H3C s5800 series Configuration manual

H3C S5820X&S5800 Series Ethernet Switches

Layer 3 - IP Services

Configuration Guide

Hangzhou H3C Technologies Co., Ltd.

http://www.h3c.com

Document Version: 6W103-20100716

Product Version: Release 1110

No part of this manual may be reproduced or transmitted in any form or by any means without prior

written consent of Hangzhou H3C Technologies Co., Ltd.

Trademarks

H3C, , Aolynk, , H

3

Care,

, TOP G, , IRF, NetPilot, Neocean, NeoVTL,

SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V

2

G, V

n

G, PSPT,

XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,

Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners.

Notice

The information in this document is subject to change without notice. Every effort has been made in the

preparation of this document to ensure accuracy of the contents, but all statements, information, and

recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface

The H3C S5800&S5820X documentation set includes 11 configuration guides, which describe the

software features for the S5800&S5820X Series Ethernet Switches and guide you through the software

configuration procedures. These configuration guides also provide configuration examples to help you

apply software features to different network scenarios.

The Layer 3 – IP Services Configuration Guide describes IP services fundamentals and configuration. It

describes how to configure IP addresses, adjust IP parameters, resolve an IP address to a MAC

address, configure DNS, relay IP broadcasts from the specified UDP port, and implement IPv4-IPv6

interoperation.

This preface includes:

z Audience

z Document Organization

z Conventions

z About the H3C S5800&S5820X Documentation Set

z Obtaining Documentation

z Documentation Feedback

Audience

This documentation set is intended for:

z Network planners

z Field technical support and servicing engineers

z Network administrators working with the S5800 and S5820X series

Document Organization

The Layer 3 – IP Services Configuration Guide comprises these parts:

ARP Configuration Proxy ARP Configuration

ARP Snooping

Configuration

IP Addressing

Configuration

DHCP Overview

DHCP Server

Configuration

DHCP Relay Agent

Configuration

DHCP Client

Configuration

DHCP Snooping

Configuration

BOOTP Client

Configuration

IPv4 DNS Configuration IPv6 DNS Configuration

IP Performance

Optimization

Configuration

UDP Helper

Configuration

IPv6 Basics

Configuration

DHCPv6 Configuration

Tunneling Configuration

Conventions

This section describes the conventions used in this documentation set.

Command conventions

Convention Description

Boldface Bold text represents commands and keywords that you enter literally as shown.

italic

Italic text represents arguments that you replace with actual values.

[ ]

Square brackets enclose syntax choices (keywords or arguments) that are

optional.

{ x | y | ... }

Braces enclose a set of required syntax choices separated by vertical bars,

from which you select one.

[ x | y | ... ]

Square brackets enclose a set of optional syntax choices separated by vertical

bars, from which you select one or none.

{ x | y | ... } *

Asterisk marked braces enclose a set of required syntax choices separated by

vertical bars, from which you select at least one.

[ x | y | ... ] *

Asterisk marked square brackets enclose optional syntax choices separated by

vertical bars, from which you may select multiple choices or none.

&<1-n>

The argument or keyword and argument combination before the ampersand (&)

sign can be entered 1 to n times.

# A line that starts with a pound (#) sign is comments.

Symbols

Convention Description

Means reader be extremely careful. Improper operation may cause bodily

injury.

Means reader be careful. Improper operation may cause data loss or damage to

equipment.

Means a complementary description.

About the H3C S5800&S5820X Documentation Set

The H3C S5800&S5820X documentation set also includes:

Category Documents Purposes

Marketing brochures Describe product specifications and benefits.

Product description and

specifications

Technology white papers

Provide an in-depth description of software features

and technologies.

PSR150-A [ PSR150-D ]

Power Modules User

Manual

Describes the appearances, features, specifications,

installation, and removal of the pluggable 150W power

modules available for the products.

Pluggable module

description

PSR300-12A

[ PSR300-12D1 ] Power

Modules User Manual

Describes the appearances, features, specifications,

installation, and removal of the pluggable 300W power

modules available for the products.

Category Documents Purposes

PSR750-A [ PSR750-D ]

Power Modules User

Manual

Describes the appearances, features, specifications,

installation, and removal of the pluggable 750W power

modules available for the products.

RPS User Manual

Describes the appearances, features, and

specifications of the RPS units available for the

products.

LSW1FAN and

LSW1BFAN Installation

Manual

Describes the appearances, specifications,

installation, and removal of the pluggable fan modules

available for the products.

LSW148POEM Module

User Manual

Describes the appearance, features, installation, and

removal of the pluggable PoE module available for the

products.

S5820X [ S5800 ] Series

Ethernet Switches

Interface Cards User

Manual

Describes the models, hardware specifications,

installation, and removal of the interface cards

available for the products.

H3C OAP Cards User

Manual

Describes the benefits, features, hardware

specifications, installation, and removal of the OAP

cards available for the products.

H3C Low End Series

Ethernet Switches

Pluggable Modules

Manual

Describes the models, appearances, and

specifications of the pluggable modules available for

the products.

S5800-60C-PWR

Ethernet Switch Hot

Swappable Power

Module Ordering Guide

Guides you through ordering the hot-swappable power

modules available for the S5800-60C-PWR switches

in different cases.

Power configuration

RPS Ordering

Information for H3C

Low-End Ethernet

Switches

Provides the RPS and switch compatibility matrix and

RPS cable specifications.

z S5800 Series

Ethernet Switches

Quick Start

z S5820X Series

Ethernet Switches

Quick Start

z S5800 Series

Ethernet Switches

CE DOC

z S5820X Series

Ethernet Switches

CE DOC

Provides regulatory information and the safety

instructions that must be followed during installation.

Hardware installation

z S5800 Series

Ethernet Switches

Quick Start

z S5820X Series

Ethernet Switches

Quick Start

Guides you through initial installation and setup

procedures to help you quickly set up and use your

device with the minimum configuration.

Category Documents Purposes

z S5800 Series

Ethernet Switches

Installation Manual

z S5820X Series

Ethernet Switches

Installation Manual

Provides a complete guide to hardware installation

and hardware specifications.

Pluggable

SFP[SFP+][XFP]

Transceiver Modules

Installation Guide

Guides you through installing SFP/SFP+/XFP

transceiver modules.

z S5800-60C-PWR

Switch Video

Installation Guide

z S5820X-28C Switch

Video Installation

Guide

Shows how to install the H3C S5800-60C-PWR and

H3C S5820X-28C Ethernet switches.

Configuration guide

Describe software features and configuration

procedures.

Software configuration

Command reference Provide a quick reference to all available commands.

H3C Series Ethernet

Switches Login

Password Recovery

Manual

Tells how to find the lost password or recover the

password when the login password is lost.

Operations and

maintenance

Release notes

Provide information about the product release,

including the version history, hardware and software

compatibility matrix, version upgrade information,

technical support information, and software upgrading.

Obtaining Documentation

You can access the most up-to-date H3C product documentation on the World Wide Web at

http://www.h3c.com.

Click the links on the top navigation bar to obtain different categories of product documentation:

[Technical Support & Documents > Technical Documents] – Provides hardware installation, software

upgrading, and software feature configuration and maintenance documentation.

[Products & Solutions] – Provides information about products and technologies, as well as solutions.

[Technical Support & Documents > Software Download] – Provides the documentation released with

the software version.

Documentation Feedback

You can e-mail your comments about product documentation to [email protected].

We appreciate your comments.

i

Table of Contents

1 ARP Configuration·····································································································································1-1

ARP Overview·········································································································································1-1

ARP Function ··································································································································1-1

ARP Message Format·····················································································································1-1

ARP Operation ································································································································1-2

ARP Table·······································································································································1-3

Configuring ARP ·····································································································································1-4

Configuring a Static ARP Entry·······································································································1-4

Configuring the Maximum Number of Dynamic ARP Entries for an Interface ································1-4

Setting the Aging Time for Dynamic ARP Entries···········································································1-5

Enabling the ARP Entry Check ·······································································································1-5

Configuration Gratuitous ARP·················································································································1-6

Introduction to Gratuitous ARP········································································································1-6

Configuring Gratuitous ARP············································································································1-7

Displaying and Maintaining ARP·············································································································1-8

ARP Configuration Example···················································································································1-8

2 Proxy ARP Configuration ·························································································································2-1

Proxy ARP Overview·······························································································································2-1

Proxy ARP·······································································································································2-1

Local Proxy ARP ·····························································································································2-2

Enabling Proxy ARP································································································································2-2

Displaying and Maintaining Proxy ARP ··································································································2-3

Proxy ARP Configuration Examples·······································································································2-3

Proxy ARP Configuration Example ·································································································2-3

Local Proxy ARP Configuration Example in Case of Port Isolation ················································2-4

Local Proxy ARP Configuration Example in Isolate-User-VLAN·····················································2-6

3 ARP Snooping Configuration···················································································································3-1

ARP Snooping Overview ························································································································3-1

Introduction······································································································································3-1

Operation of ARP Snooping············································································································3-1

Configuring ARP Snooping·····················································································································3-1

Displaying and Maintaining ARP Snooping····························································································3-2

4 IP Addressing Configuration····················································································································4-1

IP Addressing Overview··························································································································4-1

IP Address Classes·························································································································4-1

Special IP Addresses ······················································································································4-2

Subnetting and Mask·······················································································································4-2

Configuring IP Addresses·······················································································································4-3

Assigning an IP Address to an Interface·························································································4-3

ii

IP Addressing Configuration Example·····························································································4-4

Displaying and Maintaining IP Addressing ·····························································································4-6

5 DHCP Overview··········································································································································5-1

Introduction to DHCP······························································································································5-1

DHCP Address Allocation·······················································································································5-1

Allocation Mechanisms····················································································································5-1

Dynamic IP Address Allocation Process·························································································5-2

IP Address Lease Extension ···········································································································5-3

DHCP Message Format··························································································································5-3

DHCP Options·········································································································································5-4

DHCP Options Overview·················································································································5-4

Introduction to DHCP Options·········································································································5-4

Self-Defined Options ·······················································································································5-5

Protocols and Standards·························································································································5-8

6 DHCP Server Configuration······················································································································6-1

Introduction to DHCP Server ··················································································································6-1

Application Environment··················································································································6-1

DHCP Address Pool························································································································6-2

IP Address Allocation Sequence·····································································································6-3

DHCP Server Configuration Task List ····································································································6-4

Configuring an Address Pool for the DHCP Server················································································6-4

Configuration Task List····················································································································6-4

Creating a DHCP Address Pool······································································································6-5

Configuring an Address Allocation Mode for a Common Address Pool··········································6-5

Configuring Dynamic Address Allocation for an Extended Address Pool·······································6-7

Configuring a Domain Name Suffix for the Client ···········································································6-8

Configuring DNS Servers for the Client···························································································6-9

Configuring WINS Servers and NetBIOS Node Type for the Client················································6-9

Configuring the BIMS Server Information for the Client································································6-10

Configuring Gateways for the Client······························································································6-10

Configuring Option 184 Parameters for the Client with Voice Service··········································6-11

Configuring the TFTP Server and Bootfile Name for the Client····················································6-11

Configuring Self-Defined DHCP Options·······················································································6-12

Enabling DHCP·····································································································································6-13

Enabling the DHCP Server on an Interface··························································································6-14

Applying an Extended Address Pool on an Interface ···········································································6-14

Configuring the DHCP Server Security Functions················································································6-15

Configuration Prerequisites···········································································································6-15

Enabling Unauthorized DHCP Server Detection···········································································6-15

Configuring IP Address Conflict Detection····················································································6-16

Configuring the Handling Mode for Option 82 ······················································································6-16

Displaying and Maintaining the DHCP Server······················································································6-17

DHCP Server Configuration Examples·································································································6-18

Static IP Address Assignment Configuration Example ·································································6-18

iii

Dynamic IP Address Assignment Configuration Example ····························································6-19

Self-Defined Option Configuration Example··················································································6-21

Troubleshooting DHCP Server Configuration·······················································································6-22

7 DHCP Relay Agent Configuration············································································································7-1

Introduction to DHCP Relay Agent ·········································································································7-1

Application Environment··················································································································7-1

Fundamentals··································································································································7-1

DHCP Relay Agent Support for Option 82······················································································7-2

DHCP Relay Agent Configuration Task List···························································································7-3

Configuring the DHCP Relay Agent········································································································7-4

Enabling DHCP ·······························································································································7-4

Enabling the DHCP Relay Agent on an Interface ···········································································7-4

Correlating a DHCP Server Group with a Relay Agent Interface····················································7-4

Configuring the DHCP Relay Agent Security Functions ·································································7-5

Configuring the DHCP Relay Agent to Send a DHCP-Release Request ·······································7-7

Configuring the DHCP Relay Agent to Support Option 82······························································7-8

Displaying and Maintaining DHCP Relay Agent Configuration ······························································7-9

DHCP Relay Agent Configuration Examples························································································7-10

DHCP Relay Agent Configuration Example··················································································7-10

DHCP Relay Agent Option 82 Support Configuration Example····················································7-11

Troubleshooting DHCP Relay Agent Configuration··············································································7-12

8 DHCP Client Configuration·······················································································································8-1

Introduction to DHCP Client····················································································································8-1

Enabling the DHCP Client on an Interface ·····························································································8-1

Displaying and Maintaining the DHCP Client ·························································································8-2

DHCP Client Configuration Example······································································································8-2

9 DHCP Snooping Configuration················································································································9-1

DHCP Snooping Overview······················································································································9-1

Functions of DHCP Snooping ·········································································································9-1

Application Environment of Trusted Ports·······················································································9-2

DHCP Snooping Support for Option 82···························································································9-3

Configuring DHCP Snooping Basic Functions························································································9-4

Configuring DHCP Snooping to Support Option 82················································································9-5

Prerequisites····································································································································9-5

Configuring DHCP Snooping to Support Option 82········································································9-5

Displaying and Maintaining DHCP Snooping ·························································································9-7

DHCP Snooping Configuration Examples ······························································································9-8

DHCP Snooping Configuration Example·························································································9-8

DHCP Snooping Option 82 Support Configuration Example··························································9-8

10 BOOTP Client Configuration················································································································10-1

Introduction to BOOTP Client ···············································································································10-1

BOOTP Application ·······················································································································10-1

Obtaining an IP Address Dynamically···························································································10-2

iv

Protocols and Standards···············································································································10-2

Configuring an Interface to Dynamically Obtain an IP Address Through BOOTP ·······························10-2

Displaying and Maintaining BOOTP Client Configuration·····································································10-3

BOOTP Client Configuration Example··································································································10-3

11 IPv4 DNS Configuration························································································································11-1

DNS Overview·······································································································································11-1

Static Domain Name Resolution ···································································································11-1

Dynamic Domain Name Resolution ······························································································11-1

DNS Proxy·····································································································································11-3

Configuring the IPv4 DNS Client···········································································································11-4

Configuring Static Domain Name Resolution················································································11-4

Configuring Dynamic Domain Name Resolution···········································································11-4

Configuring the DNS Proxy···················································································································11-5

Displaying and Maintaining IPv4 DNS··································································································11-5

IPv4 DNS Configuration Examples·······································································································11-5

Static Domain Name Resolution Configuration Example······························································11-5

Dynamic Domain Name Resolution Configuration Example·························································11-6

DNS Proxy Configuration Example·······························································································11-9

Troubleshooting IPv4 DNS Configuration···························································································11-11

12 IPv6 DNS Configuration························································································································12-1

Introduction to IPv6 DNS ······················································································································12-1

Configuring the IPv6 DNS Client···········································································································12-1

Configuring Static Domain Name Resolution················································································12-1

Configuring Dynamic Domain Name Resolution···········································································12-1

Displaying and Maintaining IPv6 DNS··································································································12-2

IPv6 DNS Configuration Examples·······································································································12-3

Static Domain Name Resolution Configuration Example······························································12-3

Dynamic Domain Name Resolution Configuration Example·························································12-3

13 IP Performance Optimization Configuration·······················································································13-1

Overview···············································································································································13-1

Enabling Reception and Forwarding of Directed Broadcasts to a Directly Connected Network··········13-1

Enabling Reception of Directed Broadcasts to a Directly Connected Network·····························13-1

Enabling Forwarding of Directed Broadcasts to a Directly Connected Network···························13-2

Configuration Example··················································································································13-2

Configuring Cut-Through Forwarding ···································································································13-3

Enabling the SYN Cookie Feature········································································································13-3

Configuring TCP Attributes ···················································································································13-4

Configuring TCP Optional Parameters··························································································13-4

Configuring ICMP to Send Error Packets ·····························································································13-5

Displaying and Maintaining IP Performance Optimization····································································13-7

14 UDP Helper Configuration ····················································································································14-1

Introduction to UDP Helper···················································································································14-1

Configuring UDP Helper ·······················································································································14-1

v

Displaying and Maintaining UDP Helper·······························································································14-2

UDP Helper Configuration Examples····································································································14-3

UDP Helper Configuration Example······························································································14-3

15 IPv6 Basics Configuration····················································································································15-1

IPv6 Overview·······································································································································15-1

IPv6 Features································································································································15-1

IPv6 Addresses ·····························································································································15-3

IPv6 Neighbor Discovery Protocol·································································································15-6

IPv6 PMTU Discovery ···················································································································15-9

IPv6 Transition Technologies······································································································15-10

Protocols and Standards·············································································································15-10

IPv6 Basics Configuration Task List ···································································································15-11

Configuring Basic IPv6 Functions·······································································································15-11

Enabling IPv6 ······························································································································15-11

Configuring an IPv6 Unicast Address··························································································15-11

Configuring IPv6 NDP·························································································································15-14

Configuring a Static Neighbor Entry····························································································15-14

Configuring the Maximum Number of Neighbors Dynamically Learned·····································15-14

Configuring Parameters Related to RA Messages ·····································································15-15

Configuring the Maximum Number of Attempts to Send an NS Message for DAD····················15-18

Configuring PMTU Discovery··············································································································15-19

Configuring a Static PMTU for a Specified IPv6 Address···························································15-19

Configuring the Aging Time for Dynamic PMTUs ·······································································15-19

Configuring IPv6 TCP Properties········································································································15-19

Configuring ICMPv6 Packet Sending··································································································15-20

Configuring the Maximum ICMPv6 Error Packets Sent in an Interval ········································15-20

Enabling Replying to Multicast Echo Requests···········································································15-21

Enabling Sending of ICMPv6 Time Exceeded Messages···························································15-21

Displaying and Maintaining IPv6 Basics Configuration·······································································15-22

IPv6 Configuration Example ···············································································································15-23

Troubleshooting IPv6 Basics Configuration························································································15-28

16 DHCPv6 Configuration··························································································································16-1

DHCPv6 Configuration Overview··········································································································16-1

Basic Concepts······························································································································16-1

Typical DHCPv6 Network Application···························································································16-2

Stateless DHCPv6 Configuration··································································································16-2

Operation of DHCPv6 Relay Agent·······························································································16-3

Protocols and Standards···············································································································16-4

Configuring the DHCPv6 Client ············································································································16-4

Configuration Prerequisites···········································································································16-4

Configuration Procedure················································································································16-4

Configuring the DHCPv6 Relay Agent··································································································16-5

Configuration Prerequisites···········································································································16-5

Configuration Procedure················································································································16-5

vi

Displaying and Maintaining DHCPv6····································································································16-6

DHCPv6 Configuration Examples·········································································································16-7

Stateless DHCPv6 Configuration Example···················································································16-7

DHCPv6 Relay Agent Configuration Example··············································································16-8

17 Tunneling Configuration·······················································································································17-1

Tunneling Overview······························································································································17-1

Introduction to the Tunneling Technology·····················································································17-1

Introduction to IPv4/IPv6 Transition Tunnels ················································································17-2

IPv6 over IPv4 Tunnel···················································································································17-2

IPv4 over IPv4 Tunnel···················································································································17-5

IPv4/IPv6 over IPv6 Tunnel···········································································································17-6

GRE tunnel····································································································································17-7

Protocols and Standards···············································································································17-8

Tunneling Configuration Task List ········································································································17-8

Configuring a Tunnel Interface··············································································································17-9

Configuration Prerequisites···········································································································17-9

Configuration Procedure················································································································17-9

Configuring an IPv6 Manual Tunnel····································································································17-10

Configuration Prerequisites·········································································································17-10

Configuration Procedure··············································································································17-10

Configuration Example················································································································17-12

Configuring a 6to4 Tunnel···················································································································17-15

Configuration Prerequisites·········································································································17-15

Configuration Procedure··············································································································17-15

6to4 Tunnel Configuration Example····························································································17-16

Configuring an ISATAP Tunnel···········································································································17-19

Configuration Prerequisites·········································································································17-19

Configuration Procedure··············································································································17-19

Configuration Example················································································································17-20

Configuring an IPv4 over IPv4 Tunnel································································································17-23

Configuration Prerequisites·········································································································17-23

Configuration Procedure··············································································································17-23

Configuration Example················································································································17-24

Configuring an IPv4 over IPv6 Tunnel································································································17-28

Configuration Prerequisites·········································································································17-28

Configuration Procedure··············································································································17-28

Configuration Example················································································································17-29

Configuring an IPv6 over IPv6 Tunnel································································································17-32

Configuration Prerequisites·········································································································17-32

Configuration Procedure··············································································································17-32

Configuration Example················································································································17-34

Configuring a GRE over IPv4 Tunnel··································································································17-38

Configuration Prerequisites·········································································································17-38

Configuration Procedure··············································································································17-38

vii

Configuration Example················································································································17-39

Configuring a GRE over IPv6 Tunnel··································································································17-41

Configuration Prerequisites·········································································································17-41

Configuration Procedure··············································································································17-41

Configuration Example················································································································17-42

Displaying and Maintaining Tunneling Configuration··········································································17-45

Troubleshooting Tunneling Configuration···························································································17-45

18 Index ·······················································································································································18-1

1-1

1 ARP Configuration

This chapter includes these sections:

z ARP Overview

z Configuring ARP

z Displaying and Maintaining ARP

z ARP Configuration Example

ARP Overview

ARP Function

The Address Resolution Protocol (ARP) is used to resolve an IP address into a physical address

(Ethernet MAC address, for example).

In an Ethernet LAN, when a device sends data to another device, it uses ARP to translate the IP

address of that device to the corresponding MAC address.

ARP Message Format

ARP messages are classified into ARP requests and ARP replies. Figure 1-1 shows the format of the

ARP request/reply.

Figure 1-1 ARP message format

The following describe the fields in

Figure 1-1.

z Hardware type: This field specifies the hardware address type. The value “1” represents Ethernet.

z Protocol type: This field specifies the type of the protocol address to be mapped. The

hexadecimal value “0x0800” represents IP.

z Hardware address length and protocol address length: They respectively specify the length of a

hardware address and a protocol address, in bytes. For an Ethernet address, the value of the

hardware address length field is "6”. For an IP(v4) address, the value of the protocol address

length field is “4”.

z OP: Operation code. This field specifies the type of the ARP message. The value “1” represents

an ARP request and “2” represents an ARP reply.

1-2

z Sender hardware address: This field specifies the hardware address of the device sending the

message.

z Sender protocol address: This field specifies the protocol address of the device sending the

message.

z Target hardware address: This field specifies the hardware address of the device the message is

being sent to.

z Target protocol address: This field specifies the protocol address of the device the message is

being sent to.

ARP Operation

Suppose that Host A and Host B are on the same subnet and Host A sends a packet to Host B, as

shown in

Figure 1-2. The resolution process is as follows:

1) Host A looks into its ARP table to see whether there is an ARP entry for Host B. If yes, Host A

uses the MAC address in the entry to encapsulate the IP packet into a data link layer frame and

sends the frame to Host B.

2) If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request, in

which the sender IP address and the sender MAC address are the IP address and the MAC

address of Host A respectively, and the target IP address and the target MAC address are the IP

address of Host B and an all-zero MAC address respectively. Because the ARP request is a

broadcast, all hosts on this subnet can receive the request, but only the requested host (namely,

Host B) will respond to the request.

3) Host B compares its own IP address with the destination IP address in the ARP request. If they

are the same, Host B saves the source IP address and source MAC address in its ARP table,

encapsulates its MAC address into an ARP reply, and unicasts the reply to Host A.

4) After receiving the ARP reply, Host A adds the MAC address of Host B to its ARP table.

Meanwhile, Host A encapsulates the IP packet and sends it out.

Figure 1-2 ARP address resolution process

If Host A is not on the same subnet with Host B, Host A first sends an ARP request to the gateway. The

target IP address in the ARP request is the IP address of the gateway. After obtaining the MAC

address of the gateway from an ARP reply, Host A sends the packet to the gateway. If the gateway

maintains the ARP entry of Host B, it forwards the packet to Host B directly; if not, it broadcasts an

1-3

ARP request, in which the target IP address is the IP address of Host B. After obtaining the MAC

address of Host B, the gateway sends the packet to Host B.

ARP Table

After obtaining the MAC address of a host, the device puts the IP-to-MAC mapping into its own ARP

table. This mapping is used for forwarding packets with the same destination.

An ARP table contains ARP entries, which can be either dynamic or static.

Dynamic ARP entries

A dynamic entry is automatically created and maintained by ARP. It can get aged, be updated by a

new ARP packet, or be overwritten by a static ARP entry. When the aging timer expires or the interface

goes down, the corresponding dynamic ARP entry will be removed.

Static ARP entries

A static ARP entry is manually configured and maintained. It cannot get aged or be overwritten by a

dynamic ARP entry.

Using static ARP entries enhances communication security. After a static ARP entry is specified, only a

specific MAC address is associated with the specified IP address. Attack packets cannot modify the

IP-to-MAC mapping. Thus, communications between devices are protected.

Static ARP entries can be classified into long and short.

z A long static ARP entry can be directly used to forward packets. When configuring a long static

ARP entry, you must configure a VLAN and an outbound interface for the entry in addition to the

IP address and the MAC address.

z A short static ARP entry has only an IP address and a MAC address configured. It cannot be

directly used for forwarding data. If a short static ARP entry matches an IP packet to be forwarded,

the device sends an ARP request first. If the sender IP and MAC addresses in the received ARP

reply are the same as those in the short static ARP entry, the device adds the interface that

receives the ARP reply to the short static ARP entry. Then the entry can be used to forward IP

packets.

z Usually ARP dynamically resolves IP addresses to MAC addresses, without manual intervention.

z To allow communication with a device using a fixed IP-to-MAC mapping, configure a short static

ARP entry for it. To allow communication with a device through a specific interface in a specific

VLAN and using a fixed IP-to-MAC mapping, configure a long static ARP entry for it.

1-4

Configuring ARP

Configuring a Static ARP Entry

A static ARP entry is effective when the device is working normally. However, when the VLAN or VLAN

interface to which a static ARP entry corresponds is deleted, the entry, if long, will be deleted, and if

short and resolved, will become unresolved.

Follow these steps to configure a static ARP entry:

To do… Use the command… Remarks

Enter system view

system-view

—

Configure a long static

ARP entry

arp static

ip-address mac-address

vlan-id interface-type

interface-number [

vpn-instance

vpn-instance-name ]

Required

No long static ARP entry is configured by

default.

Configure a short static

ARP entry

arp static

ip-address mac-address

[

vpn-instance

vpn-instance-name ]

Required

No short static ARP entry is configured by

default.

z The vlan-id argument must be the ID of an existing VLAN that corresponds to the ARP entries. In

addition, the Ethernet interface following the argument must belong to that VLAN. A VLAN

interface must be created for the VLAN.

z The IP address of the VLAN interface corresponding to the vlan-id argument must belong to the

same network segment as the IP address specified by the ip-address argument.

Configuring the Maximum Number of Dynamic ARP Entries for an Interface

Follow these steps to set the maximum number of dynamic ARP entries that an interface can learn:

To do… Use the command… Remarks

Enter system view

system-view

—

Enter Ethernet interface view

interface

interface-type

interface-number

—

1-5

To do… Use the command… Remarks

Set the maximum number of

dynamic ARP entries that an

interface can learn

arp max-learning-num

number

Optional

16384 by default for S5800 series

Ethernet switches

8192 by default for S5820X series

Ethernet switches

Setting the Aging Time for Dynamic ARP Entries

To keep pace with the network changes, the ARP table is refreshed. Each dynamic ARP entry in the

ARP table has an aging time rather than is always valid. Dynamic ARP entries that are not refreshed

before expiration are deleted from the ARP table. The aging time is reset each time the dynamic ARP

entry is refreshed. You can adjust the aging time for dynamic ARP entries according to the actual

network condition.

Follow these steps to set the aging time for dynamic ARP entries:

To do… Use the command… Remarks

Enter system view

system-view

—

Set the aging time for dynamic

ARP entries

arp timer aging

aging-time

Optional

20 minutes by default.

Enabling the ARP Entry Check

The ARP entry check function controls the device to support static ARP entries with multicast MAC

addresses.

When the ARP entry check enabled, you cannot configure a static ARP entry with a multicast MAC

address on the device; otherwise, the system displays error messages.

When the ARP entry check is disabled, you can configure a static ARP entry with a multicast MAC

address on the device.

Follow these steps to enable the ARP entry check:

To do… Use the command… Remarks

Enter system view

system-view

—

Enable the ARP entry check

arp check enable

Optional

By default, ARP entry check is enabled.

1-6

Configuration Gratuitous ARP

Introduction to Gratuitous ARP

In a gratuitous ARP packet, the sender IP address and the target IP address are both the IP address of

the device issuing the packet, the sender MAC address is the MAC address of the device, and the

target MAC address is the broadcast address ff:ff:ff:ff:ff:ff.

A device sends a gratuitous ARP packet to:

z Determine whether its IP address is already used by another device. If the IP address is already

used, the device is informed of the conflict by an ARP reply, or

z Inform other devices of its new MAC address so they can update their ARP entries.

Enabling Learning of Gratuitous ARP Packets

With this feature enabled, a device receiving a gratuitous ARP packet adds the sender IP and MAC

addresses carried in the packet to its ARP table if no corresponding ARP entry exists. If a

corresponding ARP entry is found, the device updates the ARP entry.

After this feature is disabled, the device will use the address information in the received gratuitous

ARP packets to update the existing ARP entries only, but not to create new ARP entries.

Configuring Periodic Sending of Gratuitous ARP Packets

Enabling a device to periodically send gratuitous ARP packets helps downstream devices update their

corresponding ARP entries or MAC entries in time. This feature can be used to:

z Prevent gateway spoofing

If an attacker sends forged gratuitous ARP packets to the hosts on a network, the traffic destined for

the gateway from the hosts is sent to the attacker instead. As a result, the hosts cannot access the

external network.

To prevent such gateway spoofing attacks, you can enable the gateway to send gratuitous ARP

packets containing its primary IP address or one of its manually configured secondary IP addresses at

a specific interval. In this way, each host can learn correct gateway address information.

z Prevent ARP entries from being aged out

Heavy network traffic or high CPU utility on a host may cause received ARP packets to be discarded

or processed too late. Eventually, the dynamic ARP entries on the receiving host will be aged out, and

the traffic between the host and the corresponding devices will be interrupted until the host creates the

ARP entries again.

To prevent such a problem, you can enable the gateway to send gratuitous ARP packets periodically.

The gratuitous ARP packets contain the gateway's primary IP address or one of its manually

configured secondary IP addresses. Thus, the receiving host can update ARP entries in time and thus

ensure traffic continuity.

z Prevent the virtual IP address of a VRRP group from being used by a host

The master router of a VRRP group can periodically send gratuitous ARP packets to the local hosts,

so that the hosts can update local ARP entries and avoid using the virtual IP address of the VRRP

group.

If the virtual IP address of the VRRP group is associated with a virtual MAC address, the sender MAC

address in the gratuitous ARP packet is the virtual MAC address of the virtual router. If the virtual IP

1-7

address of the VRRP group is associated with the real MAC address of an interface, the sender MAC

address in the gratuitous ARP packet is the MAC address of the interface on the master router.

For more information about VRRP, see VRRP Configuration in the High Availability Configuration

Guide.

Configuring Gratuitous ARP

Follow these steps to configure gratuitous ARP:

To do… Use the command… Remarks

Enter system view

system-view

—

Enable learning of gratuitous ARP

packets

gratuitous-arp-learning enable

Optional

Enabled by default.

Enable the device to send

gratuitous ARP packets upon

receiving ARP requests from

another network segment

gratuitous-arp-sending enable

Required

By default, a device does not send

gratuitous ARP packets upon

receiving ARP requests from

another network segment.

Enter interface view

interface

interface-type

interface-number

—

Enable periodic sending of

gratuitous ARP packets and set

the sending interval

arp send-gratuitous-arp

[

interval

milliseconds ]

Required

Disabled by default.

z You can enable periodic sending of gratuitous ARP packets on a maximum of 1024 interfaces.

z Periodic sending of gratuitous ARP packets takes effect only when the link of the enabled

interface goes up and an IP address has been assigned to the interface.

z If you change the interval for sending gratuitous ARP packets, the configuration is effective at the

next sending interval.

z The frequency of sending gratuitous ARP packets may be much lower than is expected if this

function is enabled on multiple interfaces, if each interface is configured with multiple secondary

IP addresses, or if a small sending interval is configured in the above cases.

Page is loading ...

H3C s5800 series, s5820x series Configuration manual

Related papers

Other documents