtel-vlanif2] quit Configuration on VLAN 3 # Switch the port to a switched port. <rtel> system-view [rtel] interface gigabitethernet 3/0/0 [rtel-gigabitethernet3/0/0] portswitch [rtel-gigabitethernet3/0/0] quit [rtel] interface gigabitethernet 4/0/0 [rtel-gigabitethernet4/0/0] portswitch [rtel-gigabitethernet4/0/0] quit # Create VLAN 3. [rtel] vlan 3 # Add GE 3/0/0 and GE 4/0/0 to VLAN 3. [rtel-vlan3] port gigabitethernet 3/0/0 4/0/0 [rtel-vlan3] quit # Configure the VLANIF interface. Issue 5.3 (30 March 2009) rtel Networks Inc. 1-9

33 1 VLAN troubleshooting rtel Secure Router 8000 Series [rtel] interface vlanif 3 [rtel-vlanif3] ip address [rtel-vlanif3] quit Troubleshooting flowchart Based on the networking diagram shown in Figure 1-4, after you configure each router, if users in a VLAN or different VLANs cannot communicate, perform troubleshooting according to the following flowchart. Figure 1-5 Port-based VLAN troubleshooting flowchart Interfaces in a VLAN or between VLANs cannot communicate Interfaces are added to the VLAN? Add interfaces to the VLAN Fault removed? Interfaces in the VLAN are Up? VLANIF interface is Up? Check whether interfaces are shutdown and ensure network cables are correctly connected Restart VLANIF interface Fault removed? Fault removed? Network segments VLANs belong to are correctly configured? Re-plan network segments Fault removed? Interfaces have learnt MAC addresses and ARP entries? Seek technical support Refer to "ARP Troubleshooting" in the VRP Troubleshooting - TCP/IP End Fault removed? 1-10 rtel Networks Inc. Issue 5.3 (30 March 2009)

34 rtel Secure Router 8000 Series 1 VLAN troubleshooting Troubleshooting procedure The troubleshooting steps are as follows: Step 1 Check that ports are added to the specified VLANs. Check whether ports are added to the specified VLANs according to network planning. Ports in the same VLAN communicate with each other through MAC addresses; ports in different VLANs communicate with each other through routes between VLANs. Run the display vlan command to view ports in a VLAN. <rtel> display vlan 2 VLAN ID Type Status MAC Learning Broadcast common enable enable enable Untagged Port: Ethernet3/0/0 Step 2 Check that ports in a VLAN are in the Up state. The link indicator on the Ethernet interface should be on. If it is off, check the network cable. Table 1-2 describes the indicators on the Ethernet interface. Table 1-2 Description of indicators on the Ethernet interface Color Indicator Description Green LINK Indicates the connection status: If the indicator is on, the physical connection is successful. If the indicator is off, the physical connection failed. Orange ACT Indicates the status of sending and receiving data: If the indicator blinks, data is sent or received. If the indicator is off, no data is sent or received. Check whether ports in a VLAN are shut down. If so, enable them. Run the display interface command to view the port status. For example: <rtel> display interface gigabitethernet 2/0/0 gigabitethernet2/0/0 current state: up Hardware is WAN-FastEthernet, Address is 00e0-fc17-ac14 Description: rtel Series, GigabitEthernet2/0/0 Interface The Maximum Transmit Unit is 1500 bytes, the BandWidth is Kbits Send-frame-type is Ethernet_II, loopback not set Negotiation enabled, full-duplex, 1000Mbps, trust 802.1p This port works as a Switch Statistics last cleared: never Traffic statistics: Last 5 minutes input rate 0 bytes/sec, 0 packets/sec Last 5 minutes output rate 0 bytes/sec, 0 packets/sec 0 packets input, 0 bytes 0 packets output, 0 bytes Issue 5.3 (30 March 2009) rtel Networks Inc. 1-11

35 1 VLAN troubleshooting rtel Secure Router 8000 Series Input: 0 shorts, 0 jumbos, 0 giants, 0 pauses 0 unicasts, 0 multicasts, 0 broadcasts 0 MulticastOctets, 0 MulticastPkts 0 input fragments, 0 jabbers 0 CRC, 0 errors, 0 overruns Output: 0 shorts, 0 jumbos, 0 giants 0 unicasts, 0 multicasts, 0 broadcasts 0 MulticastOctets, 0 MulticastPkts 0 runts, 0 jabbers, 0 CRC 0 deferrals, 0 underruns, 0 aborts 0 collisions, 0 lates, 0 singles 0 multiples, 0 excessives PVID is 2, port is hybrid port MSTP configured to disable Port priority is 0 In the previous display, GigabitEthernet2/0/0 current state: up indicates that GE 2/0/0 in the VLAN is in the Up state. Step 3 Check that the VLANIF interface is in the Up state. Check the IP address of the VLANIF interface. Check whether the VLANIF interfaces are shut down. If so, enable them. <rtel> display interface Vlanif 2 Vlanif2 current state : UP Line protocol current state : UP Description : rtel Series, Vlanif2 Interface, Route Port The Maximum Transmit Unit is 1500 bytes Internet Address is /24 Hardware address is 00ff Physical is VLANIF Ensure that the VLANIF interface is not in the Administratively Down state and is assigned an IP address. If the port in the VLAN is Up, its corresponding VLANIF interface should also be Up. Check whether the related VLANIF interface is shut down. If so, enable it. If the VLANIF interface is Up, check the status of the VLAN. For example: <rtel> display vlan 2 VLAN ID Type Status MAC Learning Broadcast common enable enable enable Untagged Port: GigabitEthernet2/0/0 Ensure that the status is enable. Step 4 Check the network segments to which VLANIF interfaces belong. The IP address of the PC and the related VLANIF interface should be in the same network segments. The IP address of the gateway specified on the PC should be the IP address of the VLANIF interface. Step 5 Check that the interfaces can learn MAC addresses and Address Resolution Protocol (ARP) entries rtel Networks Inc. Issue 5.3 (30 March 2009)

36 rtel Secure Router 8000 Series 1 VLAN troubleshooting Run the display mac-address dynamic command to view the dynamically learned MAC addresses. Run the display arp dynamic command to view the dynamically learned ARP entries. Check whether the learned entries are correct. If they are incorrect or no entry is learned, see the chapter about ARP troubleshooting in rtel Secure Router 8000 Series Troubleshooting - VAS (NN ). ----End 1.3 VLAN trunk troubleshooting This section covers the following topics: Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure Typical networking Figure 1-6 Networking diagram of VLAN trunk RouterA GE1/0/0 VLAN5 GE1/0/0 RouterB Ethernet1/0/0 Ethernet2/0/0 VLAN5 Ethernet3/0/0 Ethernet4/0/0 VLAN9 VLAN9 Figure 1-6 shows the following: Ethernet 1/0/0 and Ethernet 2/0/0 belong to VLAN 5. Ethernet 3/0/0 and Ethernet 4/0/0 belong to VLAN 9. GE interfaces on Router A and Router B allow frames from VLAN 5 and VLAN 9 to pass. Issue 5.3 (30 March 2009) rtel Networks Inc. 1-13

37 1 VLAN troubleshooting rtel Secure Router 8000 Series Configuration notes Item Sub-item tes Configuring ports Configuring VLANs Switch the port Configure the VLAN allowed by the trunk interface Add the port to the VLAN Ports added to the VLAN must be switched ports. If the port is a routed port, run the portswitch command to change it to a switched port. The original port must not be configured with any service. You cannot configure Layer 3 features, such as IP addresses, for ports that belong to the VLAN allowed to pass the trunk port. The two methods are as follows: Run the port default vlan command in the interface view to add the port to the VLAN. Run the port command in the VLAN view to add the port to the VLAN. Ports added to a VLAN must be of the same type. FE and GE interfaces cannot be added to the same VLAN. Configuration on Router A # Create VLAN 5 and add Ethernet 2/0/0 to VLAN 5. Create VLAN 9 and add Ethernet 3/0/0 to VLAN 9. <RouterA> system-view [RouterA] vlan 5 [RouterA-vlan5] port ethernet 1/0/0 2/0/0 [RouterA-vlan5] quit [RouterA] vlan 9 [RouterA-vlan9] port ethernet 3/0/0 4/0/0 [RouterA-vlan9] quit # Configure the switched interface GE 1/0/0 as a VLAN trunk port, permitting frames from VLAN 5 and VLAN 9 to pass. [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] portswitch [RouterA-GigabitEthernet1/0/0] port trunk allow-pass vlan 5 9 [RouterA-GigabitEthernet1/0/0] quit Configuration on Router B # Configure the switched interface GE 1/0/0 as a VLAN trunk port, permitting frames from VLAN 5 and VLAN 9 to pass. [RouterB] interface gigabitethernet 1/0/0 [RouterB-GigabitEthernet1/0/0] portswitch [RouterB-GigabitEthernet1/0/0] port trunk allow-pass vlan 5 9 [RouterB-GigabitEthernet1/0/0] quit 1-14 rtel Networks Inc. Issue 5.3 (30 March 2009)

38 rtel Secure Router 8000 Series 1 VLAN troubleshooting Troubleshooting flowchart Based on the networking diagram shown in Figure 1-6, after you configure each router, if users in the same VLAN on different routers cannot communicate with each other, perform troubleshooting according to the following flowchart. Figure 1-7 VLAN trunk troubleshooting flowchart On different routers, interfaces in the same VLAN cannot communicate Interfaces are added to the VLAN? Interfaces in the VLAN are Up? Trunk VLAN is configured? Add interfaces to the VLAN Check whether interfaces are shutdown andensure network cables are correctly connected Reconfigure Trunk on two ends Fault removed? Fault removed? Fault removed? Interfaces have learnt MAC addresses and ARP entries? Refer to "ARP Troubleshooting" in the VRP Troubleshooting - TCP/IP Fault removed? Seek technical support End Troubleshooting procedure The troubleshooting steps are as follows. Step 1 Check that ports are added to the specified VLANs. Check whether ports are added to the specified VLANs according to network planning. Ports in the same VLAN can implement Layer 2 communication; ports in different VLANs can implement Layer 3 communication. Run the display vlan command to view the ports in a VLAN. <rtel> display vlan 5 VLAN ID Type Status MAC Learning Broadcast common enable enable enable Issue 5.3 (30 March 2009) rtel Networks Inc. 1-15

39 1 VLAN troubleshooting rtel Secure Router 8000 Series Untagged Tagged Port: Ethernet2/0/0 Port: GigabitEthernet1/0/0 Step 2 Check that ports in a VLAN are in the Up state. The link indicator on the Ethernet interface should be on. If it is off, check the network cable. Table 1-3 describes the indicators on the Ethernet interface. Table 1-3 Description of indicators on the Ethernet interface Color Indicator Description Green LINK Indicates the connection status: If the indicator is on, the physical connection is successful. If the indicator is off, the physical connection failed. Orange ACT Indicates the status of sending and receiving data: If the indicator blinks, data is sent or received. If the indicator is off, no data is sent or received. Check whether ports in a VLAN are shut down. If so, enable them. Run the display interface command to view the port status. For example: <rtel> display interface gigabitethernet 2/0/0 gigabitethernet2/0/0 current state: up Hardware is WAN-FastEthernet, Address is 00e0-fc17-ac14 Description: rtel Series, GigabitEthernet2/0/0 Interface The Maximum Transmit Unit is 1500 bytes, the BandWidth is Kbits Send-frame-type is Ethernet_II, loopback not set Negotiation enabled, full-duplex, 1000Mbps, trust 802.1p This port works as a Switch Statistics last cleared: never Traffic statistics: Last 5 minutes input rate 0 bytes/sec, 0 packets/sec Last 5 minutes output rate 0 bytes/sec, 0 packets/sec 0 packets input, 0 bytes 0 packets output, 0 bytes Input: 0 shorts, 0 jumbos, 0 giants, 0 pauses 0 unicasts, 0 multicasts, 0 broadcasts 0 MulticastOctets, 0 MulticastPkts 0 input fragments, 0 jabbers 0 CRC, 0 errors, 0 overruns Output: 0 shorts, 0 jumbos, 0 giants 0 unicasts, 0 multicasts, 0 broadcasts 0 MulticastOctets, 0 MulticastPkts 0 runts, 0 jabbers, 0 CRC 0 deferrals, 0 underruns, 0 aborts 0 collisions, 0 lates, 0 singles 0 multiples, 0 excessives PVID is 2, port is hybrid port 1-16 rtel Networks Inc. Issue 5.3 (30 March 2009)

40 rtel Secure Router 8000 Series 1 VLAN troubleshooting MSTP configured to disable Port priority is 0 In the previous display, GigabitEthernet2/0/0 current state: up indicates that GE 2/0/0 is in the Up state. Step 3 Check that the trunk interfaces that connect two routers are configured. Check the port in the VLAN. The port connecting routers should be in the tagged port list. <rtel> display vlan 5 VLAN ID Type Status MAC Learning Broadcast common enable enable enable Untagged Port: Ethernet2/0/ Tagged Port: GigabitEthernet1/0/0 The preceding bold display indicates that trunk interfaces are configured. Step 4 Check that the interfaces can learn MAC addresses and ARP entries. Run the display mac-address dynamic command to view the dynamically learned MAC addresses. Run the display arp dynamic command to view the dynamically learned ARP entries. Check whether the learned entries are correct. If they are incorrect or no entry is learned, see the chapter about ARP troubleshooting in rtel Secure Router 8000 Series Troubleshooting - VAS (NN ). ----End 1.4 VLAN aggregation troubleshooting This section covers the following topics: Typical networking Configuration notes Troubleshooting flowchart Troubleshooting procedure Typical networking Figure 1-8 shows a typical networking diagram for VLAN aggregation. VLAN aggregation troubleshooting is based on this diagram. Issue 5.3 (30 March 2009) rtel Networks Inc. 1-17

41 1 VLAN troubleshooting rtel Secure Router 8000 Series Figure 1-8 Networking diagram of VLAN aggregation VLAN2 VLAN3 VLAN4 As shown in Figure 1-8: Configure VLAN 2 and VLAN 3 as sub-vlans. Add related ports to sub-vlans. Create VLAN 4 as a super-vlan. Configure an IP address for VLANIF Configuration notes Item Sub-item tes Configuring ports Configuring VLANs Switch the port Create sub-vlans Add ports to VLANs Create a super- VLAN Ports added to the VLAN must be switched ports. If the port is a routed port, run the portswitch command to switch it to a switched port. The port added to the VLAN must not be configured with any service. By default, the newly created VLAN is a sub- VLAN. When configuring sub-vlans, you only need to add ports to the configure sub-vlans. Do not configure Layer 3 features, such as IP addresses, on the sub-vlan interfaces. The two methods are as follows: Run the port default vlan command in the interface view to add ports to VLANs. Run the port command in the VLAN view to add the port to the VLAN. Ports added to a VLAN must be of the same type. FE and GE interfaces cannot be added to the same VLAN. The super-vlan and sub-vlans should have different VLAN IDs. The super-vlan must not contain any physical interfaces rtel Networks Inc. Issue 5.3 (30 March 2009)

42 rtel Secure Router 8000 Series 1 VLAN troubleshooting Item Sub-item tes Configuring VLANIF interfaces Add sub-vlans to the super-vlan Create VLANIF interfaces Configure IP addresses Only sub-vlans can be added to the super-vlan. When creating VLANIF interfaces, associated VLANs must exist and must be a super-vlan. IP addresses of different VLANIF interfaces must be in different network segments. Configuration on sub-vlans # Configure VLAN 2 and VLAN 3 as sub-vlans and add ports to them. <rtel> system-view [rtel] vlan 2 [rtel-vlan2] port interface ethernet 1/0/0 2/0/0 [rtel-vlan2] quit [rtel] vlan 3 [rtel-vlan3] port interface ethernet 3/0/0 4/0/0 Configuration on a super-vlan [rtel] vlan 4 [rtel-vlan4] aggregate-vlan [rtel-vlan4] access-vlan 2 to 3 Configuration on a VLANIF interface [rtel] interface Vlanif 4 [rtel-vlanif4] ip address Troubleshooting flowchart Based on the networking diagram shown in Figure 1-8, after each router is configured, if ports in the VLAN cannot access the external network, perform troubleshooting based on the following flowchart. Issue 5.3 (30 March 2009) rtel Networks Inc. 1-19

43 1 VLAN troubleshooting rtel Secure Router 8000 Series Figure 1-9 VLAN aggregation troubleshooting flowchart The interface in a VLAN fails to access the outside network Check that the interface is added to the sub-vlan Add the interface to the sub-vlan Fault disappears Check that interfaces in the sub-vlan are Up Check whether the interface is shutdown or network cables are correctly connected Fault disappears Check that the sub-vlan is added to a super-vlan Add the sub-vlan to the super-vlan Fault disappears Check that the VLANIF interface is Up Restart the VLANIF interface and configure an IP address in the specified network segment Fault disappears Check that the interface has learnt MAC addresses and ARP entries Refer to "ARP Troubleshooting" in the VRP Troubleshooting- TCP/IP Fault disappears Seek technical support End Troubleshooting procedure The troubleshooting steps are as follows: Step 1 Check that ports are added to specific sub-vlans. Check whether ports are added to specific sub-vlans according to network planning. Ports in the same VLAN communicate with each other at Layer 2; ports in different VLANs communicate with each other at Layer 3. Run the display vlan command to view the ports in a VLAN. <rtel> display vlan 2 VLAN ID Type Status MAC Learning Broadcast rtel Networks Inc. Issue 5.3 (30 March 2009)