3Com 10014299 manual

http://www.3com.com/ 3Com Router Configuration Guide Published March 2004 Part No. 10014299[...]

3Com Corporation 350 Campus Drive Marlbor ough, MA 01752-3064 Copyright © 2004, 3Com C orporation. All rights r eserv ed. No part of this do cumentation m ay be r epr oduc ed in any form or by any means or used to make any deri vative work (such as translat ion, transformation, or adaptation) without written perm ission fr om 3 Com Co rporatio n. [...]

G ETTING S TARTED 1 S YSTEM M ANAGEMENT 33 I NTERFACE 121 L INK L AYER P RO T O C O L 183 N ETWORK P RO T O C O L 335 R OUTING 423 M ULTICAST 517 S ECURITY 543[...]

VPN 615 R ELIABILITY 665 Q O S 681 D IAL - UP 721[...]

A BOUT T HIS G UIDE This guide describes 3Com r outers and how to configure them. Conventions Ta b l e 1 and Ta b l e 2 list conventions that are used thr oughout this guid e. Ta b l e 1 No tice Icons Ta b l e 2 T ext Conventions Icon Notice Type Description Information note Information that describes important features or instructions. Caution Inf[...]

2 A BOUT T HIS G UIDE[...]

I G ETTING S TARTED Chapter 1 3Com Router Introduction Chapter 2 3Com Router User Interface[...]

4[...]

1 3C OM R OUTER I NTR ODUCTION This chapter includes information on the following topics: ■ Overview of the 3Com Router System ■ Architectur e of the 3Com Router ■ Features of the 3Com Router V ersion 1.10 ■ New Features of the 3Com Router 1.x Overview of the 3Com Router System The 3Com Router OS is the network ope rating system platform. W[...]

6 C HAPTER 1: 3C OM R OUTER I NTRODUCTION Figure 1 Schematic diagram of the 3Com Router architectur e Features of the 3Com Router V ersion 1.10 The following table lists the basic features of the 3Com Router 1.x: Ta b l e 3 List of the 3Com Router 1.x features System service TCP/UDP IP forwarding engine Fast forwarding IP security and firewall QoS [...]

Features of the 3Com Router Version 1.10 7 Network prot ocol IP service ■ Supports AR P ■ Supports Static domain name resolution ■ Supports IP Address Un numbered ■ Supports DHCP Server and DHCP relay ■ Supports VLAN ■ Supports IP Accounting Non-IP service ■ Supports Novell IPX protocol, provide R IP and SAP to maintain the database o[...]

8 C HAPTER 1: 3C OM R OUTER I NTRODUCTION Network security Authen ticati on, Authorization and Accounting (AAA) service ■ Provides PPP and login user authentication ■ Supports RADIUS, provides RADIUS authentication /accounting ■ Provides local authentication ■ Supports CHAP and PAP authentication Firewall ■ Supports standard access contro[...]

Features of the 3Com Router Version 1.10 9 Quality of service (QoS) Traffic classification and flow control ■ Supports CAR (Commi tted Access Speed ) and packet priority, monitoring the ne twork traffic entering ISP ■ Supports LR (Line Rate of phy sica l interface) to limit the total speed of packet transmission on physical interfac e Traffic s[...]

10 C HAPTER 1: 3C OM R OUTER I NTRODUCTION New Features of the 3Com Router 1.x New features have been adde d to the 3Com Rout er1.10. Support New Interfaces E3 and CE3 Interfaces Both E3 and E1 are part of the ITU-T digital carrier architecture and ar e used in most regions beyond North America. The data transmission speed of E3 is 34.368 Mbps and [...]

New Features of the 3Com Router 1.x 11 ■ Combined with BDR, Frame Relay over ISDN can be taken as the backup communication method for Frame Relay . Multilink Frame Relay The Multilink Frame Relay (MFR) featur e introduces function ality based on the Frame Relay Forum Multilink Frame Rela y UNI/NNI Implem entation Agr eement (FRF .16). This featur[...]

12 C HAPTER 1: 3C OM R OUTER I NTRODUCTION[...]

2 3C OM R OUTER U SER I NTERFACE This chapter includes information on the following topics: ■ Establish Configuration Environment ■ Command Line Interface (CLI) ■ User Identity Management ■ Basic Configuration and Management of the System Establish Configuration Environment The 3Com Router 1.x supports local and remote configuration, and th[...]

14 C HAPTER 2: 3C OM R OUTER U SER I NTERFACE Figure 3 Establish a new connection Figure 4 Select the computer serial port for actual connection[...]

Establish Configuration Environment 15 Figure 5 Set port communication parameters Figure 6 Select terminal emulation type 3 Power on the router to display the self-test information of the router . Press Enter after the self-test to disp lay the prompt “Username:” and “password:”. T ype in the correct username and the password, then enter th[...]

16 C HAPTER 2: 3C OM R OUTER U SER I NTERFACE 4 Enter the command to config ure the r outer or view the running status of the router . Enter “?” to get help when nece ssary . For details of specific commands, please refer to the following chapt ers . Remote Configuration Environment via Async Serial Port The router powers on, then creates a rem[...]

Establish Configuration Environment 17 Figure 8 Establish a dial-up connect ion via “HyperT erminal” Figure 9 Dial on r emote computer 4 If a dial-up connection is established, then press Enter after t he self-t es t to disp lay the prompt “Username:” and “password:”. Enter the correct username and the password, then enter the system vi[...]

18 C HAPTER 2: 3C OM R OUTER U SER I NTERFACE configuration environment, connect the computer with th e router via the W AN interface . Figure 10 . Establish configuration environm ent of local telnet connection Figure 11 Establish a configuration environment of a r emote telnet connection 2 As shown in the follo wing two figures (T elnet client pr[...]

Command Line Interface (CLI) 19 Figure 12 Run a telnet pr ogram Figure 13 Establish a telnet connection with r outer The host name in the above figur e is the na me or IP address of a router interf ace of the remote connection. 3 If connection is established, press Enter after the self-test to d isplay the prompt “Username:” and “password:”[...]

20 C HAPTER 2: 3C OM R OUTER U SER I NTERFACE ■ Provide online help any time the user keys in “?”. ■ Provide network test commands, such as tracert and ping , etc. to quickly diagnose whether the network is normal. ■ Provide rich and detailed debugging information for diagnosis of network faults. ■ Use telnet command to directly log in [...]

Command Line Interface (CLI) 21 Figure 14 Hierar chical view structure of the 3Com Router The following table gives some details of the fun ct i onalit y features of the command views as well as the commands for entering these views. System view Ta b l e 4 Views and their pr ompts System view RIP view OSPF v iew BGP view Routing policy view PIM vie[...]

22 C HAPTER 2: 3C OM R OUTER U SER I NTERFACE async serial interface view Configures the asynchronous serial interface parameters [Router-Async0] Enter interface async 0 in any views Enter quit to return to the system view AUX interface view Configures the AUX interface parameters [Router-Aux0] Enter interface aux 0 in any views Enter quit to retur[...]

Command Line Interface (CLI) 23 The command line prompt character consist s of the network device name (Router by default) and the command view name, such as [Router -rip]. The commands are divided according to view . In general, in a certain view , only the commands defined by the view can be executed, but some widely used commands (including ping[...]

24 C HAPTER 2: 3C OM R OUTER U SER I NTERFACE ■ The help information obtained via the above-mentioned online help is described as follows: 1 Full help: Enter “?” in any view , all th e commands in this view and their brief descriptions can be obtained. [Router]? aaa-enable Enable AAA(Authentication, Authorization and Accounting) acl Specifyst[...]

Command Line Interface (CLI) 25 History Command The command line interface of the 3Com R outer 1.x provides a function similar to DOSKey by automatically saving the history of commands inputted users. Users can check the history of comm ands sa ved in the command line to repe at execution. 10 history commands can be sa ved at the most for each user[...]

26 C HAPTER 2: 3C OM R OUTER U SER I NTERFACE Ta b l e 9 Display function table User Identity Management The 3Com Router sets three kinds of router management users: administrator user , operator user and guest user . Differ ent kinds of users have differ ent rights to execute commands. 1 An administrator user has the right to execute all the comma[...]

User Identity Management 27 By defaul t, no user is set on the r outer . In this case, th e user can lo g onto the router without user name and password, op erating as the administrator u ser and have the right to execute all commands. The router should be configured with at least one administrator user . This is because any user can log onto th e [...]

28 C HAPTER 2: 3C OM R OUTER U SER I NTERFACE By default, the system clock is 08:0 0:00 1 1 199 7. The system clock will reset to the initial number when the conf iguration is deleted by using the delete command or is deleted at the boot menu. 3 Reboot the system Please perform the followin g commands in all views. Ta b l e 13 Reboot the system Bef[...]

II S YSTEM M ANAGEMENT Chapter 3 System Manage ment Chapter 4 T erminal Service Chapter 5 Configuring Network Management Chapter 6 Display and Debugging T ools Chapter 7 POS T erminal Access Service[...]

30[...]

3 S YSTEM M ANAGEMENT This chapter includes information on the following topics: ■ Storage Media and File T ypes Supported by the System ■ Upgrade Boot R OM Software ■ Upgrade th e 3Com Rou ter Main Pr ogra m Softwar e ■ Configure On-Line Upgrading of the Car d ■ Configuration File Management ■ Configure F TP Storage Media and File T yp[...]

32 C HAPTER 3: S YSTEM M ANAGEMENT Quickly input Ctrl+D to enter the Boot ROM menu. If Ctrl+D is not input within three seconds, the system will restart the r outer and the following pr ompt information displays: **************************** ************** * * * 3Com Router Series Bootrom , V4.25 * * * **************************** ************** 3C[...]

Upgrade Boot ROM Software 33 5 Example: if you select baud rate 115200 bps, the system will prompt you to modify the baud rate and select XMO DEM transfer protocol: Download speed is 115200 bps. Change t he terminal's speed to 115200 bps, and select XMODEM protocol. Press ENTER key when ready. According to the above prompt, change th e baud ra[...]

34 C HAPTER 3: S YSTEM M ANAGEMENT Figure 16 “Send file” message window 8 After downloading, the router will save th e file into Flash or NVRAM, display the following information, and prompt rest oring of the baud-rate setting of the terminal emulator . Download completed. Writing to flash memory... Please waiting, it needs a long ti me #######[...]

Upgrade the 3Com Router Main Program Software 35 Y ou can load the 3Com Router main softwa re with XModem or TF TP (T rivial File T ransfer Protocol) approach when poweri ng on the router . Alternatively , you can load the software with the F T P (File T ransfer Protocol) approach after the router is booted. XModem Approach 1 Power on the router . [...]

36 C HAPTER 3: S YSTEM M ANAGEMENT 3: 38400 bps 4: 57600 bps 5: 115200 bps 6: Exit and Reboot Enter your choice(1-6): Make your selection as needed. 5 After a baud rate (11 5200 bps for example) is selected , the sy stem displays the following information to prompt you to modify the baud ra te and select the XModem pr ot oc ol: Download speed is 11[...]

Upgrade the 3Com Router Main Program Software 37 Figure 18 T ransfer File dialog box 7 Click Browse to open the fold er containing the Boot ROM so ftware, select the file, change the download prot ocol to XModem, click Send , and the system will start downloading and the following dialog box displays: Figure 19 The Downloading dialog box 8 Upon the[...]

38 C HAPTER 3: S YSTEM M ANAGEMENT 9 Restore the baud rate of the terminal emulation pr ogram to 9600 bps and press Enter for rebooting the router so that the new 3Co m Router main program softwar e can be run. TF TP Approach TF TP is a pr otocol used fo r transferring trivial files be t ween clients and servers in the TCP/IP suite. It pr ovides lo[...]

Upgrade the 3Com Router Main Program Software 39 Figure 21 Tftp d32: Set interface Enter the file dire ctory in the field of Base Director y , and click OK for confirmation. The setting interface may var y with di fferent TF TP server program software. 2 Connect the router a Select an Ether net interface for downloading on the r outer . 3Com Router[...]

40 C HAPTER 3: S YSTEM M ANAGEMENT NETWORK INTERFACE PARAMETERS: Do you want a LAN interface? [N] y This board's LAN IP address? [169. 254.1.1] 10.110.10.1 Subnet mask for LAN (0 for none)? [255.255.0.0] TFTP SERVER PARAMETERS: IP address of the TFTP server? [16 9.254.75.166] 10.110.10.13 What is the name of the file to be loaded and started? [...]

Upgrade the 3Com Router Main Program Software 41 Input the Boot ROM password at the prompt . (By default, no ex-facto ry Boot ROM password is set on the r outer . Simply press Enter in this case.) If the Boot ROM password has been modified, enter the correct password. The system terminates the process if the password authenti cation attempts fails [...]

42 C HAPTER 3: S YSTEM M ANAGEMENT After a client originates a control connection to a server by using the port command and uses a randomly assigned F TP port to establish the control link with port 21 on the server , the link will be in place until there is no data waiting for transmission. The server uses port 20 to establish data link with the c[...]

Upgrade the 3Com Router Main Program Software 43 remote F TP user sends a request to the F TP server , and the server will perform actions accordingly and return the execution result to the subscriber . Perform the following configuration in system view . Ta b l e 18 Enable F TP server Upgrade the 3Com Router Main Softwar e with F TP 1 Assign an IP[...]

44 C HAPTER 3: S YSTEM M ANAGEMENT 7 At the prompt ftp> , appearing after the file uploading is completed, en ter the dir command to display the file name and size on the router . If the uploading operation is successful, t he program or configuration file on the router and the uploaded file on the host should have the same size. 8 At the pr omp[...]

Configure On-Line Upgrad ing of the Card 45 Configure On-Line Upgrading of the Card The 3Com Router 1.x supports on-line upgrading of such cards as 2SA/4SA, E1VI and 6AM/12AM. While upgrading, the host ac ts as F TP Server and the router to be upgraded as the F TP Client. The host and the r outer coordinate to download the card upgrading files. Whe[...]

46 C HAPTER 3: S YSTEM M ANAGEMENT Figure 24 Path Name dialog box Select the check boxes Read, W rit e and De lete in FILES and click OK to r eturn. Figure 25 Edit Users/Grou p check box 4 The car ds can be upgraded on-line after the on-line upgrading files are copied to the path of the serv-u F TP . Perform the following configuration in the syste[...]

Configuration File Manag ement 47 After the display version command is used, the information on the slot displays: card name Driver need to be updated On-line upgrading uses the upgrading program of other car ds and this car d will not be upgraded on-line. The Console di splays the following prompt information: %Error: File ID error! If the on-line[...]

48 C HAPTER 3: S YSTEM M ANAGEMENT Ta b l e 21 Load configuration files Follow these steps in the te rminal emulation program: 1 Enter the comma nd an d make the confir mation. [Router] download config Do you want really download the co nfig.ini?(Y/N)y 2 Set the binary transmission protocol to XModem/CRC. Change Protocol to Xmodem,then Sen d the Se[...]

Configuration File Manag ement 49 At the prompt of “ftp>”, use the put Lo calFile [ RemoteFile ] command to upload the specif ied file to the router . RemoteFile should use the name of the config file on the router , and the name is case sensitive. Y ou can use the ftp-server config-name command to modify the file name on the router . For de[...]

50 C HAPTER 3: S YSTEM M ANAGEMENT 226 file transmit success. ftp: 735 bytes received in 0.06Sec onds 12.25Kbytes/sec. View Current and Saved Configuration of the Router During the power - on of th e router , read the configuration files from Flash (or NVRAM) to initialize the r outer . Ther efor e, the configuration file in Flash (or NVRAM) is cal[...]

Configuration File Manag ement 51 Ta b l e 25 Select and view the storage media of configuration file If ther e is only one type of stora ge media availabl e, the configfile command will not be effective. Modify and Sa ve Current Config uration Users can modify the current configurat ion of the router via the command line interface. T o save the cu[...]

52 C HAPTER 3: S YSTEM M ANAGEMENT Ta b l e 28 Set/clear the flag bit to enter the initial setup By default, no flag bit fo r enteri ng the initial setup mode is set. Configure F TP F T P (File T ransfer Protocol), which belongs to the application layer pr otocol in the TCP/IP protocol suite, mainly provides f ile transfer between remote hosts. Bor[...]

Configure FTP 53 Ta b l e 29 Set the authentication mode of F TP server 2 Add F TP authorized user name and pa ssword Input the following command in system view . Ta b l e 30 Add F TP authorized user name and password For a detailed introduction to the abov e command, please refer to the chapter “AAA and RADIUS Configuration” in th e Security s[...]

54 C HAPTER 3: S YSTEM M ANAGEMENT The names of the program/configuration file are “system” and “config” respectively by default. In the command, file-n ame is a character string with the length of 1 to 30. 2 Set F TP update mode When logging onto the F TP Serv er from a PC, you can use t he put command to upload the file. The F TP Server a[...]

Configure FTP 55 Display F TP Serve r Ta b l e 36 Display F TP server Operation Command Display the configuration status of current FTP server display ftp-server Display detailed information of the FTP user display local-user[...]

56 C HAPTER 3: S YSTEM M ANAGEMENT[...]

4 T ERMINAL S ERVICE This chapter includes information on the following topics: ■ T erminal Service Overview ■ T erminal Message Service ■ Dumb T erminal Service ■ T erminal Service of T elnet Connection ■ Rlogin T erminal Service ■ X.25 P AD Remote Access Service T e rminal Serv ice Overview The terminal services provided by the 3Com R[...]

58 C HAPTER 4: T ERMINAL S ERVICE Features of T erminal Service at Async Serial Port The 3Com Router supports remote configuration on the router via asynchronous serial port (including synchronous/asynchr onous serial port, 8/16 asynchronous serial port, and AUX port). Please refer to Chapter 2 “3Com Router User Interface ” of this manual for t[...]

Terminal Message Service 59 with user B, user A should telnet onto Router B and execute the send command to send the related information in all views. Then user B can receive the “message” sent from user A. If user B does not want to r eceive additional similar messages, they can use the send switch command to disable the function of receiving [...]

60 C HAPTER 4: T ERMINAL S ERVICE T ypical Example of T erminal Message Service Configuration # Input the send command in system view. [Router] send Enter message, end with CTRL/Z; ab ort with CTRL/C: # Input the contents of the messa ge that the terminal will send. hello world # (Enter <Ctrl+W> to terminate the message input ) end message? [[...]

Dumb Terminal Service 61 By default, no dumb terminal service is configured. 2 Configure auto-exe cute command command If the auto-execute command command is configured on the asynchronous serial interface, when you press Enter twice on the exter nal terminal connected to the interface or log onto the router in modem dial-up mode and press Enter tw[...]

62 C HAPTER 4: T ERMINAL S ERVICE Figure 27 Dumb terminal networking diagram 1 Configure the interface to dumb ter minal mode. [Router-Serial1] physical-mode async [Router-Serial1] undo modem [Router-Serial1] async mode flow 2 Configure the auto-execute command command. [Router-Serial1] auto-execute comm and telnet 10.110.164.45 After the configura[...]

Terminal Service of Telnet Connection 63 Figure 29 T elnet client servic e Reverse T elnet Overview Reverse T elnet service: the user logs on the r outer with a specified port number by running the T eln et client program on the PC. Then the connection to the serial port device connected with the async port of the router is established. One example[...]

64 C HAPTER 4: T ERMINAL S ERVICE Ta b l e 46 Establish T elnet Server or T elnet Client connection By default, T elnet Server starts automatically . The default value of ser vice-port is 23. T o terminate T elnet service, enter Ctrl+] at T elnet Client side. Setup Reverse T elnet Connection Please use async mode flow and undo modem commands in asy[...]

Terminal Service of Telnet Connection 65 The interface listen port number is within the range of 1025 to 65535. Please note that the listen port number can not be the same as that of the widely used ports. By default, the port number and asynchronous interface have th e following relations: ■ The async serial interface number starts from 2 001. F[...]

66 C HAPTER 4: T ERMINAL S ERVICE Password: User guest logged in . 3 The message showing successful T e lnet to Router B shou ld pop up and display the host name of RouterB. [RouterB] Example of Reverse T e lnet The host is connected to the router , then communicates with the device connected to the seventh asynch ronous serial interface of the rou[...]

Rlogin Terminal Service 67 ■ Only supports IP address configuration. DNS is not supported. ■ The supported terminal type is VT100. ■ The supported b aud rate is 9600 bps. ■ Supports remote access of user term inals connected with the asynchronous serial port under the flow mode by asyn ch ronous private line or modem dial-up and supports th[...]

68 C HAPTER 4: T ERMINAL S ERVICE SCO OpenServer(TM) Release 5 (C) 1976-1998 The Santa Cruz Opera tion, Inc. (C) 1980-1994 Microsoft Corporatio n. All rights reserved. For complete copyright credits, enter "copyrights" at the command prompt. you have mail Terminal type is vt100 # X.25 P AD Remote Access Service P AD (Packet Assembly/Dis a[...]

X.25 PAD Remote Access Service 69 Therefore X.25 P AD devices actually serv e as a procedur e translator or network server , pr oviding services to differ ent terminals and helping them to access the X.25 network. The 3Com Router implements X.29 and X.3 protocol in the X.25 P AD as well as in the X.29 protocol-based T elnet applicatio n and the use[...]

70 C HAPTER 4: T ERMINAL S ERVICE By default, no X.25 P AD remote user is configured at the Server side. For details of the Command, refer to the relevant sections on Security Configuration Co mmands in Command Reference (V1.6). Start AAA authentication of X.25 re mote users After the configuration of X.25 P AD remote users, AAA authentication is s[...]

X.25 PAD Remote Access Service 71 Exit command can also be nested with the Pad command. That is, users can access a thir d or even more r outers from a r outer by repeatedly using the telnet/pad command or by re peatedly using the exit command to exit the routers being accessed in turns until returning to the one from which the first call is placed[...]

72 C HAPTER 4: T ERMINAL S ERVICE c Enter the view of interface Serial 0 and set its link layer pr otocol as X.25 DTE IETF . [RouterA] interface serial 0 [RouterA-serial0] link-protocol x25 dte ietf d Set its X.121 address as 123456. [RouterA-serial0] x25 x121-address 123456 2 Configure Router B: a Enter the view of interface Serial 0 and set its l[...]

5 C ONFIGURING N ETWORK M ANAGEMENT This chapter includes information on the following topics: ■ SNMP Overview ■ RMON Overview SNMP Overview Simple Network Mana gement Protocol (SNMP), a widely accepted industry standard, is the most dominant networ k management protocol in computer networks by far . It is developed to ensur e transmission of m[...]

74 C HAPTER 5: C ONFIGURING N ETWORK M ANAGEMENT addition to the fun ctions define d in SNMPv2c and SNMPv1 . In other wor ds, SNMPv3 dev elops SNMP v2c by adding securit y an d management fun ctions. SNMPv1 and SNMPv2c lack security func tions, especially in the aspect of authentication and privacy . SNMPv1 defines only a type of community repr ese[...]

SNMP Overview 75 sub-tree, the network administrator can access the device wi th read or write authority . Otherwise, the op erations will be r ejected. SNMP ar chitectur e An SNMP entity comprises one SNMP engi ne and multiple SNMP applications. The SNMP engine is the core of the SNMP entity . It transceives and authent icates SNMP messages, extra[...]

76 C HAPTER 5: C ONFIGURING N ETWORK M ANAGEMENT Ta b l e 56 3Com Router -supported MIB Configure SNMP SNMP configur ation includes: ■ Configure the network management agent on a router ■ Configure the information of r outer administrator ■ Configure the SNMP version ■ Configure the trap ■ Adjust the maximum size of SNMP packets 1 Configu[...]

SNMP Overview 77 “Corporation code of 3Com Corpo ration. (800007DB) + Equipment information” . Equipment information can be the IP ad dr ess, MAC address or self-defined hexadecimal digit string. Y ou can skip these two operations when you begin to configure SNMP for a r outer because SNMP service will be enabled once you configure any related [...]

78 C HAPTER 5: C ONFIGURING N ETWORK M ANAGEMENT By default, SNMPv3 is used . The default view name in the system is View Default, and OID of which is 1.3.6.1. SNMP group has only the r ead-only authority by default. If SNMPv1/SNMPv2c is used, the comm unity name or SNMPv1/SNMPv2c groups and users should be configured. If SNMPv3 is used, SNMPv3 gro[...]

SNMP Overview 79 By default, the router is disabled to send traps. 5 Configure the maximum size of SNMP pa ckets that the router can send/ receive Set the Max SNMP messages that can be r eceived/sen t by the agent accor ding to the network loading capacity . Perform the following configurations in system view . Ta b l e 61 Configure the maximum siz[...]

80 C HAPTER 5: C ONFIGURING N ETWORK M ANAGEMENT T ypical Configuration Examples Example 1: Configure Network Management of SNMPv1 I. Networking Requirements In the following diag ram the NMS and a router are connected via the Ether n et. The IP addresses of NMS and the Ether n et interface on the router are r espectively 129.102.149.23 and 129.1 0[...]

RMON Overview 81 ■ Required if traps ar e to be sent — the IP address of the interface ethernet 0 is the source addr ess of the traps, and the address of the NMS is the destination address. II. Networking Diagram Refer to the networking diagram of Example 1. III. Configuration Procedur e 1 Enable the router to support SN MP and select an SNMP v[...]

82 C HAPTER 5: C ONFIGURING N ETWORK M ANAGEMENT thus managing large-scale interconnection networks easily and effective ly . RMON also allows several monitors and can collect data in two ways: one is to co llect with the RMON probe — NMS dir ectly obt ains management data from an RMON probe and contr ols network resources. In this way , all RMON[...]

RMON Overview 83 ■ Enable RMON statistics of Ether net in ter face 1 Enable RMON statistics of Ether net in ter face After enabling RMON statistics of an Ethe rnet interface, the router will perform the statistics of the packet incoming and outgo ing through this interface. After disabling it, the r outer will not perform the statistics of the pa[...]

84 C HAPTER 5: C ONFIGURING N ETWORK M ANAGEMENT [RouterA] interface ethernet 0 [RouterA-Ethernet0] rmon promiscuo us[...]

6 D ISPLAY AND D EBUGGING T OOLS This chapter includes information on the following topics: ■ Display Command Set ■ Debugging Command Set ■ T est T ool of Network Connection ■ Log Function Display Command Set Wi th display commands, the system status and system info rmation can be viewed. display commands can be divided as follows according[...]

86 C HAPTER 6: D ISPLAY AND D EB UGGING T OOLS T wo switches control the output of the debugging information: ■ Debugging switch, which controls whether to test a certain function/module/protocol. ■ Syslog output direction switch, which contr ols outputting the debugging information to the control console, T elnet terminal or internal buffer or[...]

Test Tool of Network Connection 87 Please see relevant chapters in the 3Com Router Command Reference Guide for detailed meanings of various options and parameters. Ping supporting IP pro tocol ■ For each ping message sent, if the r es ponse message has not been received when the waiting time crosses the threshold, then Req uest time out is output[...]

88 C HAPTER 6: D ISPLAY AND D EB UGGING T OOLS !!!!! --2.0.0c91.f61f IPX ping statistics-- 5 packets transmitted 5 packets received 0% packet loss round-trip min/avg/max = 1/2/3 m s tracert command (T race Route Command) The t race route command helps to trace the current network path to a destinatio n. W ith tracert command, all gateways by which [...]

Log Function 89 3 lilac-dmc.Berkeley.EDU (128.32.216. 1) 39 ms 19 ms 19 ms 4 ccngw-ner-cc.Berkeley.EDU (128.32.1 36.23) 19 ms 39 ms 39 ms 5 ccn-nerif22.Berkeley.EDU (128.32.16 8.22) 20 ms 39 ms 39 ms 6 128.32.197.4 (128.32.197.4) 59 ms 119 ms 39 ms 7 131.119.2.5 (131.119.2.5) 59 ms 5 9 ms 39 ms 8 129.140.70.13 (129.140.70.13) 80 m s 79 ms 99 ms 9 1[...]

90 C HAPTER 6: D ISPLAY AND D EB UGGING T OOLS Set the direction of syslog outputting log information As described before, Syslog of the 3Com Router 1.x ca n output vario us log information in four directions: ■ Output log information to local control console via Console port ■ Output log information to remote T elnet termin al or dumb terminal[...]

Log Function 91 Set Severity of Log Information Syslog is divided into 8 levels accordin g to the Severity (or priority) of the information. The rule to f ilter the log information acco rding to the level is: the more urgent the log information is, the le ss sever e it will be . The log information with severity higher than the set thr eshold is fo[...]

92 C HAPTER 6: D ISPLAY AND D EB UGGING T OOLS Here, module stands for the module name. Only the log information re lated to a specified module can be filtered and output. T urn on/turn off syslog Please enter the foll owing commands in system view . Ta b l e 70 T urn on/tur n off syslog When Syslog is turned on, the performance of the system will [...]

Log Function 93 3 When log files like config an d security ar e created and /etc/syslog.conf file is modified, an HUP will be sent to the sy stem daemon, Syslogd, by executin g the following commands to make Syslo gd re-read its configuration file /etc/syslog.conf . #ps -ae | grep syslogd 147 #kill -HUP 147 After the above operations, the router ca[...]

94 C HAPTER 6: D ISPLAY AND D EB UGGING T OOLS[...]

7 POS T ERMINAL A CCESS S ERVICE This chapter contains information on the following top ics: ■ POS Access Service Overvi ew ■ POS Access Service Configuration ■ Display and Debug POS Access ■ T ypical Configurat ion Examp le of POS Access Service POS Access Service Overview Point of Sale (POS) service is a type of smart card service widely [...]

96 C HAPTER 7: POS T ERMINAL A CCESS S ERVI CE Figure 40 Dial-up access when the POS access router is located at the commer cial client side Due to the way POS access se rvice usually operates, that is, low speed, high frequency and small traf fic, it is rather sensitive to the dial-up connection time and requir es the interface board for fast dial[...]

POS Access Service Configuration 97 ■ Avoiding the dial-up time problem and fast connecting to the transaction processing center . ■ Reducing the numb er of occupied communication links, hence saving the communications cost greatly . ■ Avoiding the pr oblem of service queuing as it is as though each POS terminal device enjoys a dedicated line[...]

98 C HAPTER 7: POS T ERMINAL A CCESS S ERVI CE If the FCM interface is used as POS access interf ace undo modem cannot be configured. If another in ter face is used as the POS access interface undo modem must be configured. Since POS access does not support flow control, the interface should be configured with t he flow-control none comman d. If th[...]

POS Access Service Configuration 99 POS access does not support flow control, therefore, the interface should be configured with the flow-control none command. 5 Configure POS Multi-Appli cation Map POS multi-application is a kind of POS ac cess function, which sends the packets from a POS terminal devic e to differ ent POS applicati ons accor ding[...]

100 C HAPTER 7: POS T ERMINAL A CCESS S ERVICE implemented otherwise, the system will pr ompt as follows to indicate that the configuration has failed: App-state is wrong . 7 Set the parameters of FCM used during Modem negotiation In the POS access application, the Mod em on the FCM card usually acts as the called party , and the Modem embedded in [...]

Typical Configuration Exam ple of POS Access Service 101 T yp ical Configu ration Example of POS Access Service Configuration Example when the Router is Located at the FEP Side in TCP/IP Mode I. Networking Requirements Three POS te rminals ac cess the Router A located at the FEP side thr ough the FC M card and connect to UNIX A (10.1.1.1) and UNIX [...]

102 C HAPTER 7: POS T ERMINAL A CCESS S ERVICE 9 Configure POS access interface FCM2 [Router] interface fcm2 [Router-FCM2] async mode pos 3 Configuration Example when the Router is Located at the FEP Side in Asynchronous Connection Mode I. Networking Requirements Thr ee POS termina ls acc ess the Router A located at the FEP side through the FCM and[...]

Typical Configuration Exam ple of POS Access Service 103 [Router-FCM2] async mode pos 3 9 Configure Async 0 to operate in POS application mode. [Router] interface async 0 [Router-Async0] undo modem [Router-Async0] flow-control none [Router-Async0] async mode posapp 10 Configure Async 1 to operate in POS application mode. [Router] interface async 1 [...]

104 C HAPTER 7: POS T ERMINAL A CCESS S ERVICE [RouterA] interface async 1 [RouterA-Async1] undo modem [RouterA-Async0] flow-control none [RouterA-Async0] undo detect dsr-d tr [RouterA-Async1] async mode pos 2 f Configure POS access interface 2. [RouterA] interface async 2 [RouterA-Async2] undo modem [RouterA-Async0] flow-control none [RouterA-Asyn[...]

III I NTERFACE Chapter 8 Interface Configuration Overview Chapter 9 Configuring LAN Interface Chapter 10 Configuring W AN Interface Chapter 11 Configuring Logical Interface[...]

106[...]

8 I NTERFACE C ONFIGURATION O VERVIEW This chapter contains information on the following top ics: ■ Interface Configuration Overview ■ Configure Interface ■ Display and Debug Interface Interface Configuration Overview The router interface r efers to the part thr ough which the router exchanges data and interacts with other devices in the ne t[...]

108 C HAPTER 8: I NTERFACE C ONFIGURAT ION O VERVIEW In the 3Com Rout er , the command to enter E1/T1 interface view is controller { e1 | t1 } , which is diff e re n t fr om th e command of other interfaces. Exit the Interface View . In the interface view , in put quit to return to th e system view . Set Interface Description The 3Com Router has a [...]

Display and Debug Interface 109 ■ If a firewall is to be establ ished on this interface, please conf igure parameters about related message filtering or add ress conversion. There ar e lots of parameters to be configured in the interface view . So, this part will mainly introduce configurat ions of some parameters specific to the physical interfa[...]

110 C HAPTER 8: I NTERFACE C ONFIGURAT ION O VERVIEW[...]

9 C ONFIGURING LAN I NTERFACE This chapter contains information on the following top ics: ■ Ethernet Interface Overview ■ Configure Ethernet Interface ■ Display and Debug Ether net Interface ■ T ypical Ether net Interface Configuration Example ■ T r oubleshooting Ether net Interface Overview Ethernet interface of the 3Com Router se ries c[...]

112 C HAPTER 9: C ONFIGURING LAN I NTERFACE Ta b l e 85 Enter view of specified Ether net interface 2 Set network protocol address The 3Com Router supports IP and IPX at Ethernet interface. Therefore, it is necessary to configure IP or IPX network address. Please use the following commands in Ether net interface view . Ta b l e 86 Set IP address Wh[...]

Display and Debug Ethernet Interface 113 V alue r anges and default values of MTUs with different link layer protocol ar e differ ent. When Ether net_II frame format is adopted, MTU value range will be 46-1500 bytes with the default value as 1500 bytes, and when Ether net_SNAP frame format is adopted, MTU value range will be 46-1492 bytes with defa[...]

114 C HAPTER 9: C ONFIGURING LAN I NTERFACE T ypical Ethernet Interface Configuration Example I. Networking Requirement As shown below , the Ethernet int erfaces of Routers A is con nected to IP networks 192.168.0.0. The computer in LAN connects to the Inter net through Router A. Set the MTU of Ether net interface to 1492 bytes, and set the frame f[...]

Troubleshoo ting 115 the party with 10 0 Mbps configuration s hows no connection, while the party with 10 Mbps connect io n sho w s th e co nn ec t i on ha s bee n esta blished. Furthe r mo r e, the activity indicator of the physical layer blin k quickly and messages can not be received or transm itted normally . On checking the connection of fast [...]

116 C HAPTER 9: C ONFIGURING LAN I NTERFACE HUB is connected, all the other devices on the whole network segment will show serious network collisions), while the pa rty working in full duplex mode shows large amount of error messages r eceived , accompanied with serious message losses at both parties. In this case, use display interfaces ethernet c[...]

10 C ONFIGURING WA N I NTERFACE This chapter contains information on the following top ics: ■ W AN Interface Intr oduction ■ Asynchronous Serial Interface ■ AUX Interface ■ Synchronous Serial Interface ■ ISDN BRI Interface ■ CE1/PRI Interface ■ CT1/PRI Interface ■ E1-F Interface ■ T1-F Interface ■ CE3 Interfa c e ■ CT3 Interfa[...]

118 C HAPTER 10: C ONFIGU RING WAN I NTERFACE ■ Set the asynchronous serial interface to work in dialup or dedicated line mode ■ Set link layer pr otocol ■ Set baud rate ■ Set link establishment mode ■ Set the check mode in flow mode ■ Set stop bit in flow mode ■ Set data bit in flow mode ■ Set flow control mode ■ Enable or disabl[...]

Asynchronous Serial Interface 119 instructions in dialup mode. In dedicated line mode, ensure that modem command is not configured, i.e. disable dial with undo modem command. Please use the following commands in the view of asynchronous serial interface. Ta b l e 96 Set the work mode of asynchronous serial interface The asynchr onous serial interfa[...]

120 C HAPTER 10: C ONFIGU RING WAN I NTERFACE Dedicated mode is usually used when as ynchronous serial interfaces are directly connected. ■ Flow: Also cal led the Interactive mo de, which means two ends of the link interact with each other after the set up of a physical conn ection. Th e calling end sends configuration command to the receiving en[...]

Asynchronous Serial Interface 121 When the link establishment mode of async serial interface is flow or TTY , the two ends of the link will interact with each other after the setup of a physical connection. The calling end will send confi guration command to the receiving end and set the interactive parameters of lin k layer pr otoc ol on the r ece[...]

122 C HAPTER 10: C ONFIGU RING WAN I NTERFACE Please use the following commands in the view of the asynchr onous serial interface . Ta b l e 104 Enable or disable the level detection for the asynchronous serial interface By default the level detection is enable d for the asynchronous serial interface. 12 Enable or disable inter nal loopback and ext[...]

Synchronous Serial Interface 123 Configure AUX interface 1 Enter AUX interface view Perform the following configuration in the all views. Ta b l e 108 Enter AUX interface view 2 Configure AUX interface The configuration of AUX interface is basically the same with that of common asynchronous serial interfaces. The following items should be noted: a [...]

124 C HAPTER 10: C ONFIGU RING WAN I NTERFACE ■ Enable or disable level detection ■ Enable or disable data carrier detection ■ Setting the synchronous serial interface to work in full duplex or half duplex mode ■ Enable or disable internal loopback/ext ernal loopback ■ Set MTU ■ Set the time interval for sending ke epalive packets ■ S[...]

Synchronous Serial Interface 125 Perform following commands in synchronous serial interface view . Ta b l e 112 Set the digital signal encoding format of synchronous serial interface By default, the digital signal encoding fo rmat of synchronous serial interface is NRZ. 5 Set baud rate Please use the following c ommand in the vi ew of the synchr on[...]

126 C HAPTER 10: C ONFIGU RING WAN I NTERFACE TxClk stands for transmitting clock, RxClk for receiving clock, the clock before “=” is DTE-side clock, and that b ehind “=” is DCE-side clock. Please use the following commands in the view of the synchronous serial interface . Ta b l e 115 Select work clock The clock of DCE-side synchronous ser[...]

Synchronous Serial Interface 127 Level detection is enabled fo r the sync hronous serial inte rface by default. 9 Enable or disable data carrier detection By default, when the system decides whethe r the synchronous serial interface is in UP status or DOWN status , it detects the DSR signal , DCD signal and whether the interface connects a cable at[...]

128 C HAPTER 10: C ONFIGU RING WAN I NTERFACE 12 Configure MTU MTU of synchronous serial interface af fects the fragme ntation and reassembling of IP network protocol message on this interface. Please use the following commands in the view of the synchronous serial interface . Ta b l e 121 Set MTU of synchronous serial interface The unit of mtu is [...]

ISDN BRI Interface 129 equipment complying with relevant ISDN standard of ITU-T able to access ISDN easily . User -n etwork interface specification of ISDN: In ITU-T I.411 recommendations, refer ence configurations for ISDN user -networ k interfaces are given according to concepts of function group (a gr oup of functions requir ed by users to acces[...]

130 C HAPTER 10: C ONFIGU RING WAN I NTERFACE ■ Whether the interface provided by tele com service provider is ISDN BRI U interface or ISDN BRI S/T interface: In ITU-T I.411 recommendation, the refer ence model of ISDN user -n etwork interface is given. However , ther e is a worldwide dispute about the posit ion of division point between the user[...]

CE1/PRI Interface 131 ■ When the interface is used as a CE1 inte rface, all the timeslots except timeslot 0 can be divided into multiple channel se ts at will, and each gr oup can be used as an interface upon timeslot binding. Its logic feature is the same as that of a synchronous serial interface. It supports the data link layer pr otocols, such[...]

132 C HAPTER 10: C ONFIGU RING WAN I NTERFACE Ta b l e 127 Enter the synchronous serial interface view The following ar e to be set: ■ Operating parameters of data link laye r protocol, such as PPP , Frame Relay , LAPB or X.25. ■ IP address ■ The operating par ameters of the standb y cent er need to be set when the interface serves as the mai[...]

CE1/PRI Interface 133 ■ The rules for address translation or packet f iltering need to be set if the firewal l is to be set up on the interface. For more details, r efer to the related sections of this manual. 4 Bind an interface to be a pri set Perform the following configurations in CE1/PRI interface view . Ta b l e 130 Bind the interface to be[...]

134 C HAPTER 10: C ONFIGU RING WAN I NTERFACE Ta b l e 132 Set the line code format on the CE1/PRI interface By default, the line code form at on the CE1/PRI interface is hdb3 . 6 Set line clock When the CE1/PRI in terface operate s as DCE, you should choose the interna l clock, that is, master clock mode. When it operates as DTE, you should choo s[...]

CT1/PRI Interface 135 By default, the functions of inter nal lo opback and external loopback are disabled on the CE 1/PRI inte rface. Display and Debug CE1/PRI Interface Perform the following configurations in all views to display the status and related information of the CE1/PRI interface, so as to monitor and maintain it. Ta b l e 136 Display and[...]

136 C HAPTER 10: C ONFIGU RING WAN I NTERFACE ■ Bind the interface to be a pri set ■ Set the length/attenuation of the transmission cable ■ Set the line code format ■ Set line clock ■ Set frame format ■ Enable/disable internal lo opb ack/external loopback 1 Enter the view for a specified interface In system view , use the following comm[...]

CT1/PRI Interface 137 ■ The rules for address translation or packet f iltering need to be set if the firewal l is to be set up on the interface. For more details, r efer to the related sections of this manual. 3 Bind an interface to be a pri set Perform the following configurations in CT1/PRI interface view . Ta b l e 140 Bind the interface to be[...]

138 C HAPTER 10: C ONFIGU RING WAN I NTERFACE By default, the a ttenuation of trans mission cabl e that the CT1/PRI interface matches is long 0db . 5 Set the line code format A CT1/PRI interface supports two types of line code formats: ami format and b8zs format. Perform the following configuratio ns in CT1/PRI interface view . Ta b l e 143 Set the[...]

E1-F Interface 139 By default, the frame format of CT1/PRI interface is ESF . 8 Enable/disable internal loopback/exter nal loopback The interface needs to be set to internal loopback or exter nal loopback wh en during the test on some special functions. Perform the following configurations in CT1/PRI interface view . Ta b l e 146 Enable/disable the[...]

140 C HAPTER 10: C ONFIGU RING WAN I NTERFACE supporting the data link layer protocols PPP , HDLC, Frame Relay , LAPB and X.25, as well as the network pr otocols IP and IPX. When it works in framed mode , however , it is physically divided into 32 time slots numbered in the range of 0 to 31. In these time slots, except for time slot 0 used for sync[...]

E1-F Interface 141 Perform the following configuration in E1-F interface view . Ta b l e 150 Set interface rate after binding operation By default, binding operation will be done on all the ti me slots on E1-F interface. Ti me sl ot 0 on E1 -F in te r fa ce is us e d for synchro nization information transmission. Therefore, in practice, only time s[...]

142 C HAPTER 10: C ONFIGU RING WAN I NTERFACE Ta b l e 153 Set frame format for an E1-F interface By default, the frame fo rmat of E1-F inter face is no-CRC4. 7 Enable or Disable Local Loopback/Remote Loopback An interface should be place in local loopback or r emote loopback for some special functionality tests. Perform the following con figuratio[...]

T1-F Interface 143 T1-F Interface T1-F interface is fractional T1 interface, and it is r esp ectively simplified CT1/PRI interface. If there is no need to use mu ltiple channel sets or if ISDN PRI is not necessary in an T1 application, it is too much to use CT1/PRI interface. At this time, T1-F interface is more than enough for meeting the simple T[...]

144 C HAPTER 10: C ONFIGU RING WAN I NTERFACE module in slot 2. Hence, the E1-F interf ace will be numbered Serial 0, and the 4SA interfaces will be number ed Serial 1 through Serial 4, an d the T1-F interfaces will be numbered Serial 5 and Serial 6. 2 Set Interface Rate a fter Binding Operation When T1-F interface works in fr amed mode , time s lo[...]

T1-F Interface 145 If T1-F interface is used as DCE, the slave clock should be selected. If it is used as DTE, the master clock should be selected. If the T1-F interfaces of two routers ar e di rectly connected, they must re spectively work in slave and master clock modes. If the T1-F in terface of th e router is connected to an exchange, however ,[...]

146 C HAPTER 10: C ONFIGU RING WAN I NTERFACE Display and Debug T1-F Interface Perform the display command in all views to displa y the state of T1-F interface and other related informatio n. Ta b l e 163 Display and debug T1-F interface CE3 Interface Both E3 and E1 belong to ITU-T digital carr ier system and are used in most areas outside th e Nor[...]

CE3 Interface 147 Ta b l e 164 Enter the view of the spec ified E3 interface 2 Set Clock Mode of CE3 Interface Perform the following configuration in CE3 interface view . Ta b l e 165 Set clock mode of the CE3 interface By defaul t, CE3 inte rface uses slave clo ck. The user can also set clock mode for E1 chann els of CE3 interface. Ta b l e 166 Se[...]

148 C HAPTER 10: C ONFIGU RING WAN I NTERFACE If framing has been enabled on an E1 chann el, you can set its frame format. Perform the following configuration in CE3 interface view . Ta b l e 170 Set E1 frame forma t By default, the frame fo rmat of E1 channel is no-crc4 . 6 Configure Operating Mode of CE3 Interface When setting the operating mode [...]

CT3 Interface 149 Display and Debug CE3 Interface The display and debug operat ions of CE3 in terface include d isa bling interface and displaying interface information. But y ou should be careful when using the shutdown command, because disabling an in terface will cause the interface to stop working. Perform the following configuration in all vie[...]

150 C HAPTER 10: C ONFIGU RING WAN I NTERFACE ■ Set CRC of the Serial Interface Depending on the networ king requir ements, the user p erhaps needs t o configure the parameters such as PPP , Frame Relay and IP addr ess for the CT3 interface. For details, r efer to the involving chapters. 1 Enter the vie w of the specified CT3 interface CT interfa[...]

CT3 Interface 151 Ta b l e 178 Set loopback mode of the CT3 interface Differ ence between two types of exter nal loopback o f the CT3 interf ace: Frame header overhead should be proce ssed for extern al payload loopb ack ( payload ) while frame is not processed for exter nal remote loopback ( rem o t e ). By default, loopback is disabled. Single-ch[...]

152 C HAPTER 10: C ONFIGU RING WAN I NTERFACE By default, CT3 mode is used. When CT3 interface works in T3 mode, the system will automatically create a serial interface whose number is serial number /0:0 and whose rate is 44.736Mbps. The interface has the same lo gic featu re as that of a synchr onous serial interface; therefore, it can be re gar d[...]

CT3 Interface 153 Ta b l e 185 Disable and Enabl e CT3 interface The enabling/disabling operatio n done on the CT3 interface takes effect on CT3 interface, the T1 channels and the se rial interfaces formed through binding operation. Th e enabling/disabling operation done on the T1 interface takes effect on T1 interface and the serial interf aces fo[...]

154 C HAPTER 10: C ONFIGU RING WAN I NTERFACE[...]

11 C ONFIGURING L OGICAL I NTERFACE This chapter contains information on the following top ics: ■ Logical Interface Introduction ■ Dialer Interface ■ Loopback Interface ■ Null Interface ■ Sub-Interface ■ Standby Center Logic Channel ■ Virtual-T emplate and Virtual Interface Logical Interface Introduction The logical interface r efers [...]

156 C HAPTER 11: C ONFIGU RING L OGICAL I NTERFACE Some applications (such as configuring local peer of SNA) requir es that a local interface with specified IP address should be configured without af fecting physical interfa ce co nf ig u r at io n. Furthermor e, this addr ess should have a 32 - b it mask to reduce the use of IP addr esses and it s[...]

Sub-Interface 157 Any packet reaching the null i nterface w ill be dropped, which provides another method for packet filtering: Just sendi ng unnecessary netwo r k traffic to Null0 interface, so that there is no need to configur e ACL. For example: Use static routing configuration command ip route-static 192.101.0.0 255.255.0.0 null 0 will dr op al[...]

158 C HAPTER 11: C ONFIGU RING L OGICAL I NTERFACE Configure sub-interfaces of Ethernet interface 1 Create and delete Ethernet sub-interfaces Please use the following commands in all views. Ta b l e 190 Create and delete Ether net interface When using the abo ve commands, if corresponding Ethernet sub-interface h as been created (the same as sub-nu[...]

Sub-Interface 159 ■ IPX network number which is dif feren t from that of the af filiated W AN interface, and other IPX working paramet ers ■ Virtual circuit of the sub-interface Please see chapters in Operation Manual - Link Layer Protocol and Operation Manual - Network Protocol for details about the above configurations. Configure su b-interfa[...]

160 C HAPTER 11: C ONFIGU RING L OGICAL I NTERFACE [Router-Serial0] link-protocol fr 3 Specify DTE as its fra me r elay terminal ty pe [Router-Serial0] fr interface-type dte 4 Create sub-interface Serial 0.1 on W AN in terface Serial0 of router A in point-to point mode, and enter it s view [Router] interface serial 0.1 point -to-point 5 Set its IP [...]

Virtual-Template and Virtual Interface 161 dynamically cr eate a virtual interface based on the config uration parameters of the template. Similarly , after multiple PPP links ar e bound as MP , a virtual interface also needs to be created to exchange data with the opposite end. At this time, select an interface template to dynamica lly create a vi[...]

162 C HAPTER 11: C ONFIGU RING L OGICAL I NTERFACE 3 Create corr esponding relation between the virtual-template a nd related physical interface In VPN application environment, it is nece ssary to build up corresponding relations between L2TP group and virtua l-template. In MP application environment, it is necessary to build up corresponding relat[...]

IV L INK L AYER P RO T O C O L Chapter 12 Configuring PPP and MP Chapter 13 Configuring PPPoE Client Chapter 14 Configuring SLIP Chapter 15 Configuring ISDN Protocol Chapter 16 Configuring LAPB and X.25 Chapter 17 Configuring Frame Relay Chapter 18 Configuring HDLC Chapter 19 Configuring Bridge[...]

164[...]

12 C ONFIGURING PPP AND MP This chapter contains information on the following top ics: ■ PPP Overview ■ MP Overview ■ Configure PPP ■ Configure MP ■ Display and Debug PPP ■ T ypical PPP Configuration Example ■ T ypical MP Configuration Example ■ Fault Diagnosis and T r oubleshootin g of PPP PPP Overview The Point-to-Point Protocol ([...]

166 C HAPTER 12: C ONFIGU RING PPP AND MP The authenticator sends some rand omly generated packets to the requester (challenge), and at the same time it sends its configured username to the req u es t e r . When the requester receives the challenge, it will look for the user password according to the authenticator's u ser name and its own user[...]

MP Overview 167 Figure 49 Diagram of PPP negotiation phases For detailed description of PPP , refer to RFC1661. MP Overview MP protocol (PPP Multilink protocol) can bi nd multiple PPP links, so as to increase bandwidth. MP protocol can fragment la rge packets , and then the fragmentation will be sent to the same de stination thr ough differ ent PP [...]

168 C HAPTER 12: C ONFIGU RING PPP AND MP Ta b l e 194 Configure the link layer protocol of the interface to PPP The default link layer protocol of the interface is PPP . 2 Configure PPP Authentication PPP has two authentication modes: P AP mo de and CHAP mode. CHAP authentication is more secure. ■ Configure P AP authentication a Configure the au[...]

Configure PPP 169 Ta b l e 197 Configure the local authenticates the peer in CHAP mode b Configure the r equester of CHAP authentication Perform the following configuration in the interface view , and use the local-user command in the system view . Ta b l e 198 Configure as the peer authenticates the local in CHAP mode Generally , when the router c[...]

170 C HAPTER 12: C ONFIGU RING PPP AND MP Whether the PPP user passes th e authentica tion will be finally decided by AAA, which can authen ticate PPP user at local o r at RADIUS server . Local authentication is to authenticate the local user configured through the local-user user password { simple | cipher } password command, and RADIUS server aut[...]

Configure MP 171 In MP working mode, it is not recommended to use PPP compress ion. T o configure PPP compression negotiation on the virtual interface, PPP compr ession must be configured on Virtual-template interface before the subordinate p hysical interface can accept the PPP compression neg otiation. 6 Configure PPP Link Quality Monitoring PPP [...]

172 C HAPTER 12: C ONFIGU RING PPP AND MP ■ Configure MP Protocol Parameters 1 Cr eate Virtual T emplate Ta b l e 203 Create/Delete virtual template 2 Configure Operating Parameters of Virtual T emplate Comparing virtual template interface wi th general physical interface, users can find that the link layer protocol suppo rts only PPP and the net[...]

Configure MP 173 ■ Bind accor ding t o use rname or en dp o i n t Here the username refers to the received remote username when PPP link performs P AP or CHAP authentication. En dpoint is the unique mar k of a router and refers to the r eceived r emote endpoint when performing LCP negotiation. The system can implement MP binding ac cording to the[...]

174 C HAPTER 12: C ONFIGU RING PPP AND MP By default, the maximum link numb er of links that MP channel permits to bind is 16. b Configure the maximum number of fragments r eceived by MP channel Ta b l e 209 Configure the maximum number of fragments received by MP channel By default, the maximum number of fr agment s that MP channel permits to rece[...]

Display and Debug PPP 175 By default, virtual Baud rate is not set on interface. Display and Debug PPP Please use the disp lay and debugging commands in all views. Ta b l e 212 Display and debug PPP T y pical PPP Configuration Example P AP Authentication Example I. Configuration Requirement As shown in Figure 50 , Router1 and Router2 are interconne[...]

176 C HAPTER 12: C ONFIGU RING PPP AND MP II. Configuration Procedur e 1 Configure Router1: a Add a user with name Router2 and pa ssword hello to the local database [Router] local-user Router2 passwor d simple hello b Set local username as Router 1 [Router] interface serial 0 [Router-Serial0] ppp chap user Rout er1 c Configure to start CHAP authent[...]

Typical MP Configuration Example 177 [Router] local-user router-c password si mple router-c b Specify the virtual interface templa tes for the two users and begin PPP negotiation for the NCP informatio n using this template [Router] ppp mp user router-b bind virtu al-template 1 [Router] ppp mp user router-c bind virtu al-template 2 c Configure virt[...]

178 C HAPTER 12: C ONFIGU RING PPP AND MP [Router] interface serial2: 1 [Router-Serial2:1] ppp mp [Router-Serial2:1] ppp authenticati on-mode pap [Router-Serial2:1] ppp pap local-us er router-c password simple router-c Fault Diagnosis and T roubleshooting of PPP Fault 1: Link always fails to turn to up status. T roubleshooting: It is possible that [...]

13 C ONFIGURING PPP O E C LIENT This chapter contains information on the following top ics: ■ PPoE Overview ■ Configure PPPoE Clie nt ■ Display and Debug PPPoE Client ■ T ypical PPPoE Co nfiguration Example PPoE Overview Point-to-Point Pr otocol over Ethernet (PPP oE) can be used for connec ting Ethe rnet hosts to a remote access concentrat[...]

180 C HAPTER 13: C ONFIGU RING PPP O E C LIENT implement the client dial-up function of PP Po E), so the subscribers can access the Internet w ithout installing a PPPoE client software on PCs. Furthermore, all the PCs on the same LAN can share an ADSL account. Figure 52 Networking for PPPoE As shown in the above figure, the PCs on an Ethernet are c[...]

Configure PPPoE Client 181 Depending on the n eeds, it is probably re quired to configure the parameters such as PPP authentication on a dialer interfac e. The dialer interf ace configuration will not be covered in this sect ion, however . Please see Operation Manual - Dial-up for ref e re nc e . 2 Configure PP PoE Se ssion Perform the following co[...]

182 C HAPTER 13: C ONFIGU RING PPP O E C LIENT Regardless of whether a PPPoE session is permanent or packet-triggered, executing the undo pppoe-client command will permanently delete the session. Hence, you need to make r econfiguratio n for establishing a new PPPoE session. Display and Debug PPPoE Client Perform the display and debugging command i[...]

Typical PPPoE Configuration Example 183 [Router-Dialer1] ip ppp-negotiate [Router-Dialer1] ppp pap local-user 3com password cipher 12345 2 Configure a PPPoE se ssion [Router] interface ethernet 1 [Router-Ethernet1] pppoe-client dial-bundle-numb er 1 3 Configure the LAN interface and the default r oute [Router] interface ethernet 0 [Router-Ethernet0[...]

184 C HAPTER 13: C ONFIGU RING PPP O E C LIENT[...]

14 C ONFIGURING SLIP This chapter contains information on the following top ics: ■ SLIP Overview ■ Configure SLI P ■ Display and Debug SLIP ■ T ypical SLIP Configuration Example SLIP Overview SLIP (Serial Link Internet Protocol) can transmit data ov er the asynchronous serial link. Through SLIP , the user can dial up to access the Internet.[...]

186 C HAPTER 14: C ONFIGU RING SLIP By default, the synchronous/asynchronous se rial interface operates in synchronous mode 2 Configure the link layer pr otocol of the interface to SLIP Perform the following task in the asynchronous interface view . Ta b l e 218 Configure the link layer protocol of the interface to SLIP By default, the link layer p[...]

Typical SLIP Configurati on Example 187 III. Configuration Procedur e 1 Configure Router A: a Configure Dialer Rule [Router] dialer-rule 1 ip permit b Configure the synchronous/asynchr onous interface to asynchronous mode [Router] interface serial 0 [Router-Serial0] physical-mode async c Configure IP addr ess of synchr onous/asynchronous interface [...]

188 C HAPTER 14: C ONFIGU RING SLIP [Router] ip route-static 0.0.0.0 0.0.0.0 10.110.0.1[...]

15 C ONFIGURING ISDN P RO T O C O L This chapter contains information on the following top ics: ■ ISDN Overview ■ Configure ISDN ■ Display and Debug ISDN ■ T ypical Configurat ion Examp le ■ Fault Diagnosis and T r oubleshootin g of ISDN ISDN Overview ISDN (Integrated Services Digital Network), de veloped from tele phone integrated digita[...]

190 C HAPTER 15: C ONFIGU RING ISDN P ROTOCOL ■ Set the called nu mb er or sub -a d dr ess to be checked in digital incoming call 1 Configure ISDN Signal ing T ype Perform the following configuration s in either system view or inter face view . Ta b l e 220 Configure type of signaling on ISDN interface By default, DSS1 si gnaling is used on ISDN [...]

Configure ISDN 191 When a router originates a call to PBX, it usually contains all called number information in the SETUP message . However , you can configure the command to determine whether th e Sending Se nding-Co mplete Information Element (SCIE) should be c arried in the SETUP message . Perform the following configurations in interface view .[...]

192 C HAPTER 15: C ONFIGU RING ISDN P ROTOCOL Configur e ISDN DoV ISDN call includes voice call and digital call. Dif fer ent communi cati on mode ma kes differ ent calls. In common cir cumstances, users initiate voice call when making voice commun ication and initiate digit al ca ll when making data transmission. ISDN DoV (Data over V oice) can fi[...]

Typical Configur ati on Example 193 T ypical Configuration Example Interconnect Rou ters for Data T ransmission via ISDN PRI Line I. Networking Requirement Router A is connected with router B via W AN, as shown in the following diagram. II. Networking Diagram Figure 56 Networking diagram of ISDN pr otocol configuration example III. Configuration Pr[...]

194 C HAPTER 15: C ONFIGU RING ISDN P ROTOCOL II. Networking Diagram Figure 57 Networking for ISDN DoV III. Configuration Procedu re 1 Configure Router A: [Router] dialer-rule 1 ip permit [Router] interface bri 0 [Router-Bri0] ip address 100.1.1.1 255.255.255.0 [Router-Bri0] dialer-group 1 [Router-Bri0] dialer route ip 100.1 .1.2 8810148 [Router-Br[...]

16 C ONFIGURING LAPB AND X.25 This chapter contains information on the following top ics: ■ X.25 and LAPB Protocols Overview ■ Configure LAPB ■ Configure X.25 ■ Configure X.25 over Other Protocols ■ Display and Debug LAPB and X.25 ■ T ypical LAPB Configurat io n Example ■ T ypical X.25 Configu rat ion Example ■ Fault Diagnosis and T[...]

196 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Figure 58 X.25 network model The X.25 protocol suite maps to the lowe st three layers of the OSI (Open System Interconnection) refer ence model. The fo llowing protocols are typically used in X.25 implementations: Pac ket-Layer Protocol (PLP), Link Access Procedure Balanced (LAPB), and other physical-la [...]

X.25 and LAPB Protocols Overview 197 Once a virtual circuit is established between a pair of DTEs, it is assigned with a unique virtual circuit number . When one DTE is to send a packet t o the other , it numbers this pack et (wi th vi r tua l circui t nu mb e r) and sends it to DCE. Accor ding to the number on the packet , DCE determines the metho[...]

198 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Figure 61 Relations among LAPB, X.25 and X.25 switching Configure LAPB LAPB configuration includ es: ■ Configure the link pr otocol of the interface to LAPB ■ Configure LAPB pr otocol parameters 1 Configure the Link Layer Protocol of the Interface to LAPB Perform the following command in the interfac[...]

Configure X.25 199 N1 value r epresents the maximum number bits of I frame that DCE or DTE wants to receive fr om DTE or DCE. N2 value r epresents the maximum number of times that DCE or DTE tries to successfully send a frame to DTE or DCE. Ta b l e 232 Configure LAPB N1, N2 By default, n1 is 12032, and n2 is 10. d Configure LAPB T1, T2, T3 LAPB T1[...]

200 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Configure X.25 Interface The configuration of X.2 5 interface includes: ■ Configure X.121 address ■ Configure X.25 working mode ■ Configure X.25virtual circuit range ■ Configure X.25 modulo ■ Configure X.25 default flow control parameter Only when configured as an X.25 interfa ce, can an interf[...]

Configure X.25 201 X.25 protocol can multiplex multiple virtual conne ction over a real physical link between DTE and DCE, also called virt ual ci rcuit (VC) or logical channel (LC). X.25 can establish up to 4095 virtual connections numbered from 1 to 4095. The number that can be e mployed to identi fy ea ch virtual circuit (or logic al channel) is[...]

202 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Ta b l e 237 Set/cancel X.25 virtual circuit range The above shows that each section (except the permanent virtual circuit section) is defined by two parameters: upper limit an d lower limit, the value of which ranges between 1 and 4095 (including 1 and 4095 ). Correct configuration must satisfy the foll[...]

Configure X.25 203 end-to-end is affected, that is, the effici ency between t w o set s of c ommunicatin g DTE increases. 5 Configure X.25 flow contro l parameter It is essential to set corr ect default flow control pa rameters (window size and packet size) for the operation of the link because X.25 protocol is good at traffic control. However , mo[...]

204 C HAPTER 16: C ONFIGU RING LAPB AND X.25 ■ Prohibit the r estart of X.25 layer 3 It is necessary to config ure certain supple mentary X.25 paramete rs in some special network environments. 1 Configure the delay of X.25 layer 3 timer X.25 protocol defines a series of timers to facilitate its procedure. After X.25 sends a control packet, if it [...]

Configure X.25 205 of a call that reaches X.25 interface may be inconsistent with X.121 address of the destination interface (because th e de stination address of this call is modified within the network), still th e interface will accept this call. At thi s time, one or multiple aliases should be specified for th is interface by performing the fol[...]

206 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Ta b l e 244 Configure/Cancel the attributes related to the addr ess code block in the call packet or call accept packet 4 Configure default upper layer protocol X.25 call r equest packet incl udes a CUD field (Call Us er Data), which shows the upper layer protocol type X.25 pr otocol carries. When recei[...]

Configure X.25 207 Configur e X.25 Datagram T ransmission The configuration of X.25 data gram tr ansmission includes: ■ Create the mapping fr om the pr otocol address to X.121 addr ess ■ Create the permanent virtual circuit In the most frequently used X.25 service, data is transmitted remotely between two hosts using the X.25 protocol via X.25 [...]

208 C HAPTER 16: C ONFIGU RING LAPB AND X.25 process and it always exists. An addr ess ma pping will be created implicitly while a permanent virtual circuit is cr eated. T o create/delete a permanent virtual circ uit, perform the following tasks in interface view . Ta b l e 247 Create/Delete permanent virtual circuit The format of this command show[...]

Configure X.25 209 Ta b l e 248 Specify/Cancel SVC maximum idle time By default, the value of SVC maximum idle time is 0 minute, which means this SVC will not be disconnected for idle times out. 2 Configure the maximum number of SVCs that ar e associated with the same address mapping The maximum number of virtual circuits to be set up on the same a[...]

210 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Ta b l e 250 Specify/Cancel packet pre-acknowledgement By default, the number of pr e-acknowledged pa ckets is 0. 4 Configur e X.25 user facil ity X.25 pr otocol defines various user fa cility options. The user can choose and configure the facilities. These configurations can be modified in two ways: Con[...]

Configure X.25 211 window-size and packet-size options are also supported in x25 pvc command. However , in x25 pvc command, these two options specify the window size and maximum packet length of the set PVC. If these two options are not selected in the x25 pvc command, the set PVC will choose the default value of X.25 interface. name is the name of[...]

212 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Generally , inter -network protocols will ne ed to send some broadcast datagrams for specific purposes. On the broadcasting physical networks (s uch as Ethernet ), such requir ement s are naturally supported. But for non-broadcasting networks like X.25, how to realize the broadcasting? The X.25 of the 3C[...]

Configure X.25 213 Configur e X.25 Sub-Interface X.25 sub-interface is a virtual interface with its own protocol address and virtual circuit. Multiple sub-interf aces can be created on a physical interface, so the networks can be interconnected via one physical interface. The sub-in terface of X.25 falls into two types: point-to-point s ub-inter fa[...]

214 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Figure 64 X.25 switching networking diagram 1 Enable or disable X.25 switching In the system view , perform the following task to enable or disable X.25 switching. Ta b l e 257 Enable or disable X.25 switching Add or delete a PVC route Ta b l e 258 Add or delete a PVC route After configuration, the displ[...]

Configure X.25 215 which guarantees no occurrence of link over load when an address is accessed by a large number of su b s cr ib er s. X.25 load balancing is provided by DCEs. In order to implement the load balancing in X.25 networks, a group of DTE/DCE interfaces (synchronous serial interfaces o r XOT T un nels) need to be configured at the remot[...]

216 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Figure 65 Diagram of X.25 network load balancing As shown in the above figure, Server A and Server B concurrently provide subscribers with identical services. They are configur ed as a hunt group named hg1. Server A and Server B have the sa me addr ess of 9999 and the hunt group address is 8888. Enable t[...]

Configure X.25 217 DCE equipment in X.25 networks to provid e the function of load balancing for DTE equipment) then configuration of X.25 load balancin g needs to be made on the routers. The main configuration tasks of X.25 load balancing are as follows: ■ Start X.25 switching ■ Create X.25 hunt group ■ Add interfaces an d XOT T unnels to hu[...]

218 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Ta b l e 263 Add/Delete X.25 switching route whose forwarding addr ess is hunt gr oup 5 Configure other X.25 switching routes Ta b l e 264 Add/delete other X.25 switching routes Configure X.25 over Other Protocols Configur e X.25 over TCP (XOT) Introduction to XOT Pr otocol XOT (X.25 Over TCP) is a proto[...]

Configure X.25 over Other Protocols 219 protocol pr ovides reliable data transmi ssion link. Because TCP has the mechanism of error r e dir ection and window flow cont rolling to guarantee the r eliability of links, it can be used by X.25. XOT builds a TCP tunne l connection between the two X.25 networks, and the X.25 packets are supported by TCP a[...]

220 C HAPTER 16: C ONFIGU RING LAPB AND X.25 Ta b l e 265 Start X.25 switching 1 By default, do not start X.25 switch. 2 Configure IP side interface Because the XOT implements the connection of two X.25 nets thr ough IP net, first you should ensure that the IP net is exped ite. For the specific config uration, refer to chap ters of Operation Manual[...]

Configure X.25 over Other Protocols 221 Ta b l e 268 Configure PVC XOT switching 5 Configure Keepalive and xot-source attributes After the TCP link is established, TCP will not be easily cleared even if the link is disconnected. But after configuring Keepalive, the router will send checking packets in time to check the usability of the link. If it [...]

222 C HAPTER 16: C ONFIGU RING LAPB AND X.25 When configuring an Annex G DLCI, the user must explicitly configure it with the argument DCE or DTE . In addition, the configurations on the routers of a connection should not be the same. That is, if a router is configured to work as DTE, the other router must be configured as DCE. Ta b l e 271 Configu[...]

Display and Debug LAPB and X.25 223 By default, X.25 template is not applied on DLCIs. Display and Debug LAPB and X.25 In the all views, perform the following tasks to enable real-time monitoring of the current status of LAPB a nd X.25. Ta b l e 273 Display and debug LAPB and X.25 Ty p i c a l L A P B Configuration Example I. Networking Requirement[...]

224 C HAPTER 16: C ONFIGU RING LAPB AND X.25 [Router-Serial0] lapb module 128 [Router-Serial0] lapb window-size 1 27 2 Configure Router B: a Select interface [Router] configure [Router] interface serial 1 b Specify IP address for this interface [Router-Serial1] ip address 202.38. 160.2 255.255.255.0 c Configure the link layer pr otocol of the inter[...]

Typical X.25 Configuration Example 225 e Specify address mapping to the peer [Router-Serial0] x25 map ip 202.38.160.2 x121-address 20112452 f As this is a direct conn ec tion, the flow contr ol paramete rs ca n be incre ase d slightly [Router-Serial0] x25 packet-size 1024 10 24 [Router-Serial0] x25 window-size 2 Configure Router B: a Select interfa[...]

226 C HAPTER 16: C ONFIGU RING LAPB AND X.25 II. Networking Diagram Figure 69 Connect the router to X.25 public packet network III. Configuration Procedu re 1 Configure Router A: a Configure interface IP addr ess [Router] interface Serial 0 [Router-Serial0] ip address 168.173 .24.1 255.255.255.0 b Connect to public packet network, make the router a[...]

Typical X.25 Configuration Example 227 [Router-Serial0] x25 map ip 168.173.24.1 x121-address 30561001 [Router-Serial0] x25 map ip 168.173.24.2 x121-address 30561002 Configure Virtual Cir cuit Range I. Networking Requirement The link layer protocol of router's interfac e Serial0 is X.25l, with the virtual cir cuit range: permanent virtual circu[...]

228 C HAPTER 16: C ONFIGU RING LAPB AND X.25 [Router-Ethernet0] ip address 196.2 5.231.1 255.255.255.0 [Router-Ethernet0] interface serial 0 [Router-Serial0] ip address 192.149.13.2 255.255.255.0 [Router-Serial0] link-protocol x25 [Router-Serial0] x25 x121-address 1 004358902 [Router-Serial0] x25 vc-range bi-ch annel 8 1024 [Router-Serial0] x25 pvc[...]

Typical X.25 Configuration Example 229 II. Networking Diagram Figure 72 Diagram of X.25 sub-interface configuratio n III. Configuration Procedur e 1 Configure Router A: [Router] interface serial 0 [Router-Serial0] link-protocol x25 dte [Router-Serial0] x25 x121-address 100 [Router-Serial0] interface serial 0.1 a Create sub-interface serial 0.1 [Rou[...]

230 C HAPTER 16: C ONFIGU RING LAPB AND X.25 SVC Application of XOT I. Networking Requirement Router B and C connect through Ethernet interface, and build TCP connection between them. X.25 packets for w ard through TCP , and configu re SVC to implement the SVC function. II. Networking Diagram Figure 73 SVC application networking diagram of XOT III.[...]

Typical X.25 Configuration Example 231 4 Configure Router C a Start X.25 switching [Router] x25 switching b Configure X.25 local switching [Router] x25 switch svc 2 interface seri al 0 c Configure XOT switching [Router] x25 switch svc 1 xot 10.1.1.1 d Configure Ethernet 0 [Router] interface ethernet 0 [Router-Ethernet0] ip address 10.1.1.2 2 55.0.0[...]

232 C HAPTER 16: C ONFIGU RING LAPB AND X.25 [Router-Serial0] x25 x121-address 2 [Router-Serial0] x25 x25 vc-range i n-channel 10 20 bi-channel 30 1024 [Router-Serial0] x25 pvc 1 ip 1.1.1 .1 x121-address 1 [Router-Serial0] ip address 1.1.1.2 255.0.0.0 3 Configure Router B a Start X.25 switching [Router] x25 switching b Configure Ether net 0 [Router[...]

Typical X.25 Configuration Example 233 II. Networking Diagram Figure 75 Networking diagram of typical configuration of X.25 hunt gr oup III. Configuration Procedur e 1 Configure RouterA a Configure the link layer pr otocol of interface Serial1 to X.25 and specify it to operate in DCE mode . [Router] interface serial 1 [Router-Serial1] link-protocol[...]

234 C HAPTER 16: C ONFIGU RING LAPB AND X.25 [Router] interface serial 0 [Router-Serial0] link-protocol x25 dte [Router-Serial0] x25 x121-address 8 888 The configurations o f RouterC and RouterE are identica l with the configu ration of RouterB 3 Configure RouterD a Configure link layer protocol of interface Serial 0 to X.25 and specify it to opera[...]

Typical X.25 Configuration Example 235 Note that you must configure a virtual IP address and two static r outes on interface Serial 1 to deceive the router because two lines conne ct ed to the same peer exist in router RouterC. Thus load balancing can be achi eved b ecause router RouterC will deem that t here ar e two r outes connected to n etwork [...]

236 C HAPTER 16: C ONFIGU RING LAPB AND X.25 [Router-Serial1] x25 x121-address 3 333 [Router-Serial1] ip address 2.1.1.3 255.255.255.0 [Router-Serial1] x25 map ip 1.1.1.1 x121-address 1111 [Router-Serial1] x25 map ip 2.1.1.1 x121-address 1111 [Router-Serial1] x25 map ip 1.1.1.2 x121-address 2222 [Router-Serial1] x25 map ip 2.1.1.2 x121-address 2222[...]

Typical X.25 Configuration Example 237 [Router-fr-dlci-100] x25-template profil e1 [Router-fr-dlci-100] quit i Map the Frame Relay address to the destination IP address. [Router-Serial1] fr map ip 202.38.163.25 2 100 2 Configure RouterB: a Create an X.25 template. [Router] x25 template profile1 b Configur e the loca l X.25 addr ess. [Router-x25-pro[...]

238 C HAPTER 16: C ONFIGU RING LAPB AND X.25 II. Networking Diagram Figure 78 Networking for the SVC application of X.25 over Frame Relay III. Configuration Procedu re 1 Configure the r outer Router A: a Configure the basic X.25 parameters. [Router] interface serial 0 [Router-Serial0] link-protocol x25 dte ietf [Router-Serial0] x25 x121-address 1 [[...]

Typical X.25 Configuration Example 239 [Router] x25 switch svc 1 interface seri al 0 g Configure X.25 over Frame Relay switch ing. [Router] x25 switch svc 2 interface seri al 1 dlci 100 4 Configure the router Router C: a Enable X.25 switching. [Router] x25 switching b Configure Seria l 0 as the X.25 interface. [Router] interface serial 0 [Router-Se[...]

240 C HAPTER 16: C ONFIGU RING LAPB AND X.25 [Router-Serial0] x25 x121-address 1 [Router-Serial0] x25 vc-range in-ch annel 10 20 bi-channel 30 1024 [Router-Serial0] x25 pvc 1 ip 1.1.1 .2 x121-address 2 [Router-Serial0] ip address 1.1.1.1 255.0.0.0 2 Configure Router D: a Configure the basic X.25 parameters. [Router] interface serial 0 [Router-Seria[...]

Fault Diagnosis and Troubl eshooting of LAPB 241 [Router-x25-profile1] x25 vc-range in-ch annel 10 20 bi-channel 30 1024 [Router-x25-profile1] x25 pvc 1 interfac e serial 0 pvc 1 5 Configure Se ria l 1. a Configure S1 as the Frame Relay interface. [Router] interface serial 1 [Router-Serial1] link-protocol frame-rel ay b Configure a Frame Relay Anne[...]

242 C HAPTER 16: C ONFIGU RING LAPB AND X.25 ■ Facility options inhibited by network have been carried. T roubleshooting: if the address is configur ed incorrectly , chang e the configuration. For the last two causes, please consult the network management department fo r correct channel range and pe rmissible facility options. Fault 3: The virtua[...]

Fault Diagnosis and Troubleshooting of X.25 243 ■ If receiving the ping packet forwarded fr om the router at one end, check whether the returning route has been configured in the r outing table. In addition, if the destination IP address for r eturning the packets is different fr om that configured in the Frame Relay address map and X.25 address [...]

244 C HAPTER 16: C ONFIGU RING LAPB AND X.25[...]

17 C ONFIGURING F RAME R ELAY This chapter contains information on the following top ics: ■ Frame Relay Protocol Overview ■ Configure Frame Relay ■ Configure Frame Relay QoS ■ Configure Frame Relay over Other Protocols ■ Display and debug Frame Relay ■ T ypical Frame Relay Co nfiguration Example ■ Fault Diagnosis and T r oubleshootin [...]

246 C HAPTER 17: C ONFIGU RING F RAME R ELAY Virtual circuits can be divided into perm anent virtual cir cuit and switching virtual ci rc ui t , ac c o rdi n g to t h ei r d iff e re nt configuration meth od. V irtual circuits configured manually ar e called Permanent vi rtual circuits (PVCs), and those created by protocol negotiation ar e called s[...]

Configure Frame Relay 247 Note the following: ■ The interface's link layer pr otocol can be configur ed to Frame Relay only wh en it operates in the synchronous mode. ■ When the interface's link la yer protocol is SLIP , the physical attributes of the interface cannot be modified to synchronous mode. At this time, you should first mod[...]

248 C HAPTER 17: C ONFIGU RING F RAME R ELAY When the Frame Relay interface type is DCE or NNI, the default type of LMI pr o t ocol of interfa ce is Q933a. When th e Frame Relay interface type is DTE, the default LMI protocol of interface is null. 4 Configure the Related Parameters of Frame Relay LMI Pr otocol The procedur e of the LMI protocol is [...]

Configure Frame Relay 249 The following table de scribes the value ranges and default values of re lated parameters of the Fr ame Relay LMI protocol Ta b l e 278 D escriptions of related parameters of Frame Relay LMI protocol In which, the r elated parameters at the DTE side include: ■ T391DTE: The int erval of the link integrity po lling for the[...]

250 C HAPTER 17: C ONFIGU RING F RAME R ELAY N392, the DTE equipment will assume th at the number of errors reaches the threshold, and will r egard the physical path and all the virtual cir cuits as unusable. The parameters at the DCE side include: ■ T392DCE: Define the longest duration for the DCE equipment to wait for a status enquiry message. [...]

Configure Frame Relay 251 The map created thr ough the dynamic inverse ARP has broadcast attribute. 6 Configure Frame Relay Local Virtual Circuit Number Perform the following configurations in synchronous serial interface view . Ta b l e 281 Configure Frame Relay local virtual circuit number After entering the DLCI view through the fr dlci command,[...]

252 C HAPTER 17: C ONFIGU RING F RAME R ELAY b Configure virtual circuit of Frame Relay sub-interface In interface view , perform the following task to configure the virtual circuit of Frame Relay sub-interf ace. Ta b l e 283 Configure virtual circuit of Frame Relay sub-interface c Configure Sub-Interface PVC and Establish Ad dress Mapping Since th[...]

Configure Frame Relay 253 Perform “Enabling/Disabling Frame Relay PVC switching” in system view , and configure all the other commands in synchronous serial interface view . Ta b l e 286 Configure the Frame Relay PVC switching By default, Frame Relay PVC swit ching is disabled. The configured PVC can take effect only when the type of Frame Rela[...]

254 C HAPTER 17: C ONFIGU RING F RAME R ELAY By default, no Frame Rela y switched PVC is cr eated. After configuring the Frame Relay switched PVC, the user will enter the frame relay switch view to perform the operations of shutdown and undo shutdown on the switched PVC. The differences between configuring a Frame Relay switched route and configuri[...]

Configure Frame Relay 255 will not take ef fect. On th e MFR interface, you can co nfigure the network layer parameters (e.g., IP address) and Frame Rela y parameters (e.g., DLCI). The physical interface bundled on the MFR interfac e will use the parameters on the MFR interface. Configur e MFR The configuration tasks of th e MFR are listed as follo[...]

256 C HAPTER 17: C ONFIGU RING F RAME R ELAY Ta b l e 294 Configure the parameters of the bundle link interface The default link identification is th e name of its physical interface. By default, a bundle link will send out hello message every 10 se conds; it will send a hello message a maximum of 3 times an d wait 4 seconds for a hello message ack[...]

Configure Frame Relay 257 Perform the following configurations in interface view . Ta b l e 296 Configure Frame Relay Compression on multipoint interface By defaul t, Frame Re lay payl oad compr ession is disable. On the 3Com Router , both the Frame Rela y main interfaces a nd sub-interfaces can be multipoint interfaces. Enable/Disable TCP/IP Heade[...]

258 C HAPTER 17: C ONFIGU RING F RAME R ELAY Configure Frame Relay QoS Quality of Service (QoS) is a set of te chnologies adopted to meet the users' requir ements in thr oughput, delay jitter , delay and packet loss ratio. Briefly speaking, QoS technologies pr ovides network servi ces of dif fer ent qua lit ies for di ff ere n t req u i rem e [...]

Configure Frame Relay QoS 259 Figure 82 Frame Relay traf fic shaping If the Frame Relay traffic shaping is applied on the out going interface Serial 0 on Router B, the interface will be able to transmit packets at 64 kbps, a relatively average rate, so as to avoid the network cong estion. Even if the congestion occurs to the network, Router B can s[...]

260 C HAPTER 17: C ONFIGU RING F RAME R ELAY notification (BECN) flag bit is 1, indicating that the congestion has occurred to the network, and the transmit rate of the PVC will be lowered to CIR. Frame Relay Queueing Management T o ensure that the packets on the PVCs can be trans mitt ed a t an ave rag e rate in the process of Frame Relay traffic [...]

Configure Frame Relay QoS 261 Figure 85 Frame Relay traf fic policing As shown in the above figure, Router A at the user side transmits packets at 192 kbps to Router B at the switching side. However , Router B only wants to provide the 64 kbps bandwidth for Router A. In this cas e, you need to configure the Frame Relay traffic policing at the DCE s[...]

262 C HAPTER 17: C ONFIGU RING F RAME R ELAY Frame Relay Congestion Management Frame Relay congestion ma nagement can process th e Frame Relay pack ets whenever there is network congestion. It will discard the packets that are marked with the DE flag bit. At the same time, it will notify other devices on the network about the congestion. Frame Rela[...]

Configure Frame Relay QoS 263 Ta b l e 299 Create/Delete a Frame Relay class By defa ult, no Fram e Relay class is cr eated. After creating the Frame Relay class using this command, the user will enter the frame relay class view under which you can configure the pa rameters like CIR. 2 Associate the Frame Relay class with the Frame Relay in terface[...]

264 C HAPTER 17: C ONFIGU RING F RAME R ELAY ■ Configure the parameters of Frame Relay class 1 Enable the Frame Relay traffic shaping Perform the following configurations in synchr onous serial interface view . Ta b l e 301 Enable/Disable the Frame Relay traffic shaping By default, the Frame Relay traffic sh aping is no t ena bled on the interfac[...]

Configure Frame Relay QoS 265 Numerically , the value of CBS should not be less than CIR ALLOW , otherwise , the large packets may not be sent. Configure Frame Relay T raffic Policing Frame Relay traffic policing configurat ion includ es: ■ Enable the Frame Relay traf fic policing ■ Crea te a Frame Relay class ■ Associate the Frame Relay clas[...]

266 C HAPTER 17: C ONFIGU RING F RAME R ELAY Configure Frame Relay Congestion Manageme nt There ar e two ways to set the congestion threshold. One is to configure the congestion threshold for a PVC in a specified Frame Relay class, an othe r is to configure the congestion threshold for the overall interface in interface view . The router determines[...]

Configure Frame Relay QoS 267 Configure Frame Relay DE Rule List 1 Configure a DE rule list Perform the following configurations in system view . Ta b l e 307 Configure a DE rule list By default, no DE rule list is defined. A router can support up to 10 DE rule lists, and each of them can contain up to 100 DE rules. The commands fr del inbound-inte[...]

268 C HAPTER 17: C ONFIGU RING F RAME R ELAY By default, the queue type of a Frame Relay PVC is FIFO. When the congestion management is en abled on Frame Relay PVCs, the queue type on the interface can only be FIFO. For the configuration of PQ, CQ and WFQ, refer to the part of QoS . 2 Configure Frame Relay Interface Queu eing The user can configure[...]

Configure Frame Relay over Other Protocols 269 Configure Frame Relay over Other Protocols Frame Relay over IP IP networks are used to carry the Fram e Relay data to interconnect the Frame Relay networks. In the technique of Frame Relay over IP , a GRE tunnel is established between the Frame Relay networks at both ends of IP , and the Frame Relay da[...]

270 C HAPTER 17: C ONFIGU RING F RAME R ELAY After configuring t he Frame Relay route through the fr dlci-switch interface tunnel command, two r outes will be added to the Frame Relay routing table on the router . One route takes the tunnel inte rface as the incoming interface and the serial interface as the outgoing interface. On the contrary , th[...]

Configure Frame Relay over Other Protocols 271 ■ The DCE device identifies the calli ng number of the in co ming call and authenticates the DTE device according to it to determine wheth er to accept or deny the call. ■ If the DTE device passes the au thenticati on, it can estab lish a B channel to the DCE device for carrying out the Frame Relay[...]

272 C HAPTER 17: C ONFIGU RING F RAME R ELAY A DCE devic e provides Frame Re lay swit ching. Its one end is connected to a DTE device via ISDN, and the other end is directly connected to another DTE device, as shown in the following figure: Figure 91 Frame Relay switching conne ction between DTE devices The DCE device cannot originate a call, since[...]

Configure Frame Relay over Other Protocols 273 2 Configuration Related to Frame Relay Switch ing Only some simple Frame Relay switching conf igurations are covere d in this section. For other configurations, refer to the Link Layer Protocol . Configure the commands fr switch and fr switching in system view , and perform other configurations in syn [...]

274 C HAPTER 17: C ONFIGU RING F RAME R ELAY In the legacy BDR implementat ion of Frame Relay over ISDN, a diale r interface and all the ISDN physical interfaces (including BR I a nd PRI interfaces) attache d to it will be Configured with Frame Relay . ■ Adopt dialer profiles In the dialer pr ofiles impleme ntati on of Frame Relay over ISDN, the [...]

Display and debug Frame Relay 275 Display Frame Relay data receiving/sending statistics information. displ ay fr statistics [ interface type number ] Display the Frame Relay PVC stat istics display fr pvc-info [ serial number ] [ dlci dlci-number ] Display Frame Relay PVC route table display fr dlci-switc h Display Frame Relay switch PVC route tabl[...]

276 C HAPTER 17: C ONFIGU RING F RAME R ELAY T y pical Frame Rela y Configuration Example Inter connect LANs via Frame Relay Network I. Networking Requirement Interconnect LANs via the public Frame Re lay network. The r outer work as user equipment in the Frame Relay DTE mo de. The routers use static address mapping. II. Networking Diagram Figure 9[...]

Typical Frame Relay Configur ati on Example 277 [Router-Serial1] ip address 202.38.163. 253 255.255.255.0 b Configure the link layer protocol of the interface to Frame Relay [Router-Serial1] link-protocol fr [Router-Serial1] fr interface-type dte c Configur e stati c addr ess mapping [Router-Serial1] fr map ip 202.38.163.25 1 dlci 80 Interconnect L[...]

278 C HAPTER 17: C ONFIGU RING F RAME R ELAY II. Networking Diagram Figure 94 MFR bundle networking III. Configuration Procedu re 1 Configure RouterA a Create a MFR interface. [Router] interface mfr 0 [Router-MFR0] ip address 202.38.163 .251 255.255.255.0 [Router-MFR0] fr interface-type dte [Router-MFR0] fr dlci 100 [Router-MFR0] fr map ip 202.38.1[...]

Typical Frame Relay Configur ati on Example 279 II. Networking Diagram Figure 95 networking diagram of Frame Relay over IP III. Configuration Procedur e 1 Configure Router A [Router] interface serial 0 [Router-Serial0] ip address 202.38.163.2 51 255.255.255.0 [Router-Serial0] fr interface-type dte [Router-Serial0] fr dlci 100 [Router-Serial0] fr ma[...]

280 C HAPTER 17: C ONFIGU RING F RAME R ELAY [Router-fr-class-frts] cir allow 64 000 64000 [Router-fr-class-frts] cbs 64000 [Router-fr-class-frts] cir 64000 [Router-fr-class-frts] fragment 80 data-level Configuration Example of Frame Relay T r affic Shaping I. Configuration Requirements The Router is connected to the Frame Relay ne twork via the in[...]

Typical Frame Relay Configur ati on Example 281 II. Networking Diagram Figure 98 Networking diagram of Frame Relay over IP III. Configuration Procedur e 1 Configure RouterA a Configure the Frame Relay interface Serial0 [Router] interface serial 0 [Router-Serial0] link-protocol fr [Router-Serial0] fr interface-type dce [Router-Serial0] fr dlci 100 b[...]

282 C HAPTER 17: C ONFIGU RING F RAME R ELAY On RouterA, two BRI interfaces, Bri0 and Bri1 , are available. Bri0 is assigned with the ISDN number 660218, the IP addr ess 110.0.0.1 and the DLCI number 100. Bri1 is assigned with the ISDN number 660208, th e IP ad dress 120.0.0.1 and the DLCI number 200. On RouterB, one PRI int erf ace is available fo[...]

Typical Frame Relay Configur ati on Example 283 [Router-Serial2:15] dialer bundle-member 20 For configuring the BDR and Fr ame Relay parameters on Dialer1, refer to the configuration on Dialer0. The user only needs to change the IP address to 120.0.0.2, DLCI number to 20 0, and configure to r eceive the incoming calls from the number 660208 and ass[...]

284 C HAPTER 17: C ONFIGU RING F RAME R ELAY 2 Configure RouterB a Configur e the BD R an d Fram e Relay parameters on the PRI interface. [Router] dialer-rule 1 ip permit [Router] fr switching [Router] controller e1 0 [Router-E1-0] pri-set [Router] interface dialer 0 [Router-Dialer0] ip address 110.0.0 .2 255.255.255.0 [Router-Dialer0] dialer bundl[...]

Fault Diagnosis and Troubleshooting of Frame Relay 285 Fault Diagnosis and T roubleshooting of Frame Relay Fault 1: the physical layer in DOWN status. T r oubleshooting: ■ Check whether the physical line is norma l. ■ Check whether the opposite equipment runs nor mally . Fault 2: the physical layer is alr eady UP , but the link layer protocol i[...]

286 C HAPTER 17: C ONFIGU RING F RAME R ELAY ■ Check whether the Frame Relay configurat ions at both ends are correct. Read the section of troubleshooting in Link Layer Protocol .[...]

18 C ONFIGURING HDLC This chapter contains information on the following top ics: ■ Configure HDLC ■ Display and Debug HDLC Configure HDLC HDLC (High Data Link Control) is a bit-oriented link layer protocol. Its most prominent feature is that it can transpar ently transmit any kind of bit flow without the restriction that the data must be ch ara[...]

288 C HAPTER 18: C ONFIGU RING HDLC Enable HDLC p acket debugging debugging hdlc packet [ interface type number ][...]

19 C ONFIGURING B RIDGE This chapter contains information on the following top ics: ■ Bridge Overview ■ Configure Bridge’ s Routing Function ■ Display and Debug Bridge ■ T ypical Bridge Configuration Bridge Overview Bridge is a type of network device on th e data link layer , whic h interconnects Loca l Area Networks (L ANs) and tra nsfer[...]

290 C HAPTER 19: C ONFIGU RING B RIDGE ■ Supports bridging on the Frame Relay links. ■ Supports bridging on the sub-interfaces of VLAN. ■ Supports bridging o n BDR and dialing standby . ■ Supports binding of multiple ports and load sharing. ■ Support both routing and bridging function for specified protocol . ■ Support filtering Ether n[...]

Bridge Overview 291 Figure 102 Bridge learns that Workstation A is connected with Port 1 Once Workstation B r esponds to Workstation A, the bridge can detect the responding Ethernet frame from W orkstat ion B and learn that Workstation B is also connected to Bridge port 1 b ecause the frame is detected o n port 1 too. As a result, the correlation b[...]

292 C HAPTER 19: C ONFIGU RING B RIDGE Figure 104 Final bridging address table Forward and Filter The bridge will make the decision to fo rward frames or not (that is, to filter frames) depending on the fo llo wing th ree conditions: ■ If Workstation A sends an Ethernet frame wh ose destination is Workstation C, the bridge will detect this frame [...]

Bridge Overview 293 Figure 106 Filter (not forwar d) ■ Suppose that Workstation A sends an Ethernet frame to Workstation C, and the bridge does not find the corr elation between th e MAC address of Workstation C and the port in the bridging address table, what will the bridge do? The bridge will forwar d this frame destined to an unknown MAC addr[...]

294 C HAPTER 19: C ONFIGU RING B RIDGE Figure 108 Pr eliminary examination state of bridging loops As shown in the following figure, the broadcast frame is forwarded over Ethernet segment 2 and Ethernet segment 3 that are connected with Bridge Z. Upon detecting two copies of this frame on two different ports, Bridge Z forwards them to Ether net seg[...]

Bridge Overview 295 will also specify which bridge to be the “root bridge” and whic h bridges to be the “leaf nodes” . A BPDU cont ains the fo llowing inform ation: ■ Root Identi fier: Consists of the Brid ge Priority and th e MAC address of the root bridge. ■ Root Path Cost: Path cost from the individual leaf nodes to the root bridge. [...]

296 C HAPTER 19: C ONFIGU RING B RIDGE Figure 110 Spanning tr ee topology BPDU Forwar ding Mechanism Upon the initiation of the network, all th e bridges assume them selves as the root bridge. The designated interface of the bridge r egularly sends its BPDU once a Hello Time. If it is the root port r eceives the BPDU, it will incr ease the Message [...]

Configure Bridge’s Routing Functi on 297 will be routed through IP . Certainly , if IP cannot find a route, it will discard the packet instead of forwarding it to the brid ge for pr ocessing. If the packet uses a protocol other than IP (for example, if it is the pack et from the ne twork like AppleT alk or DecNet), it will be bridged. For the 3Co[...]

298 C HAPTER 19: C ONFIGU RING B RIDGE 2 Configure Bridge-Set Each bridge set is independent, and packets can not be transmitted between the ports belonging to differ ent bridge sets. That is, the packets re ceived via one bridge set port can only be sent via the po rts of the same bridge set. One physical interface can only be added to one bridge [...]

Configure Bridge’s Routing Functi on 299 Perform the following configuration in system view . Ta b l e 324 Enable/Disable forwarding by using dynamic address table By default, the dynamic address table is used to forward frames. c Configure the aging time of dynamic addr ess table The aging time of dynamic address table r efers to the time that a[...]

300 C HAPTER 19: C ONFIGU RING B RIDGE Ta b l e 327 Configure the bridge priority By default, the bridge priority is 32768. It is valued in the range of 0 to 65 535. c Configur e the pat h co st of br id ge port The path cost of the p ort is related to its link speed. T he higher the link speed is, the lower the path cost should be co nfigu red. If[...]

Configure Bridge’s Routing Functi on 301 Ta b l e 330 Configure the interval for sending BPDUs By default, the value of Hello T ime timer is 2 seconds. It is in the range of 1 to 10 seconds. When configuring the Hello T ime timer , it should be noted that: ■ In the spanning tree, all the bridges us e the time value of Hello T ime timer of the r[...]

302 C HAPTER 19: C ONFIGU RING B RIDGE The Max Age is the parameter used t o ju dge whether the BP DUs are “timeout”. Users can configure it accor ding to the actual network conditions. When a port enables the STP , the Max Age timer begins to time. If no BPDU is received in the specified period, it w ill assume that the lin k has failed and th[...]

Configure Bridge’s Routing Functi on 303 When creating an ACL based on Ethernet type code (Ether net-II, SNAP or LSAP), you can specify aclt- number in the range of 200 to 299. type-code is a 16-bit hexadecimal number written with a leading “0x”, co rresponding to the type-code field in the Ethe rnet-II or SNAP frames. type-wildcard is a 16-b[...]

304 C HAPTER 19: C ONFIGU RING B RIDGE By default, no ACL is applied on the port. When applying an ACL on the port, note that: ■ Add the port to a bridge-set first, then apply the ACL on that port. ■ If ACLs of the same type are applied to the same port, the lat est ACL applied will replace the previous ones. 8 Configure Routing Function a Enab[...]

Configure Bridge’s Routing Functi on 305 Ta b l e 340 Configure bridge set to route or bridge the network layer pr otoco l By default, the bridging is enabled, the routing is disabled. Y ou can execute the display bridge bridge- set bridge-template command to view the configuration of routing and bridging on each interface. 9 Configure Link-Set a[...]

306 C HAPTER 19: C ONFIGU RING B RIDGE Ta b l e 343 Map the bridge address to DLC I 11 Configure Bridging over BDR Perform the following confi guration in system view . a Define a dialer list Ta b l e 344 Define a dialer list b Configure the bridge interface Perform the following confi guration in interface view . Ta b l e 345 Configuration on the [...]

Display and Debug Bridge 307 Ta b l e 349 Configure bridge on VLAN Display and Debug Bridge Perform the reset , display and debugging commands in all vi ews. Ta b l e 350 Display and debug bridge T ypical Bridge Configuration T ranspar ent Bridging Multiple LANs I. Networking Requirements Suppose that there are several PCs located on the Ether net [...]

308 C HAPTER 19: C ONFIGU RING B RIDGE II. Networking Diagram Figure 111 Networkin g of building transparent bridges between multiple Ethernet segments III. Configuration Procedu re 1 Configur e Router A [Router] bridge enable [Router] bridge 1 stp ieee [Router] bridge 1 learning [Router] bridge aging-time 300 [Router] interface ethernet 0 [Router-[...]

Typical Bridge Config uration 309 T ranspar ent Bridging over Frame Relay I. Networking Requirements T w o routers are dire ctly connected via serial interfaces. Imple ment transparent bridging over the Frame Relay . II. Networking Diagram Figure 112 T ransparent bridge over the Frame Relay III. Configuration Procedur e 1 Configur e Rou ter A [Rout[...]

310 C HAPTER 19: C ONFIGU RING B RIDGE T ransparent Bridging for Synchronous Dial-in Standby I. Networking Requirements Configure transpar ent bridging for synchr onous dial-in standby on two routers. Thereby , transparent bridging can be implemented by enabling synchronous dial-in in case that the serial interfaces through which the r outers are d[...]

Typical Bridge Config uration 311 T ranspar ent Bridging for Asynchronous Dial-in Standby I. Networking Requirements Configure transparent bridging for asynchronous dial-in standby on two routers. Thereby , transparent bridging can b e implement ed by enabling a synchronous dial-in in case that the serial interfac es through which the routers are d[...]

312 C HAPTER 19: C ONFIGU RING B RIDGE Bridge-T emplate interface I. Networking Requirements Configur e a r outer so that r outing can be carried out on each int er f ace in th e bridge-set. II. Networking Diagram Figure 114 Networking of bridge-template interface III. Configuration Procedu re [Router] bridge enable [Router] bridge routing-enable [[...]

Typical Bridge Config uration 313 Bridging on Sub-Interfaces I. Networking Requirements T w o r outers are connected via a network ca ble. Enabling bridging on the Ether net sub-interfaces so that the two bridges established via the routers can be interconnected. II. Networking Diagram Figure 115 Networking for bridging on sub-interfaces III. Confi[...]

314 C HAPTER 19: C ONFIGU RING B RIDGE Link-Set Configuration I. Networking Requirements Bind multiple parallel links between bridge s into a link-set so that the links can share the load when bridging the traffic. II. Networking Diagram Figure 116 Networkin g of use link-set to implement port binding III. Configuration Procedu re 1 Configure Route[...]

V N ETWORK P RO T O C O L Chapter 20 Configuring IP Address Chapter 21 Configuring IP Application Chapter 22 Configuring IP Performance Chapter 23 Configuring IP Count Chapter 24 Configuring IPX Chapter 25 Configuring DLSw[...]

316[...]

20 C ONFIGURING IP A DDR ESS This chapter contains information on the following top ics: ■ IP Address Overview ■ T r oubleshooting IP Address Configuration ■ Map between W AN Interface IP Addre ss and Link Layer Protocol Addr ess IP Address Overview IP address is a unique 32-b it address assigned to a host conn ected to Internet. Usually it i[...]

318 C HAPTER 20: C ONFIGU RING IP A DDRESS The IP addresses a user can use are listed in the following table. Ta b l e 351 IP address classes and ranges Important features of IP address: Some IP addr esses are not in a hierarc hic al structur e, which is differ ent from the structure of telephone number . In other words, these IP addresses cannot r[...]

IP Address Overview 319 completely inter nal to the en terprise itself, and seen from the outside, the enterprise only has one net-id. When an ex ternal message enters this enterprise network , th e int ernal route r can ro u t e accor ding to the sub-net number , and finally reach the destination host. The following figure shows the sub-net cla ss[...]

320 C HAPTER 20: C ONFIGU RING IP A DDRESS Figure 119 Relation between host name, IP addr ess and physical address Configur e IP Addr ess Configure IP Addr es s for an Interface Use a mask to label the network ID contained in an IP address. Example : the IP address of an Ethernet interface of a router is 129.9.30.42, and the mask is 255.255.0.0. T [...]

IP Address Overview 321 When configuring the mast er IP address for an interface, note: ■ An interface can only have one master IP address. ■ When deleting the IP address of the in terface, if no IP addr ess and mask is specified, all the IP addr e sses (including all slave IP addresses) will be deleted from the interface. ■ One router can be[...]

322 C HAPTER 20: C ONFIGU RING IP A DDRESS Ta b l e 354 Set negotiable attribute of IP address for an interface By default, the interface ha s no negotia ting IP addr ess. Note the following: ■ Because PPP supports IP address negotia tion, IP address negotiation of an interface can be set only when the interface is encapsula ted with PPP . When t[...]

IP Address Overview 323 Ta b l e 355 Configure IP address unnumber ed By default, the interfa ce has no IP address. 2 Display IP address unnumbered Ta b l e 356 Display IP address unnumber ed Configuration Example I. Configuration Requirements Suppose the headq uarters of a comp any is in Beijing, with subsidiary offices in Shenzhen and Shanghai an[...]

324 C HAPTER 20: C ONFIGU RING IP A DDRESS 2 Configure r outer R1 of Shenzhen subsidiary: [Router-Ethernet0] ip address 172. 16.20.1 255.255.255.0 a Borrow IP addr ess of Ethernet [Router-Serial0] ip address unnumb ered Ethernet0 [Router-Serial0] link-protocol ppp b Configure r outing to Ether net segment on Beijing router R, this routing is defaul[...]

Map between WAN Interface IP Address and Link Layer Protocol Address 325 cannot r eceive the arp m essage, then possibly t he err or is on the Ethe rnet physical layer . Fault 2: When the interface is encapsulated with PPP or Frame Relay , the link layer protocol status does not change to UP . T r oubleshooting: ch eck whether the IP add ress of th[...]

326 C HAPTER 20: C ONFIGU RING IP A DDRESS[...]

21 C ONFIGURING IP A PPLICATION This chapter contains information on the following top ics: ■ Configure Addr ess Resolution Protocol (ARP) ■ Configure Domain Name Resolution (DNS) ■ VLAN Configuration ■ DHCP Server Configuration ■ Configure DHCP Relay ■ Configure Network Address T ranslation (NA T) Configure Addr ess Resolution Protocol[...]

328 C HAPTER 21: C ONFIGU RING IP A PPLICATION By default, the system ex ecutes static ARP mapping. Static ARP mapping items ar e valid as l ong as the r outer works normally , but dynamic ARP mapping items are valid for only 20 minutes. Display and Debu g ARP Ta b l e 359 Display and Debug ARP Configure Domain Name Resolution (DNS) The TCP/IP Extr[...]

VLAN Configuration 329 By default, the system has no static domain name resolution mapping. Pay attention that when adding a domain n ame mapp ing, if the same hostname has been input twice, the current confi guration will overwrite the pr evious one. A static domain name resolution table can maintain a max imum of 50 mapping relationships between [...]

330 C HAPTER 21: C ONFIGU RING IP A PPLICATION Figure 122 Format of VLAN tag TPID (T ag Protocol Identifier) field has two bytes. When its value is 0X8100, it means the Et her net frame header contain s VLAN tag. The third and fourth byte are TCI (T ag Control Information) fields, with the higher three bits being user priority field, the fourth bei[...]

VLAN Configuration 331 In as Ethernet interface is connected wi th a LAN Switch port. As the Ether net subinterface of every specif ied VLAN ID can act as an indep endent gateway , this subinterface and other Ether net subinte rface in the same VL AN ID should belong to the same subnet segment. Please implement the following configu rat ion under E[...]

332 C HAPTER 21: C ONFIGU RING IP A PPLICATION [Router] interface ethernet 0.1 b Specify 3 as the ID nu mb er of the VLAN on which the subinterface is located. [Router-Ethernet0.1] vlan-type dot 1q vid 3 c Configure IP address for the subinterface. [Router-Ethernet0.1] ip address 3. 3.3.8 255.255.255.224 d Create and enter the view of Ether net sub[...]

DHCP Server Configuration 333 connected with PC must be set as “untagged ” for th e reason that PC cannot identify data packet marked with VLAN tag. Fault: Ping T wo PCs, but fa ils to ping them through. T r oublesh ooting: The st eps below can be taken. ■ First, ping the IP address of Ethernet subinterface in the same VLAN from a PC. If the [...]

334 C HAPTER 21: C ONFIGU RING IP A PPLICATION DHCP server can provide thr ee types of IP address allocation policies accor ding to t he d i ff ere n t req u ire m e nt s : ■ Allocate addresses ma n ually: Administrators configu r e special IP addresses for a small number of part icular hosts such as the service server WWW . ■ Allocate addresse[...]

DHCP Server Configuration 335 ■ DHCP client logins the network f or the first time If it is the first time for a DHCP client to login to the network, it will establish a connection with the DHCP server through four s tages: ■ Discovering stage. This is the stage when the DHCP client searches the DHCP servers. The DHCP client broa dcasts a DHCP_[...]

336 C HAPTER 21: C ONFIGU RING IP A PPLICATION will take bac k the IP address. If the DHCP client wants to continue to use this address, it should r enew the IP leasing contract such as extending the leasing contract o f the IP address. ■ In practice, the DHCP client will automatically send the message for renewing the IP leasing c ontract to the[...]

DHCP Server Configuration 337 ■ Configure the range of a DHCP addr ess pool ■ Configure the IP addr esses that do no t participate in auto-allocation in the DHCP addr e ss pool ■ Configure the lease valid period of the IP addr esses in a DHCP address pool ■ Configure the IP addr ess of the outgoing gateway r outer at the DHCP client ■ Con[...]

338 C HAPTER 21: C ONFIGU RING IP A PPLICATION By default, no DHCP ad dress pool is created. 3 Configure the range of a DHCP addr ess pool a Configure the static binding add ress allocated to the client Some special clients (e.g., WWW server) need to be bound with fixed IP addresses, that is, to bind a certain client MAC addr ess with a certain IP [...]

DHCP Server Configuration 339 The command network cannot be superimposed, that is, the latest configuration will overwrite the previous one. The command network and the commands static-bind ip-address and static-bind mac-address are conflicting. In other words, for the same DHCP address pool, configure eit her dyn ami cally bind ing address or the [...]

340 C HAPTER 21: C ONFIGU RING IP A PPLICATION By default, the valid leasing period of IP address is 1 day . 6 Configure the IP Address of Egress Gateway Router for DHCP Clients When a DHCP client accesse s a server (or host) beyond the local subnetwork, all the data must be sent and received via the egress gateway for the local network. Only a max[...]

DHCP Server Configuration 341 That is because the new DNS address will replace the previous one rather than superimpose it. 9 Configure IP Addr ess of NetBIO S Server U sed by DHCP Clients Clients can communicate through the NetBIOS protocol. As for the clients installed with the Microsoft operating system, WI NS (W indows Int ernet Naming Service)[...]

342 C HAPTER 21: C ONFIGU RING IP A PPLICATION assume that the IP addr ess in this segment is not in use. Only when it is not in use can the IP address be alloca ted to the specified client. Perform the following confi gurations in system view . Ta b l e 377 Configure maximum number of ping packets sent by DHCP server & time for response By def[...]

DHCP Server Configuration 343 T ypical DHCP Se rver Configuration Example The common DHCP networking methods can be classified into two cat egories: One is that the DHCP server and the clients reside on the same subnetwork and they directly carry out the interaction of DHCP . Another one is that the DHCP server and the clients reside on dif fer en [...]

344 C HAPTER 21: C ONFIGU RING IP A PPLICATION 4 Configure the attributes (address pool ra nge, outgoing gateway and addr ess lease period) in DHCP pool 1. [Router] dhcp server ip-pool 1 [Router-dhcp1] network 10.1.1.0 ma sk 255.255.255.128 [Router-dhcp1] gateway-list 10.1.1 .126 [Router-dhcp1] expired day 10 hour 12 5 Configure the attributes (add[...]

Configure DHCP Relay 345 Figure 127 Schematic diagram of DHCP r elay The above figur e is the schematic diagra m of DHCP relay . Its work ing principle is as follows: After starting DHCP client, a configur atio n request message is broadcast and the DHCP relay r outer will send the message to the designated DHCP server on the other network after pr[...]

346 C HAPTER 21: C ONFIGU RING IP A PPLICATION UDP needs to be forwarded Broadcast messages of common protocols usually adopt UDP . The destination port numb er of UDP is configured to set the transparent transmission pr otocol. For exam ple, tr ansparent transmission o f TF TP broadcast messages (port nu mber 69) and DNS protocol br oadcast messag[...]

Configure DHCP Relay 347 II. Networking Diagram Figure 128 Networking diagram of an DHCP r elay configuration example III. Configuration Procedur e 1 Configure DHCP relay r outer: [Router-Ethernet0] ip address 10.110.1. 1 255.255.0.0 [Router-Ethernet0] ip relay-address 202 .38.160.2 T o configure helper address 202.38.160.2 on the Ether net interfa[...]

348 C HAPTER 21: C ONFIGU RING IP A PPLICATION II. Networking Diagram Figure 129 Config uration example of transpar ent transmission forwar ding protocol III. Configuration Procedu re 1 Configure Router A: [Router] ip relay protocol udp 69 [Router] interface ethernet 0 [Router-Ethernet0] ip address 10.1 10.1.1 255.255.0.0 [Router-Ethernet0] ip rela[...]

Configure Network Address Translation (NAT) 349 ■ Check whether the transp arent transmission r outer itself is configured with services of t he pr otocol tra nsmitted tran sparen tly . Configure Network Address T ranslation (NA T) Network Address T ranslation (NA T), also known as address proxy , implements the function for the private network t[...]

350 C HAPTER 21: C ONFIGU RING IP A PPLICATION 203.196.3.23:32814. The destination addre ss and port remains unchanged. In the proxy server , it maintains one corresponding table of address port. After the WWW server of the external network returns a result , the proxy server will translate the destination IP address and p ort in the result data me[...]

Configure Network Address Translation (NAT) 351 ■ The debugging of the network becomes ev e n m o re d iff i cu l t . F o r in s t an c e, when one host machin e of the inter nal network attempts to attack ot her networks, it is very difficult to pinpoint which comp uter is attacking computer , since the IP addr ess of the host machine is shielde[...]

352 C HAPTER 21: C ONFIGU RING IP A PPLICATION access control list, then locate the co rresponding data pool according to the correlation. Thus, the source address is translated into one address in the data pool and the address translation pr ocess is completed. In the translation correlation form, the necessary corresponding information of the tra[...]

Configure Network Address Translation (NAT) 353 corresponding internal server . During the course of ad dress translation, it will look up the resour ce addr ess of the message, to determine if the message is sent fro m the internal server . If yes, the source address is translated to the corresponding public network address. The information the us[...]

354 C HAPTER 21: C ONFIGU RING IP A PPLICATION Display and Debug NA T Ta b l e 388 Display and debug NA T Ty p i c a l N A T Configuration Example An enterprise is connected to W AN by the address translation function of an internal server . I. Networking Requirement An enterprise is connected to W AN by the address translation function of the 3Com[...]

Configure Network Address Translation (NAT) 355 II. Networking Diagram Figure 132 NA T configuration case networking diagram 1 III. Configuration Procedur e a Configure addr ess pool and access list [Router] nat address-group 202.38.160.101 202. 38.160.105 pool 1 [Router] acl 1 [Router-acl-1] rule permit source 10.110 .10.0 0.0.0.255 b Allow addres[...]

356 C HAPTER 21: C ONFIGU RING IP A PPLICATION The internal LAN of an enterprise ca n dial-up to access Inter net by the address translation. I. Networking Requirement The internal LAN of an enterprise can dial -up to access Internet through serial port S0 by the addr ess translation of the 3Com Router series. II. Networking Diagram Figure 133 NA T[...]

Configure Network Address Translation (NAT) 357 Fault 2: Internal server abnormal T r oubleshooting: If an exter nal host cannot access th e internal s erver normally , check the configuration on the internal server host, or the inter nal server configuration on the router . It's possible that t he inter nal server IP address is wrong, or that[...]

358 C HAPTER 21: C ONFIGU RING IP A PPLICATION[...]

22 C ONFIGURING IP P ERFORMANCE This chapter contains information on the following top ics: ■ Configure IP Performance ■ Configure TCP Performance ■ Configure Fast Forwarding ■ Display and Debug IP Performan ce ■ T r oubleshooting IP Performan ce Configuratio n Configure IP Performance T o configure IP performance, carry out the following[...]

360 C HAPTER 22: C ONFIGU RING IP P ERFORMANCE Ta b l e 391 Configure router forwar ding redir ect packets By default, r outer forwarding r edirect packets is enabled. 4 Configure Router Receiving/Forwarding Sour ce Route Packets The following configurations should be made in system view . Ta b l e 392 Configure router r eceiving/forwar ding sour c[...]

Configure TCP Performance 361 The Synwait timer's timeout ranges between 2~6 00 seconds, with a defau lt value of 75 seconds. The Finwait timer's timeout ranges between 76~3600 seconds, with a default value of 675 seconds. Th e value of window-size ranges between 1~32Kbytes, with a de f au l t valu e of 4Kb yt e s. Configure the size of t[...]

362 C HAPTER 22: C ONFIGU RING IP P ERFORMANCE Configure Fast Forwarding Message forwar ding efficiency is a key feature evaluating r outer performance. According to r egular flow , wh en a message arrives, the r outer will copy it from the interface memory to t he main CPU. The CP U specifies the network ID from the IP address, consults with the r[...]

Display and Debug IP Performance 363 By default, fast-forwarding is enabled in the input/output directions of the interface. When fast-forwarding is carried out on an interface, note that: ■ Y ou can disable fast-forwarding as necessary . For example, if load sharing is requir ed, fast-forwarding must be disabled in the forwarding direction of th[...]

364 C HAPTER 22: C ONFIGU RING IP P ERFORMANCE T roubleshooting IP Performance Configuration Fault 1: TCP and UDP ar e created u pon IP protocol, and IP is able to provide data packet transmission. However , TCP and UDP pr otocols do not work normally T r oubleshooting: T urn on corresponding debugging swit ches to check the debugging information ?[...]

23 C ONFIGURING IP C OUNT This chapter contains information on the following top ics: ■ IP Count Introduction ■ IP Count Configuration ■ Display and Debug IP Count ■ T ypical Configurat ion Examp le ■ T r oubleshooting IP Count Introduction IP Count makes the statistics about the inpu t and output packets, and the packets denied by the fi[...]

366 C HAPTER 23: C ONFIGU RING IP C OUNT Figure 134 Networkin g for an IP Count application IP Count mainly implements the following functions: ■ Configure IP Count list ■ Make statistics on the output and input packets ■ Make statistics on the packets processed by the firewall ■ Display all packet statistics ■ Clear all packet statistics[...]

IP Count Configuration 367 Configuring IP Count on an interface can enable packet accounting on the interface. Y ou can configure to make statistics on the packets input or output on the interface, as well as packets denied by firewall. Perform the following configuration in interface view . Ta b l e 400 Configure IP Count on an interface By defaul[...]

368 C HAPTER 23: C ONFIGU RING IP C OUNT The default max entries number of exterior is set to 0, namely , the packets that do not match the rules will not be counted. 5 Configur e Upper Th r eshold of Interior -List Accoun t in g Entries The following command is used for specifyi ng count maximum of interior , that is, the max entries number of the[...]

Troubleshoo ting 369 II. Networking Diagram See Figure 4-1 Networking for IP Count ap plication for refere nce. III. Configuration Procedur e 1 Configure the r outer a Enable IP Count service [Router] ip count enable b Specify count maximu m of ext e rio r -list to 10 [Router] ip count exterior-threshold 10 c Specify count maximu m of int e rior -l[...]

370 C HAPTER 23: C ONFIGU RING IP C OUNT[...]

24 C ONFIGURING IPX This chapter contains information on the following top ics: ■ IPX Pr otocol Overview ■ Configure IPX IPX Protocol Overview Novell IPX protocol is a connectionless pr otocol. Thoug h both data and destination IPX addr ess are included in IPX packet, the protocol cannot confirm whether a packet has been forwarded successfully [...]

372 C HAPTER 24: C ONFIGU RING IPX network routing information which can be sent to destination or needs to be forwarded, so that when a packet is received, the next router can be found to transmit the packet. The routing inform ation here can be configured both statically and dynamically . In a router , collection and maintenan ce of dynamic routi[...]

Configure IPX 373 clients can always obtain the latest se rver addresses. The following diagram describes the r elation be t w ee n main components of SAP . Figure 136 Schematic diagram of the r elation between main components of SAP Configure IPX IPX configuration includes: ■ Activate/deactivate IPX ■ Enable IPX interface ■ Adjust Novell IPX[...]

374 C HAPTER 24: C ONFIGU RING IPX Perform the following task in interface view . Ta b l e 407 Enable IPX interface By default, IPX is disabled on all interfaces after being started. Delete interface IPX, then IPX configurat ion is removed from the interface, static service information and static r out ing information will be deleted. 3 Configure R[...]

Configure IPX 375 Ta b l e 410 Configure RIP updating period By default, the time interval for RI P updating period is adjusted to be 60 seconds. c Configur e aging per i o d of I PX RIP Perform the following task in system view . Ta b l e 411 Configure RIP aging period By default, the agin g per iod of a routing table item is 3 times that of RIP u[...]

376 C HAPTER 24: C ONFIGU RING IPX When the length of a route reserve queue is 1, the system only saves one route for a destination. If this unique r oute is faulty , it will be deleted by the system and ther e will be no route to the destinat ion while sear ching for the substitute routes, r esulting in huge loss of packets. When the length of a r[...]

Configure IPX 377 Ta b l e 416 Configure IPX SAP updating period By default, the updating perio d of IP X SAP is 1 tick (i.e. 1/18 seconds). c Configure SAP aging period Perform the following task in system view . Ta b l e 417 Configure SAP aging period By default, the service information which is not updated in three update periods will be deleted[...]

378 C HAPTER 24: C ONFIGU RING IPX If the length of a service information re serve queue is 1 , th e system saves only one service information. If the server to which the only service infor mation corresponds is faulty , syst em will delete this information, and you cannot find any server to provide such service while sear ching for the substitute [...]

Configure IPX 379 Ta b l e 423 Configure the delay of interface sending IPX packets By default, the delay of Ethernet interface is 1 tick, For asynchronous serial port is 30 ticks and that for W AN port is 6 ticks. The range of ticks is: 0~30000. 8 Configur e Manage me nt of IPX Packet By default, the router usually discar ds the broadcast packet o[...]

380 C HAPTER 24: C ONFIGU RING IPX Display and Debug IPX Ta b l e 427 Display and Debug IPX Ty p i c a l I P X Configuration Example I. Networking Requirement Networking with Router A and Router B. Here, both Server1 and Server2 are installed with NetWar e 4.1. Server1 is the master server , its external network ID is 2, packet encapsulation format[...]

Configure IPX 381 d Activate IPX module on interface Se rial0, the network ID being 1000. Configuring BDR parameter [Router] interface serial 0 [Router-Serial0] dialer enable-legacy [Router-Serial0] dialer-group 1 [Router-Serial0] ipx network 1000 e Configure an address map to Router B [Router-Serial0] dialer route ipx 1000. 0.0c91.f61f 8810124 [Ro[...]

382 C HAPTER 24: C ONFIGU RING IPX i Configure an information about Server 1 directory service [Router] ipx service 26B tree 937f .0000.0000.0001 5 hop 2 [Router] ipx service 278 tree 937f .0000.0000.0001 4006 hop 2 j Configure dialing rules [Router] dialer-rule 1 ipx permit[...]

25 C ONFIGURING DLS W This chapter contains information on the following top ics: ■ DLSw Protocol Overview ■ Configurat io n of DLS w ■ Display and Debug DLSw ■ T ypical DLSw Configuratio n Example ■ Diagnosis and T roubleshooting of DLSw Fault DLSw Protocol Overview Data Link Switch Protocol (DLSw) is a method designed by Advanced Peer -[...]

384 C HAPTER 25: C ONFIGU RING DLS W Configuration of DLSw DLSw configuration includes: ■ Cr ea te DLSw local peer entity ■ Cr ea te DLSw r emote end peer entity ■ Configur e Brid ge set conne cting to DLS w ■ Configure to add Ether net port to Bridge set ■ Configur e link layer pr otocol for interf ace encapsula tion to be SDLC ■ Confi[...]

Configuration of DLSw 385 Please perform th e following configuration s in system view . Ta b l e 429 Create DLSw remote end peer entity No DLSw r emote end peer entity is crea ted by default. When creating remote backup-peer , note: When the remote backup peer is created, the tcp ip-address should be the IP address of peer back up entity and the b[...]

386 C HAPTER 25: C ONFIGU RING DLS W Please process the following configurations in the Ether net interf ace view . Ta b l e 431 Configure to add ethernet port to Bridge set No Ethernet port is added to Bridge set by default. 5 Configure Link Layer Protocol for Interface Encapsulation as SDLC SDLC is a link layer pr otocol relative to SN A. The wor[...]

Configuration of DLSw 387 forwarding. This command is used to specify the virtual MAC address on the interface, thus providing source MAC ad dr ess for transformin g SDLC message into LLC2 message. Please process the following configurati ons in the synchronous interface view . Ta b l e 434 Configure SDLC virtual MAC address There is no SDLC virtua[...]

388 C HAPTER 25: C ONFIGU RING DLS W partner shall be the MAC address of th e r emote end SNA equipment (physical addresses of such equipment as Ethern et and T oken- Ring) or next-hop MAC address composed of SDLC. Please process the following configurations in the synchronous interface view . Ta b l e 436 Configure SDLC peer entity By default, syn[...]

Configuration of DLSw 389 12 Configure to Stop Running DLSw Please carry out the follow ing configuratio n und er overall view . Ta b l e 439 Configure to stop running DLSw By default, the system does not run DLSw protocol. After using this command, the system w ill release all the dynamic r esources but reserv e the ex isting configuration. 13 Con[...]

390 C HAPTER 25: C ONFIGU RING DLS W Ta b l e 442 Configure Idle time encoding mode of synchronous Interface By default, the synchronous inte rface uses encoding mod e "7E". Generally , the idle time encoding mode of synchronous interface doesn't need to be modified. Y ou may need to configur e this command when connecting AS/400, th[...]

Configuration of DLSw 391 LLC2 pre-answer refers to sending answe r packet to the peer in advance afte r receiving the specified amount of p ack ets. This parameter and local answer display time in 1 controls the time to send answer packet together . If any condition is satisfied, the answer p ack et will be sent, that is, it sends acknowledgement [...]

392 C HAPTER 25: C ONFIGU RING DLS W Ta b l e 448 Configure retransmission number of LLC2 By default, the retransmi ssion number of LLC2 is 20. f Configure LLC2 Local Ackn owled gement T ime LLC2 local acknowledgement time refers to max wait time for waiting for the other part's acknowledgement after sendi ng a piece of LLC2 data message. Plea[...]

Configuration of DLSw 393 Ta b l e 452 Configure REJ status time of LLC2 By default, REJ status time of LLC2 is 500 ms. j Configure Queue Length of Sending Message of LLC2 Please process the following configurat ions in the Ethernet interface view . Ta b l e 453 Configure queue length of sending message of LLC2 By default, the queue length of sendi[...]

394 C HAPTER 25: C ONFIGU RING DLS W By default, the modulo value of SDLC is 8. d Configure Maximum Receivable Frame Length N1 of SDLC Maximum frame length of SDLC refe rs to byte number of maximum transmissible and receivable message, no t including parity bit an d stop bit. Please process the following configurati ons in the synchronous interface[...]

Configuration of DLSw 395 Ta b l e 460 Configure SAP address for tr ansforming SDLC to LLC2 By default, both LSAP and DSAP of LLC2 are 04. h Configure Data Bi-dir ectional T ransmission Mo de of SDLC This command is used to allow the sync hronous serial port of the encapsulated SDLC pr o tocol to work in the bi-d ir ection al data transmission mode[...]

396 C HAPTER 25: C ONFIGU RING DLS W Ta b l e 463 Configure acknowledgement wait time T2 of SDLC secondary station By default, the ack nowledgement wait time T2 of SDLC s econdary station is configured to be 500 ms. Display and Debug DLSw Ta b l e 464 Display and debug DLSw Ty p i c a l D L S w Configuration Example DLSw Configuration of LAN-LAN I.[...]

Typical DLSw Configuration Example 397 II. Networking Diagram Figure 139 Networking diagram of DLSw configuration o f LAN-LAN III. Configuration Procedur e 1 Router A Configuration : [Router] dlsw local 10.120.25.1 [Router] dlsw remote 10.120.5.2 [Router] dlsw bridge-set 5 [Router] interface ethernet 0 [Router-Ethernet0] bridge-set 5 2 Router B Con[...]

398 C HAPTER 25: C ONFIGU RING DLS W II. Networking Diagram Figure 140 Networking diagram of DLSw configuration of SDLC-SDLC III. Configuration Procedu re 1 Router A Configuration: [Router] dlsw local 110.87.33.11 [Router] dlsw remote 202.39.28.33 [Router] dlsw bridge-set 1 [Router] interface serial 0 [Router-Serial0] link-protocol sdlc [Router-Ser[...]

Typical DLSw Configuration Example 399 II. Networking Diagram Figure 141 Networking Diagram of SDLC-LAN III. Configuration Procedur e: 1 Router A Configuration: [Router] dlsw local 110.87.33.11 [Router] dlsw remote 202.39.28.33 [Router] dlsw bridge-set 1 [Router] interface ethernet 0 [Router-Ethernet0] bridge-set 1 2 Router B Configuratio n : [Rout[...]

400 C HAPTER 25: C ONFIGU RING DLS W above example, c1 and c2 are the equi pment of PU2.0 type, and c3 is the equipm ent of PU2.1 ty pe. Diagnosis and T roubleshooting of DLSw Fault The normal communication of DLSw requires the sound coordination between the two SNA equipments and two r outers operating DLSw , which participate in the communication[...]

Diagnosis and Troublesho oting of DLSw Fault 401 active equipment of SDLC (such as AS/4 00 or S390) is activated. Sometimes, communication can be implemented afte r you activate SDLC line manually .[...]

402 C HAPTER 25: C ONFIGU RING DLS W[...]

VI R OUTING Chapter 26 IP Routing Protocol Chapter 27 Configuring Static Routes Chapter 28 Configuring RIP Chapter 29 Configuring OSPF Chapter 30 Configuring BGP Chapter 31 Configuring IP Routin g Policy Chapter 32 Configuring IP Policy Routing[...]

404[...]

26 IP R OUTING P RO T O C O L IP Routing Protocol Overview Routers are used to sel ect the route in the Internet. A router sele cts a suitable path according to the destination host address contained in a r eceived data packet, and sends the data packet to the next router . The last router on the path sends the data packet to the destination host. [...]

406 C HAPTER 26: IP R OUTING P ROTOCO L of the router should be used to tran sfer a data packet to a sub-network or a host, so the packet can reach the next router on this path, or reach the host as a directly connected destination without passing through other routers. The routing table consists of the following key items: ■ Destination address:[...]

Routing Mana gem ent Strategy 407 Figure 143 Routing table illustratio n 3Com routers support not only static route configuration, but also dynamic routing protocols such as RIP , OSPF an d BGP . Depen ding on th e interface status and user configuration, a router can automatically obtain some direct routes during their operation. Routing Managemen[...]

408 C HAPTER 26: IP R OUTING P ROTOCO L Except for the direct r oute (Connected), the priority of each dynamic routing protocol can be manually config ured accord ing to specific requir ements. In addition, each static route can have a differ ent priority . Support of the Route Backup A backup route allows a router to automa tically select another [...]

27 C ONFIGURING S TATIC R OUTES This chapter covers the following topics: ■ Static Route Overview ■ Configuring a Static Route ■ Displaying and Debugging t he Routing T a ble ■ Static Route Configuration Example ■ T r oubleshooting a Static Route Configuration Static Route Overview A static route is a special r oute that allows a router t[...]

410 C HAPTER 27: C ONFIGU RING S TATIC R OUTES Default routes ar e very useful in networ k. In a typical network with hundreds of routers, dynamic r outing protocols may consume lot s of bandwidth resource. Using de fault r oute means t hat you ca n r eplace high bandwidth links with adequate bandwidth links to meet the re quirements of communicati[...]

Displaying and Debugging the Routing Table 411 IP addr ess to the link layer address (such as dialer ro ute ip, x.25 map ip or fr map ip commands, and so on). In this case, you cannot specify the transmitting in terface for the sta tic route and must configure the IP address of the next hop. Actually , all the r oute items must mark th e address of[...]

412 C HAPTER 27: C ONFIGU RING S TATIC R OUTES Static Route Configuration Example By configuring a status route, any two hosts or routes can communicate with each other . Figure 144 Example of static r oute configuration T o configure a static route: 1 Configure the static route for RouterA: [RouterA] ip route-static 1.1.4.0 255.255.255.0 1.1.6.2 [[...]

28 C ONFIGURING RIP This chapter covers the following topics: ■ RIP Overview ■ Configur e RIP ■ Displaying and Debugging R IP ■ RIP - Unicast Configuration Example ■ T r oubleshooting RIP RIP Overview The Routing Info rmation Protocol (RIP) is an interior gateway and dynamic routing protocol based on the Distance-V ector (D-V) routing alg[...]

414 C HAPTER 28: C ONFIGU RING RIP The procedur e of running RIP can be described as follows: 1 When a specific router is starting RIP for the first time, it broadcasts request messages to the neighbor routers. Afte r receiving the r equest messages, the neighbor routers r espond to the request and return response messages including local routing i[...]

Configure RIP 415 ■ Configuring RIP Ho rizontal Segmentation on the Interface ■ Configuring Route Import fo r RIP ■ Specifying Default Route Metric V alue fo r RIP ■ Specifying Additional Route Metric V alues for RIP ■ Setting Route Pr efer ence ■ Configuring Route Distribut ion for RIP ■ Resetting RIP Enabling RIP T o enter RIP view [...]

416 C HAPTER 28: C ONFIGU RING RIP Defining a Neighboring Route r RIP is a broadcast protocol. It ex changes r outing information with non-broadcasting networks in unicast mode. Perform the following configurations in RIP view . Ta b l e 471 Define a Neighboring Router By default, no neighbor in g routers ar e defined. Normally , this command is no[...]

Configure RIP 417 RIP V ersion 2 does not have provisions for a zer o field in its header so this configuration is invalid for RIP-2. Perform the following configurations in RIP view . Ta b l e 473 Configure Check Zero Field of RIP V ersion 1 RIP VERSION 1 ena bles zero fiel d check by default. Specifying the Status of an Interface Y ou can specify[...]

418 C HAPTER 28: C ONFIGU RING RIP By default, the router is en ab led to receive the host routes. Enabling Route Summarization for RIP V ersion 2 Route summarization summarizes the routes of differ ent subnets within the same natural network segment an d sends the su mmary to other network segmen ts as a summarized r oute with a na tural mask. Rou[...]

Configure RIP 419 Configuring RIP Horizontal Segmentation on the Interface RIP is a Distance-V ector algorithm routing pr otocol. It uses the split-horizon algorithm to avoid loop routes. Split-horiz on means that routes received at a certain interface are not sent to the same interface. If correct transmission of routes is mor e important than eff[...]

420 C HAPTER 28: C ONFIGU RING RIP Since the route metric of route import cannot be r everted, the dynamic route information may be significantly distorted. Therefore, r oute import is done cautiously to prevent loss of RIP protocol's performance. Specifying Additional Route Metric V alues for RIP The additional routing metric her e is to add [...]

Displaying and Debugging RIP 421 Configure filtering the routing information bein g advertised Ta b l e 484 Filter the Routing Information Being Advertised by RIP By default, RIP does not filter any rout e information received or being advertised. The protocol attribute specifies the routing domain that can be filter ed. At present, RIP can filter [...]

422 C HAPTER 28: C ONFIGU RING RIP RIP - Unicast Configuration Example RIP is a br oadcast protocol so it can only exchange r outing information with non-broadcasting networks in unicas t mode. This example shows how to configure RIP message unicasting. Router A connects Router B and Router C with serial lines in non-broadcasting networks. Router A[...]

29 C ONFIGURING OSPF This chapter covers the following topics: ■ OSPF Overview ■ Configuring OSPF ■ Displaying and Debugging OSPF ■ OSPF Configuration Example OSPF Overview Open Shortest Path First (OSPF) is an autonomous, link-state-based inter nal routing protocol developed by Internet E ngineering T ask Fo rce (IETF). The current version[...]

424 C HAPTER 29: C ONFIGU RING OSPF 0.0.0.0. All areas must be continuous logically . Thus, a virtual link is introduced to the backbone to ensure that physically se parated ar eas are still connected logically . The r outer between the ASs is called auto nomous system boundary router (ASBR). Routing information, such as static routing, RIP r outin[...]

Configuring OSPF 425 ■ Configuring Sending Packet Cost ■ Configuring a Peer for the NBMA Interface ■ Specifying the Router Priority ■ Specifying the Hello Interval ■ Specifying the Dead Interval ■ Specifying the Retransmitting Interval ■ Specifying the T ransmit-delay ■ Configuring a Stubby Area and a T otally Stubby Area ■ Config[...]

426 C HAPTER 29: C ONFIGU RING OSPF By default, OSPF is disabled. Associating an Area-id with the Specified Interface The OSPF protocol divides the autonomous system in to areas. An ar ea is the logical group of the router . Some routers belong to differ ent areas (called area boundary router ABR), while a network segment can only be in one area. I[...]

Configuring OSPF 427 hello packet before this interface sets up neighboring r elations with the adjacent rou t e rs . The interface can be configured into nbma mode on the broadcast network without multi-access capability . If not all routers are inter -reachable on NBMA network, the interface can be configured into p2mp mode. If the router has onl[...]

428 C HAPTER 29: C ONFIGU RING OSPF The default value of the cost o f sending a pack et on the interface is calculated automatically according to the in terface bau d rat e as follows: The default value is automatically calcul ated accor ding to interface baud r ate. ■ If the baud rate is less than 2000 bps, 2000 is t aken, and the overhead value[...]

Configuring OSPF 429 Specifying the Router Priority It is necessary to establish the peer rela tionship manually between interfaces for multi-point access network, (NBMA and broadcast type networks). But establishing peer relationshipoccupies large amounts of system r esources when there ar e hundreds of r outers in the network. T o resolve this is[...]

430 C HAPTER 29: C ONFIGU RING OSPF Specifying the Hello Interval The Hello packet is periodically sen t to th e neighboring router to find and main tain OSPF neighbor relationship, and to el ect the DR and BDR in the NBMA and broadcast networks. When one router is started, it only sends hello p ackets to the neighbors whose precedences ar e larger[...]

Configuring OSPF 431 Specifying the Retransmitting Interval The router waits for confirmation from the ne ighbor to whom it has sent an LSA. If the router does not receive the neighbor's confirmation after a specified interval, the retransmitting interval, it resends the LSA. Y ou can set the time interval for re-transmitting an LSA. Perform t[...]

432 C HAPTER 29: C ONFIGU RING OSPF information is reduced gr eatly . A default r o uting (0.0.0.0) is generated for the area by the ABR of the area to insure that thes e r outes ar e reac ha ble. A stub area is a n optional configured attribute, but it does no t mean that each area i s configurable. Usually , a stub ar ea is located at the boundar[...]

Configuring OSPF 433 In the following group network, an AS operating the O SPF protocol includes thr ee areas, ar ea 1, area 2, and area 0. Ar ea 0 is the backbone area. The other ASs operate RIP . Area 1 is defined as an NSSA area . After an RIP route adve rtises to the NSSA ASBR that generates a T ype-7 LS A and propagates in Area 1. After the T [...]

434 C HAPTER 29: C ONFIGU RING OSPF which reduces the LSDB in other areas. The configuration of range is only effective when it is configured on teh ABR in the stub area. For example, ther e ar e two network segments in an area a s follows: 202.38.160.0 255.255.255.0 202.38.180.0 255.255.255.0 They are summarized into one networ k segment: 202.38.0[...]

Configuring OSPF 435 The virtual link is acti vated after the r oute thr ough the transit ar ea is calculated. It is equivalent to a point-to-point connec tion between t wo terminals. Parameters can be configured for this connection like a physical interface, such as sending a hello-timer . A “logic channel” is pr ovided for multiple routers ru[...]

436 C HAPTER 29: C ONFIGU RING OSPF ■ dead-timer: 40 seconds Configuring Authentication OSPF supports simple text authentica tion and MD5 authen tication between adjacent routers. Perform the following configurations in int erface view . Ta b l e 502 Configure Authentication By default, the inte rface does not authenticat e OSPF packets. The maxi[...]

Configuring OSPF 437 Ta b l e 503 Configure Route Import for OSPF By default, OSPF does not import routes from other domains into the routing table. The protocol attribute specifies the source r outing domain that can be imported. At present, OSPF can import r outes doma in such as connected, static, RIP , and BGP . See “Configuring Route Import [...]

438 C HAPTER 29: C ONFIGU RING OSPF By default, the cost value is 1, and th e tag value is 1. The imported r oute is external route T ype 2, th e interval of im porting exter nal route is 1 second and at most 150 extern al routes can be imported in each interval. Setting Route Prefer ence Multiple dynamic r outing pr otoc ols may be ex ecuted on th[...]

OSPF Configuration Example 439 OSPF Configuration Example This section describes several dif ferent c onfigurations of OSPF with a suggested procedur e for each configuration Configuring OSPF on the Point-to-Multipoint Network. The configuration for this example includes the following features: ■ Router A communicates with Router B th rough DLCI [...]

440 C HAPTER 29: C ONFIGU RING OSPF [RouterA] interface serial 0 [RouterA-Serial0] ip address 1.1.1 .1 255.0.0.0 [RouterA-Serial0] link-protocol fr [RouterA-Serial0] fr map IP 1.1.1. 2 dlci 101 broadcast [RouterA-Serial0] fr map IP 1.1.1.3 dlci 1 02 broadcast [RouterA-Serial0] fr map IP 1.1.1. 4 dlci 103 broadcast b Enable OSPF [RouterA-Serial0] qu[...]

OSPF Configuration Example 441 c Configure the ar ea-id of the in terface and the interface type [RouterC-ospf] quit [RouterC] interface serial 0 [RouterC-Serial0] ospf enable area 0 [RouterC-Serial0] ospf network-type p2m p [RouterC-Serial0] ospf peer 1.1.1.1 [RouterC-Serial0] ospf peer 1.1.1.2 4 Configure Router D: a Configure the ip addr ess of [...]

442 C HAPTER 29: C ONFIGU RING OSPF II. Networking diagram Figure 148 Networkin g diagram of configuring “DR” selection of OSPF prefer ence III. Configuration pr ocedure 1 Configure Router A: [RouterA] interface ethernet 0 [RouterA-Ethernet0] ip address 192 .1.1.1 255.255.255.0 [RouterA-Ethernet0] ospf dr-priori ty 100 [RouterA-Ethernet0] quit [...]

OSPF Configuration Example 443 Run display ospf peer on Router A to show OSPF peer . Note that Router A has 3 peers. [RouterA] display ospf peer The status of every pe er is full, wh ich means that Router A has created neighboring relation with all peers. Only DR and BDR have cr eated neighboring relation with all routers on the network. Router A i[...]

444 C HAPTER 29: C ONFIGU RING OSPF Configuring an OSPF Virtual Link Area 4 is not directly connected with ar ea 0 in the following diagram. Area 1 serves as the transit ar ea to connect are a 4 and ar ea 0. Configur e a virtual link between Router B and Router C. Figure 149 Networking diagram of configuring OSPF virtual link T o configure an OSPF [...]

OSPF Configuration Example 445 [RouterC] router id 3.3.3.3 [RouterC] ospf enable [RouterC-ospf] interface ethernet 0 [RouterC-Ethernet0] ospf enable area 2 [RouterC-Ethernet0] interface serial 0 [RouterC-Serial0] ospf enable area 1 [RouterC-Serial0] quit [RouterC] ospf [RouterC-ospf] vlink peer-id 2.2.2.2 tr ansit-area 1 Configuring OSPF Peer Authe[...]

446 C HAPTER 29: C ONFIGU RING OSPF [RouterB] ospf enable [RouterB] interface ethernet 0 [RouterB-Ethernet0] ip address 192 .1.1.2 255.255.255.0 [RouterB-Ethernet0] ospf enable ar ea 0 [RouterB-Ethernet0] ospf authentic ation-mode simple 3Com 3 Configure Router C: [RouterC] router id 3.3.3.3 [RouterC] ospf enable [RouterC-ospf] interface serial 0 [[...]

OSPF Configuration Example 447 dial-up mode, although the PPP protocol is enc apsulated on the link layer , it is still NBMA type. The peer must be specified manually . Use the ospf peer ip-address command . ■ If the network type is broadcast network or NBMA, at least the priority of one interface must be over 0. ■ If an area is configured to a[...]

448 C HAPTER 29: C ONFIGU RING OSPF[...]

30 C ONFIGURING BGP This chapter covers the following topics: ■ BGP Overview ■ Configuring BGP ■ Displaying and Debugging B GP ■ BGP Configuration Example BGP Overview Border Gateway Pr otocol (BGP) is an int e r -AS dynamic route discovery protocol. Its primary function is to exchange lo op- free r outing information between ASs automatica[...]

450 C HAPTER 30: C ONFIGU RING BGP The BGP system runs on a specific r outer as a high layer pr otocol. A t system startup, the whole BGP routing table is transmitted for the exchang e of routing information. Later on, only an update message is tr ansmitted for updating the routing tabl e. In the system, ke ep-alive messages ar e received and trans[...]

Configuring BGP 451 ■ Configuring a BGP Community ■ Configuring a BGP AS Confederation Attribute ■ Configuring Route Dampening ■ Configuring Synchronization of BGP and IGP ■ Configuring the Interactions between BGP and an IGP ■ Defining an Access List Entry , an AS Path-list Entry , a Routing Policy ■ Configuring a Route Filter for BG[...]

452 C HAPTER 30: C ONFIGU RING BGP BGP peer advanced configurati on incl udes the following steps: 1 Configure the connection between EBGP peers th at are connected indirectly . Ta b l e 511 Configure Connection Between EBGP Peers Connected Indirectly By default, the BGP co nnecti on can be established with a directly connected peer router . 2 Conf[...]

Configuring BGP 453 Ta b l e 515 Configure to Send Community Attribute to the Pee r By default, the community attrib utes are not sent to the peer . 6 Configure the peer to be the client of the r oute reflector . Ta b l e 516 Configure the Peer to be the Client of the Route Reflector 7 Configure to distribute default r oute to the peer . Ta b l e 5[...]

454 C HAPTER 30: C ONFIGU RING BGP By default, the route from the peer or pe er group is not designated with any route policy . 10 Create an filtering policy ba sed on access list for the peer . Ta b l e 520 Create a Fltering Policy Based on Access List for the Peer By default, no r oute filtering policy based on IP ACL for a peer is set. 11 Create[...]

Configuring BGP 455 By default, MED values from dif ferent AS neighboring r outes are not compar ed when determining the best route. This configuration should not be used unle ss it is certain that differ ent ASs uses the same IGP and routing modes. Configuring the Local Pr eferen ce Configuring different local prefer ences affects BGP r outing sel[...]

456 C HAPTER 30: C ONFIGU RING BGP holdtime-interval attribute is 180 seconds and may have a time interval ranging from 3 to 42949675 seconds. Configuring a BGP Peer Group The BGP peer gr oup command can be used for user configuration. When starting several peers of the same configuration, you can first create and configure one peer group, then add[...]

Configuring BGP 457 T o configure an advanced BG P peer group configuration: 1 Configure the AS number of BGP peer group Ta b l e 528 Configure AS Number of BGP Peer Group By default, there is no AS number for BGP peer group. 2 Configure connection betwee n peers indirectly connected Ta b l e 529 Configure Connection Between Peers Indirectly Connec[...]

458 C HAPTER 30: C ONFIGU RING BGP By default, send no community attribute to any peer group. 6 Configure a peer group as the client of a BGP reflector In general, the AS requires that all the IBGP routers should be connected to one another , and the routes sent by the IBGP neighbors is not advertised, to prevent route l oop. However , if the route[...]

Configuring BGP 459 By default, the route fr om the peer or pe er gro up is not de signated with a ny r oute policy . 10 Create a filtering policy based on the access list for the peer group Ta b l e 537 Create a Filtering Policy Based on Access List for Peer Group By default, no rout e fi ltering polic y based on IP ACL for peer gr oup is set. 11 [...]

460 C HAPTER 30: C ONFIGU RING BGP By default, an aggr egate is disabled. Configur e BGP Route Reflector T o guarantee the connectivity between t h e IBGP peers, an all-closed network should exist between IBGP peers. In some networks, the int ernal B GP network can become very large (with more than one hundred sessions in each r outer), resulting i[...]

Configuring BGP 461 The non-clients must form an all-closed ne twork with the reflector , as they follow the basic rules of IBGP . A client should not be peer o f othe r inter nal speakers outside its cluster . The r eflecting function is achieved only on the route reflector . All the clients and non-clients are normal BGP peers irr elevant to the [...]

462 C HAPTER 30: C ONFIGU RING BGP Ta b l e 542 Configure the Cluster ID By default, the router ID of the rout e reflector is used as the cluster ID. Configuring a BGP Community In BGP range, a community is a logical ar ea formed by a group of destinatio ns which share common attributes for applying the route policy . A community is n ot limited to[...]

Configuring BGP 463 The disadvantage is that when a non-confederation scheme ch anges to a confederation scheme, it is required to reconfigur e the router and to modify the logical topology . In addition, if the BGP strategy is not manually configured, the best path may not be selected through the confederation. 1 Configure a Confederation Y ou can[...]

464 C HAPTER 30: C ONFIGU RING BGP Configuring Route Dampening Route instability is frequently indicated when a r oute disa ppears that used to exist in the routing table. This route may r ea ppear and disappear fr equently , which is called routing flapping. When ther e is route flapping, the UPDA TE and WITHDRA WN messages are br oa dcast repeate[...]

Configuring BGP 465 Ta b l e 547 Configure Route Dampening By default, route dampening is disabled. 2 Display route flap information. Perform the following configurations in system view . Ta b l e 548 Display Route Flap Information Configuring Synchronization of BGP and IGP BGP protocol pr escribes that a BGP router does not advertise the dest inat[...]

466 C HAPTER 30: C ONFIGU RING BGP peer and advertises it to other EBGP peers, it will try to check whether this destination can be reached through its AS. Perform the following configurations in BGP view . Ta b l e 549 Configure Synchron ization of BGP and IGP By default, BGP synchr onizes with IGP . 3Com routers pr ovide the ability to canc el BG[...]

Configuring BGP 467 Ta b l e 551 Allow the Import of Network 0.0.0.0 into the BGP By default, the import of netwo rk 0.0.0.0 into BGP is disabled. Defining an Access List Entry , an AS Path-list Entry , a Routing Policy This section describes the configuration of an access list, an AS path list, and a rout in g po licy . Define an access list entry[...]

468 C HAPTER 30: C ONFIGU RING BGP Perform the following confi gurations in system view . Ta b l e 553 Define a Routing Policy Define a match rule Perform the following configuratio ns in BGP Routing policy view . Ta b l e 554 Define a Match Rules By default, AS regular expression, commun ity list, interface ty pe, IP add ress range, and metric val[...]

Configuring BGP 469 By default, AS serial numbe r , BGP community attribute, next hop, local prefer ence, metric value, and origin attributes are not applied. See “Define Apply Clause “of “Config uration of IP Routing Policy” for details. Configuring a Route Filter for BGP Perf orm the following configurations in BGP view . Configure a r ou[...]

470 C HAPTER 30: C ONFIGU RING BGP Configure Filtering Route Information being Advertised by BGP Ta b l e 557 Filter Routing Information Being Advertised by BG P By default, BGP does not filter any route information that is received or advertised. protocol specifies the routing domain that can will be filter ed. At present, BGP can filter route dom[...]

BGP Configuration Example 471 BGP Configuration Example This section describes several dif ferent configurations of BGP with a suggested procedur e for each configuration. Configuring the AS Confederation Attribute As sh own in the following d iagram, AS 1 00 is divided into 3 sub-ASs: 1001, 1 002, 1003, which are configur ed with EBGP , confederat[...]

472 C HAPTER 30: C ONFIGU RING BGP Figure 154 Networkin g diagram of configuring AS confederation 1 Configure Router A: [RouterA] bgp 1001 [RouterA-bgp] undo synchronization [RouterA-bgp] confederation id 100 [RouterA-bgp] confederation peer-a s 1002 1003 [RouterA-bgp] peer 172.68.10.2 as- number 1002 [RouterA-bgp] peer 172.68.10.3 as- number 1003 [...]

BGP Configuration Example 473 Figure 155 Networking diagram of con figuring route r eflector 1 Configure Router A: [RouterA] bgp 100 [RouterA-bgp] undo synchronization [RouterA-bgp] peer 192.1.1.2 as-number 200 [RouterA-bgp] interface serial 0 [RouterA-Serial0] ip address 192.1.1.1 255.255.255.0 2 Configure Router B: a Configure BGP peers [RouterB][...]

474 C HAPTER 30: C ONFIGU RING BGP [RouterC-Serial0] ip address 193.1 .1.1 255.255.255.0 d Configure Serial 1 [RouterC-Serial0] interface serial 1 [RouterC-Serial1] ip address 194.1 .1.1 255.255.255.0 [RouterC-Serial1] ospf enable area 0 4 Configure Router D: a Configure BGP peers [RouterD] bgp 200 [RouterA-bgp] undo synchronization [RouterD-bgp] p[...]

BGP Configuration Example 475 Figure 156 Networking diagram of con figuring BGP path selection 1 Configure Router A: [RouterA] interface serial 0 [RouterA-Serial0] ip address 192.1.1.1 255.255.255.0 [RouterA] interface serial 1 [RouterA-Serial1] ip address 193.1.1.1 255.255.255.0 [RouterA-Serial1] quit a Start BGP [RouterA] bgp 100 [RouterA-bgp] un[...]

476 C HAPTER 30: C ONFIGU RING BGP 2 Configure Router B: [RouterB] interface serial 0 [RouterB-Serial0] ip address 192.1.1.2 255 .255.255.0 [RouterB] interface serial 1 [RouterB-Serial1] ip address 194.1 .1.2 255.255.255.0 [RouterB] ospf enable [RouterB-ospf] network 194.1.1.0 0 .0.0.255 area 0 [RouterB-ospf] network 192.1.1.0 0 .0.0.255 area 0 [Ro[...]

BGP Configuration Example 477 [RouterD-ospf] network 4.0.0.0 0.0.0.255 area 0 [RouterD] bgp 200 [RouterD-bgp] undo synchronization [RouterD-bgp] peer 194.1.1.2 as-number 100 [RouterD-bgp] peer 194.1.1.2 as-number 200 T o make the configuration effectiv e, use the reset bgp all command to r eset all BGP neighbors.[...]

478 C HAPTER 30: C ONFIGU RING BGP[...]

31 C ONFIGURING IP R OUTING P OLICY This chapter covers the following topics: ■ IP Routing Policy Overview ■ Configure IP Routing Policy ■ Displaying and Debugging IP R outing Policy ■ Configuring IP Routing Policy ■ T r oubleshooting IP Routing Policy IP Routing Policy Overview During the information exchange with a peer router , the rou[...]

480 C HAPTER 31: C ONFIGU RING IP R OUTING P OLICY Routing Policy A routing policy matches attributes of the given routing information and sets some attributes of the routing information when the conditions are matched. A routing policy contains several "if-mat ch" clauses and "apply" clauses. The "if-match" clauses sp[...]

Configure IP Routing Policy 481 community . Actually , it is a method of grouping accor ding to the destination address wher e the packets a re sent. Afte r gr ouping, the whole group of r outing information should be distributed, receiv ed or imported. The community-list is an access list based on community information, used for the BGP protocol. [...]

482 C HAPTER 31: C ONFIGU RING IP R OUTING P OLICY Define a Matching Rules The if-match clause defines matching ru les to meet th e filter ing conditions of the routing information of the current r outing policy . The matched objects ar e the attributes of this routing information. Perform the following configurat ions in routing policy view . Ta b[...]

Configure IP Routing Policy 483 be filtered thr ough the routing policy unless it matches all if-match clauses of this part and it can execute the operation of teh apply sub-clause. ■ If an if-match clause is not specified, all r outing information is filter ed through the policy of this n ode. Defining an Apply Clause The apply clause specifies [...]

484 C HAPTER 31: C ONFIGU RING IP R OUTING P OLICY Ta b l e 563 Configure Route Import By default, a protocol does not import routes from other domains into the its routing table. protocol specifies the source routing domain that can be imported. At present, it can import routes domain such as direct , static, RIP , OSPF , OSPF-ASE and BGP . Softwa[...]

Configure IP Routing Policy 485 type is the type of ospf extern al route corr esponding to the imported route when ospf is importing other protocol r outes. type 1 re fers to external r ou te type 1 and type 2 refe rs to ex t ernal r oute type 2. The metric value of the imported r oute can be set as the following: 1 Specify the metric value with th[...]

486 C HAPTER 31: C ONFIGU RING IP R OUTING P OLICY Ta b l e 565 Configure Filtering Route Information Received 2 Configure filtering the route information being advertised Define a strategic rule and quote an AC L or prefix-list to filter the routing information that does not meet the requirements when r eceiving routes. Specify the protoc ol to fi[...]

Configuring IP Routing Po lic y 487 Ta b l e 567 Display and Debug of IP Routing Policy Configuring IP Routing Policy This example explains how an OSPF pr ot ocol selectively imports an RIP ro ute. As shown in the following figure, the router connects a campus network which uses RIP as its internal routing protocol and an external area ne twork whi[...]

488 C HAPTER 31: C ONFIGU RING IP R OUTING P OLICY Figure 158 Networking diagram of configuring OSPF r oute filtering 1 Configure Router A: a Configure static r outes: [RouterA] ip route-static 20.0.0.1 32 ethernet 0 [RouterA] ip route-static 30.0.0.1 32 ethernet 0 [RouterA] ip route-static 40.0.0.1 32 ethernet 0 b Start OSPF protocol. [RouterA] ro[...]

Troubleshooting IP Routing Po licy 489 Figure 159 Networking diagram of filtering th e distributed r outing information 1 Configure ip-pr efix [Router] ip ip-prefix p1 permit 192.1.1. 0/24 2 Configure RIP protocol [Router] rip [Router-rip] network 192.1.0.0 [Router-rip] network 202.1.1.0 [Router-rip] filter-policy ip-prefix p1 export T roubleshooti[...]

490 C HAPTER 31: C ONFIGU RING IP R OUTING P OLICY[...]

32 C ONFIGURING IP P OLICY R OUTING This chapter covers the following topics: ■ IP Policy Routing Overview ■ Configuring IP Policy Routing ■ Displaying and Debugging IP Policy Routing ■ IP Policy Routing Configuration Example IP Policy Routing Overview IP policy routing is a mechanism in which messages are transmitted and forwar ded by stra[...]

492 C HAPTER 32: C ONFIGU RING IP P OLICY R OUTI NG Creating a Routing Policy The strategy specified with the strategy name may have several strategy points and each strategy poin t is specified with sequence-num . The smaller the sequence-num , the higher t he prefer ence and the defined strategy will be executed first. This strategy can be used t[...]

Displaying and Debugging IP Policy Rou ting 493 Y ou can specify multiple next-hops or se nd th e message to multiple interfaces. Generally , only th e first para meter works. If the first parameter is mismatched, the second parameter will take effect, and so on. By default, no apply clause is defined. Enabling and Disabling Local Policy Routing Pe[...]

494 C HAPTER 32: C ONFIGU RING IP P OLICY R OUTI NG IP Policy Routing Configuration Example This section describes two differ ent configurations for IP policy routing with a suggested procedur e for each configuration. Configur e Policy Routing Based on Source Addr ess Define a policy named “aaa” that incl udes two nodes, through which all TCP [...]

IP Policy Routing Configurati on Example 495 4 Adopt policy aaa in Ether net interface [Router-route-policy] interface ethernet 0 [Router-Ethernet0] ip policy route-polic y aaa Configure Policy Routing Based on Message Size Router A sends the messages of 64-100 bytes through S0, messages of 101-1000 bytes through S1 and those of other sizes must be[...]

496 C HAPTER 32: C ONFIGU RING IP P OLICY R OUTI NG [RouterA] debugging ip policy-routi ng IP: s=151.1.1.1(local),d=152.1.1.1, len 64, policy match IP: r oute map lab1, item 10, permit IP: s=151.1.1.1(local),d=152.1.1.1, len 64, policy routed IP: local to serial 150.1.1.2 On Router A, change the message s ize to 101 bytes and monitor policy routing[...]

VII M ULTICAST Chapter 33 IP Multicast Chapter 34 Configuring IGMP Chapter 35 Configuring PIM-DM Chapter 36 Configuring PIM-SM[...]

498[...]

33 IP M ULTICAST This chapter covers the following topics: ■ IP Multicast Overview ■ IP Multicast Addresses ■ IP Multicast Features ■ IP Multicast Routing Protocols ■ IP Multicast Packet Forwarding ■ IP Multicast Application IP Multicast Overview When the destination ad dresses carrying information (data, voice, and video) transmit with[...]

500 C HAPTER 33: IP M ULTICAST Class D address is 1110, the range of the multicast addresses is from 224.0.0.0 to 239.255.255.255. The multicast group can be either permanent or temporary . The permanent gr oup has a constant group address assigned by IANA, while the number of members in the group can be random, even zer o. T empo rary multicast gr[...]

IP Multicast Routing Protocols 501 the IP multicast environment, the destinat ion address of a data packet is not one address but a group, forming a group addr ess. All the information re ceivers are added to a group, and once they access th e group, data flowing to the destination address begin to transmit to the r eceivers of that particular grou[...]

502 C HAPTER 33: IP M ULTICAST Multicast Routing Protocol The gr oup address in the multicast protocol is a virtual address. Therefor e, unlike unicast, data packets cannot be routed di r ectly from the data source to the specific destination address. The multic ast application pr ogram sends the data packet to a group of r eceivers instead of a si[...]

IP Multicast Packet Forwarding 503 The transmitting end is first register ed at the RP if it needs to send data to a specific address, and then sends the data to the RP . Once data reaches the RP , multicast data packets are duplicated and sent to receivers who ar e interested in getting them along the distribution tree path. The duplication only o[...]

504 C HAPTER 33: IP M ULTICAST[...]

34 C ONFIGURING IGMP This chapter covers the following topics: ■ IGMP Overview ■ Configuring IGMP ■ Displaying and Debugging IGMP ■ IGMP Configuration Example IGMP Overview The Inter net Group Management Protocol (IGM P) is a pr otocol that is r esponsible for the IP multicast member man agement among the TCP/IP protocol family . It is the [...]

506 C HAPTER 34: C ONFIGU RING IGMP IGMP is asymmetric between hosts and ro uters. The host re sponds to the IGMP query message of the multicast router , a nd makes a r esponse in the membership report message. The r outer periodically sends a general quer y message. Then it determines, based on the re sponse message received, whether a specific gr[...]

Configuring IGMP 507 Configuring the V ersion Number of IGMP at the Router Interface IGMP V e rsion 2 is able to configure query message timeout and the maximum query response time. All the systems in th e same subnet must run the same IGMP version because the routers ar e not able to check the version number of IGMP currently running on the interf[...]

508 C HAPTER 34: C ONFIGU RING IGMP The default maximum query r esponse time is 10 seconds but ranges from 1 to 25 seconds. This configuration can only be carried out if the current router interface is operating IGMP V er s io n 2. Configuring Subnet Querier Survival Time When there are several routers operating IGMP in a subnet, one r outer is cho[...]

IGMP Configuration Example 509 Figure 162 IGMP network diagram 1 Configure the IP addr esses of the interfa ces of Router A, Router B and the PC. [RouterA] interface e0 [RouterA-Ethernet0 ]ip address 10.16.1.3 24 [RouterB] interface e0 [RouterB-Ethernet0] ip address 10.16.1.2 24 2 Execute the multicast r outing-enable command on 3Com A and 3Com B t[...]

510 C HAPTER 34: C ONFIGU RING IGMP[...]

35 C ONFIGURING PIM-DM This chapter covers the following topics: ■ PIM-DM Overview ■ PIM-DM Configuration ■ Displaying and Debugging PIM-DM ■ PIM-DM Configuration Example PIM-DM Overvie w Protocol Independent Multicast--Dense Mode (PIM-DM) is applicable to the following conditions: ■ The transmitter and the receiver are clos e to each oth[...]

512 C HAPTER 35: C ONFIGU RING PIM-DM operating IGMPv1 (each PIM router pe riodically broadcasts a hello message, and the route r with higher IP addr ess is chosen to be the D R). ■ Graft Message: The host informs the router which multicast gr oups it wants to join by a IGMP memb ership report message. At this time, the p ort sends a graft messag[...]

Displaying and Debugging PIM-DM 513 Starting the PIM-DM Protocol Y ou must start the PIM-DM protocol at each interface. By default, the system disables the PIM-DM protocol. Make the following configuration in the interface view . Ta b l e 584 Start/Disable PIM-DM Protocol Configuring the Time Interval for Hello Messages After the interface st arts [...]

514 C HAPTER 35: C ONFIGU RING PIM-DM After making the previous configuration, execute the display command in all views to display the running of the PIM-DM configur ation, and to verify the effect of the configuration. Execute the debugging command in system view to debug PIM-DM. PIM-DM Configuration Example In this example, the multicast source s[...]

36 C ONFIGURING PIM-SM This chapter covers the following topics: ■ PIM-SM Overview ■ PIM-SM Configuration ■ Displaying and Debugging PIM-SM ■ PIM-SM Configuration Example ■ T r oubleshooting PIM-SM PIM-SM Overview Protocol Independent Multicast--Sparse Mo de (PIM-SM) is used in the following conditions: ■ The distribution of the group m[...]

516 C HAPTER 36: C ONFIGU RING PIM-SM neighbors. The hello message also t akes charge of choosing a DR for the router operating IGMPv1. ■ Register Message: When the DR receiv es the multicast message sent by the host in the local network, it encapsulates it in the register message and unicasts it to the RP to distribute the message along the RP t[...]

PIM-SM Configuration 517 Ta b l e 588 Enable/Disable PIM-SM Protocol By defaul t, the inter face disables PIM-SM pr otocol . Note that PIM-S M only runs on spec ific interfaces. One interf ace can only run one multicast r outing pr otoc ol at one time. Configuring the Candidate BSR In a PIM-SM domain, there must be a unique bootstrap r outer to ena[...]

518 C HAPTER 36: C ONFIGU RING PIM-SM By default, no interface is c onfigured to be candidate RP . Use pim command in system view to enter PIM view . Generally , only one C-BSR and on e C-RP are configur ed in the network, and usually it is the same router . Only one C-BSR can be configured for a single router . The latter configured C-BSR replaces[...]

Displaying and Debugging PIM-SM 519 By default, the time interval of interfa ce sending Hello messag e is 30 seconds. Configuring the Threshold of the Shortest Path The PIM-SM router first forwards multicast data packets by the shared tr ee. But if the multicast data rate exce eds a certain threshold value, the r outer for the last hop of multicast[...]

520 C HAPTER 36: C ONFIGU RING PIM-SM After the above configurat ion, execute the display command in all views to display PIM-SM configuration, and to verify the effect of the configuration. Executethe debugging command in system view for the debugging of PIM-SM. PIM-SM Configuration Example In the actual network, because differ ent manufacturers p[...]

Troubleshooting PIM-SM 521 [RouterB-Serial1] pim sm [RouterB] interface serial 2 [RouterB-Serial2] pim sm b Configure the candidate BSR [RouterB-pim] c-bsr serial 0 30 2 c Configure the candidate RP [RouterB-pim] acl 5 [RouterB-acl-5] rule permit source 225. 0.0.0 255.0.0.0 [RouterB-acl-5] pim [RouterB-pim] c-rp serial 0 accept-poli cy 5 d Configur[...]

522 C HAPTER 36: C ONFIGU RING PIM-SM[...]

VIII S ECURITY Chapter 37 Configuring T erminal Access Security Chapter 38 Configuring AAA and RADIUS Protocol Chapter 39 Configuring Firewall Chapter 40 Configuring IPSec Chapter 41 Configuring IKE[...]

524[...]

37 C ONFIGURING T ERMINAL A CCESS S ECURITY This chapter pr ovides an overview to the security features pr ovided for terminal access of 3Com routers and covers the fo llowing topics: ■ T erminal Access Security Overview ■ Configuring T erminal Access Security ■ EXEC Configuration Example T erm inal Access Security Overview 3Com routers adopt[...]

526 C HAPTER 37: C ONFIGU RING T ERMINAL A CCESS S ECURITY By default, no user is config ured. Configuring User Login Authentication All users who access a router through a term inal are called terminal users. 3Com routers divide terminal users into five types: ■ Asynchronous port terminal user ■ X.25 P AD calling user ■ Console port user ■[...]

EXEC Configuration Example 527 ■ An administrator user using the co nsole port ■ An operator user using telnet Configureng Administrator User Login Authentication fr om a Console Port In this example, the u ser name is abc and the password is hello. The RADIUS server first authenticates the user , and then local authentication is used when the [...]

528 C HAPTER 37: C ONFIGU RING T ERMINAL A CCESS S ECURITY[...]

38 C ONFIGURING AAA AND RADIUS P RO T O C O L This chapter covers the following topics: ■ AAA Overview ■ RADIUS Overview ■ Configuring AAA and RADIUS ■ Displaying and Debugging AAA and RADIUS ■ AAA and RADIUS Configuration Examples ■ T r oubleshooting AAA and RADIUS AAA Overview AAA implements the following network security services: ?[...]

530 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL responsible for receiving a user's r equest for connection, authen ticating the user , and returning the requir ed information to NAS. The RADIUS server main tains three databases: ■ Users: stores user information, such as username, password, applied protocols, IP address ■ Clients: s[...]

RADIUS Overview 531 Figure 166 Basic message interaction pr ocess of RADIUS The basic operation is described as follows: 1 The user enters a user name and password. 2 Having received the username and pa ssword, teh RADIUS client sends an authentication request packet (Access- Request) to the RADIUS server . 3 The RADIUS server authenticates the use[...]

532 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL Figure 167 RADIUS packet structur e The Identifier field is used to match request packets and r esponse requests. It varies with the Attribute field and the valid received r esponse packets, but r emains unchanged during retransmission. The Authen ticator field (16 bytes) is used to authentica[...]

Configuring AAA and RADIUS 533 Ta b l e 598 Attribute Fi elds Attribute field 26 (V ender -Specific) in the RADIUS protocol can be easily extended, so that the user can define extension attrib utes. Figure 168 shows the packet structure: Figure 168 Fragment of the RADIUS packet that includes extension attribute Configuring AAA and RADIUS Configurin[...]

534 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL ■ Assigning an IP Addr ess for a PPP User ■ Configuring a Local User Database ■ Configure RADIUS Server Enabling and Disabling AAA Please perform the follo win g configurations in the system view . Ta b l e 599 Enable/Disable AAA By default, AAA is disabled. Configuring the Authenticatio[...]

Configuring AAA and RADIUS 535 methods the subsequ ent methods can be used. If authentication again, the authentication is terminated. The none method is meaningful only when it is the last item of the method list. Note th at only one login method list can be configured, which can use a different name from the previously configur ed list. The lates[...]

536 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL ■ aaa authentication-scheme p pp default radius local Differ ent PPP authentication method lists can be configured for differ ent interface s. Configuring the Local-First Authentication of AAA When local-first authentication is configured , the user is authenticated locally first. If local a[...]

Configuring AAA and RADIUS 537 The pool-number ranges from 0 to 99. Addr esses in each address pool must be consecutive, and each address pool can have at most 256 addr esses. Assigning an IP Addr ess for a PPP User For a user accessin g the Internet through remote PPP dialing, the system either specifies an addr ess or allocates an u noccupied add[...]

538 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL The Call back techniqu e enhances sec urity . In the pr ocessing of a Callback, th e server calls the client accor ding to the ca ll number configured locally . This avoids security risks caused by leakage of user name or password. The server can also classify call-in requests according to its[...]

Configuring AAA and RADIUS 539 Ta b l e 609 Configure F TP User and the Usable Directory Authorize a Us er with Us able Service T ypes The services, which can be used by a user , ar e authorized in the local database. Presently ther e ar e five service types, which are listed as follows: ■ exec refers to operations that include loggi ng in to the[...]

540 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL ■ When the RADIUS server used first does not respond, the succeeding servers are used in sequence. When the authentication or accounting po rt number is configured to 0, the client does not use the authentication or accounting function provided by the server . Ta b l e 611 Configure IP Addre[...]

Configuring AAA and RADIUS 541 Configure the Request Retransmission Times If the RADIUS server fails to respond, th e router sends the authentication request packet again periodically . If no RADIUS server r esponse is received after the configured value of timeout, the authen tication request pa cket need s to be transmitted again. Th e user can s[...]

542 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL By default, the real-time accounting packet is sent to th e RADIUS server at an interval of 0 minutes, indicati ng that real-time accounting is disabled. The inter val ranges from 0 to 32767 minutes. Displaying and Debugging AAA and RADIUS Use the debugging and display commands in all modes. T[...]

AAA and RADIUS Configuration Examples 543 Figure 169 Networking diagram of typical AAA and RADIUS configuration 1 Enable AAA and configure default authentication metho d list of PPP user . [Router] aaa-enable [Router] aaa authentication-scheme ppp d efault radius 2 Configure IP addr ess and port of RADIUS server . [Router] radius server 129.7.66.66[...]

544 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL 3 Configure RADIUS server [Router] radius server 129.7.66.66 authentication-port 1000 accounting-port 1001 [Router] radius server 129.7.66.67 4 Configure RADIUS server shared secr et, retransmission times, and time length of timeout timer [Router] radius shared-key this-is -my-secret [Router] [...]

Troubleshooting AAA and RADIUS 545 unavailable. Moreover as the radius timer quiet command has not been configured (defaulted as 5 minutes), or a r elative long dead-time has been configured, the system does not know that the server has recover ed. Use undo radius server command to delete the original RADIUS server , and r econfigur e it by radius [...]

546 C HAPTER 38: C ONFIGU RING AAA AND RADIUS P ROTOCOL[...]

39 C ONFIGURING F IR EWALL This chapter covers the following topics: ■ Firewall Ov erview ■ Configure Fir ewall ■ Displaying and Debugging Firewall ■ Firewall Configuration Example Firewall Overview A fir ewall is used to control the network equipment, which accesses the internal network resour ces. Setting a firewall at the access entry po[...]

548 C HAPTER 39: C ONFIGU RING F IREWALL Classification of Firewall s Usually firewalls ar e divided into two type s: network layer fire walls and application layer firewalls. A network layer fir ewa ll mainly obtains the packet head information of data packets, s uch as pr otocol number , source address and source port, destination address and des[...]

Firewall Overview 549 Figure 171 Packet filtering schematic diagram The following can be realized by data packet filtering: ■ Prohibit logging on with telnet from outside ■ Every E-mail is sent by S MTP (S imple Message T ransfer Protocol). ■ One PC, rather than all other PCs, can send news to us by NNTP (Network News T ransfer Protocol). Pac[...]

550 C HAPTER 39: C ONFIGU RING F IREWALL acl acl-number [ match-order confi g | auto ] rule { normal | special }{ permit | deny } [source source-addr source-wildcard | any ] ■ Extended access contr ol list acl acl-number [ match-order confi g | auto ] rule { normal | special }{ permit | deny } pro-number [source source-addr source-wildcard | any [...]

Firewall Overview 551 Ta b l e 619 Mnemonic Symbol of the Port Number Protocol Mnemonic Symbol Meaning and Actual Value TCP bgp chargen cmd daytime discard domain echo exec finger ftp ftp-data gopher hostname irc chat klogin kshell login lpd nntp pop2 pop3 smtp sunrpc syslog tacacs talk telnet time uucp whois www Border Gateway Protocol (179) Chara[...]

552 C HAPTER 39: C ONFIGU RING F IREWALL As for the ICMP , you can sp ecify the ICMP packet type. Y ou can use a number (ranging 0 to 255) or a mnemonic sy mbol to specify the packet type. UDP biff bootpc bootps discard dns dnsix echo mobilip-ag mobilip-mn nameserver netbios-dgm netbios-ns netbios-ssn ntp rip snmp snmptrap sunrpc syslog tacacs-ds t[...]

Firewall Overview 553 Ta b l e 620 Mnemonic Symbol of the ICMP Message T ype By configuring the firewall and adding appropriate access rules, you can use packet filtering to check IP packets that pass the router . The passing of unexpected packets can thus be prohibited. In this way the packet filtering helps to protect the network security . Confi[...]

554 C HAPTER 39: C ONFIGU RING F IREWALL The “depth -f ir st ” pr in ci ple means matchi ng the access rules with the smallest definition range of data p ackets. It can be achieved by comparing the wildcards of address. The smaller the wildcards ar e, the smaller the range specified by th e host is. For example, 129.102.1.1. 0.0.0.0 specifies a[...]

Configure Firewall 555 Configuring Standard Access Control List The value of the standard access contr ol list is an integer from 1 to 99. First of all, enter the ACL view through acl command, and configure the match sequence of the access control list, and then configur e specific access rules through rule command. If the matching sequence is not [...]

556 C HAPTER 39: C ONFIGU RING F IREWALL normal means that this rule functions during normal time range, while special means that this rule will function dur ing the special time range . Users shall set the special time range when using special . Multiple rules with the same serial number will be matched accordi ng to “depth-first”principle. By[...]

Configure Firewall 557 one to use after viewing the current time range (special or normal). For example, the current system time is in special time range (which is defined by rule special acl-number ), and then the special time range ru les will be used for filtering. But when the current system time is switched to the normal time range (which is d[...]

558 C HAPTER 39: C ONFIGU RING F IREWALL Ta b l e 627 Configure Rules for Applying Access Contr ol List on Interface By default no rule for filtering me ssages on interface is specified. In one direction of an interface ( inbound or outbound ), up to 20 access rules can be applied. That is to say , 20 rules can be applied in firewall packet-filter [...]

Firewall Configuration Examp le 559 www server address 129.38.1 .3. Th e enterprise address to the outside is 202.38.160.1.Address conversion has been co nfigured on the router so that the internal PC can access the Internet, and the external PC can access the internal server . By configuring a firewa ll, the following are expected: ■ Only specif[...]

560 C HAPTER 39: C ONFIGU RING F IREWALL 6 Configure rules to permit specific user to obtain data (only packets of port greater than 1024) from an external network [Router-acl-102] rule permit tcp source any destination 202.3 8.160.1 0.0.0.0 destination-port greater-t han 1024 7 Apply rule 101 on packets comin g in from interface Ether net0 [Router[...]

40 C ONFIGURING IPS EC This chapter covers the following topics: ■ IPSec Protocol Overview ■ Configuring IPSec ■ Crea ting a Se curity Policy ■ Displaying and Debugging IPSec ■ IPSec Configuration Example ■ T r oubleshooting IPSec IPSec Protocol Overview IPSec is the general name of a series of network security protocols that provide se[...]

562 C HAPTER 40: C ONFIGU RING IPS EC state by po lling. Thus , crypto car ds can synchronously pr oce ss user data, which improves the speed of data encryption and decryption. For the IPSec applied at the crypto card side, the crypto card s will be unable to implement the IPSec processing if all th e crypto cards on the router ar e in abnormal sta[...]

Configuring IPSec 563 policy with smaller sequence number in the same security policy group is of higher prio r ity . ■ SA (Security Association): IPSec provides security service for data str eams through security association, which in cl udes protocol, algorithm, key and other contents and sp ecifies how to process IP messages. An SA is a unidir[...]

564 C HAPTER 40: C ONFIGU RING IPS EC authentication and encrypt ion, for instance), it is necessary to create two dif fer ent encryption access control lists and apply them to different security policies. Encryption access control list can be us ed to judge both inbound communication and outb ou n d co mmu n i ca tion. T o create an encryption acc[...]

Configuring IPSec 565 Configure NDEC Car d s Enable the crypto car ds When several crypto car ds on the r out er work simultaneously , The commands enable and disable can be used to manage the crypto car ds. T o facilitate the management and debugging, yo u can set a cr ypto card to be in disabled state (disable the crypto card to pr ocess data) or[...]

566 C HAPTER 40: C ONFIGU RING IPS EC Ta b l e 634 Enable/Disable the Host to Backup the NDEC Cards By default, the host is disabled to backup the crypto cards. Defining IPSec Proposal The IPSec saved in conversion mode ne eds a special security protocol and encryption/authentication algorithm to provide various security parameters for the IPSec ne[...]

Configuring IPSec 567 The default mode is tunn el-encapsulat io n mo de. Select Security Protocol After the transport mode is defined, it is necessary to select the security protocol for the transport mode. The security protoc ols available at present include AH and ESP , both o f which can also be used at th e same time. Both ends of security tunn[...]

568 C HAPTER 40: C ONFIGU RING IPS EC Perform the following configur ations in IPSec proposal view (or proposal view of crypto card) Ta b l e 638 Select Encryption Algorithm and Authentication Algorithm By default, ESP protocol adopts des encryption algorithm and md5- hmac-96 authentication algorithm, and AH protocol adopts md5-hmac-96 authentica t[...]

Creating a Security Policy 569 higher priority . When a security policy group is applied on an interface, actually multiple differ ent security policies in th is security policy gr oup are applied on it at the same time, so that dif fer ent data str eams a r e pr otected by dif fer ent SAs. Creating a Security Policy Manually Perform the following [...]

570 C HAPTER 40: C ONFIGU RING IPS EC By default, the sta rt poin t and the end point of the security tunnel are not specified. Set IPSec proposal quoted in security policy When SA is cr eated manually , a security policy can quote only one IPSec proposal, and to set new IPSec proposal, the previously configured one must be deleted first. If the lo[...]

Creating a Security Policy 571 Perform the following configurations in IPSec policy view . 1 Set SPI parameters for the security policy association Ta b l e 643 Configure SPI Parameters of Security Policy Association By default, no SPI value of inbound/outbound SA is set. 2 Set the key used by the security policy association Ta b l e 644 Configure [...]

572 C HAPTER 40: C ONFIGU RING IPS EC The keys are input in two modes and those input in string mode are pr eferred. At both ends of the security tunnel, the keys should be input in the same mode. If the key is input at one end in string mode, but at the other end in hexad ecimal mode, the security tunnel cannot be created corr ec tly . T o set a n[...]

Creating a Security Policy 573 By default, the end point of the securi ty tunnel is not specified . Set the IPSec pr oposal quot ed in security policy Perform the following configurations in IPSec policy view . Ta b l e 648 Configure IPSec Proposal Quoted in Security Policy By default, the security policy quotes no IPSec proposal. When SA is create[...]

574 C HAPTER 40: C ONFIGU RING IPS EC defined by kilobytes . Hard timeout of SA means that the SA lives for the whole lifetime. Perform the following confi gurations in system view . Ta b l e 649 Configure Global SA LIfetime By default, time-based lifetime is 3600 seconds (an hour),- and traffic-based lifetime is 1843200 kilobytes. Configure a sepa[...]

Displaying and Debuggi ng IPSec 575 Ta b l e 651 Enable Detection of the Router at the Remote End of the T unnel By default, detection of the router at th e remote end of the tunnel is disabled. Apply Security Policy Group on Interface T o put the defined SA into effect, it is ne cessary to apply a security policy to each interface (logical or phys[...]

576 C HAPTER 40: C ONFIGU RING IPS EC Ta b l e 653 Display and Debug IPSec Displaying and Debugging the NDEC Car d Resetting the crypto card When the crypto card operates abnormally , resetting the crypto card can be used to restor e the crypto car d to normality . When resetting the crypto card, the crypto card r estor es its initializa tion. At t[...]

IPSec Configuration Example 577 Displaying and Debugging the crypto car d Use the debugging , re se t and display command in all views. Ta b l e 655 Display and Debug NDEC Card IPSec Configuration Example The following sections demonstr ate the following IPSec configurations: ■ Creating an SA Manually ■ Creating an SA in IKE Negotiation Mode ?[...]

578 C HAPTER 40: C ONFIGU RING IPS EC Figure 174 Networking diagram of manually cr eating SA Prior to the configuration, you should ensure that Router A and Router B can interwork at the network layer through a serial interface. 1 Configure Router A: a Configure an access list and define the data stream fr om Subnet 10.1.1x to Subnet 10.1.2 x. [Rou[...]

IPSec Configuration Example 579 l Apply security policy group on serial interface [RouterA] interface serial 0 [RouterA-Serial0] ipsec policy policy1 [RouterA-Serial0] ip address 202.38.163 .1 255.255.255.0 m Configure the r oute. [RouterA] ip route-static 10.1.2.0 255. 255.255.0 202.38.162.1 2 Configure Router B: a Configur e an access list and de[...]

580 C HAPTER 40: C ONFIGU RING IPS EC [RouterB-Serial0] ipsec policy use 1 [RouterB-Serial0] ip address 202.3 8.162.1 255.255.255.0 o Configure the r oute. [RouterB] ip route-static 10.1.1.0 255.255.255.0 202.38.163.1 After the configuratio n is complete and the security tunn el between Router A and Router B is established, the data st ream between[...]

IPSec Configuration Example 581 [RouterA] interface serial 0 l Configure ip addr ess of the serial interface [RouterA-Serial0] ip address 202.38.163 .1 255.255.255.0 m Apply security policy group on serial interface [RouterA-Serial0] ipsec policy policy1 n Configure the r oute. [RouterA] ip route-static 10.1.2.0 255. 255.255.0 202.38.162.1 o Config[...]

582 C HAPTER 40: C ONFIGU RING IPS EC m Configure corresponding IKE [RouterB] ike pre-shared-key abcde remote 202.38.163.1 After the above co nfigu rations are comp leted, if the messa ges between Subnet 10.1.1.x and Subnet 10.1.2x transmits between Router -A and Router -B, IKE will be triggered to negotiate to establish SA. Afte r IKE negotiates s[...]

IPSec Configuration Example 583 [RouterA-ipsec-policy-policy1-10] secur ity acl 101 i Set remote addr ess. [RouterA-ipsec-policy-policy1-10] tunne l remote 202.38.162.1 j Set local address. [RouterA-ipsec-policy-policy1-10] tunne l local 202.38.163.1 k Quote IPSec proposal. [RouterA-ipsec-policy-policy1-10] propo sal tran1 l Set SPI. [RouterA-ipsec[...]

584 C HAPTER 40: C ONFIGU RING IPS EC [RouterB-ipsec-card-proposal-tran1 ] esp-new authentication-algorith m sha1-hmac-96 f Return to system view . [RouterB-ipsec-card-proposal-tran1 ] quit g Establish a security policy w ith manual configuration mod e. [RouterB] ipsec policy map1 10 man ual h Quote access list. [RouterB-ipsec-policy-map1-10] sec u[...]

Troubleshooting IPSec 585 Do the following: ■ Display the plugging conditions of the crypt o card to check whether the crypto card was plugged in corr ectly . Under normal condition, the “run” indicat or of the crypto card will blink normally (one second on, one second off). ■ Use the display encrypt-card version command to check the crypto[...]

586 C HAPTER 40: C ONFIGU RING IPS EC[...]

41 C ONFIGURING IKE This chapter covers the following topics: ■ IKE Pr otocol Overview ■ Configuring IKE ■ Displaying and Debugging IKE ■ IKE Configuration Example ■ T r oubleshooting IKE IKE Protocol Overview The Inter net Key Exchange (IKE) protocol , implements hybrid pr otocols of both Oakley and SKEME key exchange s in an IS AKMP net[...]

588 C HAPTER 41: C ONFIGU RING IKE Figure 176 Diagram o f relationship between IKE and IPSec IKE features ■ Avoid specifying manually all IPSec secu rity parameters in password mapping of both communication ends. ■ Allow specifying the lifetime of IPSec SA ■ Allow exchanging ciphering key during IPSec session ■ Can provide anti-replay servi[...]

Configuring IKE 589 ■ Hashing algorithm: SHA-1(HMAC anamorphosis) or MD5 (HMAC anamorphosis) algorithm ■ Authentication method: RSA signatu re or RSA r eal-time encryption ■ Diffie-Hellm an group ID ■ SA lifetime T o negotiate the IKE policies used by two ends, the initiator sends all the IKE policies to the peer to neg otiate the public IK[...]

590 C HAPTER 41: C ONFIGU RING IKE The system cr eates only the default IKE secu rity policy that cannot be deleted or modified by users. Selecting an Encryption Algorithm The two types of encryptio n algorithms that are supported are the 56-bit DES-Cipher Block Chaining (DES-CBC) algorithm and the 168-bit 3DES-CBC algorithm. Before being encrypted[...]

Configuring IKE 591 There ar e two hashing algorithm options : SHA- 1 and MD5. Both algorithms provide data source authentication and integrity protection mechanism. Compared with MD5, SHA-1 contained more summary information, and is mo re secure, but the authentication speed is r ela tively slow . A kind of attack subject to MD5 can be successful,[...]

592 C HAPTER 41: C ONFIGU RING IKE By default, SA lifetime is 86400 seconds (a day). It is r ecommended that the configured seconds should be greater than 10 minutes. Configuring IKE Keepalive Timer The Keepalive function detects and dele tes idle security association when the peer party is invalid and cannot operate. Usually , the initiato r trans[...]

IKE Configuration Example 593 IKE Configuration Example ■ Hosts A and B communica tes secur ely , and a security cha n ne l is estab lish e d with IKE automatic negotiatio n between security gateways A and B. ■ Configure an IKE policy on Gateway A, with Policy 10 is of highest priority and the default IKE policy is of the lowest priority . ■ [...]

594 C HAPTER 41: C ONFIGU RING IKE for protecting dif ferent data streams. At pr esent, we use the user IP ad dress to identify the user . got NOTIFY of type INVALID_ID_INFO RMATION or drop message from X.X.X.X due to n otification type INVALID_ID_INFORMATION Check whether ACL contents in ipsec policy configur ed at i nterfaces of both ends are com[...]

IX VPN Chapter 42 Configuring VPN Chapter 43 Configuring L2TP Chapter 44 Configuring GRE[...]

596[...]

42 C ONFIGURING VPN This chapter covers the following topics: ■ VPN Overview ■ Basic Networking Applications of VPN ■ Classification of IP VPN VPN Overview VPN establishes private networks on public networks by creating a “virtual”, or logical networ k fr om r esour ces of the ex is ting ne twork. Carrie rs can make use of their spare net[...]

598 C HAPTER 42: C ONFIGU RING VPN The VPN with service quality guarantee ca n provide dif ferent levels of service quality guarantees for users by charging for different services. Basic Networking Applications of VPN An enterprise that has an intranet estab lished with VPN is shown in the following figure. Figure 178 Schematic diagram of VPN netwo[...]

Classification of IP VPN 599 T unnel Protocols The tunnel protocols can be divided into layer 2 tunneling protocols and layer 3 tunneling protocols depending on the layer at which the tunnelin g is implemented based on OSI model. Layer 2 tunneling protocol The Layer 2 tunneling protocol encapsulates the whole PPP frame in the internal tunnel. The c[...]

600 C HAPTER 42: C ONFIGU RING VPN ISP gateway and PPP se ssion ends at NAS, it is unneces sary for the gateway at the user end to manage and maintain the status of every PPP session, thus improving system performance. Generally , Layer 2 and Layer 3 tunnel protocols ar e used independently so combining L2TP together w ith the IPSec pr otocol provi[...]

43 C ONFIGURING L2TP VPDN and L2TP Overview Virtual Pr ivate Dial Network (VPD N) is fu lf illed with the help of dial-up and access services of public network (ISDN and PS TN), which pr ovides access services for enterprises, small ISPs , and mobile offices. VPDN adopt s private comm unication pr otoc ols with netw ork encryptio n featur e, so ent[...]

602 C HAPTER 43: C ONFIGU RING L2TP Figure 179 Networking diagram of typical VPDN application In this figure, LAC stands for L2TP Access Con centrator , which is a switch network device with a PPP end system and L2TP clie nt-side processing ability . Usually , LAC is a NAS, which provides access service for us ers through PSTN/ISDN. LNS stands for [...]

VPDN and L2TP Overview 603 The networking diagram of these two typical methods is illustrated in the following figure: Figure 180 Networking diagram of two typical methods of VPDN Overview of L2TP The L2TP (Layer 2 T unneling Protocol) supports transmitting PPP frames by tunneling, and the end of layer 2 data link and the PPP session can reside on [...]

604 C HAPTER 43: C ONFIGU RING L2TP The L2TP header includes the informat io n of tunnel and session IDs, which are used to identify differ ent tunnels and sessions. The messages with the same tunnel ID and differ ent session IDs is multiplexed in o n e tu nnel. T unnel ID and session ID are distributed to the opposite end of the tu nnel. L2TP dete[...]

VPDN and L2TP Overview 605 Figure 182 Call setup flow of L2TP channel V . Features of L2TP ■ Flexible identity authentication mechanism and high secur ity L2TP protocol by itself does not provid e connection security , but it can depend on the authentication (e.g. CHAP and P AP) pr ovided by PPP , so it has all security features of PPP . L2TP can[...]

606 C HAPTER 43: C ONFIGU RING L2TP addresses (RFC1918). The addresses allocated to remote users are private addresses belonging to an enterprise , thus the addresses can be easily managed and the security can also be improved. ■ Flexible network charging Charging can be fulfilled at both LAC and LNS sides at the same time, that is, at ISP (to ge[...]

Basic Configuration at LAC 607 Ta b l e 666 Create/Delete a L2TP Group Originate L2TP Connection Request and Configure LNS Address After a dial-up user passes VPN authentication succes sfully , LAC conveys the request of creating tunnel to a designated LNS. Besides the IP address of the LNS, LAC can fulfill authentication for 3 types (namely , 3 tr[...]

608 C HAPTER 43: C ONFIGU RING L2TP Ta b l e 668 Configure AAA and Local Users By default, the local user name and passwor d are not configured. As the AAA attributes of L2TP are not standa r d attributes of RADIUS protocol, it is necessary to add the definition of L2TP a ttributes to the attribute set of RADIUS server . Ta b l e 669 L2TP Attribute[...]

Basic Configuration at LNS 609 Create an L2TP Group T o configure related parameters of L2TP , L2TP group should be added. The L2TP group is used to configure the L2TP func tions on the router and facilitate the network ing applica tions of one- to-one, on e-to-multip le, multiple -to-one a nd multiple-to-multiple connections betwee n the LAC and L[...]

610 C HAPTER 43: C ONFIGU RING L2TP Ta b l e 673 Configure the Name of the Receiving End of the T unnel When the group number of L2TP is 1 (the default L2TP group number), it is unnecessary to specify the remote-name . If the name of r emote end is still specified in the view of L2TP group 1, L2TP group 1 will not work as the default L2TP group. On[...]

Advanced Configuration at LAC or LNS 611 ■ Configure to disconnect tunnel by force ■ Configure the r eceiving window size for controlling flow over tunnel ■ Enable/Disable hi ding A V pairs ■ Configure the maximum number of L2TP sessions ■ Configure domain delimiter and searching or der Advanced configurations at LNS side includes: ■ Co[...]

612 C HAPTER 43: C ONFIGU RING L2TP ■ LAC and LNS authe nticate each other . It can be found that either LAC or LNS can originate tunnel authentication request. However , if o ne side enables the tunnel authentica tion, the tunn el can be established only when the passwords on bo th ends of the tunne l are exactly the same. If tunnel authenticati[...]

Advanced Configuration at LAC or LNS 613 By default, the interval for sending the tu nnel Hello message is 60 seconds. If this configuration is not implemented, LAC or LNS will adopt the default value as the interval to send the Hello message to the peer . Configure Domain Delimiter and Searching Order This configuration is a pplicable to LAC only [...]

614 C HAPTER 43: C ONFIGU RING L2TP information (ACK) and wait for some time before clearing the tunnel, so that the request transmitted again from the peer can be pr operly received when ACK message is lost. After disc onnecting the tunnel by force, all control connections and session connections on the tunnel will also be cleared. After tunnel di[...]

Advanced Configuration at LAC or LNS 615 Ta b l e 680 Force Local End to Perform CHAP Authentication Local CHAP authentication will not be carried out by default. Configur e to Force the LCP to Renegotiate This co nfiguration is applicable to LNS only . For an NAS-originated VPN service request, at the beginning of PPP sessio n, the user will first[...]

616 C HAPTER 43: C ONFIGU RING L2TP By default, address pool 0 (t he default one) will be used by the peer for allocating addresses. When specifying the address pool from which addresses are allocated for users, the default address pool will be used for allocating addresses if no specific pool-number value is configured after the key word pool . Co[...]

Display and Debug L2TP 617 of each VPN connection can be guaranteed. The maximum number of sessions can be c onfigur ed at eith er LNS or LAC, and the smaller one is valid. Perform the following configurations in system view . Ta b l e 685 Configure the Maximum Number of L2TP Sessions By default, the maximum numb er of L2TP sessions is 1000. Given [...]

618 C HAPTER 43: C ONFIGU RING L2TP II. Networking diagram Figure 183 Networking diagram of NAS-originated VPN III. Configuration pr ocedure 1 Configuration at the LAC (NAS) side:) a Configure username and password (when dialing in W i ndo ws2000). [Router-LAC] local-user lac servic e-type ppp password simple lac b Implement local AAA authenticatio[...]

L2TP Configuration Examples 619 d Configure the IP addr ess of Serial0 interface of LNS. [Router-LNS] interface serial 0 [Router-LNS-Serial0] ip address 192.167 .0.1 255.255.255.0 e Configure the Virtual-T emplate-related information. [Router-LNS] interface virtual-template 1 [Router-LNS-Virtual-Template1] ip addre ss 192.168.0.1 255.255.255.0 [Rou[...]

620 C HAPTER 43: C ONFIGU RING L2TP Figure 185 Internet Connection Wizard (1) ■ Click <Next> and input the telephone number at the NAS side in the popup dialog box (if it is a local telephone numb er , you should deselect “Use area code and dialing rules”), as shown in the following figure.[...]

L2TP Configuration Examples 621 Figure 186 Internet Connection Wizard (2) ■ Click <Next> and input username and pa s sword (such as the username lac and password lac) in the popup dialog box so as to access ISP . The input conten ts must be the same as the configurat ion at the NAS side, as shown in the following figure.[...]

622 C HAPTER 43: C ONFIGU RING L2TP Figure 187 Internet Connection Wizard (3) ■ Click <Next> and input the name of dialup connection (such as “Connection to 660046”) in the popup dialog box, as shown in the followin g figure. Figure 188 Internet Connection Wizard (4)[...]

L2TP Configuration Examples 623 ■ Click <Next> and deselect "T o connect to the Inter net immediat ely , select this box and then click Finish" in the popup dialog box, as shown in the following figure. Figure 189 Internet Connection Wizard (5) ■ Click <Finish> and double click “Con nection to 6604 6” icon, then after [...]

624 C HAPTER 43: C ONFIGU RING L2TP Figure 190 Connect to “Connection to 66046” T o determine the IP address assigned to your computer by the LNS, use the DOS-based command ipconfig. Client-originated VPN Networking I. Networking requir ements After connecting to the Inter net, the VPN user originates request for connect ing T unnel. At r eceiv[...]

L2TP Configuration Examples 625 c Configure the IP addr ess of Se rial1 interface at LAC side. [Router-LAC] interface serial 1 [Router-LAC-Serial1] ip address 192.167 .0.2 255.255.255.0 d Configur e BDR par ame ters. [Router-LAC] dialer-rule 1 ip permit [Router-LAC] interface async 2 [Router-LAC-Async2] async mode protocol [Router-LAC-Async2] link-[...]

626 C HAPTER 43: C ONFIGU RING L2TP ■ Search for HKEY_LOCAL_MACHINE, System, CurrentControlSet, Services, Rasman and Para meters le vel by level in the r egister in the left. Click <Parameters>, and click in the blank space in the right window . Choose {Cr eat e/ Double byte value} and create a r egister value (name: Pr ohibitIPSec, value:1[...]

L2TP Configuration Examples 627 Figure 193 Net work Connection Wizard (2) ■ Click <Next>, and configure the IP addr ess of LNS in the popup dialog box (The address is the addr ess of LNS interface connected to the Inter net), as shown in the following figure. Figure 194 Net work Connection Wizard (3)[...]

628 C HAPTER 43: C ONFIGU RING L2TP ■ Click <Next> to comple te the configuration. ■ Double click [Connect Connection to 6600 46] to start VPN conn ection. Before that, if the dialup connection is not set up, the system will automatically prompt you to set up dialup connection. After connection, i nput the user name and password that ar e[...]

L2TP Configuration Examples 629 through the Internet. Through setting up a VPN, the user can have access to the information in the internal network. II. Networking diagram Figure 196 Networking diagram of an individua l user interconnecting headquarters III. Configuration procedur e 1 Configuration at the user side Set up a dialup network, with the[...]

630 C HAPTER 43: C ONFIGU RING L2TP [Router2] ip pool 1 192.168.0.2 19 2.168.0.100 b Enable AAA authentication. [Router2] aaa-enable [Router2] aaa authentication-schem e ppp default local c Configure Virtual-T emplate 1. [Router2] interface virtual-templa te 1 [Router2-Virtual-Template1] ip add ress 192.168.0.1 255.255.255.0 [Router2-Virtual-Templa[...]

L2TP Configuration Examples 631 b Adopt AAA authentication. [Router1] aaa-enable [Router1] aaa authentication-scheme ppp default local [Router1] aaa accounting-scheme optiona l c Create an access control list and specify the encrypted L2TP data. [Router1] acl 101 [Router1-acl-101] rule permit udp sourc e 202.38.161.1 0.0.0.0 destination 202.38.161.[...]

632 C HAPTER 43: C ONFIGU RING L2TP [Router2-ipsec-proposal-l2tptrans] transform esp-new [Router2-ipsec-proposal-l2tptrans] esp-new encryption-algorithm des [Router2-ipsec-proposal-l2tptrans] esp-new authentication-algorithm sha1-hmac-96 [Router2-ipsec-proposal-l2tptrans] encapsulation-mode transport f Create the IPSec policy , use IKE negotiation [...]

Troubleshooting L2TP 633 ■ Errors occur to user name and password set at LAC, or the corresponding user information is not set at LNS. ■ LNS cannot allocate addresses, e.g., the address pool is set too small, or is not set at all. ■ The types of tunnel password authentica tion are inconsistent. Given that the default authentication type of VP[...]

634 C HAPTER 43: C ONFIGU RING L2TP[...]

44 C ONFIGURING GRE This chapter covers the following topics: ■ GRE Protocol Overview ■ Configuring GRE ■ Displaying and Debugging G RE ■ GRE Configuration Example ■ T r oubleshooting GRE GRE Protocol Overview The Generic Routing Encap sulation (GRE) protocol encapsulates datagram of network layer protocols, such as IP and IPX, and enable[...]

636 C HAPTER 44: C ONFIGU RING GRE which examines the key , checksum or message sequence number . After the GRE header is removed, the IP message is pr ocessed by the IPX pr otocol in the same way as an ordinary datagram. The system receives a datagram to be encapsulated and routed,. The datagram is first encapsulated in the GRE message so that the[...]

GRE Protocol Overview 637 GRE Services GRE can fulfill the following services: 1 Implement the LAN protocol communication in W AN by encapsulating all kinds of LAN protocols into a W AN protocol. Figure 201 Multi-pr otocol local network transm itting via single-protocol b ackbone network In Figure 201 , Group1 and Group2 ar e the local networks run[...]

638 C HAPTER 44: C ONFIGU RING GRE The two sub-networks group1 and group2 that ar e running the Novell IPX protocol ar e in differ ent cities. Wit h th e tunnel available, the trans-W AN VPN can be establ ished. In addition, GRE also allows user s to sele ct and recor d an identification key wor d for the tunnel interface, a check of th e encapsula[...]

Configuring GRE 639 Setting the Destination Address of a T unnel Interface After a tunnel interface is cr eated, the destination addr ess of the tunnel channel must be configur ed The destination addr ess is the addr ess of the physical interface where the GRE packets are r eceived. The source address and destination address of a tunnel interface u[...]

640 C HAPTER 44: C ONFIGU RING GRE By default, no iden t ification key word of the tunnel interface is configur ed. Setting the T unnel Interface to Check with Checksum It is stipulated in RFC 1701 that if the ch ecksum field of the GRE he ader is set, the checksum is valid. The transmitting side calculates the checksums of GRE header and payload. [...]

Displaying and Debugging GRE 641 By default, the tunnel interface to sy nchronize datagram sequence numbers is disabled. Displaying and Debugging GRE T o view the working status of the tunnel interface, use the display command in all views. Ta b l e 694 Display and Debug GRE GRE Configuration Example Application of IP-over -IP GRE VPN should be bui[...]

642 C HAPTER 44: C ONFIGU RING GRE b Configure the IP addr ess of Ethernet0 interface. [RouterA-Serial0] exit [RouterA] interface ethernet 0 [RouterA-Ethernet0] ip address 10. 110.24.1 255.255.255.0 c Create a virtual T unnel interface and conf igure the IP addr ess, source address and destinat io n ad d r ess. [RouterA-Ethernet0] exit [RouterA] in[...]

GRE Configuration Example 643 Figure 205 Networking of GRE 1 Configure Router A: a Activate IPX. [RouterA] ipx enable node a.a.a b Configure the IP addr ess an d IPX address of Ethernet0. [RouterA] interface ethernet 0 [RouterA-Ethernet0] ip address 10.1.1.1 255.255.255.0 [RouterA-Ethernet0] ipx network 1e c Configure the IP addr ess of Serial0 int[...]

644 C HAPTER 44: C ONFIGU RING GRE [RouterB] ipx route 1e 1f.a.a.a ti ck 30000 hop 15 T roubleshooting GRE The two interfaces at both ends of the tunnel ar e corr ectly configur ed and the ping operation is successful, bu t the ping operation between PC A and PC B fails. Check whether there is a route passing through the T unnel interface, that is,[...]

X R ELIABILITY Chapter 45 Configuring a Standby Center Chapter 46 Configuring VRRP[...]

646[...]

45 C ONFIGURING A S TANDBY C ENTER This chapter covers the following topics: ■ Standby Center Overview ■ Configuring the Standby Center ■ Displaying and Debugging t he Standby Center ■ Standby Center Configuration Examples Standby Center Overview T o enhance a network's relia bility , 3Com r outers provid e perfect standby functions th[...]

648 C HAPTER 45: C ONFIGU RING A S TANDBY C ENTER main interface is a physical interface or sub-interface, use the following commands in system view to ent er th e view of the interface. Ta b l e 695 Enter the View of the Main Interface If the main interface is a virtual circuit, it should be treated differ ently depending on the ty pe of t he vir [...]

Configuring the Standby Center 649 Setting the Delay Time for Switchover between Main and Standby Interface When the state of the main interface changes from up to down, the system doesn't switch to a standby interface immediately , but waits for a preset time delay instead. The system switches to the standby interfa ce only if the state of th[...]

650 C HAPTER 45: C ONFIGU RING A S TANDBY C ENTER priority; after the logic channel changes to up, it's requir ed to switch from the standby interface with the second high est priority to this logic channel. Perform the following commands in the view of the logic channe l. Ta b l e 701 Set the State-judging Conditions When the Main Interface i[...]

Standby Center Configuration Examples 651 Multiple Standby Interfaces T ake both interf aces Serial 1 and Serial 2 as the stan dby interface of interface Serial 0, and use interface Se rial 1 as a prefer ence. 1 Enter the view of Serial 0. [Router] interface serial 0 2 Set interfaces Serial 1 and Se rial 2 as th e stan dby inter faces, their priori[...]

652 C HAPTER 45: C ONFIGU RING A S TANDBY C ENTER 5 Enter the view of logic channel 5 and set logic channel 3 and interface Serial 1 as its standby interfaces, their priorities being 50 an d 20 respectively . [Router-Serial1] logic-channel 5 [Router-logic-channel5] standby log ic-channel 3 50 [Router-logic-channel5] standby int erface serial 2 20[...]

46 C ONFIGURING VRRP This chapter covers the following topics: ■ VRRP Overview ■ Configuring VRRP ■ Displaying and Debugging VR RP ■ VRRP Configuration Examples ■ T r oubleshooting VRRP VRRP Overview Virtual Router Redundancy Protocol (VRRP) is a fault-tolerant protocol. In general, a default route (the next hop is 10.100.10.1) is configu[...]

654 C HAPTER 46: C ONFIGU RING VRRP Figure 208 Virtual r outer diagram This virtual router has its own IP addr ess: 10.100.10.1 (it can be the same as the interface address of a router within the standby group). The routers within the standby group have their own IP addr e sses (10.100.10.2 for the master routers and 10.100.10.3 for the backup rout[...]

Configuring VRRP 655 Ta b l e 704 Add Virtual IP Address The standby group numbers ranges from 1 to 255. The virtual IP addr ess should be the address of the n etwork segment wh ere the interface resides. It can b e an unused IP address in the network segment, or the r outer's own IP address. When the virtual IP address is the r outer’ s own[...]

656 C HAPTER 46: C ONFIGU RING VRRP Configuring Preemption Mode an d De lay of Standby Group Routers Once a router in the standby gr oup becomes the master router , so long as it still functions properly , other r outers, even co nf igured with higher priority later , cannot become the master router unless they are configur ed with pr eemption mode[...]

Displaying and Debugging VRRP 657 Configure Standby Group Timer The master router of a VRRP standby group notifies its normal operation state to the routers within the gr oup by sending them VRRP packets regularly ( adver_inter val). If the backup routers fail to r eceive the VRRP pac kets over a certain period of t ime ( master_down_interval), the[...]

658 C HAPTER 46: C ONFIGU RING VRRP Ta b l e 710 Display and Debug VRRP VRRP Configuration Examples This section describes several different configurations of VRRP with a suggested procedur e for each configuration VRRP Single Standby Group Host A uses the VRRP standby gr oup which combines router A and router B as its default gateway to visit host[...]

Troubleshooting VRRP 659 VRRP Monitoring Interface As shown in Figure 209 , even when router A is still f unctioning, it may want router B to function as a gateway when the Inter n et int erface connected with it doe s not function properly . This can be implemented by configuring the monitoring interface. T o facilitate explanation, the standby gr[...]

660 C HAPTER 46: C ONFIGU RING VRRP The console f r equ ently disp lays messages about configuration mistakes. This shows that a mistaken VRRP packet has been r eceived. One r eason may be inconsistent configuration of another router within the standby group. Another reason may be the attempt of some devi ces to send out ille gal VRRP packets. The [...]

XI Q O S Chapter 47 QoS Overview Chapter 48 T r affic Policing, T raffic Shaping and Line Rate Chapter 49 Congestion Management Chapter 50 Congestion Avoidance[...]

662[...]

47 Q O S O VERVIEW This chapter covers the following topics: ■ What Is QoS? ■ Three T ypes of QoS Services ■ Benefits of QoS for the Network Service What Is QoS? In the traditional IP network, all the packets are treated identic ally . Each router ha s to handle these packets a following first in first out (FIFO) policy . That is, it m akes b[...]

664 C HAPTER 47: Q O S O VERVIEW ■ Differ entiated service: This is is a kind of mult i-service model oriented to dif f er ent de mands. It sort s the services into classe s, and provides differ ent qualities of services according to the various classes without the support of signal. Differ entiated service adopts the following technologies: ■ [...]

Benefits of QoS for the N etwork Service 665 ■ Adjustable network service. If the user is ISP , by using QoS, the adjustable network ser vices of dif fer ent pr iority leve ls can be provided to various types of clients. ■ Secure network services for specific data flows. For example, it can ensure that the multimedia data flows and voice fl ows[...]

666 C HAPTER 47: Q O S O VERVIEW[...]

48 T RAF FIC P OLICING , T RAF FIC S HAPING AND L INE R ATE T raffic Classification Overview T raffic classification means classifying pa ckets into multiple priority levels or multiple service types according to the T oS (T ype of Service) of IPv4 packet header . The other two values are r eserved for other uses. After the pack ets a re classified[...]

668 C HAPTER 48: T RAFFIC P OLICING , T RAFFIC S HAPING AND L INE R ATE ■ Dropping dir ectly — CAR drops the packets that do not "conform to" the traffic specifications. ■ Forwarding after modifying the packet priority level — The packets with the estimated result of "partial conformance" are forwarded after they are mar[...]

Committed Access Rate (CAR) 669 does not ha ve suffic ient tokens, it is considered “out of conformance”. “Conformance” indicates that the traffic does not exceed the limit--at this time, the number of tokens that correspond to the "conformance" limit can be used and “nonconformance” indicates that the nu mb er of tokens that [...]

670 C HAPTER 48: T RAFFIC P OLICING , T RAFFIC S HAPING AND L INE R ATE ■ Destination IP address ■ Destination MAC address ■ Application port ■ IP pr otocol type ■ Other standards that may be identified through the access list and extended access list. The packets can also be classified based on the exter nal conditions of the netwo rk. F[...]

Committed Access Rate (CAR) 671 By defaul t, no CAR ru le of ACL list is established. For the same carl-index, only one CAR rule can be defined. The later defined CAR rule will overwrite the ear lier CAR rule. Howeve r , multiple CAR ru les with different carl-index may be defined. Before the CAR ru le is configured, fast f orwarding must be disab [...]

672 C HAPTER 48: T RAFFIC P OLICING , T RAFFIC S HAPING AND L INE R ATE Displaying and Debugging CAR Ta b l e 713 Display and Debug CAR CAR Configuration Examples Applying a CAR Policy to all Packets ■ The CAR policy is applied to all the pa ckets that are i nput to router A Ethern et 0, directly forwarding the packets that meet the conditions an[...]

Committed Access Rate (CAR) 673 Figure 212 Networking diagram of con figuring th e priority level based CAR policy 1 Configure Router A: The CAR policy is applied to the packet i nputted to router A serial interf ace 0 and matching priority level 1. [RouterA] qos carl 1 precedence 1 [RouterA] acl 1 [RouterA-acl-1] rule permit source 10.0. 0.0 0.0.0[...]

674 C HAPTER 48: T RAFFIC P OLICING , T RAFFIC S HAPING AND L INE R ATE Apply a CAR Policy on the Packets that Match ACL ■ The CAR policy is applied to the packet that is input to router A serial interface 0 and that matches the specific ACL rule, dir ectly forwarding the packet that meets the conditions and dropping the packet that does not meet[...]

Traffic Shaping 675 Figure 215 Schematic diagram of GTS processing If an interface does not use the rule defined by rule to classify the packet, the interface has only one queue. If GTS uses the rule defined by rule to classify th e packet, it maintains a separate queue for every type of flow . In every interface, GTS can select either of the follo[...]

676 C HAPTER 48: T RAFFIC P OLICING , T RAFFIC S HAPING AND L INE R ATE Ta b l e 714 Configure Shaping Parameters for a Specified Flow By default, the traffic shaping is not performed on the interface. This command may be repeatedly used to set different shap ing parameters for different flows. This command cannot be used together with the qos gts [...]

Physical Interface Line Rate 677 Shape all the flows on Ether net inter face 1. [Router] interface ethernet1 [Router-Ethernet1] qos gts any cir 4500 0000 cbs 5800000 ebs 5800000 Physical Interface Line Rate By using the physical interface line rate (LR), the total rate for sending packets (including the emergency packet) on a physical in terface ca[...]

678 C HAPTER 48: T RAFFIC P OLICING , T RAFFIC S HAPING AND L INE R ATE Displaying and Debugging LR Ta b l e 718 Display and Debug LR Operation Command Display the LR configuration condi tions and statistic information of the interface display qos lr [ interface type number ][...]

49 C ONGESTION M ANAGEMENT This chapter covers the following topics: ■ What is Congestion? ■ Congesti on Manageme nt Policy Over view ■ Selecting Congestion Management Policies ■ Operating Principle of the Congestion Management Policie s ■ Configuring Congestion Management ■ Congesti on Manageme nt Configur ation Examp les What is Conge[...]

680 C HAPTER 49: C ONGESTIO N M ANAGEMENT Figure 217 Schematic diagram of the congested network Congestion Management Policy Overview When the congestion occurs, if not enough memory space is provided to buffer the packets, som e of the packets will be lost. The loss of th e packets may cause the host or router that is sending the packet to r esend[...]

Selecting Congestion Management Policies 681 For the interface with the lower rate, cu stomizing the queue for it can guarant ee that the data flows passing through this interface may also obtain the netwo rk services to certain extent. Weigh ted Fair Queuing Weighted Fair Queuing (WFQ ) provides a dynamic and fair queuing mode, which distinguishes[...]

682 C HAPTER 49: C ONGESTIO N M ANAGEMENT Ta b l e 719 Comparison of Several Congestion Management Policies Operating Principle of the Congestion Management Policies For congestion management , queuing technology is used. When congestion occurs, the data packet is que ued at the r outer by a policy . When dispat ching, the order for sending the dat[...]

Operating Principle of the Congestion Management Policies 683 Figure 218 Schematic diagram of t he first in first out queue First-In, First-Out (FIFO) Queuing As shown in Figure 21 8 , the data packets are input to t he first-in, first-out (FIFO) queue according to the priority order of their arrivals. Data packets that first arrive are first trans[...]

684 C HAPTER 49: C ONGESTIO N M ANAGEMENT rate and throughput rate can be guaranteed to a certain extent in case of n etwork congestion. The key se rvice (such as E RP) data pa ckets may be p ut into the higher prio rity queue, while the non-key service (such as E-Mail) data packets are put into the lower priority queue, so that the data packets of[...]

Operating Principle of the Congestion Management Policies 685 In the network shown in Figure 217 , it is assumed that the server of LAN 1 transmits the data of the key service t o th e server of LAN 2, and the PC of LAN 1 transmits the data of the non -key service to PC of LAN 2. If the serial interface to be connected with the WAN is configur ed f[...]

686 C HAPTER 49: C ONGESTIO N M ANAGEMENT occupied by each traffic is (each priority + 1)/ the sum of each priority plus 1, that is, 1/15, 2/15, 3/15, 4/15 and 5/15. For example, there ar e total 4 flows currently , and the priority levels of three of them are 4, and that of one of them is 5, and then the total number of the allocated bandwidth is:[...]

Configuring Congestion Manag ement 687 lengths of various qu eues, and the numbe r of bytes that may be continuously transmitted by polling of every queue. The priority queue may be configured according to the following methods: 1 Configure the priority queue accor d ing to the network layer protocol Based on packet length, TCP/UDP port number , wh[...]

688 C HAPTER 49: C ONGESTIO N M ANAGEMENT By default, no priority queue is established. 3 Configure the default priority-list queuing. The data packets that are not matched with any policy in the priority queue (both protocol type and interface type ar e not matched) will be allocated to the default priority queue. Please perform the follo win g co[...]

Configuring Congestion Manag ement 689 queue-length is th e queues lengths of the 4 priori ty levels. They range 1 to 1024 packets. The default length of each priority queue is shown in the following table: Ta b l e 727 Default Length V alue of the Priority Queue Displaying and debugging the priority queue Ta b l e 728 Display and Debug the Priorit[...]

690 C HAPTER 49: C ONGESTIO N M ANAGEMENT Configure the custom queue according to the network layer protocol The data packets can be classified accord ing to differ ent protocol types, and be input to different custom queues. Perform the following configur ations in the system view . Ta b l e 729 Configure the Custom Queue Accor ding to the Network[...]

Configuring Congestion Manag ement 691 Applying the custom-list queuing group to the interface T o put the custom-list queue into operat io n, the configured custom-list queue must be applied to the spe cific in ter face. Every interface can only use one custom queue, but one custom queue can be appl ied to multiple interfaces. Multiple differ ent [...]

692 C HAPTER 49: C ONGESTIO N M ANAGEMENT byte-count : When the router dispatches the user queue of CQ, it continuously extracts and sends the data packets from this queue, u ntil the number o f the transmitted bytes is not less than the byte-count value configured for this queue or the queue is empty , the next user queue of CQ is to be transmitte[...]

Congestion Management Configuration Ex amples 693 Congestion Management Configuration Examples PQ Configuration Example 1 Define the access control table, and allow the packets from 10.10.0.0 network segment to pass t hrough. [Router] acl 1 [Router-acl-1] rule permit source 10.10. 0.0 2 Define one policy for the group 1 of the pr iority queue: The [...]

694 C HAPTER 49: C ONGESTIO N M ANAGEMENT Figure 222 Networking diagram of CQ typical configuration 1 Configur e Router A [RouterA] acl 105 [RouterA-acl-105] rule normal permit ip sou rce 10.1.4.0 0.0.0.255 destination 10.1.5.0 0.0.0.255 [RouterA-acl-105] rule normal deny ip sour ce any destination any [RouterA-acl-105] acl 107 [RouterA-acl-107] ru[...]

Congestion Management Configuration Ex amples 695 [RouterB-acl-105] rule normal permit ip source 10.1.5.0 0.0.0.255 destination 10.1.4.0 0.0.0.255 [RouterB-acl-105] rule normal deny ip s ource any destination any [RouterB-acl-105] acl 107 [RouterB-acl-107] rule normal permit ip source 192.168.0.1 0.0.0.0 destination 192.168.0.2 0.0.0.0 [RouterB-acl[...]

696 C HAPTER 49: C ONGESTIO N M ANAGEMENT[...]

50 C ONGESTION A VOIDANCE This chapter covers the following topics: ■ Congestion Avoidance Overview ■ WRED Configuratio n ■ Displaying and Debugging Con gestion Avoidance ■ Congestion Avoidance Configuration Example Congestion A voidance Overview The purpose of the congestion avoid ance technology is to monitor the network traffic flow , pr[...]

698 C HAPTER 50: C ONGESTIO N A VOIDANCE and it causes the sudden increase and decrease of the network t raffic, and the line traffic always fluctuates between the states of few or none and full. RED and WRED RED and WRED can avoid global synchr onization of TCP by dr opping packets randomly . When the packets of a TCP conn ection ar e dropped, and[...]

WRED Configuration 699 ■ When the length of the queue is between the minimum threshold and maximum threshold, the WRED algorithm is used to calculate and determine whether the packet is dropped. The specif ic me thod is that each incoming packet is allocated with a random number , which is compared with the dr op probability of the current queue,[...]

700 C HAPTER 50: C ONGESTIO N A VOIDANCE exponent is the filtering coefficient for calculating the average queue length, and the range of the value is 1 to 16, and the default value is 9. When exponent=0 and the que ue length exceeds the thre shold, WRED will act accordingly . When exponent is higher , WRED will act slowly to the change of queue st[...]

Displaying and Debugging Congestio n Avoidance 701 Displaying and Debugging Congestion A voidance Ta b l e 741 Display and Debug Congestion Avoidance Congestion A voidance Configuration Example 1 Configure a WFQ queue. [Router] interface ethernet 0 [Router-Ethernet0] qos wfq 2 Enable WRED. [Router-Ethernet0] qos wred 3 Configure the exponent to cal[...]

702 C HAPTER 50: C ONGESTIO N A VOIDANCE[...]

XII D IAL - UP Chapter 51 Configuring DCC Chapter 52 Configuring Modem[...]

704[...]

51 C ONFIGURING DCC This chapter covers the following topics: ■ DCC Overview ■ Configuring DCC ■ Displaying and Debugging DCC ■ DCC Configuration Examples ■ T r oubleshooting DCC DCC Overview Dial Control Center (DCC) is the routing technique adopted when the routers interconnect via a PSTN (P ublic Switched T eleph one Network) or IS DN [...]

706 C HAPTER 51: C ONFIGU RING DCC DCC Configuration Methods 3Com routers pr ovide two DCC configuration methods: circular DCC, and resour ce-shared DCC. With distinguishing features, these two methods are applicable to dif ferent applications. In applications, the participating parties of a call can flexibly select either m ethod as needed. In oth[...]

DCC Overview 707 associate with multiple destination addre sses. Each dialer interface can contain multiple physical interfaces . In addition, a physical interface does not necessarily belong to any dialer interface, and can dire ctly route to one or multiple destination addresses. As shown in Figure 22 4 , physical interfaces Serial1, Bri0 and Ser[...]

708 C HAPTER 51: C ONFIGU RING DCC As shown in Figure 225 , a physical interface can belong to multiple dialer bund les and hence serve multip le dialer int erfaces, but each dialer interface associates with only one destination address. Each dialer interface can use only one dialer bu ndle that contains multiple physical inter faces having differ [...]

Configuring DCC 709 Pr eparing to Configure DCC Determine the topology of DCC application ■ Determine which routers w ill pr ovide DCC and the r elevant communication parameters between the routers. ■ Determine the interfaces on the routers that p rovide DCC the functions carried out by ea ch ro uter . ■ Determine the transmission medium, PST[...]

710 C HAPTER 51: C ONFIGU RING DCC Configuring the mode of the physical interface For a synchronous/asynchr onous serial in terface, config ure th e physical interface to operate in asynchronous and dial mode if it is connected to an asynchr onous modem. If the physical interface is co n nected to a synchronous modem, configure the physical interfa[...]

Configuring DCC 711 becomes the same as that on the Dialer interface, which allows the same B channel to be used by differe nt link layer protocols, impr oving flexibility . When the B channel is disconnected, the encapsulation protocol on the ISDN interface will be automatically restored to PPP . Associating a DCC dialer ACL with the interface A p[...]

712 C HAPTER 51: C ONFIGU RING DCC Assure that the commands dialer rule dialer-group and dialer-group dialer-group adopt the same dialer -gr oup. Do not concurrently configure the functi onal arguments of the protocol-name an d acl-number for the same dialer rule command when configuring a dialer ACL. Configuring Circular DCC If Circular DCC is use[...]

Configuring DCC 713 Figure 226 An interface placing a call to a r emote end As shown in this figur e, the single local interface interf ace0 (if0) originates a DCC call to the single remote interface if1. Since the call originates at a single remote end the dialer string can be configured using the dialer number or dialer r oute command. When the c[...]

714 C HAPTER 51: C ONFIGU RING DCC As shown in this figure, the single local interface interface0 (i f0) r eceives a DCC call fr om a single re mote interface if1. Since the call is received by a single local interface, the dialer circular gr oup can be used to configure DCC. Y ou can ch oose to configure either P AP or CHAP authentication. Perform[...]

Configuring DCC 715 By default, Circular DCC is enabled on IS DN BRI and PRI interfaces, but disabled on other interfaces (serial, asynch ronous, AUX, etc.) and the user should manually configure the dialer enable-circular command. No dialer numbers for calling the remote ends are configur ed by default. Configuring an interface to receive calls fr[...]

716 C HAPTER 51: C ONFIGU RING DCC Figure 230 Multiple interfaces placing calls to multiple r emote ends As shown in Figure 230 , the local interfaces interf ace0 (if0), if1, and if2 originate DCC calls to the remote interfaces if1, if2 and if3. For allowing calls to originate from multiple r emote ends, the user must use the dialer route command t[...]

Configuring DCC 717 By default, circular DCC is enabled on ISDN BRI and PRI interfaces, b ut disabled on other interfaces (serial, asynch ronous, AUX, etc.) and the user should manually configure the dialer enable-circular command. In addition, when no dialer interface is cr eated, the physi cal interfac e does not belong to any dialer circular gro[...]

718 C HAPTER 51: C ONFIGU RING DCC Configuring Resource-Shar ed DCC Each RS-attribute set consists of a dialer interface, the attributes o f the interface, and a dialer bundle. Specifically , ■ Only one dialer number can be defined for a dialer in terface. Since this d ialer number has its own dial attributes set, a ll the calls originated by dia[...]

Configuring DCC 719 ■ Configuring dialing authentication for resource-shar ed DCC Enabing Resour ce-Shared DCC Before enabling the r esour ce-shar e d DCC, please use the command undo dialer enable-circular to disable cir cular DCC first, then enable the resource-shar ed DCC by using dialer bundle command. Perform the following configurati on in [...]

720 C HAPTER 51: C ONFIGU RING DCC Ta b l e 753 Create a Dialer Bundle and Assigning the Physical Interfaces to it By default, no dialer bund le is created, and the physi cal interfaces do not belong to any dialer bundle. If a physical interfac e is assign ed to a dialer bundle, a default priority of 1 is assigned. Configuring dialing authenticatio[...]

Configuring DCC 721 Configuring MP Binding for DCC In DCC applications, the user can configur e a traffic threshold for links. Setting the traffic thr eshold to 0 means that the max bandwidth of all the channels is enabled and there is no flow control. If the traf fic threshold is in the range 1 to 100, MP binding will adjust the allocated bandwi d[...]

722 C HAPTER 51: C ONFIGU RING DCC Configuring MP binding in r esour ce-shared DC C If an interface is a serial, asynchr onous interface or an AUX interface, then the resour ce-shar ed DCC will enable another physical interface in the dialer bundle of the dialer interface whenever th e percentage of traffic on the physical interface to the bandwidt[...]

Configuring DCC 723 Ta b l e 757 Implement PPP Call back (Client C onfiguration) in Circular DCC By default, the system doe s not enable callback function and is not configured with any W indows NT server callback dial number . 2 Configure the PPP callback server i n the cir cular DCC impl ementation The callback server can originate a return call [...]

724 C HAPTER 51: C ONFIGU RING DCC By default, the system does not enable th e callback function. On ce it is enabled, the server will originate retu rn calls according to the user name configur ed in the dialer route command. If the callback client adopts the dynamically assigned network address, the server will be unable to use the dialer route c[...]

Configuring DCC 725 By default, the system doe s not enable callback function and is not configured with any W indows NT server callback dial number . 2 Configure the PPP callback server i n the resour ce-shared DCC implementation When resour ce-shared DCC are adopted to implement PPP callback, the PPP authentication configuration at server end is [...]

726 C HAPTER 51: C ONFIGU RING DCC ■ Secondary rule: The best match is the one that is found first. Confirm which dialer call-in at server end is associated with the incoming call ■ In circular DCC, upon receiving an incoming call, the server searches for the dialer call-in matching the incoming number in the dialer call-in commands configured [...]

Configuring DCC 727 Ta b l e 763 Implement ISDN Call er Identification Callback (Client Configuration) in Resource-Shar ed DCC T o configure the ISDN caller identification callback server in the resource-shar ed DCC implementation, perform the following c onfiguration in dialer inter face view . Ta b l e 764 Implement ISDN Call er Identification Ca[...]

728 C HAPTER 51: C ONFIGU RING DCC do not automatically disconnect due to timeout. In other words, the dialer timer idle command does not take effect on auto-dial. Perform the following configur ation in dial interface (physical or dialer inter face) view . Ta b l e 766 Configure Auto-Dial By default, auto-dial is not configured. If auto-dial f unc[...]

Configuring DCC 729 idle time, no the packet which comp lies with the “permit” statements are transmitted over the line. Perform the following configuration in dial interface (physical or dialer interface) view . Ta b l e 768 Configure the Link Idle Time By defaul t, the link id le time is 120 seconds. Configuring the link disconnection time be[...]

730 C HAPTER 51: C ONFIGU RING DCC Configuring the timeout of call setting up When placing DCC calls to some remote ends, the intervals bet ween originating the calls and establishing the connections are not the same. T o effectively contr ol the time that should wait for the connect ion after a call is originated, the user can configure the wait-c[...]

DCC Configuration Examples 731 DCC Configuration Examples DCC Applications in Common Use RouterA can call RouterB an d RouterC via multiple interfaces. Likewise, Rout erB and RouterC can respectively call Router A. However , Ro uterB and RouterC cannot call each other . As shown in Figure 23 3 , when circular DCC is used, the addresses of RouterA, [...]

732 C HAPTER 51: C ONFIGU RING DCC [Router-Serial0] dialer circular-group 0 [Router-Serial0] interface serial 1 [Router-Serial1] physical-mode async [Router-Serial1] modem [Router-Serial1] dialer circular-group 0 2 Configure RouterB: [Router] dialer-rule 1 ip permit [Router] interface serial 0 [Router-Serial0] physical-mode async [Router-Serial0] m[...]

DCC Configuration Examples 733 [Router-Serial0] dialer bundle-member 1 [Router-Serial0] dialer bundle-member 2 [Router-Serial0] link-protocol ppp [Router-Serial0] ppp authentication-mod e pap [Router-Serial0] ppp pap local-user use ra password simple usera [Router-Serial0] interface serial 1 [Router-Serial1] physical-mode async [Router-Serial1] mod[...]

734 C HAPTER 51: C ONFIGU RING DCC Solution 3: Establish a connection via ISDN BRI or PR I inter faces by using Circular DCC, and configure the DCC parameters on the physical interfaces. 1 Configure RouterA: [Router] dialer-rule 1 ip permit [Router] interface bri 0 [Router-Bri0] ip address 100.1.1.1 255.255.255.0 [Router-Bri0] dialer enable-circul [...]

DCC Configuration Examples 735 [Router-Bri0] dialer bundle-member 1 [Router-Bri0] dialer bundle-member 2 [Router-Bri0] link-protocol ppp [Router-Bri0] ppp authentication-mode p ap 2 Configure Route r B: [Router] dialer-rule 2 ip permit [Router] local-user usera password simp le usera [Router] interface dialer 0 [Router-Dialer0] ip address 100.1.1.2[...]

736 C HAPTER 51: C ONFIGU RING DCC Figure 234 Network for the DCC application pr oviding MP binding 1 Configur e RouterA: [Router] dialer-rule 1 ip permit [Router] local-user userb password simple userb [Router] flow-interval 3 [Router] interface dialer 0 [Router-Dialer0] ip address 100.1.1.1 255. 255.255.0 [Router-Dialer0] undo dialer enable-circu[...]

DCC Configuration Examples 737 DCC Application Using ISDN BRI Interface to Dial and Providing Leased Line T o implement circular DCC, use a B cha nnel on the ISDN BRI inter face to provide a leased line, and another B channel to implement remote dialing connection. As shown in Figure 23 5 , the B2 channel on the interface Bri0 of RouterA is connect[...]

738 C HAPTER 51: C ONFIGU RING DCC callback servers. RouterA and RouterC use the same address 100.1.1.1, whereas RouterB and RouterD u se the same address 100.1.1.2. Figure 236 Network for the DCC application pr oviding router -to-router callback Solution 1: Use Cir cular DCC to implement P PP callback. The server determi nes whether to originate a[...]

DCC Configuration Examples 739 [Router-Serial0] ip address 100.1.1.1 2 55.255.255.0 [Router-Serial0] physical-mode async [Router-Serial0] modem [Router-Serial0] dialer enable-circular [Router-Serial0] dialer-group 1 [Router-Serial0] dialer route ip 100.1. 1.2 8810052 [Router-Serial0] link-protocol ppp [Router-Serial0] ppp pap local-user use ra pass[...]

740 C HAPTER 51: C ONFIGU RING DCC Figure 237 Network for the DCC application pr oviding router -to-PC callback 1 Configur e the PC: a Configure the modem connected to the PC to be in “autoanswer mode”. b Select Start > Programs > Accessories > Communications > Dialup network . c Click Set up new connection in the Dialup networ k wi[...]

DCC Configuration Examples 741 Figure 238 Network for the DCC application pr oviding NT server -to-router callback 1 Configur e Rou terA: [Router] dialer-rule 1 ip permit [Router] interface async 0 [Router-Async0] async mode protocol [Router-Async0] link-protocol ppp [Router-Async0] ppp callback client [Router-Async0] ppp pap local-user Rout er pas[...]

742 C HAPTER 51: C ONFIGU RING DCC Dial Number Cir cular Standby and Internet Access for DCC In PSTN, the dial number circular stan dby is fulfilled through configuring the dialer route command a t the dialing side. The access side pr ovides the accessing service for DCC via the asynch ronous serial interface, and ad opts the P AP authentication to[...]

DCC Configuration Examples 743 [Router-Serial0] ip address ppp-negotia te [Router-Serial0] dialer enable-circular [Router-Serial0] dialer-group 1 [Router-Serial0] dialer route ip 100.1. 1.254 8810048 [Router-Serial0] dialer route ip 100.1. 1.254 8810049 …… [Router-Serial0] dialer route ip 100.1. 1.254 8810055 [Router-Serial0] link-protocol ppp [...]

744 C HAPTER 51: C ONFIGU RING DCC c Start dialing, and input the user name user1 and the password pass1. Solution 2: The dialing side uses a single number to di al, and the accessing side uses circular DCC to set up the connection via the ISDN PRI interface. Configure the DCC parameters on the dialer interface. 1 Configure RouterC: [Router] dialer[...]

DCC Configuration Examples 745 Figure 240 Network for the DCC application pr oviding logic interface standby through dialer route Solution 1: Adopt circular DCC and use the logic interface configur ed through the dialer route command as the standby interface. 1 Configure RouterA: [Router] dialer-rule 1 ip permit [Router] interface serial 0 [Router-[...]

746 C HAPTER 51: C ONFIGU RING DCC [Router-Serial0] dialer route ip 100.1.1.2 8810060 logic-channel 1 [Router-Serial0] logic-channel 1 [Router-logic-channel1] standby in terface serial 1 [Router-logic-channel1] interface serial 1 [Router-Serial1] ip address 200.1.1.1 255. 255.255.0 [Router-Serial1] link-protocol ppp 2 Configure RouterB: [Router] di[...]

Troubleshooting DCC 747 Use the DCC Debugging Information to Locate Problems Enabling DCC debugging Execute the following c ommands in sy stem view for displaying the DCC debugging informat ion: [Router] debugging dialer event [Router] debugging dialer packet [Router] info-center enable Output debugging information for the interconnection failure b[...]

748 C HAPTER 51: C ONFIGU RING DCC DCC : peeraddr matching error on interface *** , shutdown link The debugging information is probably outputted because the local dialer route does not contain the remote network address. To solve the probl em, add the dialer route corresponding to the remote network address on the local router or use the dial numb[...]

52 C ONFIGURING M ODEM This chapter covers the following topics: ■ Modem Function Provided by 3Com Routers ■ Configuring a Modem ■ Displaying and Debugging a Mod em ■ Modem Configuration Examples ■ T r oubleshooting Modem Function Provided by 3Com Routers T o offer the optimal flexibility , 3Com routers pr ovide the following modem manage[...]

750 C HAPTER 52: C ONFIGU RING M ODEM Syntax description of modem script The modem script format in common use is as follow: receive-string1 send-string1 recei ve-string2 send-string2...... Where: ■ Normally , receive-strin g and send-string appear in pairs, and the script must begin with a receive-string. For example, “ receive-string 1 send-s[...]

Configuring a Modem 751 Ta b l e 775 Script Keywords In which, seconds defaults to 180 and is in the range of 0 to 180. Ta b l e 776 Script Escape Characters Configuring a Modem Modem Configuration includ es: ■ Configure the Modem Dial-in and Dial-out Authorities ■ Configure Modem Thr ough the A T Command ■ Configure a Modem Script ■ Execut[...]

752 C HAPTER 52: C ONFIGU RING M ODEM Configure Modem Through the A T Comma nd Perform the following configuration in in terface (asynchronous serial, AUX or AM interface) vi ew . Ta b l e 778 Configure a Modem Script A modem can accept the A T commands only when it is in A T command mode. If it is forwarding data, the A T command sent via the send[...]

Configuring a Modem 753 Perform the following co nfiguration in int e rface (asyn chronous serial, AUX or AM interface) view . Ta b l e 781 Specify the Events T riggering the Modem Scripts The argument following the script init-str ing command is the initialization string rather than the modem script name. Configure th e Mo dem Answer Mod e This co[...]

754 C HAPTER 52: C ONFIGU RING M ODEM Ta b l e 783 Configure Authentication for Modem Dial-In User By default, the authentication for a mo dem dial-in user is not configured. Displaying and Debugging a Modem Execute the debugging command in all views for t he debugging. Ta b l e 784 Display and Debug Modem Modem Configuration Examples This section [...]

Modem Configuration Examples 755 Restore the ex-factory modem settings T o restore the ex-factory modem settings, use the “A T&F” command. [Router] script-string factory "" AT OK AT&F OK [Router] interface serial 0 [Router-Serial0] start-chat factory Configure the modem initialization parameters Correctly initializing the mode[...]

756 C HAPTER 52: C ONFIGU RING M ODEM Power -on Initialization through the Initialization Script Enable the router to initialize t he modem to which the asynchronous interface is connected when powering on the router or r ebooting it. [Router] script-string init "" AT OK AT&B1&C1&D2&S0=1 OK AT&W OK [Router] interface a[...]

Troubleshoo ting 757 ■ If the modem is still in abnormal status, proceed to run the AT string, such as “A T&F OK A TE0S0=0&C1&D2 OK A T&W” on th e router physical interface connected to the modem.[...]

758 C HAPTER 52: C ONFIGU RING M ODEM[...]