HPE FlexNetwork 5510 HI Switch Series Layer 3 IP Services Command Reference Part number: 5200-3837 Software version: Release 13xx Document version: 6W100-20170315
Copyright 2015, 2017 Hewlett Packard Enterprise Development LP The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor s standard commercial license. Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website. Acknowledgments Intel, Itanium, Pentium, Intel Inside, and the Intel Inside logo are trademarks of Intel Corporation in the United States and other countries. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Adobe and Acrobat are trademarks of Adobe Systems Incorporated. Java and Oracle are registered trademarks of Oracle and/or its affiliates. UNIX is a registered trademark of The Open Group.
Contents ARP commands 1 arp check enable 1 arp check log enable 1 arp max-learning-num 2 arp max-learning-number 3 arp mode uni 4 arp multiport 4 arp smooth 5 arp static 5 arp timer aging 7 display arp 7 display arp entry-limit 9 display arp ip-address 9 display arp timer aging 10 display arp vpn-instance 11 reset arp 11 Gratuitous ARP commands 13 arp ip-conflict log prompt 13 arp send-gratuitous-arp 13 gratuitous-arp-learning enable 14 gratuitous-arp-sending enable 15 Proxy ARP commands 16 display local-proxy-arp 16 display proxy-arp 16 local-proxy-arp enable 17 proxy-arp enable 18 ARP snooping commands 19 arp snooping enable 19 display arp snooping 19 reset arp snooping 20 ARP direct route advertisement commands 22 arp route-direct advertise 22 IP addressing commands 23 display ip interface 23 display ip interface brief 25 ip address 27 ip address unnumbered 28 DHCP commands 29 Common DHCP commands 29 dhcp client-detect 29 dhcp dscp 29 dhcp enable 30 dhcp log enable 30 dhcp select 31 DHCP server commands 32 address range 32 bims-server 33 bootfile-name 34 class ip-pool 35 class option-group 35 class range 36 i
default ip-pool 37 dhcp apply-policy 38 dhcp class 38 dhcp option-group 39 dhcp policy 40 dhcp server always-broadcast 41 dhcp server apply ip-pool 41 dhcp server bootp ignore 42 dhcp server bootp reply-rfc-1048 43 dhcp server database filename 43 dhcp server database update interval 45 dhcp server database update now 45 dhcp server database update stop 46 dhcp server forbidden-ip 47 dhcp server ip-pool 47 dhcp server ping packets 48 dhcp server ping timeout 49 dhcp server relay information enable 50 display dhcp server conflict 50 display dhcp server database 51 display dhcp server expired 52 display dhcp server free-ip 53 display dhcp server ip-in-use 54 display dhcp server pool 55 display dhcp server statistics 57 dns-list 59 domain-name 60 expired 60 forbidden-ip 61 gateway-list 62 if-match 63 ip-in-use threshold 65 nbns-list 66 netbios-type 67 network 67 next-server 68 option 69 reset dhcp server conflict 70 reset dhcp server expired 71 reset dhcp server ip-in-use 72 reset dhcp server statistics 72 static-bind 73 tftp-server domain-name 74 tftp-server ip-address 74 valid class 75 verify class 76 voice-config 76 vpn-instance 77 DHCP relay agent commands 78 dhcp relay check mac-address 78 dhcp relay check mac-address aging-time 79 dhcp relay client-information record 79 dhcp relay client-information refresh 80 dhcp relay client-information refresh enable 81 dhcp relay dhcp-server timeout 82 dhcp relay gateway 82 dhcp relay information circuit-id 83 dhcp relay information enable 85 dhcp relay information remote-id 85 dhcp relay information strategy 86 dhcp relay master-server switch-delay 87 dhcp relay release ip 88 ii
dhcp relay server-address 88 dhcp relay server-address algorithm 89 dhcp relay source-address 90 dhcp smart-relay enable 91 dhcp-server timeout 92 display dhcp relay check mac-address 92 display dhcp relay client-information 93 display dhcp relay information 94 display dhcp relay server-address 95 display dhcp relay statistics 96 gateway-list 97 master-server switch-delay 98 remote-server 99 remote-server algorithm 99 reset dhcp relay client-information 100 reset dhcp relay statistics 101 DHCP client commands 101 dhcp client dad enable 101 dhcp client dscp 102 dhcp client identifier 102 display dhcp client 103 ip address dhcp-alloc 106 DHCP snooping commands 106 dhcp snooping binding database filename 106 dhcp snooping binding database update interval 108 dhcp snooping binding database update now 109 dhcp snooping binding record 109 dhcp snooping check mac-address 110 dhcp snooping check request-message 110 dhcp snooping deny 111 dhcp snooping disable 112 dhcp snooping enable 112 dhcp snooping enable vlan 113 dhcp snooping information circuit-id 113 dhcp snooping information enable 115 dhcp snooping information remote-id 116 dhcp snooping information strategy 117 dhcp snooping log enable 118 dhcp snooping max-learning-num 118 dhcp snooping rate-limit 119 dhcp snooping trust 120 dhcp snooping trust interface 120 display dhcp snooping binding 121 display dhcp snooping binding database 123 display dhcp snooping information 123 display dhcp snooping packet statistics 125 display dhcp snooping trust 125 reset dhcp snooping binding 126 reset dhcp snooping packet statistics 126 BOOTP client commands 127 display bootp client 127 ip address bootp-alloc 128 DNS commands 129 display dns domain 129 display dns host 130 display dns server 131 display ipv6 dns server 132 dns domain 133 dns dscp 133 dns proxy enable 134 dns server 135 iii
dns source-interface 135 dns spoofing 136 dns trust-interface 137 ip host 138 ipv6 dns dscp 139 ipv6 dns server 139 ipv6 dns spoofing 140 ipv6 host 141 reset dns host 142 DDNS commands 143 ddns apply policy 143 ddns dscp 143 ddns policy 144 display ddns policy 145 interval 146 method 147 password 148 ssl-client-policy 149 url 149 username 151 Basic IP forwarding commands 153 display fib 153 ip forwarding-table save 154 Load sharing commands 156 display ip load-sharing mode 156 display ip load-sharing path 157 ip load-sharing local-first enable 158 ip load-sharing mode 159 Fast forwarding commands 161 display ip fast-forwarding aging-time 161 display ip fast-forwarding cache 161 display ip fast-forwarding fragcache 162 ip fast-forwarding aging-time 163 ip fast-forwarding load-sharing 164 reset ip fast-forwarding cache 164 IPv4 adjacency table commands 166 display adjacent-table 166 IPv6 adjacency table commands 168 display ipv6 adjacent-table 168 IRDP commands 170 ip irdp 170 ip irdp address 170 ip irdp interval 171 ip irdp lifetime 172 ip irdp multicast 172 ip irdp preference 173 IP performance optimization commands 174 display icmp statistics 174 display ip statistics 174 display rawip 176 display rawip verbose 176 display tcp 179 display tcp statistics 180 display tcp verbose 182 iv
display udp 186 display udp statistics 187 display udp verbose 187 ip forward-broadcast 190 ip icmp error-interval 191 ip icmp fragment discarding 192 ip icmp source 193 ip mtu 193 ip redirects enable 194 ip ttl-expires enable 195 ip unreachables enable 195 reset ip statistics 196 reset tcp statistics 197 reset udp statistics 197 tcp mss 198 tcp path-mtu-discovery 198 tcp syn-cookie enable 199 tcp timer fin-timeout 200 tcp timer syn-timeout 200 tcp window 201 UDP helper commands 202 display udp-helper interface 202 reset udp-helper statistics 202 udp-helper broadcast-map 203 udp-helper enable 204 udp-helper port 204 udp-helper server 205 IPv6 basics commands 207 display ipv6 fib 207 display ipv6 icmp statistics 208 display ipv6 interface 209 display ipv6 interface prefix 213 display ipv6 nd snooping 214 display ipv6 nd snooping count 215 display ipv6 neighbors 216 display ipv6 neighbors count 218 display ipv6 neighbors entry-limit 218 display ipv6 neighbors vpn-instance 219 display ipv6 pathmtu 220 display ipv6 prefix 221 display ipv6 rawip 222 display ipv6 rawip verbose 222 display ipv6 statistics 226 display ipv6 tcp 227 display ipv6 tcp verbose 228 display ipv6 udp 231 display ipv6 udp verbose 232 ipv6 address 235 ipv6 address anycast 236 ipv6 address auto 236 ipv6 address auto link-local 237 ipv6 address eui-64 238 ipv6 address link-local 239 ipv6 address prefix-number 240 ipv6 hop-limit 241 ipv6 hoplimit-expires enable 241 ipv6 icmpv6 error-interval 242 ipv6 icmpv6 multicast-echo-reply enable 243 ipv6 icmpv6 source 243 ipv6 mtu 244 v
ipv6 nd autoconfig managed-address-flag 245 ipv6 nd autoconfig other-flag 245 ipv6 nd dad attempts 246 ipv6 nd ns retrans-timer 247 ipv6 nd nud reachable-time 247 ipv6 nd ra halt 248 ipv6 nd ra hop-limit unspecified 249 ipv6 nd ra interval 249 ipv6 nd ra no-advlinkmtu 250 ipv6 nd ra prefix 250 ipv6 nd ra prefix default 252 ipv6 nd ra router-lifetime 253 ipv6 nd router-preference 253 ipv6 nd snooping dad retrans-timer 254 ipv6 nd snooping enable global 255 ipv6 nd snooping enable link-local 255 ipv6 nd snooping glean source 256 ipv6 nd snooping lifetime 256 ipv6 nd snooping max-learning-num 257 ipv6 nd snooping uplink 257 ipv6 neighbor 258 ipv6 neighbor link-local minimize 259 ipv6 neighbor stale-aging 260 ipv6 neighbors max-learning-num 260 ipv6 pathmtu 261 ipv6 pathmtu age 262 ipv6 prefer temporary-address 263 ipv6 prefix 263 ipv6 reassemble local enable 264 ipv6 redirects enable 265 ipv6 temporary-address 265 ipv6 unreachables enable 266 local-proxy-nd enable 267 proxy-nd enable 268 reset ipv6 nd snooping 268 reset ipv6 neighbors 269 reset ipv6 pathmtu 269 reset ipv6 statistics 270 DHCPv6 commands 271 Common DHCPv6 commands 271 display ipv6 dhcp duid 271 ipv6 dhcp advertise pd-route 271 ipv6 dhcp dscp 272 ipv6 dhcp log enable 272 ipv6 dhcp select 273 DHCPv6 server commands 274 address range 274 class pool 275 default pool 276 display ipv6 dhcp option-group 276 display ipv6 dhcp pool 278 display ipv6 dhcp prefix-pool 281 display ipv6 dhcp server 282 display ipv6 dhcp server conflict 283 display ipv6 dhcp server database 284 display ipv6 dhcp server expired 285 display ipv6 dhcp server ip-in-use 286 display ipv6 dhcp server pd-in-use 288 display ipv6 dhcp server statistics 290 dns-server 291 domain-name 292 vi
if-match 293 ipv6 dhcp apply-policy 295 ipv6 dhcp class 295 ipv6 dhcp option-group 296 ipv6 dhcp policy 297 ipv6 dhcp pool 297 ipv6 dhcp prefix-pool 298 ipv6 dhcp server 299 ipv6 dhcp server apply pool 300 ipv6 dhcp server database filename 301 ipv6 dhcp server database update interval 303 ipv6 dhcp server database update now 303 ipv6 dhcp server database update stop 304 ipv6 dhcp server forbidden-address 305 ipv6 dhcp server forbidden-prefix 306 network 307 option 308 option-group 309 prefix-pool 310 reset ipv6 dhcp server conflict 311 reset ipv6 dhcp server expired 311 reset ipv6 dhcp server ip-in-use 312 reset ipv6 dhcp server pd-in-use 313 reset ipv6 dhcp server statistics 313 sip-server 314 static-bind 315 temporary address range 316 vpn-instance 317 DHCPv6 relay agent commands 317 display ipv6 dhcp relay client-information address 317 display ipv6 dhcp relay client-information pd 319 display ipv6 dhcp relay server-address 321 display ipv6 dhcp relay statistics 322 gateway-list 324 ipv6 dhcp client-detect 325 ipv6 dhcp relay client-information record 325 ipv6 dhcp relay gateway 326 ipv6 dhcp relay interface-id 327 ipv6 dhcp relay release-agent 328 ipv6 dhcp relay server-address 328 remote-server 329 reset ipv6 dhcp relay client-information address 330 reset ipv6 dhcp relay client-information pd 331 reset ipv6 dhcp relay statistics 331 DHCPv6 client commands 332 display ipv6 dhcp client 332 display ipv6 dhcp client statistics 334 ipv6 address dhcp-alloc 335 ipv6 dhcp client dscp 336 ipv6 dhcp client duid 337 ipv6 dhcp client pd 338 ipv6 dhcp client stateful 338 ipv6 dhcp client stateless enable 339 reset ipv6 dhcp client statistics 340 DHCPv6 snooping commands 340 display ipv6 dhcp snooping binding 341 display ipv6 dhcp snooping binding database 342 display ipv6 dhcp snooping packet statistics 342 display ipv6 dhcp snooping trust 343 ipv6 dhcp snooping binding database filename 343 ipv6 dhcp snooping binding database update interval 345 ipv6 dhcp snooping binding database update now 346 vii
ipv6 dhcp snooping binding record 346 ipv6 dhcp snooping check request-message 347 ipv6 dhcp snooping deny 347 ipv6 dhcp snooping enable 348 ipv6 dhcp snooping log enable 349 ipv6 dhcp snooping max-learning-num 349 ipv6 dhcp snooping option interface-id enable 350 ipv6 dhcp snooping option interface-id string 350 ipv6 dhcp snooping option remote-id enable 351 ipv6 dhcp snooping option remote-id string 352 ipv6 dhcp snooping rate-limit 352 ipv6 dhcp snooping trust 353 reset ipv6 dhcp snooping binding 354 reset ipv6 dhcp snooping packet statistics 354 IPv6 fast forwarding commands 356 display ipv6 fast-forwarding aging-time 356 display ipv6 fast-forwarding cache 356 ipv6 fast-forwarding aging-time 357 ipv6 fast-forwarding load-sharing 358 reset ipv6 fast-forwarding cache 359 Tunneling commands 360 bandwidth 360 default 360 description 361 destination 361 display interface tunnel 362 interface tunnel 366 mtu 367 reset counters interface tunnel 368 service 368 shutdown 369 source 370 tunnel dfbit enable 371 tunnel discard ipv4-compatible-packet 371 tunnel tos 372 tunnel ttl 372 GRE commands 374 keepalive 374 Document conventions and icons 375 Conventions 375 Network topology icons 376 Support and other resources 377 Accessing Hewlett Packard Enterprise Support 377 Accessing updates 377 Websites 378 Customer self repair 378 Remote support 378 Documentation feedback 378 Index 380 viii
ARP commands arp check enable Use arp check enable to enable dynamic ARP entry check. Use undo arp check enable to disable dynamic ARP entry check. arp check enable undo arp check enable Dynamic ARP entry check is enabled. System view Dynamic ARP entry check disables a device from supporting dynamic ARP entries with multicast MAC addresses. The device cannot learn dynamic ARP entries containing multicast MAC addresses. You cannot manually add static ARP entries that contain multicast MAC addresses. When dynamic ARP entry check is disabled, ARP entries containing multicast MAC addresses are supported. The device can learn dynamic ARP entries containing multicast MAC addresses obtained from the ARP packets sourced from a unicast MAC address. You can also manually add static ARP entries containing multicast MAC addresses. # Enable dynamic ARP entry check. [Sysname] arp check enable arp check log enable Use arp check log enable to enable the ARP logging feature. Use undo arp check log enable to disable the ARP logging feature. arp check log enable undo arp check log enable ARP logging is disabled. System view 1
This feature enables a device to log ARP events when ARP cannot resolve IP addresses correctly. The device can log the following ARP events: On a proxy ARP-disabled interface, the target IP address of a received ARP packet is not one of the following IP addresses: The IP address of the receiving interface. The virtual IP address of the VRRP group. The sender IP address of a received ARP reply conflicts with one of the following IP addresses: The IP address of the receiving interface. The virtual IP address of the VRRP group. The device sends ARP log messages to the information center. You can use the info-center source command to specify the log output rules for the information center. For more information about information center, see Network Management and Monitoring Configuration Guide. The device can generate a large number of ARP logs. To conserve system resources, enable ARP logging only when you are auditing or troubleshooting ARP events. # Enable ARP logging. [Sysname] arp check log enable arp max-learning-num Use arp max-learning-num to set the maximum number of dynamic ARP entries that an interface can learn. Use undo arp max-learning-num to restore the default. arp max-learning-num max-number undo arp max-learning-num By default, the maximum number of dynamic ARP entries that an interface can learn depends on the ARP table capacity set by using the switch-mode command. For information about the switch-mode command, see Fundamentals Command Reference. Layer 2 Ethernet interface view Layer 2 aggregate interface view Layer 3 Ethernet interface view Layer 3 Ethernet subinterface view Layer 3 aggregate interface view VLAN interface view max-number: Specifies the maximum number of dynamic ARP entries for an interface. The value range for this argument is 0 to N. The value for N depends on the ARP table capacity. 2
An interface can dynamically learn ARP entries. To prevent an interface from holding too many ARP entries, you can set the maximum number of dynamic ARP entries that the interface can learn. When the maximum number is reached, the interface stops learning ARP entries. When the number argument is set to 0, the interface is disabled from learning dynamic ARP entries. # Specify VLAN-interface 40 to learn a maximum of 10 dynamic ARP entries. [Sysname] interface vlan-interface 40 [Sysname-Vlan-interface40] arp max-learning-num 10 # Specify GigabitEthernet 1/0/1 to learn a maximum of 10 dynamic ARP entries. [Sysname] interface gigabitethernet 1/0/1 [Sysname-GigabitEthernet1/0/1] arp max-learning-num 10 # Specify Layer 2 aggregate interface Bridge-Aggregation 1 to learn a maximum of 10 dynamic ARP entries. [Sysname] interface bridge-aggregation 1 [Sysname-Bridge-Aggregation1] arp max-learning-num 10 arp max-learning-number Use arp max-learning-number to set the maximum number of dynamic ARP entries that a device can learn. Use undo arp max-learning-number to restore the default. arp max-learning-number max-number slot slot-number undo arp max-learning-number slot slot-number By default, the maximum number of dynamic ARP entries that a device can learn depends on the ARP table capacity set by using the switch-mode command. For information about the switch-mode command, see Fundamentals Command Reference. System view max-number: Specifies the maximum number of dynamic ARP entries for a device. The value range for this argument is 0 to N. The value for N depends on the ARP table capacity. slot slot-number: Specifies an IRF member device by its member ID. A device can dynamically learn ARP entries. To prevent a device from holding too many ARP entries, you can set the maximum number of dynamic ARP entries that the device can learn. When the maximum number is reached, the device stops learning ARP entries. 3
When the number argument is set to 0, the device is disabled from learning dynamic ARP entries. # Configure the device to learn a maximum of 64 dynamic ARP entries. [Sysname] arp max-learning-number 64 arp mode uni Use arp mode uni to configure a port as a customer-side port. Use undo arp mode to restore the default. arp mode uni undo arp mode A port operates as a network-side port. VLAN interface view By default, the device associates an ARP entry with routing information when the device learns an ARP entry. The ARP entry provides the next hop information for routing. To save hardware resources, you can use this command to specify a port that connects to a user terminal as a customer-side port. The device will not associate the routing information with the learned ARP entries. # Configure VLAN-interface 2 as a customer-side port. [Sysname] interface vlan-interface 2 [Sysname-Vlan-interface2] arp mode uni arp multiport Use arp multiport to configure a multiport ARP entry. Use undo arp to delete an ARP entry. arp multiport ip-address mac-address vlan-id [ vpn-instance vpn-instance-name ] undo arp ip-address [ vpn-instance-name ] No multiport ARP entries exist. System view 4
ip-address: Specifies an IP address for the multiport ARP entry. mac-address: Specifies a MAC address for the multiport ARP entry, in the format of H-H-H. vlan-id: Specifies a VLAN for the multiport ARP entry, in the range of 1 to 4094. The specified VLAN must already exist. vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the multiport ARP entry belongs. The vpn-instance-name argument represents the VPN instance name, a case-sensitive string of 1 to 31 characters. The specified VPN instance must already exist. To specify a multiport ARP entry on the public network, do not specify this option. If the VLAN or the corresponding VLAN interface is deleted, the multiport ARP entry is also deleted. To make the multiport ARP entry effective for packet forwarding, you must configure a multicast or multiport unicast MAC address entry to specify multiple output interfaces. The MAC address entry must have the same MAC address and VLAN ID as the multiport ARP entry. In addition, the IP address in the multiport ARP entry must reside on the same subnet as the VLAN interface of the specified VLAN. # Configure a multiport ARP entry that contains IP address 202.38.10.2 and MAC address 00e0-fc01-0000 in VLAN 10. [Sysname] arp multiport 202.38.10.2 00e0-fc01-0000 10 display arp multiport reset arp multiport arp smooth Use arp smooth to synchronize ARP entries from the master device to all subordinate devices. arp smooth User view # Synchronize ARP entries from the master device to all subordinate devices. <Sysname> arp smooth arp static Use arp static to configure a static ARP entry. Use undo arp to delete an ARP entry. 5
arp static ip-address mac-address [ vlan-id interface-type interface-number ] [ vpn-instance vpn-instance-name ] undo arp ip-address [ vpn-instance-name ] No static ARP entries exist. System view ip-address: Specifies an IP address for the static ARP entry. mac-address: Specifies a MAC address for the static ARP entry, in the format of H-H-H. vlan-id: Specifies the ID of a VLAN to which the static ARP entry belongs. The value range is 1 to 4094. interface-type interface-number: Specifies an interface by its type and number. vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the static ARP entry belongs. The vpn-instance-name argument represents the VPN instance name, a case-sensitive string of 1 to 31 characters. The VPN instance must already exist. To specify a static ARP entry on the public network, do not specify this option. A static ARP entry is manually configured and maintained. It does not age out and cannot be overwritten by any dynamic ARP entry. Static ARP entries can be short or long. A resolved short static ARP entry becomes unresolved upon certain events, for example, when the resolved output interface goes down, or the corresponding VLAN or VLAN interface is deleted. Long static ARP entries are effective or ineffective. Ineffective long static ARP entries cannot be used for packet forwarding. A long static ARP entry is ineffective when any of the following conditions exists: The corresponding VLAN interface or output interface is down. The IP address in the entry conflicts with a local IP address. No local interface has an IP address in the same subnet as the IP address in the ARP entry. If you specify the vlan-id interface-type interface-number argument, follow these restrictions and guidelines: The interface can be an Ethernet interface or an aggregate interface. The VLAN and VLAN interface must already exist. The specified Ethernet interface must belong to the specified VLAN. The IP address of the VLAN interface and the IP address specified by the ip-address argument must be on the same network. A long static ARP entry in a VLAN is deleted if the VLAN or VLAN interface is deleted. # Configure a long static ARP entry that contains IP address 202.38.10.2, MAC address 00e0-fc01-0000, and output interface GigabitEthernet 1/0/1 in VLAN 10. 6
[Sysname] arp static 202.38.10.2 00e0-fc01-0000 10 gigabitethernet 1/0/1 display arp reset arp arp timer aging Use arp timer aging to set the aging timer for dynamic ARP entries. Use undo arp timer aging to restore the default. arp timer aging aging-time undo arp timer aging The aging timer for dynamic ARP entries is 20 minutes. System view aging-time: Sets the aging timer for dynamic ARP entries, in the range of 1 to 1440 minutes. Each dynamic ARP entry in the ARP table has a limited lifetime, called an aging timer. The aging timer of a dynamic ARP entry is reset each time the dynamic ARP entry is updated. Dynamic ARP entries that are not updated before their aging timers expire are deleted from the ARP table. Set the aging timer for dynamic ARP entries as needed. For example, when you configure proxy ARP, set a short aging time so that invalid dynamic ARP entries can be deleted in a timely manner. # Set the aging timer for dynamic ARP entries to 10 minutes. [Sysname] arp timer aging 10 display arp timer aging display arp Use display arp to display ARP entries. display arp [ [ all dynamic multiport static ] [ slot slot-number ] vlan vlan-id interface interface-type interface-number ] [ count verbose ] Any view 7
network-operator all: Displays all ARP entries. dynamic: Displays dynamic ARP entries. multiport: Displays multiport ARP entries. static: Displays static ARP entries. slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays ARP entries for the master device. vlan vlan-id: Specifies a VLAN by its VLAN ID. The VLAN ID is in the range of 1 to 4094. interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify an interface, this command displays ARP entries for all interfaces. count: Displays the number of ARP entries. verbose: Displays detailed information about ARP entries. This command displays information about ARP entries, including the IP address, MAC address, VLAN ID, output interface, entry type, and aging timer. # Display all ARP entries. <Sysname> display arp all Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid IP Address MAC Address VID Interface/Link ID Aging Type 1.1.1.1 02e0-f102-0023 1 GE1/0/1 N/A S 1.1.1.2 00e0-fc00-0001 12 GE1/0/2 16 D 1.1.1.3 00e0-fe50-6503 12 Tunnel1 15 D 1.1.1.4 000d-88f7-9f7d 12 0x1 16 D # Display the number of all ARP entries. <Sysname> display arp all count Total number of entries : 4 Table 1 Command output Field IP Address MAC Address VID Description IP address in an ARP entry. MAC address in an ARP entry. ID of the VLAN to which the ARP entry belongs. This field displays N/A in either of the following situations: The ARP entry is an unresolved short static ARP entry. The output interface of the ARP entry does not belong to the VLAN. 8
Field Interface/Link ID Aging Type VPN Instance Total number of entries Description Output interface or the link ID in an ARP entry. This field displays N/A in either of the following situations: The ARP entry is an unresolved short static ARP entry. The ARP entry is a multiport ARP entry and has no output interface information. To obtain the output interface information of the multiport ARP entry, look up the MAC address table according to the MAC address in the ARP entry. Aging time for a dynamic ARP entry in minutes. N/A means unknown aging time or no aging time. ARP entry type: D Dynamic. S Static. O OpenFlow. R Rule. M Multiport. I Invalid. Name of VPN instance. If no VPN instance is configured for the ARP entry, this field displays [No Vrf]. Number of ARP entries. arp static reset arp display arp entry-limit Use display arp entry-limit to display the maximum number of ARP entries that a device supports. display arp entry-limit Any view network-operator # Display the maximum number of ARP entries that the device supports. <Sysname> display arp entry-limit ARP entries: 2048 display arp ip-address Use display arp ip-address to display the ARP entry for an IP address. display arp ip-address [ slot slot-number ] [ verbose ] 9
Any view network-operator ip-address: Displays the ARP entry for the specified IP address. slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays information for the master device. verbose: Displays the detailed information about the specified ARP entry. The ARP entry information includes the IP address, MAC address, VLAN ID, output interface, entry type, and aging timer. # Display the ARP entry for the IP address 20.1.1.1. <Sysname> display arp 20.1.1.1 Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid IP Address MAC Address VID Interface/Link ID Aging Type 20.1.1.1 00e0-fc00-0001 N/A N/A N/A S arp static reset arp display arp timer aging Use display arp timer aging to display the aging timer of dynamic ARP entries. display arp timer aging Any view network-operator # Display the aging timer of dynamic ARP entries. <Sysname> display arp timer aging Current ARP aging time is 20 minute(s)(default) arp timer aging 10
display arp vpn-instance Use display arp vpn-instance to display the ARP entries for a VPN instance. display arp vpn-instance vpn-instance-name [ count ] Any view network-operator vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters. The VPN instance name cannot contain any spaces. count: Displays the number of ARP entries. This command displays information about ARP entries for a VPN instance, including the IP address, MAC address, VLAN ID, output interface, entry type, and aging timer. # Display ARP entries for VPN instance test. <Sysname> display arp vpn-instance test Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid IP Address MAC Address VID Interface/Link ID Aging Type 20.1.1.1 00e0-fc00-0001 N/A N/A N/A S arp static reset arp reset arp Use reset arp to clear ARP entries from the ARP table. reset arp { all dynamic interface interface-type interface-number multiport slot slot-number static } User view all: Clears all ARP entries. dynamic: Clears all dynamic ARP entries. multiport: Clears all multiport ARP entries. 11
static: Clears all static ARP entries. slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command clears ARP entries for the master device. interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify an interface, this command clears ARP entries for all interfaces. # Clear all static ARP entries. <Sysname> reset arp static arp static display arp 12
Gratuitous ARP commands arp ip-conflict log prompt Use arp ip-conflict log prompt to enable IP conflict notification. Use undo arp ip-conflict log prompt to restore the default. arp ip-conflict log prompt undo arp ip-conflict log prompt IP conflict notification is disabled. System view By default, the device performs the following operations if it is using the sender IP address of a received ARP packet: Sends a gratuitous ARP request. Displays an error message after the device receives an ARP reply about the conflict. You can use this command to enable the device to display error messages before sending a gratuitous ARP reply or request for conflict confirmation. # Enable IP conflict notification on the device. [Sysname] arp ip-conflict log prompt arp send-gratuitous-arp Use arp send-gratuitous-arp to enable periodic sending of gratuitous ARP packets on an interface. Use undo arp send-gratuitous-arp to disable the interface from periodically sending gratuitous ARP packets. arp send-gratuitous-arp [ interval interval ] undo arp send-gratuitous-arp Periodic sending of gratuitous ARP packets is disabled. Layer 3 Ethernet interface view Layer 3 Ethernet subinterface view Layer 3 aggregate interface view 13
VLAN interface view interval interval: Specifies the sending interval in the range of 200 to 200000 milliseconds. The default value is 2000 milliseconds. This feature takes effect on an interface only when the interface has an IP address and the data link layer state of the interface is up. This feature can send gratuitous ARP requests only for a VRRP virtual IP address, or the sending interface's primary IP address or manually configured secondary IP address. The primary IP address can be configured manually or automatically, whereas the secondary IP address must be configured manually. If you change the sending interval for gratuitous ARP packets, the configuration takes effect at the next sending interval. The sending interval for gratuitous ARP packets might be much longer than the set interval when any of the following conditions exist: This feature is enabled on multiple interfaces. Each interface is configured with multiple secondary IP addresses. A small sending interval is configured in the preceding cases. # Enable VLAN-interface 2 to send gratuitous ARP packets every 300 milliseconds. [Sysname] interface vlan-interface 2 [Sysname-Vlan-interface2] arp send-gratuitous-arp interval 300 gratuitous-arp-learning enable Use gratuitous-arp-learning enable to enable learning of gratuitous ARP packets. Use undo gratuitous-arp-learning enable to disable learning of gratuitous ARP packets. gratuitous-arp-learning enable undo gratuitous-arp-learning enable Learning of gratuitous ARP packets is enabled. System view The learning of gratuitous ARP packets feature allows a device to maintain its ARP table by creating or updating ARP entries based on received gratuitous ARP packets. 14
When this feature is disabled, the device uses received gratuitous ARP packets to update existing ARP entries only. ARP entries are not created based on the received gratuitous ARP packets, which saves ARP table space. # Enable learning of gratuitous ARP packets. [Sysname] gratuitous-arp-learning enable gratuitous-arp-sending enable Use gratuitous-arp-sending enable to enable sending gratuitous ARP packets upon receiving ARP requests whose sender IP address is on a different subnet. Use undo gratuitous-arp-sending enable to disable sending gratuitous ARP packets upon receiving ARP requests whose sender IP address is on a different subnet. gratuitous-arp-sending enable undo gratuitous-arp-sending enable A device does not send gratuitous ARP packets when it receives ARP requests whose sender IP address is on a different subnet. System view # Disable a device from sending gratuitous ARP packets upon receiving ARP requests whose sender IP address is on a different subnet. [Sysname] undo gratuitous-arp-sending enable 15
Proxy ARP commands display local-proxy-arp Use display local-proxy-arp to display the local proxy ARP status. display local-proxy-arp [ interface interface-type interface-number ] Any view network-operator interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify an interface, this command displays the local proxy ARP status for all interfaces. You can use this command to check whether local proxy ARP is enabled or disabled. # Display the local proxy ARP status for VLAN-interface 2. <Sysname> display local-proxy-arp interface vlan-interface 2 Interface Vlan-interface2 Local Proxy ARP status: enabled local-proxy-arp enable display proxy-arp Use display proxy-arp to display the proxy ARP status. display proxy-arp [ interface interface-type interface-number ] Any view network-operator interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify an interface, this command displays the proxy ARP status for all interfaces. You can use this command to check whether proxy ARP is enabled or disabled. 16
# Display the proxy ARP status on VLAN-interface 2. <Sysname> display proxy-arp interface vlan-interface 2 Interface Vlan-interface2 Proxy ARP status: disabled proxy-arp enable local-proxy-arp enable Use local-proxy-arp enable to enable local proxy ARP. Use undo local-proxy-arp enable to disable local proxy ARP. local-proxy-arp enable [ ip-range start-ip-address to end-ip-address ] undo local-proxy-arp enable Local proxy ARP is disabled. Layer 3 Ethernet interface view Layer 3 Ethernet subinterface view Layer 3 aggregate interface view VLAN interface view ip-range start-ip-address to end-ip-address: Specifies the IP address range for which local proxy ARP is enabled. The start IP address must be lower than or equal to the end IP address. Proxy ARP enables a device on a network to answer ARP requests for an IP address not on that network. With proxy ARP, hosts in different broadcast domains can communicate with each other as they do on the same network. Proxy ARP includes common proxy ARP and local proxy ARP. Common proxy ARP allows communication between hosts that connect to different Layer 3 interfaces and reside in different broadcast domains. Local proxy ARP allows communication between hosts that connect to the same Layer 3 interface and reside in different broadcast domains. If you execute this command multiple times, the most recent configuration takes effect. # Enable local proxy ARP on VLAN-interface 2. [Sysname] interface vlan-interface 2 [Sysname-Vlan-interface2] local-proxy-arp enable 17
# Enable local proxy ARP on VLAN-interface 2 for an IP address range. [Sysname] interface vlan-interface 2 [Sysname-Vlan-interface2] local-proxy-arp enable ip-range 1.1.1.1 to 1.1.1.20 display local-proxy-arp proxy-arp enable Use proxy-arp enable to enable proxy ARP. Use undo proxy-arp enable to disable proxy ARP. proxy-arp enable undo proxy-arp enable Proxy ARP is disabled. Layer 3 Ethernet interface view Layer 3 Ethernet subinterface view Layer 3 aggregate interface view VLAN interface view Proxy ARP enables a device on a network to answer ARP requests for an IP address not on that network. With proxy ARP, hosts in different broadcast domains can communicate with each other as they do on the same network. Proxy ARP includes common proxy ARP and local proxy ARP. Common proxy ARP allows communication between hosts that connect to different Layer 3 interfaces and reside in different broadcast domains. Local proxy ARP allows communication between hosts that connect to the same Layer 3 interface and reside in different broadcast domains. # Enable proxy ARP on VLAN-interface 2. [Sysname] interface vlan-interface 2 [Sysname-Vlan-interface2] proxy-arp enable display proxy-arp 18
ARP snooping commands arp snooping enable Use arp snooping enable to enable ARP snooping. Use undo arp snooping enable to disable ARP snooping. arp snooping enable undo arp snooping enable ARP snooping is disabled. VLAN view # Enable ARP snooping for VLAN 2. [Sysname] vlan 2 [Sysname-vlan2] arp snooping enable display arp snooping Use display arp snooping to display ARP snooping entries. display arp snooping [ vlan vlan-id ] [ slot slot-number ] [ count ] display arp snooping ip ip-address [ slot slot-number ] Any view network-operator vlan vlan-id: Displays ARP snooping entries for a VLAN. The vlan-id argument is in the range of 1 to 4094. count: Displays the number of the ARP snooping entries. ip ip-address: Displays the ARP snooping entry for the specified IP address. slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays ARP snooping entries for the master device. 19
# Display ARP snooping entries for VLAN 2. <Sysname> display arp snooping vlan 2 IP Address MAC Address VLAN ID Interface Aging Status 3.3.3.3 0003-0003-0003 2 GE1/0/1 20 Valid 3.3.3.4 0004-0004-0004 2 GE1/0/2 5 Invalid # Display the number of the ARP snooping entries. <Sysname> display arp snooping count Total entries: 2 Table 2 Command output Field IP Address MAC Address VLAN ID Interface Aging Status Total entries Description IP address in an ARP snooping entry. MAC address in an ARP snooping entry. ID of the VLAN to which the ARP snooping entry belongs. Input interface in an ARP snooping entry. Aging time for an ARP snooping entry in minutes. If the card learns an ARP snooping entry from another card, the card cannot learn the aging time of the entry, and this field displays N/A. Status of an ARP snooping entry: Valid, Invalid, Collision. Number of ARP snooping entries. reset arp snooping reset arp snooping Use reset arp snooping to delete ARP snooping entries. reset arp snooping [ ip ip-address vlan vlan-id ] User view ip ip-address: Deletes the ARP snooping entry for the specified IP address. vlan vlan-id: Deletes ARP snooping entries for the specified VLAN. The value range for the vlan-id argument is 1 to 4094. If you do not specify any option, the command deletes all ARP snooping entries. # Delete ARP snooping entries for VLAN 2. <Sysname> reset arp snooping vlan 2 20
display arp snooping 21
ARP direct route advertisement commands arp route-direct advertise Use arp route-direct advertise to enable ARP direct route advertisement. Use undo arp route-direct advertise to disable ARP direct route advertisement. arp route-direct advertise undo arp route-direct advertise ARP direct route advertisement is disabled. Layer 3 Ethernet interface view Layer 3 Ethernet subinterface view Layer 3 aggregate interface view VLAN interface # Enable ARP direct route advertisement on Layer 3 Ethernet interface GigabitEthernet 1/0/1. [Sysname] interface gigabitethernet 1/0/1 [Sysname-GigabitEthernet1/0/1] arp route-direct advertise 22
IP addressing commands display ip interface Use display ip interface to display IP configuration and statistics for Layer 3 interfaces. display ip interface [ interface-type interface-number ] Any view network-operator interface-type interface-number: Specifies an interface by its type and number. If you do not specify an interface, this command displays IP configuration and statistics for all Layer 3 interfaces. Use the display ip interface command to display IP configuration and statistics for the specified Layer 3 interface. The statistics include the following information: The number of unicast packets, bytes, and multicast packets the interface has sent and received. The number of TTL-invalid packets and ICMP packets the interface has received. The packet statistics helps you locate a possible attack on the network. # Display IP configuration and statistics for VLAN-interface 10. <Sysname> display ip interface vlan-interface 10 Vlan-interface10 current state : DOWN Line protocol current state : DOWN Internet Address is 1.1.1.1/8 Primary Broadcast address : 1.255.255.255 The Maximum Transmit Unit : 1500 bytes input packets : 0, bytes : 0, multicasts : 0 output packets : 0, bytes : 0, multicasts : 0 TTL invalid packet number: 0 ICMP packet input number: 0 Echo reply: 0 Unreachable: 0 Source quench: 0 Routing redirect: 0 Echo request: 0 Router advert: 0 Router solicit: 0 Time exceed: 0 IP header bad: 0 23
Timestamp request: 0 Timestamp reply: 0 Information request: 0 Information reply: 0 Netmask request: 0 Netmask reply: 0 Unknown type: 0 Table 3 Command output Field current state Line protocol current state Internet Address Broadcast address The Maximum Transmit Unit input packets, bytes, multicasts output packets, bytes, multicasts TTL invalid packet number Description Physical link state of the interface: Administrative DOWN The interface has been shut down by using the shutdown command. DOWN The interface is administratively up, but its physical state is down (possibly because no physical link exists or the link has failed). UP The interface is both administratively and physically up. Data link layer state of the interface. DOWN The data link layer protocol is down. UP The data link layer protocol is up. UP (spoofing) The data link layer protocol is up, but the link is an on-demand link or does not exist. IP address of an interface followed by: Primary A primary IP address. Sub A secondary IP address. MTunnel An MTunnel interface IP address. SSLVPN An SSL VPN interface IP address. Unnumbered An unnumbered IP address. DHCP-Allocated An IP address obtained through DHCP. BOOTP-Allocated An IP address obtained through BOOTP. Mad A MAD IP address. Broadcast address of the subnet attached to an interface. MTU of the interface, in bytes. All received and sent packets and bytes, and received and sent multicast packets on an interface (statistics start at the device startup). Number of TTL-invalid packets received on the interface (statistics start at the device startup). 24
Field ICMP packet input number: Echo reply: Unreachable: Source quench: Routing redirect: Echo request: Router advert: Router solicit: Time exceed: IP header bad: Timestamp request: Timestamp reply: Information request: Information reply: Netmask request: Netmask reply: Unknown type: Description Total number of ICMP packets received on the interface (statistics start at the device startup): Echo reply packets. Unreachable packets. Source quench packets. Routing redirect packets. Echo request packets. Router advertisement packets. Router solicitation packets. Time exceeded packets. IP header bad packets. Timestamp request packets. Timestamp reply packets. Information request packets. Information reply packets. Netmask request packets. Netmask reply packets. Unknown type packets. display ip interface brief ip address display ip interface brief Use display ip interface brief to display brief IP configuration for Layer 3 interfaces. display ip interface [ interface-type [ interface-number ] ] brief [ description ] Any view network-operator interface-type: Specifies an interface type. If you do not specify an interface type, this command displays brief IP configuration for all Layer 3 interfaces. interface-number: Specifies an interface number. If you do not specify an interface number, this command displays brief IP configuration for all Layer 3 interfaces of the specified type. description: Displays complete interface descriptions. If you do not specify this keyword, the command displays a maximum of 13 characters for each interface description. If the description is longer than 13 characters, the first 10 characters are displayed, followed by an ellipsis (...). Information displayed by the command includes the state of the physical and link layer protocols, IP address, and interface descriptions. 25
# Display brief IP configuration for VLAN interfaces. <Sysname> display ip interface vlan-interface brief *down: administratively down (s): spoofing (l): loopback Interface Physical Protocol IP address VPN instance Description Vlan10 down down 6.6.6.1 -- Link to Co... Vlan2 down down 7.7.7.1 vpn-first... -- <Sysname> display ip interface vlan-interface brief description *down: administratively down (s): spoofing (l): loopback Interface Physical Protocol IP address VPN instance Description Vlan10 down down 6.6.6.1 -- Link to CoreR Outer Vlan2 down down 7.7.7.1 vpn-first-in -- stance Table 4 Command output Field *down: administratively down (s) : spoofing Interface Physical Protocol IP address VPN instance Description Description The interface is administratively shut down by using the shutdown command. Spoofing attribute of the interface. The link protocol state of the interface is up, but the link is temporarily established on demand or does not exist. Interface name. Physical state of the interface: *down The interface is administratively shut down by using the shutdown command. down The interface is administratively up but its physical state is down, possibly because of a connection or link failure. up Both the administrative and physical states of the interface are up. Link layer protocol state of the interface: down The protocol state of the interface is down. down(l) The protocol state of the interface is down (loopback). up The protocol state of the interface is up. up(l) The protocol state of the interface is up (loopback). up(s) The protocol state of the interface is up (spoofing). IP address of the interface. If no IP address is configured, this field displays hyphens (--). Name of the VPN instance to which the interface belongs. This field displays a maximum of 12 characters. If the VPN instance name is longer than 12 characters, the first 9 characters are displayed, followed by an ellipsis (...). If the interface does not belong to any VPN instance, this field displays hyphens (--). Description of the interface. This field displays a maximum of 13 characters. If the description is longer than 13 characters, the first 10 characters are displayed, followed by an ellipsis (...). If no description is configured, this field displays hyphens (--). display ip interface 26
ip address ip address Use ip address to assign an IP address to the interface. Use undo ip address to remove the IP address from the interface. ip address ip-address { mask-length mask } [ sub ] undo ip address ip-address { mask-length mask } [ sub ] No IP address is assigned to an interface. Interface view ip-address: Specifies the IP address of the interface, in dotted decimal notation. mask-length: Specifies the subnet mask length in the range of 1 to 31. For a loopback interface, the value range is 1 to 32. mask: Specifies the subnet mask in dotted decimal notation. sub: Assigns a secondary IP address to the interface. Use the command to assign a primary or secondary IP address to an interface. An interface can have only one primary IP address. A newly configured primary IP address overwrites the previous address. If the interface connects to multiple subnets, configure primary and secondary IP addresses on the interface so the subnets can communicate with each other through the interface. You cannot assign secondary IP addresses to an interface that obtains an IP address through BOOTP, DHCP, or IP unnumbered. If you do not specify any parameters, the undo ip address command removes all IP addresses from the interface. The undo ip address ip-address { mask mask-length } command removes the primary IP address. The undo ip address ip-address { mask mask-length } sub command removes a secondary IP address. The primary and secondary IP addresses assigned to the interface can be located on the same network segment. Different interfaces on your device must reside on different network segments. # Assign VLAN-interface 10 a primary IP address 129.12.0.1 and a secondary IP address 202.38.160.1, with subnet masks both 255.255.255.0. [Sysname] interface vlan-interface 10 [Sysname-Vlan-interface10] ip address 129.12.0.1 255.255.255.0 [Sysname-Vlan-interface10] ip address 202.38.160.1 255.255.255.0 sub display ip interface 27