Professional Documents
Culture Documents
Routers
V200R005C70
Issue 01
Date 2014-11-30
and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the
customer. All or part of the products, services and features described in this document may not be within the
purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,
and recommendations in this document are provided "AS IS" without warranties, guarantees or representations
of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute a warranty of any kind, express or implied.
Website: http://enterprise.huawei.com
Intended Audience
This document describes the concepts and configuration procedures of IP Service features on
the device, and provides the configuration examples.
Symbol Conventions
The symbols that may be found in this document are defined as follows.
Symbol Description
Symbol Description
Command Conventions
The command conventions that may be found in this document are defined as follows.
Convention Description
&<1-n> The parameter before the & sign can be repeated 1 to n times.
Security Conventions
l Password setting
Change History
Changes between document issues are cumulative. Therefore, the latest document version
contains all updates made to previous versions.
Contents
2 ARP Configuration......................................................................................................................21
2.1 ARP Overview..............................................................................................................................................................22
2.2 Principles......................................................................................................................................................................22
2.2.1 ARP Principles..........................................................................................................................................................22
2.2.2 Proxy ARP.................................................................................................................................................................25
2.2.3 Gratuitous ARP..........................................................................................................................................................28
2.2.4 ARP-Ping...................................................................................................................................................................28
2.2.5 Multi-Interface ARP..................................................................................................................................................29
3 DHCP Configuration..................................................................................................................63
3.1 DHCP Overview...........................................................................................................................................................64
3.2 Principles......................................................................................................................................................................64
3.2.1 DHCP Overview........................................................................................................................................................64
3.2.2 Introduction to DHCP Messages...............................................................................................................................65
3.2.3 DHCP Options...........................................................................................................................................................68
3.2.4 DHCP Principles........................................................................................................................................................71
3.2.5 DHCP Relay Principles.............................................................................................................................................74
3.2.6 IP Address Assignment and Renewal........................................................................................................................76
3.3 Applications..................................................................................................................................................................78
3.3.1 DHCP Server Application.........................................................................................................................................78
3.7.1 Example for Configuring a DHCP Server Based on the Global Address Pool.......................................................115
3.7.2 Example for Configuring the DHCP Server to Allocate Different Network Parameters to Dynamic Clients and Static
Clients in the Global Address Pool...................................................................................................................................118
3.7.3 Example for Configuring a DHCP Server Based on the Interface Address Pool....................................................121
3.7.4 Example for Configuring a DHCP Server and a DHCP Relay Agent.....................................................................124
3.7.5 Example for Configuring the DHCP Client and BOOTP Client.............................................................................128
3.7.6 Example for Configuring DHCP Rate Limit...........................................................................................................131
3.7.7 Example for Configuring Association Between an IP Address Pool and NQA......................................................133
3.8 Common Configuration Errors...................................................................................................................................138
3.8.1 DHCP Client Cannot Obtain IP Addresses When industrial switch router Functions as the DHCP Server...........138
3.8.2 DHCP Client Cannot Obtain IP Addresses When industrial switch router Functions as the DHCP Relay Agent
..........................................................................................................................................................................................139
3.9 References..................................................................................................................................................................140
4 DNS Configuration...................................................................................................................142
4.1 DNS Overview...........................................................................................................................................................143
4.2 Principles....................................................................................................................................................................143
4.2.1 Working Principle of DNS......................................................................................................................................143
4.2.2 Working Principle of DNS Proxy or Relay.............................................................................................................145
4.2.3 Working Principle of DNS Spoofing.......................................................................................................................146
4.2.4 Working Principle of DDNS...................................................................................................................................148
4.3 Applications................................................................................................................................................................149
4.3.1 DNS Client Application...........................................................................................................................................149
4.3.2 DNS Proxy Application...........................................................................................................................................150
4.4 Configuring DNS........................................................................................................................................................150
4.4.1 Configuring the DNS Client....................................................................................................................................151
4.4.1.1 Configuring the Static Domain Name Resolution................................................................................................151
4.4.1.2 Configuring the Dynamic Domain Name Resolution..........................................................................................152
4.4.1.3 (Optional) Associating a DNS Server with NQA.................................................................................................153
4.4.1.4 Checking the Configuration..................................................................................................................................155
4.4.2 Configuring DNS Proxy or Relay...........................................................................................................................156
4.4.2.1 Configuring the Destination DNS Server.............................................................................................................156
4.4.2.2 (Optional) Configuring DNS Spoofing................................................................................................................157
4.4.2.3 (Optional) Associating a DNS Server with NQA.................................................................................................158
4.4.2.4 Checking the Configuration..................................................................................................................................161
4.4.3 Configuring the DDNS Client.................................................................................................................................161
4.4.3.1 Configuring a DDNS Policy.................................................................................................................................162
4.4.3.2 Binding a DDNS Policy to an Interface...............................................................................................................165
4.4.3.3 Checking the Configuration..................................................................................................................................165
4.5 Maintaining DNS........................................................................................................................................................165
4.5.1 Deleting Dynamic DNS Entries..............................................................................................................................166
4.5.2 Deleting DNS Entries of the DNS Proxy or Relay..................................................................................................166
4.5.3 Clearing Statistics on Sent and Received DNS Packets..........................................................................................166
5 NAT Configuration...................................................................................................................188
5.1 Introduction to NAT...................................................................................................................................................189
5.2 Principles....................................................................................................................................................................189
5.2.1 Overview.................................................................................................................................................................189
5.2.2 NAT Implementation...............................................................................................................................................191
5.2.3 NAT ALG................................................................................................................................................................194
5.2.4 DNS Mapping..........................................................................................................................................................195
5.2.5 NAT Associated with VPNs....................................................................................................................................196
5.2.6 Twice NAT..............................................................................................................................................................198
5.2.7 NAT Filtering and NAT Mapping...........................................................................................................................200
5.3 Applications................................................................................................................................................................202
5.3.1 Private Network Hosts Accessing Public Network.................................................................................................202
5.3.2 Public Network Hosts Accessing Private Network Servers....................................................................................203
5.3.3 Private Network Hosts Accessing Private Network Servers Using the Domain Name..........................................203
5.4 Configuration Tasks...................................................................................................................................................204
5.5 Configuration Notes...................................................................................................................................................205
5.6 Configuring NAT.......................................................................................................................................................206
5.6.1 Configuring Dynamic NAT.....................................................................................................................................206
5.6.1.1 Configuring ACL Rules........................................................................................................................................206
5.6.1.2 Configuring Outbound NAT................................................................................................................................206
5.6.1.3 (Optional) Enabling NAT ALG............................................................................................................................207
5.6.1.4 (Optional) Configuring the SIP Call Bandwidth Limit on a NAT Device...........................................................208
5.6.1.5 (Optional) Configuring NAT Filtering and NAT Mapping..................................................................................209
5.6.1.6 (Optional) Configuring Twice NAT.....................................................................................................................210
5.6.1.7 (Optional) Configuring NAT Log Output............................................................................................................210
5.6.1.8 (Optional) Configuring the Aging Time of NAT Mapping Entries.....................................................................212
5.6.1.9 Checking the Configuration..................................................................................................................................212
5.6.2 Configuring Static NAT..........................................................................................................................................213
7 IP Performance Configuration................................................................................................258
7.1 IP Performance Overview..........................................................................................................................................259
7.2 Default Configuration.................................................................................................................................................259
7.3 Optimizing IP Performance........................................................................................................................................259
7.3.1 Configuring Source IP Addresses Verification.......................................................................................................260
7.3.2 Configuring an Outbound Interface to Fragment IP Packets...................................................................................260
7.3.3 Configuring Virtual Fragment Reassembly of IP Packets.......................................................................................261
7.3.4 Configuring Unequal Cost Multiple Path................................................................................................................261
7.3.5 Configuring the Device to Process IP Packets with Options...................................................................................263
7.3.6 Configuring an Interface to Forward Broadcast Packet..........................................................................................263
7.3.7 Configuring the Enhanced Forwarding Function for Control Packets Generated by the Device...........................264
7.3.8 Configuring ICMP properties..................................................................................................................................266
7.3.9 Configuring TCP Properties....................................................................................................................................267
7.3.10 Checking the Configuration...................................................................................................................................269
7.4 Maintaining IP Performance.......................................................................................................................................270
7.4.1 Clearing IP Performance Statistics..........................................................................................................................270
9 DHCPv6 Configuration............................................................................................................313
9.1 DHCPv6 Overview.....................................................................................................................................................314
9.2 Principles....................................................................................................................................................................314
9.2.1 DHCPv6 Overview..................................................................................................................................................314
9.2.2 DHCPv6 Packets.....................................................................................................................................................317
9.2.3 DHCPv6 Working Principles..................................................................................................................................319
9.2.4 Working Principle of DHCPv6 PD.........................................................................................................................322
9.2.5 Working Principle of the DHCPv6 Relay Agent.....................................................................................................323
9.2.6 IPv6 Address/Prefix Allocation and Lease Updating..............................................................................................324
9.3 Applications................................................................................................................................................................327
9.3.1 Typical Networking of the DHCPv6 Server............................................................................................................327
9.3.2 Typical Networking of the DHCPv6 PD Server.....................................................................................................328
9.3.3 Typical Networking of the DHCPv6 Relay Agent..................................................................................................328
9.3.4 Typical Networking of the DHCPv6 Client............................................................................................................329
9.3.5 Typical Networking of the DHCPv6 PD Client......................................................................................................329
9.4 Default Configuration.................................................................................................................................................330
9.5 Configuring DHCPv6.................................................................................................................................................330
9.5.1 Configuring a DHCPv6 Server................................................................................................................................330
9.5.1.1 Configuring the DHCPv6 DUID..........................................................................................................................330
9.5.1.2 Configuring an IPv6 Address Pool.......................................................................................................................331
9.5.1.3 (Optional) Configuring Network Server Addresses for the IPv6 Address Pool...................................................333
9.5.1.4 (Optional) Configuring the Options of an IPv6 Address Pool.............................................................................334
9.5.1.5 (Optional) Configuring the DHCPv6 Data Saving Function................................................................................334
9.5.1.6 Enabling the DHCPv6 Server Function................................................................................................................335
9.5.1.7 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm Function of DHCPv6 Messages Discarded
..........................................................................................................................................................................................338
9.5.1.8 Checking the Configuration..................................................................................................................................339
9.5.2 Configuring a DHCPv6 PD Server..........................................................................................................................339
9.5.2.1 Configuring the DHCPv6 DUID..........................................................................................................................340
9.5.2.2 Configuring an IPv6 PD Address Pool.................................................................................................................340
9.5.2.3 (Optional) Configuring Network Server Addresses for the IPv6 Address Pool...................................................341
9.5.2.4 (Optional) Configuring the Options of an IPv6 Address Pool.............................................................................342
9.5.2.5 (Optional) Configuring the DHCPv6 Data Saving Function................................................................................343
9.5.2.6 Enabling the DHCPv6 PD Server Function.........................................................................................................343
9.5.2.7 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm Function of DHCPv6 Messages Discarded
..........................................................................................................................................................................................346
9.5.2.8 Checking the Configuration..................................................................................................................................347
9.5.3 Configuring a DHCPv6 Relay Agent......................................................................................................................347
9.5.3.1 Configuring the DHCPv6 DUID..........................................................................................................................347
9.5.3.2 Configuring the DHCPv6 Relay Function............................................................................................................348
9.5.3.3 (Optional) Configuring DHCPv6 Relay Options.................................................................................................350
9.5.3.4 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm Function of DHCPv6 Messages Discarded
..........................................................................................................................................................................................352
9.5.3.5 Checking the Configuration..................................................................................................................................353
9.5.4 Configuring a DHCPv6 Client................................................................................................................................353
9.5.4.1 Enabling the DHCPv6 Client Function................................................................................................................353
9.5.4.2 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm Function of DHCPv6 Messages Discarded
..........................................................................................................................................................................................355
9.5.5 Configuring a DHCPv6 PD Client..........................................................................................................................356
9.5.5.1 Enabling the DHCPv6 PD Client Function..........................................................................................................356
9.5.5.2 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm Function of DHCPv6 Messages Discarded
..........................................................................................................................................................................................359
9.6 Maintaining DHCPv6.................................................................................................................................................359
9.6.1 Monitoring DHCPv6 Operation..............................................................................................................................360
9.6.2 Clearing DHCPv6 Packet Statistics.........................................................................................................................360
9.6.3 Resetting the Status of the IPv6 Address Pool........................................................................................................360
9.7 Configuration Examples.............................................................................................................................................361
9.7.1 Example for Configuring a DHCPv6 Server...........................................................................................................361
9.7.2 Example for Configuring a DHCPv6 PD Server.....................................................................................................363
9.7.3 Example for Configuring a DHCPv6 Relay to Assign IPv6 Addresses to the Clients in One Network Segment
Connected to the Relay.....................................................................................................................................................365
9.7.4 Example for Configuring a DHCPv6 Relay to Assign IPv6 Addresses to the Clients in Multiple Network Segments
Connected to the Relay.....................................................................................................................................................367
9.7.5 Example for Configuring a DHCPv6 PD Client.....................................................................................................371
9.7.6 Example for Configuring a DHCPv6 Client............................................................................................................373
9.8 References..................................................................................................................................................................375
1 IP Address Configuration
Network devices can communicate at the network layer only after they are configured with IP
addresses.
1.2 Principles
This section describes the implementation of IPv4.
1.6 References
This section lists references of IPv4.
Definition
Internet Protocol Version 4 (IPv4) is the core protocol in the TCP/IP protocol suite. IPv4 works
at the network layer in the TCP/IP model. This layer corresponds to the network layer in the
Open System Interconnection Reference Model (OSI RM). The network layer provides
connectionless data transmission. Each IP datagram is transmitted independently.
Purpose
IPv4 is used on the network layer between the data link layer and the transport layer. IPv4 shields
the differences at the link layer and provides a uniform format for the data packets transmitted
at the transport layer.
1.2 Principles
This section describes the implementation of IPv4.
Transport
TCP,UDP
layer
ICMP
Network
layer IP
RARP,ARP
Data link Various network
layer interfaces
As shown in Figure 1-1, ARP and RARP work between the data link layer and the network
layer for address resolution. ICMP works between the network layer and the transport layer to
ensure correct forwarding of IP datagrams.
ARP
ARP maps an IP address to a MAC address. ARP can be implemented in dynamic or static mode.
ARP provides some extended functions, such as proxy ARP, gratuitous ARP, ARP security, and
ARP-Ping.
RARP
RARP maps a MAC address to an IP address.
ICMP
ICMP works at the network layer to ensure correct forwarding of IP datagrams. ICMP allows
hosts and devices to report errors during packet transmission. An ICMP message is encapsulated
in an IP datagram as the data, and a header is added to the ICMP message to form an IP datagram.
l IP addresses do not show any geographical information. The network ID represents the
network to which a host belongs.
l When a host connects to two networks simultaneously, it must have two IP addresses with
different network IDs. In this case, the host is called a multihomed host.
l Networks allocated with the network ID are in the same class.
0 7 15 23 31
A 0 Host-id
Net-id
B 1 0 Host-id
Net-id
C 1 1 0 Host-id
Net-id
D 1 1 1 0 Multicast-address
E 1 1 1 1 Reserved
At present, most IP addresses in use belong to Class A, Class B, or Class C. Class D addresses
are multicast addresses and Class E addresses are reserved. The easiest way to determine the
class of an IP address is to check the first bits in its network ID. The class fields of Class A,
Class B, Class C, Class D, and Class E are binary digits 0, 10, 110, 1110, and 1111 respectively.
For details about IP address classification, see RFC 1166.
Certain IP addresses are reserved, and they cannot be allocated to users. Table 1-1 lists the ranges
of IP addresses for the five classes.
A 0.0.0.0 to IP addresses with all-0 host IDs are network addresses and
127.255.255.255 are used for network routing. IP addresses with all-1 host
IDs are broadcast addresses and are used for broadcasting
packets to all hosts on the network.
B 128.0.0.0 to IP addresses with all-0 host IDs are network addresses and
191.255.255.255 are used for network routing. IP addresses with all-1 host
IDs are broadcast addresses and are used for broadcasting
packets to all hosts on the network.
C 192.0.0.0 to IP addresses with all-0 host IDs are network addresses and
223.255.255.255 are used for network routing. IP addresses with all-1 host
IDs are broadcast addresses and are used for broadcasting
packets to all hosts on the network.
NOTE
Class Range
A 10.0.0.0 to 10.255.255.255
B 172.16.0.0 to 172.31.255.255
C 192.168.0.0 to 192.168.255.255
0 4 8 16 19 24 31
Version Header Length Tos Total length
identifier Flags Fragment offset
TTL Protocol Header checksum
Header
Source IP address
Destination IP address
Options (variable length)
Data
An IPv4 datagram consists of a header and a data field. The first 20 bytes in the header are
mandatory for all IPv4 datagrams. The Options field following the 20 bytes has a variable length.
Type of Service 8 bits Specifies the type of service. This field takes effect only in
(ToS) the differentiated service model.
Total Length 16 bits Specifies the length of the header and data.
Flags 3 bits Only the rightmost two bits are valid. The rightmost bit
indicates whether the datagram is not the last data fragment.
The value 1 indicates the last fragment, and the value 0
indicates non-last fragment. The middle bit is the
fragmentation flag. The value 1 indicates that the datagram
cannot be fragmented, and the value 0 indicates that the
datagram can be fragmented.
Time to Live 8 bits Specifies the life span of a datagram on a network. TTL is
(TTL) measured by the number of hops.
Protocol 8 bits Specifies the type of the protocol carried in the datagram.
Header 16 bits A device calculates the header checksum for each datagram
Checksum received. If the checksum is 0, the device knows that the
header remains unchanged and retains the datagram. This
field checks only the header but not the data.
1.2.4 Subnetting
A network can be divided into multiple subnets to conserve IP address space and support flexible
IP addressing.
When many hosts are distributed on an internal network, the internal host IDs can be divided
into multiple subnet IDs to facilitate management. Then the entire network contains multiple
small networks.
Subnetting is implemented within the internal network. The internal network has only one
network ID for the external network. When packets are transmitted from the external network
to the internal network, the device on the internal network selects a route for the packets based
on the subnet ID and finds the destination host.
Figure 1-4 shows subnetting of a Class B IP address. The subnet mask consists of a string of
continuous 1s and 0s. 1s indicate the network ID and the subnet ID field, and 0s indicate the
host ID.
Mask 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0
As shown in Figure 1-4, the first 5 bits of the host ID is used as the subnet ID. The subnet ID
ranges from 00000 to 11111, allowing a maximum of 32 (25) subnets. Each subnet ID has a
subnet mask. For example, the subnet mask of the subnet ID 11111 is 255.255.248.0. After
performing an AND operation on the IP address and the subnet mask, you can obtain the network
address.
Subnetting reduces the available IP addresses. For example, a Class B IP address contains 65534
((216 − 2)) host IDs. After 5 bits in the host ID are used as the subnet ID, there can be a maximum
of 32 subnets, each having an 11-bit host ID. Each subnet has a maximum of 2046 host IDs
(211 - 2, excluding the host IDs with all 1s and all 0s). Therefore, the IP address has a maximum
of 65472 (32 x 2046) host IDs, 62 less than the maximum number of host IDs before subnetting.
To implement efficient network planning, subnetting and IP addressing should abide by the
following rules.
Hierarchy
To divide a network into multiple layers, you need to consider geographic and service factors.
Use a top-down subnetting mode to facilitate network management and simplify routing tables.
In most cases:
Consecutiveness
Consecutive addresses facilitate route summarization on a hierarchical network, which greatly
reduces the number of routing entries and improves route search efficiency.
Scalability
When allocating addresses, reserve certain addresses on each layer to ensure consecutive address
allocation in future network expansion.
A backbone network must have enough consecutive addresses for independent autonomous
systems (ASs) and further network expansion.
Efficiency
When planning subnets, fully utilize address resources to ensure that the subnets are sufficient
for hosts.
l Allocate IP addresses by using variable-length subnet masking (VLSM) to fully use address
resources.
l Consider the routing mechanisms in IP address planning to improve address utilization
efficiency in the allocated address spaces.
Pre-configuration Tasks
Before configuring IP addresses for interfaces, complete the following tasks:
l Setting link layer parameters for the interfaces to ensure that the link layer protocol status
of the interfaces is Up
Context
Interfaces on the same industrial switch router can be assigned IP addresses on overlapping
network segments, but the IP addresses cannot be located on the same network segment. For
example, an interface has been assigned 20.1.1.1/16. If you assign 20.1.1.2/24 to another
interface on the same industrial switch router, the system displays a warning message but the
configuration succeeds. If you assign 20.1.1.2/16 to another interface, the system displays an
error message, indicating that the configuration fails because of an IP address conflict.
Procedure
Step 1 Run:
system-view
Each interface has only one primary IP address. If you configure multiple primary IP addresses
for an interface, the last configured IP address becomes the primary IP address of the interface.
----End
Context
Generally, an interface needs only a primary IP address. In some special scenarios, you need to
configure secondary IP addresses for an interface. For example, a industrial switch router
connects to a physical network through an interface, and hosts on this network belong to two
network segments. To enable the industrial switch router to communicate with all hosts on the
physical network, configure a primary IP address and a secondary IP address for this interface.
You can configure multiple IP address for a Layer 3 interface on a industrial switch router, one
as the primary IP address, and the others as secondary IP addresses. Each Layer 3 interface can
have a maximum of 31 secondary IP addresses.
The primary and secondary IP addresses of an interface can be located on overlapping network
segments but not the same network segment. For example, if an interface has been assigned a
primary IP address 20.1.1.1/24 and you assign secondary IP address 20.1.1.2/16 sub to this
interface, the system displays a warning message but the configuration succeeds.
The primary IP address of one interface and secondary IP address of another interface on the
same industrial switch router can be located on overlapping network segments but not on the
same network segment. For example, if an interface has been assigned a primary IP address
20.1.1.1/16 and you assign secondary IP address 20.1.1.2/24 sub to another interface on the
industrial switch router, the system displays a warning message but the configuration succeeds.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run:
ip address ip-address { mask | mask-length } sub
----End
Procedure
l Run the display interface [ interface-type [ interface-number ] ] command to check
information about an interface.
----End
Pre-configuration Tasks
Before configuring an IP unnumbered interface, complete the following tasks:
l Setting link layer parameters for the interfaces to ensure that the link layer protocol status
of the interfaces is Up
Context
An IP unnumbered interface cannot run dynamic routing protocols because it does not have an
IP address itself. To enable the interface to communicate with a peer network segment, configure
a static route to the network segment.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
IP unnumbered interfaces can borrow interfaces from Ethernet, Loopback, Eth-Trunk, and
VLANIF interfaces.
Step 3 Run:
ip address ip-address { mask | mask-length }
Each interface has only one primary IP address. If you configure multiple primary IP addresses
for an interface, the last configured IP address becomes the primary IP address of the interface.
----End
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run:
ip address unnumbered interface interface-type interface-number
----End
Procedure
l Run the display ip interface [ interface-type interface-number ] command to check the IP
address configuration of an interface.
l Run the display ip interface brief [ interface-type [ interface-number ] ] command to check
brief information about interface IP addresses.
----End
Networking Requirements
As shown in Figure 1-5, the Router has only one idle interface GE1/0/0 to connect to a LAN.
The hosts on the LAN are located on two network segments: 10.16.1.0/24 and 10.16.2.0/24. The
interface must be configured with two interfaces to provide access for hosts on the two network
segments.
GE1/0/0
10.16.1.1/24
10.16.2.1/24 sub
Configuration Roadmap
The configuration roadmap is as follows:
Configure a primary IP address and a secondary IP address for the interface.
NOTE
Procedure
Step 1 Configure a primary IP address and a secondary IP address for GE1/0/0.
<Huawei> system-view
[Huawei] interface gigabitethernet 1/0/0
[Huawei-GigabitEthernet1/0/0] undo portswitch
[Huawei-GigabitEthernet1/0/0] ip address 10.16.1.1 24
[Huawei-GigabitEthernet1/0/0] ip address 10.16.2.1 24 sub
# Ping a host on network segment 10.16.2.0 from the Router. The ping operation succeeds.
<Huawei> ping 10.16.2.2
PING 10.16.2.2: 56 data bytes, press CTRL_C to break
----End
Configuration Files
Configuration file of the Router
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.16.1.1 255.255.255.0
ip address 10.16.2.1 255.255.255.0 sub
#
return
Networking Requirements
As shown in Figure 1-6, RouterA and RouterC are interconnected through a tunnel. Tunnel
interfaces (Tunnel0/0/15) of RouterA and RouterC are seldom used, so they have no IP address
configured. IP unnumbered needs to be configured on the tunnel interfaces so that the two
switches can communicate through the tunnel.
RouterB
GE1/0/0 GE2/0/0
20.1.1.2/24 30.1.1.1/24
30.1.1.2/24
10.1.1.1/24
20.1.1.1/24
Tunnel
Tunnel Tunnel
0/0/15 0/0/15
PC 1 PC 2
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure OSPF to ensure that there are reachable routes between RouterA and RouterC.
2. Create tunnel interfaces on RouterA and RouterC and configure the tunnel interfaces to
borrow IP addresses from loopback interfaces to save IP addresses.
Procedure
Step 1 Configure IP addresses for physical interfaces.
# Configure RouterA.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface loopback 0
[RouterA-LoopBack0] ip address 10.1.1.1 255.255.255.0
[RouterA-LoopBack0] quit
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] undo portswitch
[RouterA-GigabitEthernet1/0/0] ip address 20.1.1.1 255.255.255.0
[RouterA-GigabitEthernet1/0/0] quit
# Configure RouterB.
<Huawei> system-view
[Huawei] sysname RouterB
[RouterB] interface gigabitethernet 1/0/0
[RouterB-GigabitEthernet1/0/0] undo portswitch
[RouterB-GigabitEthernet1/0/0] ip address 20.1.1.2 255.255.255.0
[RouterB-GigabitEthernet1/0/0] quit
[RouterB] interface gigabitethernet 2/0/0
[RouterB-GigabitEthernet2/0/0] undo portswitch
[RouterB-GigabitEthernet2/0/0] ip address 30.1.1.1 255.255.255.0
[RouterB-GigabitEthernet2/0/0] quit
# Configure RouterC.
<Huawei> system-view
[Huawei] sysname RouterC
[RouterC] interface loopback 0
[RouterC-LoopBack0] ip address 10.1.2.1 255.255.255.0
[RouterC-LoopBack0] quit
[RouterC] interface gigabitethernet 1/0/0
[RouterC-GigabitEthernet1/0/0] undo portswitch
[RouterC-GigabitEthernet1/0/0] ip address 30.1.1.2 255.255.255.0
[RouterC-GigabitEthernet1/0/0] quit
# Configure RouterB.
[RouterB] ospf 1
[RouterB-ospf-1] area 0
[RouterB-ospf-1-area-0.0.0.0] network 20.1.1.0 0.0.0.255
[RouterB-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255
[RouterB-ospf-1-area-0.0.0.0] quit
[RouterB-ospf-1] quit
# Configure RouterC.
[RouterC] ospf 1
[RouterC-ospf-1] area 0
[RouterC-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255
[RouterC-ospf-1-area-0.0.0.0] quit
[RouterC-ospf-1] quit
# After the preceding configurations, run the display ip routing-table command on RouterA
and RouterC. The command output shows that RouterA and RouterC have learned OSPF routes
to the network segment of the peer.
# Configure RouterA.
[RouterA] interface tunnel 0/0/15
[RouterA-Tunnel0/0/15] tunnel-protocol gre
[RouterA-Tunnel0/0/15] ip address unnumbered interface loopback 0
[RouterA-Tunnel0/0/15] source 20.1.1.1
[RouterA-Tunnel0/0/15] destination 30.1.1.2
[RouterA-Tunnel0/0/15] quit
# Configure RouterC.
[RouterC] interface tunnel 0/0/15
[RouterC-Tunnel0/0/15] tunnel-protocol gre
[RouterC-Tunnel0/0/15] ip address unnumbered interface loopback 0
[RouterC-Tunnel0/0/15] source 30.1.1.2
[RouterC-Tunnel0/0/15] destination 20.1.1.1
[RouterC-Tunnel0/0/15] quit
# Configure RouterA.
[RouterA] ip route-static 10.1.2.0 24 tunnel 0/0/15
# Configure RouterC.
[RouterC] ip route-static 10.1.1.0 24 tunnel 0/0/15
----End
Configuration Files
l Configuration file of RouterA
#
sysname RouterA
#
interface
GigabitEthernet1/0/0
undo portswitch
ip address 20.1.1.1
255.255.255.0
#
interface LoopBack0
ip address 10.1.1.1 255.255.225.0
#
interface Tunnel0/0/15
ip address unnumbered interface LoopBack0
tunnel-protocol
gre
source
20.1.1.1
destination 30.1.1.2
#
ospf 1
area 0.0.0.0
network 20.1.1.0 0.0.0.255
#
ip route-static 10.1.2.0 255.255.255.0 Tunnel0/0/15
#
return
GigabitEthernet2/0/0
undo portswitch
ip address 30.1.1.1
255.255.255.0
#
ospf 1
area 0.0.0.0
network 20.1.1.0 0.0.0.255
network 30.1.1.0 0.0.0.255
#
return
Fault Analysis
An error occurs in IP address configuration, so the configuration fails.
Procedure
l Check the error message and rectify the fault according to Table 1-5.
Error: The specified The specified IP address Configure another IP address for
address conflicts with is on the same network the interface.
another address. segment as the IP address
of another interface on
the local device.
Error: The specified The primary IP address You do not need to delete the IP
primary address does not to be deleted does not address.
exist. exist.
NOTE
Each interface has only
one primary IP address. If
you configure multiple
primary IP addresses for
an interface, the last
configured IP address
becomes the primary IP
address of the interface.
Error: Please delete the The primary IP address Delete all the secondary IP
sub address in the cannot be deleted addresses from the interface, and
interface view first. because the interface has then delete the primary IP
secondary IP addresses. address.
Error: The specified The command used to Run the undo ip address ip-
address cannot be delete a primary IP address { mask | mask-length }
deleted because it is not address cannot delete a sub command to delete the
the primary address of secondary IP address. secondary IP address.
this interface.
Error: The specified sub The secondary IP You do not need to delete the IP
address does not exist. address to be deleted address.
does not exist.
Error: The address The interface has been Configure a different IP address
already exists. configured with the same for the interface.
IP address.
----End
1.6 References
This section lists references of IPv4.
2 ARP Configuration
The Address Resolution Protocol (ARP) maps IP addresses to MAC addresses so that Ethernet
frames can be transmitted on a physical network.
2.2 Principles
This section describes the implementation of ARP.
2.8 References
This section lists references of ARP.
Definition
The Address Resolution Protocol (ARP) maps IP addresses into MAC addresses.
Purpose
On a local area network (LAN), a host or a network device must learn the IP address of the
destination host or device before sending data to it. Additionally, the host or network device
must learn the physical address of the destination host or device because IP packets must be
encapsulated into frames for transmission over a physical network. Therefore, the mapping from
an IP address into a physical address is required. ARP is used to map IP addresses into physical
addresses.
2.2 Principles
This section describes the implementation of ARP.
l Hardware Type: indicates the hardware address type. For an Ethernet, the value of this field
is 1.
l Protocol Type: indicates the type of the protocol address to be mapped. For an IP address,
the value of this field is 0x0800.
l Hardware Length: indicates the hardware address length. For an ARP Request or Reply
packet, the value of this field is 6.
l Protocol Length: indicates the protocol address length. For an ARP Request or Reply
packet, the value of this field is 4.
l OP: indicates the operation type. The value 1 indicates ARP requesting, and the value 2
indicates ARP replying.
l Ethernet Address of sender: indicates the MAC address of the sender.
l IP Address of sender: indicates the IP address of the sender.
l Ethernet Address of destination: indicates the MAC address of the receiver.
l IP Address of destination: indicates the IP address of the receiver.
ARP Request
HOSTA HOSTB
As shown in Figure 2-2, HOSTA and HOSTB are on the same network segment. HOSTA needs
to send IP packets to HOSTB.
HOSTA searches the local ARP table for the ARP entry corresponding to HOSTB. If the
corresponding ARP entry is found, HOSTA encapsulates the IP packets into Ethernet frames
and forwards them to HOSTB based on its MAC address.
If the corresponding APR entry is not found, HOSTA caches the IP packets and broadcasts an
ARP Request packet. In the ARP Request packet, the IP address and MAC address of the sender
are the IP address and MAC address of HOSTA. The destination IP address is the IP address of
HOSTB, and the destination MAC address contains all 0s. All hosts on the same network
segment can receive the ARP Request packet, but only HOSTB processes the packet.
ARP Reply
HOSTA HOSTB
HOSTB compares its IP address with the destination IP address in the ARP Request packet. If
HOSTB finds that its IP address is the same as the destination IP address, HOSTB adds the IP
address and MAC address of the sender (HOSTA) to the local ARP table. Then HOSTB unicasts
an ARP Reply packet, which contains its MAC address, to HOSTA, as shown in Figure 2-3.
After receiving the ARP Reply packet, HOSTA adds HOSTB's MAC address into the local ARP
table. Meanwhile, HOSTA encapsulates the IP packets and forwards them to HOSTB.
seconds, the sender can detect the fault on the receiver after N seconds. During the N
seconds, the cache on the sender is not updated.
l Number of probes for aging dynamic ARP entries
Besides setting a timer for dynamic ARP entries, you can set the number of probes for aging
dynamic ARP entries to reduce address resolution errors. Before aging a dynamic ARP
entry, a host sends ARP aging probe packets. If the host receives no ARP Reply packet
after the number of probes reaches the maximum number, the ARP entry is deleted.
l Aging probe modes for dynamic ARP entries
Before a dynamic ARP entry on a device is aged out, the device sends ARP aging probe
packets to other devices on the same network segment. An ARP aging probe packet can be
a unicast or broadcast packet.
If the IP address of the peer device remains the same but the MAC address changes
frequently, it is recommended that you configure ARP aging probe packets to be broadcast.
If the MAC address of the peer device remains the same, the network bandwidth is
insufficient, and the aging time of ARP entries is short, it is recommended that you
configure ARP aging probe packets to be unicast.
When a non-Huawei device connected to a Huawei device receives an ARP aging probe
packet whose destination MAC address is a broadcast address, the non-Huawei device
checks the ARP table. If the mapping between the IP address and the MAC address of the
Huawei device exists in the ARP table, the non-Huawei device drops the ARP aging probe
packet. The Huawei device cannot receive a response and therefore deletes the
corresponding ARP entry. As a result, traffic from the network cannot be forwarded. In
this scenario, the Huawei device needs to send ARP aging probe packets in unicast mode
and the non-Huawei device needs to respond to the ARP aging probe packets.
l Layer 2 topology detection
The Layer 2 topology detection function enables a device to retransmit ARP probe packets
to update ARP entries when a Layer 2 interface becomes Up and the aging time of the ARP
entries in the corresponding VLAN becomes 0.
Dynamic ARP
Dynamic ARP entries are generated and maintained dynamically by using ARP packets. They
can be aged out, updated, or overwritten by static ARP entries. When the aging time expires or
the interface is Down, the corresponding dynamic ARP entries are deleted.
Static ARP
Static ARP entries record fixed mapping between IP addresses and MAC addresses and are
configured manually by network administrators.
l Proxy ARP is implemented on the ARP subnet gateway without any modifications on any
hosts.
l Proxy ARP can shield topologies of physical networks so that hosts on different physical
networks can use the same network ID to communicate. Proxy ARP enables hosts that are
on the same network segment but on different physical networks to communicate.
l Proxy ARP affects only the ARP caches on hosts but does not affect the ARP cache or
routing table on the gateway.
l After proxy ARP is enabled, the aging time of ARP entries on hosts should be shortened
so that invalid ARP entries can be deleted as soon as possible. Then IP packet forwarding
failures decrease on the router.
Routed proxy ARP Allows hosts on the same network segment but on different
physical networks to communicate.
Inter-VLAN proxy ARP Allows hosts in different VLANs or hosts in different sub-
VLANs of the same VLAN to communicate at Layer 3.
VLANIF10 VLANIF20
HOSTA 172.16.2.9/24 172.16.1.9/24 HOSTB
The IP addresses of HOSTA and HOSTB are on the same network segment. When HOSTA
needs to communicate with HOSTB, HOSTA broadcasts an ARP Request packet, requesting
the MAC address of HOSTB. However, HOSTA and HOSTB are on different physical networks
(in different broadcast domains). Therefore, HOSTB cannot receive the ARP Request packet
sent from HOSTA and does not respond with an ARP Reply packet.
To solve this problem, enable proxy ARP on RouterA. After receiving an ARP Request packet,
RouterA enabled with proxy ARP searches for the routing table corresponding to HOSTB. If
the router corresponding to HOSTB exists, RouterA responds to the ARP Request packet with
its own MAC address. HOSTA forwards data based on the MAC address of RouterA.
RouterA functions as the proxy of HOSTB.
As shown in Figure 2-5, HOSTA and HOSTB are connected to RouterA. The two interfaces
connected to HOSTA and HOSTB belong to VLAN10.
RouterA
HOSTA and HOSTB cannot communicate at Layer 2 because interface isolation in a VLAN is
configured on RouterA.
To solve this problem, enable intra-VLAN proxy ARP on the interfaces of RouterA. After
RouterA's interface connected to HOSTA receives an ARP Request packet whose destination
address is not its own address, RouterA does not discard the packet but searches for the ARP
entry corresponding to HOSTB. If the ARP entry corresponding to HOSTB exists, RouterA
sends its MAC address to HOSTA and forwards packets sent from HOSTA to HOSTB.
RouterA functions as the proxy of HOSTB.
As shown in Figure 2-6, HOSTA and HOSTB are connected to RouterA. The interface
connected to HOSTA belongs to VLAN10, and the interface connected to HOSTB belongs to
VLAN20.
HOSTA HOSTB
172.16.2.20/24 172.16.2.30/24
The interfaces connected to HOSTA and HOSTB belong to different VLANs. Therefore, HOST
A and HOSTB cannot communicate at Layer 2.
To solve this problem, enable inter-VLAN proxy ARP on the interfaces of RouterA. After
RouterA's interface connected to HOSTA receives an ARP Request packet whose destination
address is not its own address, RouterA does not discard the packet but searches for the ARP
entry corresponding to HOSTB. If the ARP entry corresponding to HOSTB exists, RouterA
sends its MAC address to HOSTA and forwards packets sent from HOSTA to HOSTB.
RouterA functions as the proxy of HOSTB.
l Checks duplicate IP addresses: Normally, a host does not receive an ARP Reply packet
after sending an ARP Request packet with the destination address being its own IP address.
If the host receives an ARP Reply packet, another host has the same IP address.
l Advertises a new MAC address. If the MAC address of a host changes because its network
adapter is replaced, the host sends a gratuitous ARP packet to notify all hosts of the change
before the ARP entry is aged out.
l Notifies an active/standby switchover in a VRRP backup group: After an active/standby
switchover, the master router sends a gratuitous ARP packet in the VRRP backup group to
notify the switchover.
2.2.4 ARP-Ping
ARP-Ping includes ARP-Ping IP and ARP-Ping MAC. ARP-Ping sends ARP Request packets
or ICMP Echo Request packets to check whether a specified IP address or MAC address is used.
ARP-Ping IP
ARP-Ping IP checks whether an IP address is used by another device on the LAN by sending
ARP packets.
Before configuring an IP address for a device, configure ARP-Ping IP on the device to check
whether this IP address has been used by sending ARP Request packets.
You can also run the ping command to check whether this IP address is used by another device
on the network. However, if the router or host that uses the IP address is enabled with the firewall
function and the firewall is configured not to respond to ping packets, you may be misled into
thinking that this IP address is not used. To solve the problem, use ARP-Ping IP. ARP is a Layer
2 protocol. Therefore, ARP packets can pass through the firewall that is configured not to respond
to ping packets.
1. After an IP address is specified for a host using the arp-ping ip command, the host sends
an ARP Request packet and starts a timer of waiting for an ARP Reply packet.
2. After receiving the ARP Request packet, the router or host that uses this IP address in the
LAN returns an ARP Reply packet.
3. The sender performs the following two operations based on whether it receives the ARP
packet:
l If the sender receives an ARP Reply packet, the sender compares the source IP address
carried in the ARP Reply packet with the IP address specified using the arp-ping ip
command. If the two IP addresses are the same, the MAC address corresponding to the
specified IP address is displayed and the timer is disabled.
l If the sender does not receive an ARP Reply packet before the timer of waiting for an
ARP Reply packet expires, the sender displays a message indicating that the IP address
is not used by another router device or host.
ARP-Ping MAC
The ARP-Ping MAC process is similar to the ping process. The difference is that ARP-Ping
MAC applies only to directly connected Ethernet LANs or Layer 2 VPN Ethernet networks.
ARP-Ping MAC sends ICMP Echo Request packets. ARP-Ping MAC is implemented as follows:
1. After a MAC address is specified for a host using the arp-ping mac command, the host
sends an ICMP Echo Request packet and starts a timer of waiting for an ICMP Echo Reply
packet.
2. After receiving the ICMP Echo Request packet, the router device or host that uses this
MAC address in the LAN returns an ICMP Echo Reply packet.
3. The sender performs the following two operations based on whether it receives the ICMP
packet:
l If the sender receives an ICMP Echo Reply packet, the sender compares the source
MAC address carried in the ICMP Echo Reply packet with the MAC address specified
using the arp-ping mac command. If the two MAC addresses are the same, the sender
displays the source IP address of the ICMP Echo Reply packet and displays a message
indicating that the MAC address is used by another router device or host. The timer is
disabled.
l If the sender does not receive an ARP Reply packet before the timer of waiting for an
ICMP Echo Reply packet expires, the sender displays a message indicating that the
MAC address is not used by another router device or host.
NLB servers can work in unicast, multicast, and IGMP multicast mode. Currently, the device
can only be connected to NLB servers working in unicast or multicast mode.
l When NLB servers work in unicast mode, the virtual MAC address starts with 02BF.
l When NLB servers work in multicast mode, the virtual MAC address starts with 03BF.
As shown in Figure 2-7, each server in the NLB group has its own IP address and MAC address.
In addition, the servers share a virtual IP address and a virtual MAC address. Router functions
as the access gateway and directly connects to the NLB group. Router needs to forward packets
destined for the virtual IP address to all servers in the NLB group.
After servers in the NLB group receive ARP Request packets for the virtual MAC address from
Router, all the servers return ARP Reply packets. In the ARP Reply packets, the protocol source
IP address is the virtual IP address and the protocol source MAC address is the virtual MAC
address.
l When NLB servers work in unicast mode, Router learns only one outbound interface
(interface connecting Router to an NLB server) from the ARP entry matching the NLB
group virtual IP address in the ARP table. Therefore, Router can forward packets destined
for the virtual IP address to only one server in the NLB group.
l When NLB servers work in multicast mode, Router does not learn ARP entries after
receiving ARP Reply packets from NLB servers because the protocol source MAC address
is a multicast MAC address. If you configure a static ARP entry by binding the virtual IP
address to the virtual MAC address, only one outbound interface is specified. Therefore,
Router can forward packets destined for the virtual IP address to only one server in the
NLB group.
To resolve the preceding problems, you can deploy multi-interface ARP to allow Router to
forward packets destined for the virtual IP address to all servers in the NLB group.
Client
IP Network
Router
IF1 IF3
IF2
In multi-interface ARP, a static ARP entry is configured by binding the virtual IP address to the
virtual MAC address, and MAC address entries are configured by binding the virtual MAC
address to multiple outbound interfaces. When Router forwards packets destined for the virtual
IP address, Router first searches for the ARP entry matching the virtual IP address to determine
the virtual MAC address and the VLAN to which the NLB servers belong. Router then searches
the MAC address table for multiple outbound interfaces based on the virtual MAC address and
VLAN. Router forwards packets to each connected NLB server through the outbound interfaces.
Aging detection mode of dynamic ARP An interface sends the last ARP Aging probe
entries packet in broadcast mode, and the rest ARP Aging
probe packets are sent in unicast mode.
Context
Static ARP entries are manually configured and maintained. They cannot be aged and overridden
by dynamic ARP entries. Therefore, static ARP entries improve communication security. Static
ARP entries ensure communication between the local device and a specified device by using a
specified MAC address so that attackers cannot modify mappings between IP addresses and
MAC addresses in static ARP entries.
NOTE
Static ARP entries cannot be modified. However, the configuration workload is heavy. Static ARP entries
cannot apply to a network where IP addresses of hosts may change or a small-sized network.
Procedure
Step 1 Run:
system-view
Step 2 Run:
arp static ip-address mac-address [ vpn-instance vpn-instance-name ] or arp static
ip-address mac-address vid vlan-id [ cevid ce-vid ] interface interface-type
interface-number
l For Layer 3 physical interfaces and Layer 3 Eth-Trunk interfaces, run the arp static ip-
address mac-address command to configure static ARPentries.
l For VLANIF interfaces and Dot1q termination sub-interfaces, run the arp static ip-
address mac-address vid vlan-id interface interface-type interface-number command to
configure static ARP entries.
l For QinQ termination sub-interfaces, run the arp static ip-address mac-address vid vlan-
id cevid ce-vid interface interface-type interface-number command to configure static ARP
mapping entries with double tags. vid specified in this command must be the same as pe-
vid in the qinq termination pe-vid ce-vid command, and ce-vid must be within the value
range of ce-vid in the qinq termination pe-vid ce-vid command.
l For interfaces bound to a VPN instance:
– For Layer 3 physical interfaces and Layer 3 Eth-Trunk interfaces, run the arp static ip-
address mac-address vpn-instance vpn-instance-name command to configure static ARP
entries.
– For VLANIF interfaces and Dot1q termination sub-interfaces, run the arp static ip-
address mac-address vid vlan-id interface interface-type interface-number command to
configure static ARP entries.
– For QinQ termination sub-interfaces, run the arp static ip-address mac-address vid vlan-
id cevid ce-vid interface interface-type interface-number command to configure static
ARP mapping entries with double tags. vid specified in this command must be the same
as pe-vid in the qinq termination pe-vid ce-vid command, and ce-vid must be within the
value range of ce-vid in the qinq termination pe-vid ce-vid command.
----End
l Run the display arp [ all | brief ] command to check all ARP mapping entries.
l Run the display arp network net-number net-mask [ dynamic | static ] command to check
ARP mapping entries of a specified network segment.
l Run the display arp static command to check static ARP mapping entries.
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlan-
id ] ] command to check ARP mapping entries of a specified interface.
l Run the display arp vpn-instance vpn-instance-name static command to check static ARP
mapping entries of a specified VPN instance.
Pre-configuration Tasks
Before optimizing dynamic ARP, complete the following tasks:
l Setting link layer protocol parameters for interfaces to ensure that the link layer protocol
status of the interfaces is Up
Context
Aging parameters of ARP entries include the aging time, the number of probes, detection
intervals, and detection modes. Proper adjustment of aging parameters improves network
reliability.
NOTE
l If the IP address of the peer device remains the same but the MAC address changes frequently,
it is recommended that you configure ARP aging probe packets to be broadcast.
l If the MAC address of the peer device remains the same, and the network bandwidth is
insufficient, it is recommended that you configure ARP aging probe packets to be unicast.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run:
arp expire-time expire-time
By default, the aging time of dynamic ARP entries is 1200 seconds, that is, 20 minutes.
Step 4 Run:
arp detect-times detect-times
Step 5 Run:
arp detect-mode unicast
By default, an interface sends the last ARP Aging Detection packet in broadcast mode, and the
rest ARP Aging Detection packets are sent in unicast mode.
----End
Context
Layer 2 topology detection enables the system to update all the ARP entries in the VLAN that
a Layer 2 interface belongs to when the Layer 2 interface status changes from Down to Up.
Procedure
Step 1 Run:
system-view
Step 2 Run:
l2-topology detect enable
----End
Background Information
To improve network security, some devices do not support broadcast packets.
l Before an ARP entry ages out, the local device broadcasts an ARP request packet in an
attempt to update the ARP entry based on the reply from a peer device. If the peer device
does not support broadcast packets, it does not respond to the broadcast ARP request packet,
so the local device considers the peer device offline and deletes the ARP entry. As a result,
services will be interrupted between the two devices.
l If the local device is new, it will broadcast an ARP request packet to learn the MAC
addresses of other devices. If a peer device does not support broadcast packets, it will
discard the ARP request packet, so the local device will not learn the peer device's MAC
address. As a result, new services will not be started between the two devices.
To resolve these problems, enable the unicast ARP probe function. This function enables a local
interface to send a unicast ARP request packet that carries the specified IP and MAC addresses.
The unicast ARP probe function improves network security, without compromising service
stability. The ARP entries learned or updated by the local device will be deleted after their aging
time expires and can be updated again after the local device receives ARP request packets from
the peer device.
Procedure
l Run:
arp send-packet ip-address mac-address interface interface-type interface-
number [ vid vid [ cevid cevid ] ]
----End
Procedure
l Run the display arp [ all | brief ] command to check all ARP mapping entries.
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlan-
id ] ] command to check ARP mapping entries of a specified interface.
l Run the display arp network net-number net-mask [ dynamic | static ] command to check
ARP mapping entries of a specified network segment.
l Run the display arp dynamic command to check dynamic ARP mapping entries.
l Run the display arp vpn-instance vpn-instance-name static command to check static ARP
mapping entries of a specified VPN instance.
Pre-configuration Tasks
Before configuring proxy ARP, complete the following task:
l Setting link layer protocol parameters for interfaces to ensure that the link layer protocol
status of the interfaces is Up
Context
Proxy ARP enables PCs or industrial switch routers on the same network segment but on
different physical networks to communicate. In actual applications, if the current connected to
the industrial switch router is not configured with a default gateway address (that is, the host
does not know how to reach the intermediate system of the network), the host cannot forward
data packets. Routed proxy ARP solves this problem.
Figure 2-8 shows the routed proxy ARP networking. RouterA uses GE1/0/0 and GE2/0/0 to
connect two networks. IP addresses of the two GE interfaces are on different network segments.
However, the masks make Host A and VLANIF10 on the same network segment, Host B and
VLANIF20 on the same network segment, and Host A and Host B on the same network segment.
GE1/0/0 GE2/0/0
172.16.2.9/24 172.16.1.9/24
RouterA HOSTB
HOST A sends an ARP Request packet, requesting the MAC address of HOST B. After receiving
the packet, RouterA uses its MAC address to reply the Request packet. HOST A then forwards
data using the MAC address of RouterA.
NOTICE
IP addresses of the STAhosts on a subnet have the same network ID. Therefore, the default
gateway address does not need to be configured on the STAhosts.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
The interfaces connect routing devices to the physical networks and are enabled with routed
proxy ARP.
Step 3 Run:
ip address ip-address { mask | mask-length }
The IP address configured for the interface enabled with routed proxy ARP must be on the same
network segment as the IP address of the connected hostserver on a LAN.
Step 4 Run:
arp-proxy enable
After proxy ARP is enabled, the aging time of ARP entries on hosts should be shortened so that
invalid ARP entries can be deleted as soon as possible. The number of packets received but
cannot be forwarded by the device is decreased. To set ARP aging time, run the arp expire-
time expire-time command.
----End
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlan-
id ] ] command to check ARP mapping entries of a specified interface.
l Run the display arp vpn-instance vpn-instance-name [ dynamic | static ] command to
check ARP mapping entries of a specified VPN instance.
Context
If two hosts belong to the same VLAN but are isolated, enable intra-VLAN proxy ARP on an
interface associated with the VLAN to allow the hosts to communicate.
As shown in Figure 2-9, HOSTA and HOSTB connect to RouterA. The two interfaces that
connect HOSTA and HOSTB to RouterA belong to VLAN10.
RouterA
HOSTA and HOSTB cannot communicate at Layer 2 because interface isolation in a VLAN is
configured on RouterA.
To solve this problem, enable intra-VLAN proxy ARP on the interfaces of RouterA. After an
interface of RouterA receives an ARP Request packet whose destination address is not its own
address, RouterA does not discard the packet but searches for the ARP entry. If the ARP entry
matching HOSTB exists, RouterA sends its MAC address to HOSTA and forwards packets sent
from HOSTA to HOSTB. RouterA functions as the proxy of HOSTB.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run:
arp-proxy inner-sub-vlan-proxy enable
----End
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlan-
id ] ] command to check ARP mapping entries of a specified interface.
l Run the display arp vpn-instance vpn-instance-name [ dynamic | static ] command to
check ARP mapping entries of a specified VPN instance.
Context
If two hosts belong to different VLANs, enable inter-VLAN proxy ARP on interfaces associated
with the VLANs to implement Layer 3 communication between the two hosts.
As shown in Figure 2-10, HOSTA and HOSTB connect to RouterA. Interfaces that connect
HOSTA and HOSTB to RouterA belong to VLAN10 and VLAN20 respectively.
HOSTA HOSTB
172.16.2.20/24 172.16.2.30/24
Interfaces connecting HOSTA and HOSTB to RouterA belong to different VLANs. Therefore,
HOSTA and HOSTB cannot communicate at Layer 2.
To solve this problem, inter-VLAN proxy ARP needs to be enabled on interfaces of RouterA.
After an interface of RouterA receives an ARP Request packet whose destination address is not
its own address, RouterA does not discard the packet but searches for the ARP entry. If the ARP
entry matching HOSTB exists, RouterA sends its MAC address to HOSTA and forwards packets
sent from HOSTA to HOSTB. RouterA functions as the proxy of HOSTB.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run:
arp-proxy inter-sub-vlan-proxy enable
----End
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlan-
id ] ] command to check ARP mapping entries of a specified interface.
l Run the display arp vpn-instance vpn-instance-name [ dynamic | static ] command to
check ARP mapping entries of a specified VPN instance.
Pre-configuration Tasks
Before configuring ARP-Ping, complete the following task:
l Configuring link layer protocol parameters and IP addresses for interfaces to ensure that
the link layer protocol status of the interfaces is Up.
Context
Before configuring an IP address for a device on a LAN, run the arp-ping ip command to check
whether the IP address is used by other network devices.
The ping command can also check whether an IP address is in use. If the destination host or the
industrial switch router configured with the firewall function are configured not to reply to ping
packets, there is no response to the ping packet. Consequently, the IP address is considered
unused. ARP is a Layer 2 protocol. In most cases, ARP packets can pass through the firewall
that is disabled from replying to the Ping packets to prevent the preceding situation.
Procedure
l Run:
arp-ping ip ip-address [ timeout timeout-value ] [ interface interface-type
interface-number [ vlan-id vlan-id ] ]
----End
Context
When you know a specific MAC address but not the corresponding IP address on a network
segment, you can obtain the corresponding IP address using the arp-ping mac command to send
ICMP packets. In this way, you can obtain the IP address mapping the MAC address.
Procedure
l Run:
arp-ping mac mac-address { ip-address [ vpn-instance vpn-instance-name ] |
interface interface-type interface-number }
Check whether the MAC address is used. If the MAC address is in use, query the IP address
mapping the MAC address.
– If the following information is displayed, the MAC address is not used.
<Huawei> arp-ping mac 00e0-517d-f201 interface gigabitethernet 1/0/0
OutInterface: GigabitEthernet1/0/0 MAC[00-E0-51-7D-F2-01], press CTRL_C
to break
Request timed out
Request timed out
Request timed out
----- ARP-Ping MAC statistics -----
3 packet(s) transmitted
0 packet(s) received
MAC[00-E0-51-7D-F2-01] not be used
– If the following information is displayed, it means that the MAC address is used.
<Huawei> arp-ping mac 00e0-517d-f202 interface gigabitethernet 1/0/0
OutInterface: GigabitEthernet1/0/0 MAC[00-E0-51-7D-F2-02], press CTRL_C
to break
----- ARP-Ping MAC statistics -----
1 packet(s) transmitted
1 packet(s) received
IP ADDRESS MAC ADDRESS
10.1.1.1 00-E0-51-7D-F2-02
----End
Background Information
IP addresses may be mapped to multicast MAC addresses in some service scenarios. As shown
in Figure 2-11, the device is connected to the network load balance (NLB) group through a
Layer 2 LAN switch (LSW). The NLB group works in multicast mode; that is, the MAC address
of the NLB group is a multicast MAC address. In this case, a network administrator can enable
the device to dynamically learn multicast MAC addresses and generate ARP entries. This
reduces the network administrator's workload of configuring static ARP entries and reduces
network operation and maintenance costs.
Figure 2-11 Device connected to the NLB group through a Layer 2 LSW
Client
IP Network
Router
Eth2/0/0
LSW
Procedure
l Globally enable a device to learn multicast MAC addresses.
1. Run:
system-view
The device is globally enabled to learn multicast MAC addresses and generate
dynamic ARP entries.
NOTE
If a device is globally enabled to learn multicast MAC addresses, the interfaces of this device
are enabled to learn multicast MAC addresses.
----End
Pre-configuration Tasks
Before configuring multi-interface ARP, complete the following task:
l Creating VLANs and adding interfaces to these VLANs
NOTE
Context
All servers in an NLB group share a virtual IP address and a virtual MAC address. When the
NLB group works in unicast mode, the virtual MAC address is a unicast MAC address. When
the NLB group works in multicast mode, the virtual MAC address is a multicast MAC address.
In both modes, when a device directly connects to the NLB group and functions as the access
gateway, the device needs to forward packets destined for the virtual IP address to all servers in
the NLB group, and each server determines how to process the packets. You can configure multi-
interface ARP on the device to allow it to forward packets destined for the virtual IP address to
all servers in the NLB group.
Procedure
Step 1 Run:
system-view
Step 2 Use the following methods to configure a multi-interface MAC address entry.
Configure a multi-interface MAC address entry in the system view for the first time. When a
multi-interface MAC address entry has been created and you need to add or delete an interface,
add or delete the interface in its interface view.
Step 3 Run:
arp static ip-address mac-address [ vpn-instance vpn-instance-name ]
By default, the ARP mapping table is empty and address mappings are obtained using dynamic
ARP.
You must set mac-address to the same as the MAC address in the multi-interface MAC address
entry.
----End
Background
By default, the scheduled ARP refresh function is enabled on the device. That is, the device
updates ARP entries and clears the fast forwarding table every ten hours. When fast forwarding
is enabled (using the ip fast-forwarding enable command) on interfaces of the device, you can
disable the scheduled ARP refresh function to prevent traffic jitter occurring when the fast
forwarding table is cleared.
Procedure
Step 1 Run:
system-view
Step 2 Run:
undo arp regularly-refresh enable
----End
Context
NOTICE
ARP entries cannot be restored after being cleared. When you delete static ARP entries, the
( arp static ) command is also deleted. Exercise caution when you delete the ARP entries.
Procedure
l Run the reset arp { all | dynamic | interface interface-type interface-number | packet
statistics | static } command to clear ARP entries in the ARP mapping table.
l Run the reset arp packet statistics command in user view to clear ARP packet statistics.
----End
Context
Monitoring the ARP running status includes checking ARP mapping entries, strict ARP entry
learning, ARP packet statistics, ARP packet processing rate, and maximum number of ARP
entries learnt by an interface.
Procedure
l Run the display arp [ all | brief ] command in any view to check all ARP mapping entries.
l Run the display arp interface interface-type interface-number [ vid vlan-id [ cevid cevlan-
id ] ] command in any view to check ARP mapping entries of a specified interface.
l Run the display arp network net-number net-mask [ dynamic | static ] command in any
view to check ARP mapping entries of a specified network segment.
l Run the display arp vpn-instance vpn-instance-name static command in any view to
check static ARP mapping entries of a specified VPN instance.
l Run the display arp statistics { all | interface interface-type interface-number } command
in any view to check ARP entry statistics.
l Run the display arp packet statistics command in any view to check ARP packet statistics.
----End
Networking Requirements
As shown in Figure 2-12, a router connects departments of a company and each department
joins different VLANs. Hosts in the headquarters office and the file backup server are allocated
manually configured IP addresses, and hosts in departments dynamically obtain IP addresses by
using DHCP. Hosts in the marketing department can access the Internet and are often attacked
by ARP packets. Attackers attack the router and modify dynamic ARP entries on the router. As
a result, communication between hosts in the headquarters office and external devices is
interrupted and hosts in departments fail to access the file backup server. The company requires
that static ARP entries be configured on the router so that hosts in the headquarters office can
communicate with external devices and hosts in departments can access the file backup server.
10.164.10.1/24
0df0-fc01-003a 10.164.1.1/24
00e0-fc01-0001
GE3/0/0 Etherent2/0/0
10.164.10.10 /24 VLANIF10
PC A
10.164.1.20/24
Router
10.164.2.0/24 10.164.1.0/24
VLAN20 VLAN10
10.164.3.0/24
VLAN30
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure static ARP entries for hosts in the headquarters office on the router to prevent
ARP entries of the hosts in the headquarters office from being modified in ARP attack
packets.
2. Configure a static ARP entry for the file backup server on the router to prevent the ARP
entry of the file backup server from being modified in ARP attack packets.
Procedure
Step 1 Configure static ARP entries for the host in the headquarters office on the router.
# Create VLAN10.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 10
[Router-vlan10] quit
# Configure static ARP entries for the host in the headquarters office. PC A is used as an example.
The IP address of PC A is 10.164.1.1 and maps the MAC address 00e0-fc01-0001; the VLAN
ID is 10 and the outbound interface is Ethernet2/0/0.
[Router] arp static 10.164.1.1 00e0-fc01-0001 vid 10 interface ethernet 2/0/0
# Configure static ARP entries for other hosts in the headquarters office. The configuration
method is similar to that of PC A.
Step 2 Configure a static ARP entry for the file backup server on the router.
# Configure a static ARP entry for the file backup server: The IP address 10.164.10.1/24 maps
the MAC address 0df0-fc01-003a.
[Router] arp static 10.164.10.1 0df0-fc01-003a
[Router] quit
----End
Configuration Files
Only the configuration file of the router is provided.
#
sysname Router
#
vlan batch 10 20 30
#
interface Ethernet2/0/0
port hybrid tagged vlan 10
#
interface Vlanif10
ip address 10.164.1.20 255.255.255.0
#
interface GigabitEthernet3/0/0
undo portswitch
ip address 10.164.10.10 255.255.255.0
#
arp static 10.164.1.1 00e0-fc01-0001 vid 10 interface Ethernet 2/0/0
arp static 10.164.10.1 0df0-fc01-003a
#
return
Internet
Etherent2/0/0 Etherent2/0/0
VLAN10
VLAN20
Branch A
Branch B
Host A Host B
10.16.1.2/16 10.16.2.2/16
0000-5e33-ee20 0000-5e33-ee10
Configuration Roadmap
The configuration roadmap is as follows:
1. Add the interface connecting RouterA and branch A to VLAN10 and add the interface
connecting RouterB and branch B to VLAN20.
2. Enable routed proxy ARP on VLANIF interfaces of branch A and branch B to implement
communication between the two branches.
Procedure
Step 1 Configure RouterA.
# Create VLAN10.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] vlan 10
[RouterA-vlan10] quit
# Select HostA at 10.16.1.2/16 in branch A and select HostB at 10.16.2.2/16 in branch B. Run
the ping command on HostA to ping the IP address of HostB.
C:\Documents and Settings\Administrator> ping 10.16.2.2
PING 10.16.2.2: 56 data bytes, press CTRL_C to break
Reply from 10.16.2.2: bytes=56 Sequence=1 ttl=255 time=10 ms
Reply from 10.16.2.2: bytes=56 Sequence=2 ttl=255 time=10 ms
Reply from 10.16.2.2: bytes=56 Sequence=3 ttl=255 time=10 ms
Reply from 10.16.2.2: bytes=56 Sequence=4 ttl=255 time=10 ms
Reply from 10.16.2.2: bytes=56 Sequence=5 ttl=255 time=10 ms
# View the ARP mapping table of HostA. You can see that the MAC address of HostB is the
MAC address of VLANIF10.
C:\Documents and Settings\Administrator> arp -a
Interface: 10.16.1.2 --- 0x2
Internet Address Physical Address Type
10.16.2.2 00e0-fc39-80aa dynamic
----End
Configuration Files
l Configuration file of RouterA
#
sysname RouterA
#
vlan batch 10
#
interface Vlanif10
ip address 10.16.1.1 255.255.255.0
arp-proxy enable
#
interface Ethernet2/0/0
port link-type access
port default vlan 10
#
return
#
sysname RouterB
#
vlan batch 20
#
interface Vlanif20
ip address 10.16.2.1 255.255.255.0
arp-proxy enable
#
interface Ethernet2/0/0
port link-type access
port default vlan 20
#
return
Networking Requirements
As shown in Figure 2-14, hosts of the accounting department are located in a VLAN. Hosts of
the accounting department are attacked by viruses when they access the Internet. The attacked
hosts send a large number of broadcast packets, causing broadcast storms in the VLAN. Even
hosts cannot communicate. The company requires that broadcast storms be prevented to ensure
communication between hosts and information security.
Router
Ethernet2/0/0
VLANIF10
10.1.1.12/24
PC B PC A
10.1.1.100/24 10.1.1.10/24
VLAN10
财务部
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure interface isolation on the downstream interface of the switch to forbid Layer 2
communication and remove broadcast storms.
2. Enable intra-VLAN proxy ARP on the VLANIF interface to prevent broadcast storms and
implement Layer 3 communication between hosts in the accounting department.
Procedure
Step 1 Add Etherent2/0/0 to VLAN10.
# Create VLAN10.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 10
[Router-vlan10] quit
Create VLAN10 on the the switch and add all interfaces to VLAN10. Configure isolation for
downstream interfaces connected to users. The configuration details are not mentioned here.
# Configure an IP address for each PC. Ensure that the IP addresses of PCs and the IP address
of VLANIF10 are on the same network segment.The configuration details are not mentioned
here.
# After the configuration is complete, each PC and the router can ping each other. PCs, however,
cannot ping each other.
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
vlan batch 10
#
interface Vlanif10
ip address 10.1.1.12 255.255.255.0
arp-proxy inner-sub-vlan-proxy enable
#
interface Ethernet2/0/0
port hybrid pvid vlan 10
port hybrid tagged vlan 10
#
return
VLAN2 VLAN3
VLAN4
VLAN2 VLAN3
Configuration Roadmap
The configuration roadmap is as follows:
Procedure
Step 1 Configure a super-VLAN and sub-VLANs.
# Configure sub-VLAN2.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 2
[Router-vlan2] quit
# Create sub-VLAN3.
[Router] vlan 3
[Router-vlan3] quit
# Create VLANIF4.
[Router] interface vlanif 4
# Run the display arp command to view all the ARP entries.
<Router> display arp
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE
VLAN/CEVLAN
------------------------------------------------------------------------------
10.10.10.1 0018-2000-0083 I - Vlanif4
10.10.10.2 00e0-fc00-0002 19 D-0 Ethernet2/0/0
2/-
10.10.10.3 00e0-fc00-0003 19 D-0 Ethernet2/0/1
2/-
10.10.10.4 00e0-fc00-0004 19 D-0 Ethernet2/0/2
3/-
10.10.10.5 00e0-fc00-0005 19 D-0 Ethernet2/0/3
3/-
------------------------------------------------------------------------------
Total:5 Dynamic:4 Static:0 Interface:1
----End
Configuration Files
Only the configuration file of the router is provided.
#
sysname Router
#
vlan batch 2 to 4
#
vlan 4
aggregate-vlan
access-vlan 2 to 3
#
interface Vlanif4
ip address 10.10.10.1 255.255.255.0
arp-proxy inter-sub-vlan-proxy enable
#
interface Ethernet2/0/0
port link-type access
port default vlan 2
#
interface Ethernet2/0/1
port link-type access
port default vlan 2
#
interface Ethernet2/0/2
port link-type access
port default vlan 3
#
interface Ethernet2/0/3
port link-type access
port default vlan 3
#
return
Networking Requirements
As shown in Figure 2-16, two Ethernet interfaces are added to VLAN100 in default mode. To
view changes of ARP entries, configure Layer 2 topology detection.
Router
PC A PC B
VLAN100
10.1.1.1/24 10.1.1.3/24
Configuration Roadmap
The configuration roadmap is as follows:
Procedure
Step 1 Create VLAN100 and add two Ethernet interfaces to VLAN100 in default mode.
Step 3 Restart Ethernet2/0/0 and view changes of ARP entries and aging time.
# View ARP entries on the router. You can find the router has learned the MAC address of the
PC.
[Router] display arp all
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-
INSTANCE
VLAN/CEVLAN PVC
-----------------------------------------------------------------------------
10.1.1.2 00e0-c01a-4900 I - Vlanif100
10.1.1.1 00e0-c01a-4901 20 D-0 Ethernet2/0/0
10.1.1.3 00e0-de24-bf04 20 D-0 Ethernet2/0/1
-----------------------------------------------------------------------------
Total:3 Dynamic:2 Static:0 Interface:1
After 1 minute, run the shutdown command to shut down Ethernet2/0/0, simulate an interface
fault, and check the aging time of ARP entries. The command output shows that the ARP entries
learned from Ethernet2/0/0 are deleted after Ethernet2/0/0 is shut down.
[Router] interface ethernet 2/0/0
[Router-Ethernet2/0/0] shutdown
[Router-Ethernet2/0/0] display arp all
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE
VLAN/CEVLAN PVC
----------------------------------------------------------------------------
10.1.1.2 00e0-c01a-4900 I -
Vlanif100
10.1.1.3 00e0-de24-bf04 19 D-0 Ethernet2/0/1
------------------------------------------------------------------------------
Total:2 Dynamic:1 Static:0 Interface:1
# Run the undo shutdown command to restart Ethernet2/0/0 and check the aging time of ARP
entries. The command output shows that Ethernet2/0/0 and Ethernet2/0/1 in VLAN100 update
ARP entries after Ethernet2/0/0 is restarted and becomes Up.
[Router] display arp all
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-
INSTANCE
VLAN/CEVLAN PVC
-----------------------------------------------------------------------------
10.1.1.2 00e0-c01a-4900 I - Vlanif100
10.1.1.1 00e0-c01a-4901 20 D-0 Ethernet2/0/0
10.1.1.3 00e0-de24-bf04 20 D-0 Ethernet2/0/1
-----------------------------------------------------------------------------
Total:3 Dynamic:2 Static:0 Interface:1
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
l2-topolgy detect enable
#
vlan batch 100
#
interface Vlanif100
ip address 10.1.1.2 255.255.255.0
#
interface Ethernet2/0/0
port link-type access
port default vlan 100
#
interface Ethernet2/0/1
port link-type access
port default vlan 100
#
return
Networking Requirements
As shown in Figure 2-17, the router connects to three NLB servers through interfaces Eth2/0/1,
Eth2/0/2, and Eth2/0/3 respectively. The three interfaces belong to VLAN 10. The NLB group
works in multicast mode. Each server in the NLB group has its own IP address and MAC address.
The servers also share virtual IP address 10.128.246.252/24 and virtual MAC address 03bf-0a80-
f6fc.
When the client attempts to connect to the virtual IP address of the NLB group, the router needs
to forward packets destined for the group virtual IP address to all servers in the NLB group.
Client
IP Network
Router
Eth2/0/1 Eth2/0/3
Eth2/0/2
Configuration Roadmap
The configuration roadmap is as follows:
Procedure
Step 1 Create a VLAN and add interfaces to the VLAN.
# On the router, create a VLAN and add the interfaces to the VLAN.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface ethernet 2/0/1
[Router-Ethernet2/0/1] port link-type access
[Router-Ethernet2/0/1] quit
[Router] interface ethernet 2/0/2
[Router-Ethernet2/0/2] port link-type access
[Router-Ethernet2/0/2] quit
[Router] interface ethernet 2/0/3
[Router-Ethernet2/0/3] port link-type access
[Router-Ethernet2/0/3] quit
[Router] vlan 10
[Router-vlan10] port ethernet 2/0/1 to 2/0/3
[Router-vlan10] quit
Step 2 On the router, create a VLANIF interface and assign an IP address to it.
[Router] interface vlanif 10
[Router-Vlanif10] ip address 10.128.246.251 24
[Router-Vlanif10] quit
# On the router, run the display mac-address multiport vlan 10 command to check the multi-
interface MAC address table.
<Router> display mac-address multiport vlan 10
--------------------------------------------------------------------------------
MAC Address VLANID Out-Interface
--------------------------------------------------------------------------------
03bf-0a80-f6fc 10 Ethernet2/0/1
Ethernet2/0/2
Ethernet2/0/3
3 port(s)
--------------------------------------------------------------------------------
Total Group(s) : 1
# On the router, run the display arp static command to check the static ARP entry.
<Router> display arp static
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE
VLAN/CEVLAN PVC
------------------------------------------------------------------------------
10.128.246.252 03bf-0a80-f6fc S-- Multi-port:3
------------------------------------------------------------------------------
Total:1 Dynamic:0 Static:1 Interface:0
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
vlan batch 10
#
interface Vlanif10
ip address 10.128.246.251 255.255.255.0
#
interface Ethernet2/0/1
mac-address multiport 03bf-0a80-f6fc vlan 10
port link-type access
port default vlan 10
#
interface Ethernet2/0/2
mac-address multiport 03bf-0a80-f6fc vlan 10
port link-type access
port default vlan 10
#
interface Ethernet2/0/3
mac-address multiport 03bf-0a80-f6fc vlan 10
port link-type access
port default vlan 10
#
arp static 10.128.246.252 03bf-0a80-f6fc
#
return
2.8 References
This section lists references of ARP.
3 DHCP Configuration
DHCP dynamically manages and configures clients in a concentrated manner. It ensures proper
IP address allocation and improves IP address use efficiency.
3.2 Principles
This section describes the implementation of DHCP.
3.3 Applications
This section describes the applicable scenario of DHCP.
3.9 References
This section lists references of DHCP.
Definition
The Dynamic Host Configuration Protocol (DHCP) dynamically assigns IP addresses to users
and manages user configurations in a centralized manner.
Purpose
As the network expands and becomes complex, the number of hosts often exceeds the number
of available IP addresses. As portable computers and wireless networks are widely used, the
positions of computers often change, causing IP addresses of the computers to be changed
accordingly. As a result, network configurations become increasingly complex. To properly and
dynamically assign IP addresses to hosts, DHCP is used.
DHCP is developed based on the BOOTstrap Protocol (BOOTP). BOOTP runs on networks
where each host has a fixed network connection. The administrator configures a BOOTP
parameter file for each host, and the file remains unchanged for a long period of time. DHCP
has the following new features compared with BOOTP:
DHCP rapidly and dynamically allocates IP addresses, which improves IP address usage.
3.2 Principles
This section describes the implementation of DHCP.
DHCP Architecture
Figure 3-1 shows the DHCP architecture.
IP Network
l DHCP Client
A DHCP client exchanges messages with a DHCP server to obtain an IP address and other
configuration parameters. On the device, an interface can function as a DHCP client to
dynamically obtain configuration parameters such as an IP address from a DHCP server.
This facilitates configurations and centralized management.
l DHCP Relay
A DHCP relay agent forwards DHCP packets exchanged between a DHCP client and a
DHCP server that are located on different network segments so that they can complete their
address configuration. Using a DHCP relay agent eliminates the need for deploying a DHCP
server on each network segment. This feature reduces network deployment costs and
facilitates device management.
In the DHCP architecture, the DHCP relay agent is optional. A DHCP relay agent is required
only when the server and client are located on different network segments.
l DHCP Server
A DHCP server processes requests of address allocation, address lease extending, and
address releasing from a DHCP client or a DHCP relay agent, and allocates IP addresses
and other network configuration parameters to the DHCP client.
0 7 15 23 31
op(1) htype (1) hlen (1) hops (1)
xid (4)
secs (2) flags (2)
ciaddr (4)
yiaddr (4)
siaddr (4)
giaddr (4)
chaddr (16)
sname (64)
file (128)
options (variable)
In Figure 3-2, numbers in the round brackets indicate the field length, expressed in bytes.
op(op code) 1 byte Indicates the message type. The options are as follows:
l 1: DHCP Request message
l 2: DHCP Reply message
htype 1 byte Indicates the hardware address type. For Ethernet, the value of this
(hardware field is 1.
type)
hlen 1 byte Indicates the length of a hardware address, expressed in bytes. For
(hardware Ethernet, the value of this field is 6.
length)
hops 1 byte Indicates the number of DHCP relay agents that a DHCP Request
message passes through. This field is set to 0 by a DHCP client or
a DHCP server. The value increases by 1 each time a DHCP Request
message passes through a DHCP relay agent. This field limits the
number of DHCP relay agents that a DHCP message can pass
through.
NOTE
A maximum of 16 DHCP relay agents are allowed between a server and a
client. That is, the number of hops must be smaller than or equal to 16.
Otherwise, DHCP messages are discarded.
secs 2 bytes Indicates the time elapsed since the client obtained or renewed an
(seconds) IP address, in seconds.
flags 2 bytes Indicates the Flags field. Only the leftmost bit of the Flags field is
valid and other bits are set to 0. The leftmost bit determines whether
the DHCP server unicasts or broadcasts a DHCP Reply message.
The options are as follows:
l 0: The DHCP server unicasts a DHCP Reply message.
l 1: The DHCP server broadcasts a DHCP Reply message.
ciaddr 4 bytes Indicates the IP address of a client. The IP address can be an existing
(client ip IP address of a DHCP client or an IP address assigned by a DHCP
address) server to a DHCP client. During initialization, the client has no IP
address and the value of this field is 0.0.0.0.
NOTE
The IP address 0.0.0.0 is used only for temporary communication during
system startup in DHCP mode. It is an invalid address.
yiaddr 4 bytes Indicates the DHCP client IP address assigned by the DHCP server.
(your client The DHCP server fills this field into a DHCP Reply message.
ip address)
siaddr 4 bytes Server IP address from which a DHCP client obtains the startup
(server ip configuration file.
address)
giaddr 4 bytes Indicates the IP address of the first DHCP relay agent. If the DHCP
(gateway ip server and client are located on different network segments, the first
address) DHCP relay agent fills its IP address into this field of the DHCP
Request message sent by the client and forwards the message to the
DHCP server. The DHCP server determines the network segment
where the client resides based on this field, and assigns an IP address
on this network segment from an address pool.
The DHCP server also returns a DHCP Reply message to the first
DHCP relay agent. The DHCP relay agent then forwards the DHCP
Reply message to the client.
NOTE
If the DHCP Request message passes through multiple DHCP Relay agents
before reaching the DHCP server, the value of this field is the IP address of
the first DHCP relay agent and remains unchanged. However, the value of
the Hops field increases by 1 each time a DHCP Request message passes
through a DHCP relay agent.
chaddr 16 bytes Indicates the client MAC address. This field must be consistent with
(client the hardware type and hardware length fields. When sending a
hardware DHCP Request message, the client fills its hardware address into
address) this field. For Ethernet, a 6-byte Ethernet MAC address must be
filled in this field when the hardware type and hardware length fields
are set to 1 and 6 respectively.
sname 64 bytes Indicates the name of the server from which a client obtains
(server host configuration parameters. This field is optional and is filled in by
name) the DHCP server. The field must be filled in with a character string
that ends with 0.
file (file 128 Indicates the Bootfile name specified by the DHCP server for a
name) bytes DHCP client. This field is filled in by the DHCP server and is
delivered to the client when the IP address is assigned to the client.
This field is optional. The field must be filled in with a character
string that ends with 0.
options Variabl Indicates the DHCP Options field, which has a maximum of 312
e bytes. This field contains the DHCP message type and configuration
parameters assigned by a server to a client, including the gateway
IP address, DNS server IP address, and IP address lease.
For details about the Options field, see 3.2.3 DHCP Options.
Message Description
Name
DHCP OFFER A DHCP Offer message is sent by a DHCP server to respond to a DHCP
Discover message. A DHCP Offer message carries various configuration
information.
DHCP ACK A DHCP ACK message is sent by a DHCP server to acknowledge the
DHCP Request message from a DHCP client. After receiving a DHCP ACK
message, the DHCP client obtains the configuration parameters including
the IP address.
DHCP NAK A DHCP NAK message is sent by a DHCP server to reject the DHCP
Request message from a DHCP client. For example, after a DHCP server
receives a DHCP Request message, it cannot find matching lease records.
Then the DHCP server sends a DHCP NAK message, notifying that no IP
address is available for the DHCP client.
DHCP A DHCP Decline message is sent by a DHCP client to notify the DHCP
DECLINE server that the assigned IP address conflicts with another IP address. Then
the DHCP client applies to the DHCP server for another IP address.
DHCP A DHCP Release message is sent by a DHCP client to release its IP address.
RELEASE After receiving a DHCP Release message, the DHCP server can assign this
IP address to another DHCP client.
DHCP A DHCP Inform message is sent by a DHCP client to obtain other network
INFORM configuration parameters such as the gateway address and DNS server
address after the DHCP client has obtained an IP address.
0 7 15
Type Length Value
The Options field consists of Type, Length, and Value. The following table provides the details.
The value of the Options field ranges from 1 to 255. Table 3-4 lists common DHCP options.
58 Specifies the lease renewal time (T1), which is 50% of the lease
time.
The objects of this field vary with the functions of the Options field. For example, Option 77 is
used on a DHCP client to identify user types of the DHCP client. The DHCP server selects an
address pool to allocate an IP address and configuration parameters to the DHCP client based
on the User Class in the Option field. Option 77 is manually configured only on the DHCP client
but not on the server.
NOTE
When the device functions as the DHCP client, the client can identify the Option121 field describing static routes
in the DHCP packet sent by the DHCP server.
For more information about common DHCP options, see RFC 2132.
The Option 82 field is called the DHCP relay agent information field. It records the location of
a DHCP client. A DHCP relay agent or a device enabled with DHCP snooping appends the
Option 82 field to a DHCP Request message sent from a DHCP client, and then forwards the
DHCP Request message to a DHCP server.
You can use the Option 82 field to locate a DHCP client and implement control security and
accounting of the DHCP client. The DHCP server that supports the Option 82 field can determine
allocation of IP addresses and other parameters according to the information in the Option 82
field. IP addresses can be assigned flexibly.
The Option 82 field contains a maximum of 255 suboptions. If the Option 82 field is defined,
at least one suboption must be defined. Currently, the device supports only two suboptions: sub-
option 1 (circuit ID) and suboption 2 (remote ID).
The content of the Option 82 field is not defined uniformly, and various vendors fill in the Option
82 field as required.
DHCP DISCOVER
Step1 (broadcast)
DHCP OFFER
Step2
DHCP REQUEST
Step3 (broadcast)
As shown in Figure 3-4, when a DHCP client accesses the network for the first time, the
DHCP client sets up a connection with a DHCP server through the following four stages.
– Discovery stage: The DHCP client searches for the DHCP server.
In this stage, the DHCP client sends a DHCP Discover message to search for the DHCP
server. The DHCP server address is unknown to the client, so the DHCP client
broadcasts the DHCP Discover message. All the DHCP servers send Reply messages
after they receive the Discover message. In this way, the DHCP client knows locations
of the DHCP servers on the network.
– Offer stage: The DHCP server offers an IP address to the DHCP client.
The DHCP server receives the DHCP Discover message, selects an IP address from the
address pool, and sends a DHCP Offer message to the DHCP client. The Offer message
carries information such as the IP address, lease of the IP address, gateway address, and
DNS server address.
– Request stage: The DHCP client selects an IP address.
If multiple DHCP servers send DHCP Offer messages to the DHCP client, the client
receives the first DHCP Offer message. Then the client broadcasts a DHCP Request
message including the information about the DHCP server address (Option 54 field).
The client broadcasts a DHCP Request message to notify all the DHCP servers that the
client uses the IP address provided by the DHCP server in the Option 54 field and that
all the other servers can use the assigned IP addresses.
– Acknowledgment stage: The DHCP server acknowledges the IP address that is offered.
When the DHCP server receives the DHCP Request message from the DHCP client,
the server searches the lease record based on the MAC address in the Request message.
If there is the IP address record, the server sends a DHCP ACK message to the client,
carrying the IP address and other configurations. After receiving the DHCP ACK
message, the DHCP client broadcasts gratuitous ARP packets to detect whether any
host is using the IP address assigned by the DHCP server. If no response is received
within the specified time, the DHCP client uses the IP address.
If there is no IP address record or the server cannot assign IP addresses, the server sends
a DHCP NAK message to notify the DHCP client that the server cannot assign IP
addresses. The DHCP client needs to send a new DHCP Discover message to request
a new IP address.
After obtaining the IP address, the DHCP client checks the status of the gateway in use
before the client goes online. If the gateway address is incorrect or the gateway device
fails, the DHCP client requests a new IP address using the four modes for interaction.
l The DHCP client uses the assigned IP address.
Figure 3-5 Procedure for the DHCP client to use the assigned IP address
Client Server
DHCP REQUEST
Step1 (broadcast)
Step2
DHCP ACK/DHCP NAK
As shown in Figure 3-5, when the DHCP client accesses a network for the second time, it
set ups a connection with the DHCP server in the following procedure.
– The client accesses a network for the second time with the IP address that does not
expire. The client does not need to send a DHCP Discover message again. It directly
sends a DHCP Request message carrying the IP address assigned in the first time,
namely, the Option 50 field in the message.
– After receiving the DHCP Request message, if the requested IP address is not assigned
to another DHCP client, the DHCP server sends a DHCP ACK message to instruct the
DHCP client to use the IP address again.
– If the IP address cannot be assigned to the DHCP client, for example, it has been assigned
to another DHCP client, the DHCP server sends a DHCP NAK message to the DHCP
client. After receiving the DHCP NAK message, the DHCP client sends a DHCP
Discover message to request a new IP address.
l The DHCP client renews the IP address lease.
An expected lease can be contained in the DHCP Request message sent to the server for
an IP address. The server compares the expected lease with the lease in the address pool
and assigns a shorter lease to the client.
The IP address dynamically assigned to the DHCP client usually has a validity period. The
DHCP server withdraws the IP address after the validity period expires. To keep using the
IP address, the DHCP client needs to renew the IP address lease.
When obtaining an IP address, the DHCP client enters the binding state. The client is
configured with three timers to control lease renewal, rebinding, and lease expiration
respectively. When assigning an IP address to the DHCP client, the DHCP server also
specifies values for the timers. If the server does not specify values for the timers, the client
uses the default values. Table 3-5 lists the default timer values.
Figure 3-6 Procedure for a DHCP client to renew the IP address lease
Client Server
DHCP REQUEST
(unicast)
T1
DHCP REQUEST
(broadcast)
T2
As shown in Figure 3-6, when the DHCP client renews the IP address lease, it set ups a
connection with the DHCP server in the following procedures:
– When 50% of the IP address lease (T1) has passed, the DHCP client unicasts a DHCP
Request message to the DHCP server to renew the lease. If the client receives a DHCP
ACK message, the address lease is successfully renewed. If the client receives a DHCP
NAK message, it sends a request again.
– When 87.5% of the IP address lease (T2) has passed and the client has not received the
Reply message, the DHCP client automatically sends a broadcast message to the DHCP
server to renew the IP address lease. If the client receives a DHCP ACK message, the
address lease is successfully renewed. If the client receives a DHCP NAK message, it
sends a request again.
– If the client has not received a Reply message from the server when the IP address lease
expires, the client must stop using the current IP address and send a DHCP Discover
message to request a new IP address.
l The DHCP client releases an IP address.
When the DHCP client does not use the assigned IP address, it sends a DHCP Release
message to notify the DHCP server of releasing the IP address. The DHCP server retains
the DHCP client configurations so that the configurations can be used when the client
requests an address again.
The DHCP relay function enables message exchanges between a DHCP server and a client on
different network segments. When the DHCP client and server are on different network
segments, the DHCP relay agent transparently transmits DHCP messages to the destination
DHCP server. In this way, DHCP clients on different network segments can communicate with
one DHCP server.
Figure 3-7 shows how a DHCP client uses the DHCP relay agent to apply for an IP address for
the first time.
Figure 3-7 shows the working process of a DHCP relay agent. The DHCP client sends a Request
message to the DHCP server. When receiving the message, the DHCP relay agent processes and
unicasts the message to the specified DHCP server on the other network segment. The DHCP
server sends requested configurations to the client through the DHCP relay agent based on
information in the Request message.
1. After receiving a DHCP Discover message or a Request message, the DHCP relay agent
performs the following operations:
l Discards DHCP Request messages whose number of hops is larger than the hop limit
to prevent loops. Or, increases the value of the hop by 1, indicating that the message
passes through a DHCP relay agent.
l Checks the giaddr field. If the value is 0, set the value of the giaddr field to the IP address
of the interface which receives the Request message. Selects one IP address if the
interface has multiple IP addresses. All the Request messages received by the interface
later use this IP address to fill the giaddr field. If the value is not 0, do not change the
value.
l Sets the TTL in the request packets to the default value in the DHCP relay device, not
the value calculated by decreasing the original TTL by 1. You can change the value of
the hops field to prevent loops and limit hops.
l Changes the destination IP address of the DHCP Request message to the IP address of
the DHCP server or the IP address of the next DHCP relay agent. In this way, the DHCP
Request message can be forwarded to the DHCP server or the next DHCP relay agent.
2. The DHCP server assigns IP addresses to the client based on the Relay Agent IP Address
field and sends the DHCP Reply message to the DHCP relay agent specified in the Relay
Agent IP Address field. After receiving the DHCP Reply message, the DHCP relay agent
performs the following operations:
l The DHCP relay agent assumes that all the Reply messages are sent to the directly-
connected DHCP clients. The Relay Agent IP Address field identifies the interface
directly connected to the client. If the value of the Relay Agent IP Address field is not
the IP address of a local interface, the DHCP relay agent discards the Reply message.
l The DHCP relay agent checks the broadcast flag bit of the message. If the broadcast
flag bit is 1, the DHCP relay agent broadcasts the DHCP Reply message to the DHCP
client; otherwise, the DHCP relay agent unicasts the DHCP Reply message to the DHCP
client. The destination IP address is the value in the Your (Client) IP Address field, and
the MAC address is the value in the Client Hardware Address field.
Figure 3-8 shows how a DHCP client extends the IP address lease through the DHCP relay
agent.
Figure 3-8 Extending the IP address lease through the DHCP relay agent
DHCP RESQUEST(Unicast)
Step1
1. After accessing the network for the first time, the DHCP client only needs to unicast a
DHCP Request message to the DHCP server that assigned its currently-used IP address.
2. The DHCP server then directly unicasts a DHCP ACK message or a DHCP NAK message
to the client.
DHCP Releasing
The DHCP relay agent, instead of the client, can send a Release message to the DHCP server to
release the IP addresses that assigned to the DHCP clients. You can configure a command on
the DHCP relay agent to release the IP addresses that the DHCP server assigns to the DHCP
client.
l IP address that is in the database of the DHCP server and is statically bound to the MAC
address of the client
l IP address that has been assigned to the client before, that is, IP address in the Requested
IP Addr Option of the DHCP Discover message sent by the client
l IP address that is first found when the DHCP server searches the DHCP address pool for
available IP addresses
l If the DHCP address pool has no available IP address, the DHCP server searches the expired
IP addresses and conflicting IP addresses, and then assigns a valid IP address to the client.
If all the IP addresses are in use, an error is reported.
By using the ping command, you can check whether a response to the ping packet is received
within the specified period. If no response to the ping packet is received, the DHCP server keeps
sending ping packets to the IP address to be assigned until the number of the sent ping packets
reaches the maximum value. If there is still no response, this IP address is not in use, and the
DHCP server assigns the IP address to a client. (This is implemented based on RFC 2132.)
IP Address Reservation
DHCP supports IP address reservation for clients. The reserved IP addresses can be those in the
address pool or not. If an address in the address pool is reserved, it is no longer assignable.
Addresses are usually reserved for DNS servers.
– Run the ipconfig /renew command on the Windows 7 operating system of the PC to
apply for a new IP address.
– Run the winipcfg /renew command in the MS-DOS of Windows 98 to apply for a new
IP address.
The user PC needs to send a DHCP Discover message to the DHCP server.
3.3 Applications
This section describes the applicable scenario of DHCP.
DHCP Clients
Generally, the DHCP server is used to assign IP addresses in the following scenarios:
l On a large network, manual configurations take a long time and bring difficulties to
centralized management over the entire network.
l Hosts on the network are more than available IP addresses. Thus, not every host has a fixed
IP address. Many hosts need to dynamically obtain IP addresses through the DHCP server.
In addition, network administrators hope that there is a limit to the number of users of on-
line at the same time.
l Only a few hosts on the network require fixed IP addresses.
Internet
DHCP Clients
The earlier DHCP protocol applies to only the scenario that the DHCP client and DHCP server
are on the same network segment. To dynamically assign IP addresses to hosts on network
segments, the network administrator needs to configure a DHCP server on each network
segment, which increases costs.
The DHCP relay function is introduced to solve this problem. A DHCP client can apply to the
DHCP server on another network segment to obtain a valid IP address. In this manner, DHCP
clients on multiple network segments can share one DHCP server. This reduces costs and
facilitates centralized management.
RouterA
DHCP Client
RouterC
DHCP Server
RouterB
BOOTP Client
As it is shown in Figure 3-11, when the DHCP/BOOTP client function is configured on the
device Layer 3 interface, the device dynamically obtains IP addresses and other network
configuration parameters from the DHCP server. This operation facilitates user configurations
and management.
The DHCP server can communicate with the BOOTP client, so you do not need to configure
the BOOTP server. The DHCP server allocates IP addresses to BOOTP clients.
Pre-configuration Tasks
Before configuring a DHCP server based on the global address pool, complete the following
tasks:
l Ensuring that the link between the DHCP client and the device works properly and the
DHCP client can communicate with the device
l (Optional) Configuring the DNS service for the DHCP client
l (Optional) Configuring the NetBIOS service for the DHCP client
l (Optional) Configuring routes from the device to the DNS server and the NetBIOS server
l (Optional) Configuring the customized DHCP option
Context
When a device functions as a DHCP server, you can configure a global address pool to specify
the range of IP addresses that can be allocated to clients.
According to the requirements of clients, IP addresses can be allocated using the dynamic
allocation mode or static binding mode.
l Dynamic allocation mode: The DHCP server dynamically allocates IP addresses to clients
from the global address pool. This mode is often used to allocate IP addresses to clients
without special requirements. This type of client is also called a dynamic client.
l Static binding mode: The DHCP server allocates fixed IP addresses to fixed clients. In this
mode, IP addresses in the global address pool are bound to MAC addresses of clients. This
mode is often used to allocate IP addresses to clients with special requirements. This type
of client is also called a static client.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ip pool ip-pool-name
A global address pool is created and the global address pool view is displayed.
Step 3 Run:
network ip-address [ mask { mask | mask-length } ]
The range of IP addresses that can be allocated dynamically in the global address pool is
specified.
By default, the range of IP addresses that can be allocated dynamically to clients is not specified.
One address pool can be configured with only one IP address segment. The address range is
determined by the mask length.
NOTE
When specifying the IP address range, ensure that IP addresses within the range are on the same network segment
as the interface IP address of the DHCP server or DHCP relay agent, avoiding allocation of wrong IP addresses.
----End
Context
You can configure a DHCP Option template, configure network parameters for static clients in
the template, and bind the template to fixed terminals in the global address pool. The DHCP
server then can allocate network parameters to fixed terminals.
Procedure
Step 1 Run:
system-view
When the device functions as the DHCP server, the device can allocate IP addresses to BOOTP
clients if the BOOTP clients reside on the same network as the DHCP server.
A DHCP Option template is created and the DHCP Option template view is displayed.
When static clients need to be allocated different network parameters from dynamic clients, you
can configure a DHCP Option template. The network parameters configured in the DHCP Option
template view take effect only for static clients. If a certain network parameter is configured for
static clients in the DHCP Option template view and global address pool view, the configuration
in the DHCP Option template view takes effect.
Step 4 (Optional) Run the following one or multiple commands in the DHCP Option template view to
configure network parameters except IP addresses for clients.
l Run:
gateway-list ip-address &<1-8>
1. Run:
bootfile bootfile
The name of the startup configuration file for the DHCP client is configured.
By default, the name of the startup configuration file for a DHCP client is not configured.
2. Run:
sname sname
The name of the server from which the DHCP client obtains the startup configuration
file is configured.
By default, the name of the server from which the DHCP client obtains the startup
configuration file is not configured.
NOTE
Besides assigning IP addresses, a DHCP server can also provide the required network configuration
parameters, such as the startup configuration file name for the DHCP client. Usually, the startup
configuration file is saved on a specified file server. Therefore, the route between the DHCP client
and the file server must be reachable.
l Run:
next-server ip-address
The IP address of a server is configured for the client after the client automatically obtains
the IP address.
By default, the IP address of a server is not configured for the client after the client
automatically obtains the IP address.
l Run the following commands to configure the DNS service for the DHCP client.
– Run:
dns-list ip-address &<1-8>
The IP address of the DNS server for the DHCP client is configured.
To load balance traffic and improve network reliability, configure multiple DNS servers.
Each DHCP Option template can be configured with a maximum of eight DNS server
addresses.
– Run:
domain-name domain-name
The IP address of the NetBIOS server for the DHCP client is configured.
Each DHCP Option template can be configured with a maximum of eight NetBIOS server
addresses.
– Run:
netbios-type { b-node | h-node | m-node | p-node }
When the password is contained in option, the ascii or hex type is insecure. Set the option type to cipher.
A secure password should contain at least two types of the following: lowercase letters, uppercase letters,
number, and special characters. In addition, the password must consist of six or more than six characters.
l Run:
option121 ip-address { ip-address mask-length gateway-address } &<1-8>
The Option 184 field delivered from the DHCP server to the client is configured.
By default, the Option 184 field is not configured.
l Run:
force insert option code &<1-254>
A DHCP server is configured to forcibly insert an Option field specified in the DHCP Option
template to a DHCP Response packet that it sends to a DHCP client.
By default, a DHCP server is not configured to forcibly insert an Option field to a DHCP
Response packet that it sends to a DHCP client.
Step 6 Run:
ip pool ip-pool-name
Step 7 Run:
static-bind ip-address ip-address mac-address mac-address [ option-template
template-name ]
IP addresses in the global address pool are bound to MAC addresses of DHCP clients using the
static binding mode.
By default, an IP address in the global address pool is not bound to any MAC address.
When a client requires a fixed IP address, bind an idle IP address in the address pool to the MAC
address of the client.
To allocate network configuration parameters except IP addresses to static clients, specify the
option-template parameter.
NOTE
When binding an IP address to a MAC address, the IP address must be in the range of IP addresses that can be
dynamically allocated in the global address pool.
----End
Context
You can configure network parameters for dynamic clients in the global address pool. The DHCP
server then can allocate network parameters such as IP addresses to dynamic clients.
Procedure
Step 1 Run:
system-view
The IP addresses that are not automatically allocated in the address pool are configured.
By default, all IP addresses in an address pool can be automatically allocated to clients.
In an address pool, some IP addresses are reserved for other services (for example, an IP
address is reserved for the DNS server). These IP addresses cannot be allocated to DHCP
clients. If you run the command multiple times, you can set multiple IP address ranges that
cannot be automatically allocated to clients.
l Run:
gateway-list ip-address &<1-8>
To load balance traffic and improve network reliability, configure multiple egress gateways.
An address pool can be configured with a maximum of eight gateway addresses. These
gateway addresses cannot be subnet broadcast addresses.
l (Optional) Run the following commands to configure the DHCP client to automatically
obtain the startup configuration file.
1. Run:
bootfile bootfile
The name of the startup configuration file for the DHCP client is configured.
By default, the name of the startup configuration file for a DHCP client is not configured.
2. Run:
sname sname
The name of the server from which the DHCP client obtains the startup configuration
file is configured.
By default, the name of the server from which the DHCP client obtains the startup
configuration file is not configured.
NOTE
Besides assigning IP addresses, a DHCP server can also provide the required network configuration
parameters, such as the startup configuration file name for the DHCP client. Usually, the startup
configuration file is saved on a specified file server. Therefore, the route between the DHCP client
and the file server must be reachable.
l Run:
next-server ip-address
The IP address of a server is configured for the client after the client automatically obtains
the IP address.
By default, the IP address of a server is not configured for the client after the client
automatically obtains the IP address.
l Run:
vpn-instance vpn-instance-name
The DHCP client is dynamically allocated the DNS and NetBIOS configurations.
NetBIOS stands for Network Basic Input/Output System. When a DHCP client uses the
NetBIOS protocol for communication, its host name must be mapped to an IP address.
NOTE
After the DNS and NetBIOS configurations are dynamically allocated, you do not to configure the
DNS and NetBIOS information. To specify the IP addresses of the DNS and NetBIOS servers, you
need to statically configure the IP addresses.
The NetBIOS node type cannot be dynamically obtained using this command.
l Run the following commands to statically configure the DNS service for the DHCP client.
– Run:
dns-list ip-address &<1-8>
The IP address of the DNS server for the DHCP client is configured.
To load balance traffic and improve network reliability, configure multiple DNS servers.
Each IP address pool can be configured with a maximum of eight DNS server addresses.
– Run:
domain-name domain-name
The IP address of the NetBIOS server for the DHCP client is configured.
Each IP address pool can be configured with a maximum of eight NetBIOS server
addresses.
– Run:
netbios-type { b-node | h-node | m-node | p-node }
When the password is contained in option, the ascii or hex type is insecure. Set the option type to cipher.
A secure password should contain at least two types of the following: lowercase letters, uppercase letters,
number, and special characters. In addition, the password must consist of six or more than six characters.
l Run:
option121 ip-address { ip-address mask-length gateway-address } &<1-8>
The Option 184 field delivered from the DHCP server to the client is configured.
By default, the Option 184 field is not configured.
l Run:
force insert option code &<1-254>
A DHCP server is configured to forcibly insert an Option field specified in the global address
pool to a DHCP Response packet that it sends to a DHCP client.
By default, a DHCP server is not configured to forcibly insert an Option field to a DHCP
Response packet that it sends to a DHCP client.
----End
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp enable
DHCP is enabled.
NOTE
When the device functions as the DHCP server and the STP function is enabled, address allocation may be slow.
By default, the STP function is enabled. If the STP function is not required, run the undo stp enable command
to disable it.
Step 3 Run:
interface interface-type interface-number [.subinterface-number ]
Step 4 Run:
ip address ip-address { mask | mask-length }
When users connected to the interface that has an IP address configured request IP addresses:
l If the industrial switch router used as the DHCP server is on the same network segment as
DHCP clients, and no relay agent is deployed between them, the industrial switch router
assigns IP addresses on the same network segment as the interface to users who get online
from the interface. If the interface is not configured with an IP address or no address pool is
on the same network segment as the interface address, the clients cannot go online.
l If the industrial switch router used as the DHCP server and DHCP clients are on different
network segments, and a DHCP relay agent is deployed between them, the industrial switch
router parses the giaddr field of a DHCP Request message to obtain an IP address. If the IP
address does not match the corresponding address pool, the user cannot get online.
Step 5 Run:
dhcp select global
After the configuration is complete, users who get online from this interface can obtain IP
addresses and other configuration parameters from the global address pool.
NOTE
If there is a DHCP relay agent between the DHCP client and server, this step is optional. Otherwise, this step is
mandatory.
----End
Context
Before assigning an address to a client, the industrial switch router used as the DHCP server
needs to ping the IP address to avoid address conflicts.
After the dhcp server ping command is executed, the DHCP server can prevent repeated IP
address allocation. The DHCP server pings an IP address to be allocated. If there is no response
to the ping packet within a certain period, the DHCP server continues to send ping packets to
this IP address until the number of ping packets reaches the maximum value. If there is still no
response, this IP address is not in use, and the DHCP server allocates the IP address to a client.
Duplicate IP address detection on the DHCP server should not be too long. Otherwise, the client
cannot obtain an IP address. It is recommended that the configured total detection time
(Maximum number of send ping packets x Maximum response time) be smaller than 8s.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp server ping packet number
The maximum number of ping packets to be sent by the industrial switch router is set.
By default, the maximum number of ping packets to be sent by the industrial switch router is 0.
That is, the industrial switch router does not ping the IP addresses to be allocated.
Step 3 Run:
dhcp server ping timeout milliseconds
The period in which the industrial switch router waits for the response to a ping packet is set.
By default, the period in which the industrial switch router waits for the response to a ping packet
is 500 ms.
----End
Context
When the device functions as the DHCP server, you can enable automatic saving of DHCP data
so that IP address information is saved to the storage device periodically.
You can configure the device to save DHCP data to the storage device. When a fault occurs,
you can restore data from the storage device.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp server database enable
The function that saves DHCP data to the storage device is enabled.
After this command is executed, the system generates the lease.txt and conflict.txt files and
saves them in the dhcp folder of the storage device. The two files save the address lease
information and address conflict information. Run the command display dhcp server
database to check the storage device for saving DHCP data.
Step 3 Run:
dhcp server database write-delay interval
After the device is configured to automatically save DHCP data, the device saves data every
300 seconds by default and the latest data overwrites the previous data.
Step 4 Run:
dhcp server database recover
After this command is executed, the device restores DHCP data from the storage device during
a restart.
----End
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp server trust option82
----End
Context
When the DHCP server allocates IP addresses to clients, it records address allocation information
to facilitate routine maintenance and fault location. After the logging function during IP address
allocation of the DHCP server is configured, the DHCP server records logs about address
allocation, conflict, lease renewal, and release.
NOTE
If a large number of DHCP clients request for IP addresses after the logging function during IP address
allocation of the DHCP server is configured, the server frequently records logs and therefore the device
performance may be affected.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ip pool ip-pool-name
The global address pool is created and the global address pool view is displayed.
Step 3 Run:
logging
The logging function during IP address allocation of the DHCP server is enabled.
By default, the logging function during IP address allocation of the DHCP server is disabled.
----End
Follow-up Procedure
Configure the information center to display the IP address allocation logs recorded by the device
on user terminals or log hosts or generate them in log files. For details, see Configuring Log
Output in the Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide -
Device Management Information Center Configuration.
Context
As shown in Figure 3-12 and Figure 3-13, the router functions as the backup DHCP server.
You can associate the IP address pool on the router with NQA test instances to check the DHCP
server status (including the link and DHCP server function). This can improve network
reliability. When the DHCP server is working properly, the IP address pool on the router is
locked, and PC1 and PC2 obtain IP addresses through the DHCP server. When NQA detects
that the DHCP server is faulty, the IP address pool on the router is unlocked and assigns an IP
address to PC3 that is newly online. When NQA detects that the DHCP server fault is rectified,
the IP address pool on the router is locked again, and PC4 that is newly online obtains an IP
address through the DHCP server.
NOTE
When the DHCP server is faulty, PC3 obtains an IP address from the router; when the DHCP server is recovered,
the DHCP function is switched back to the DHCP server. At this time, if the IP address lease of PC3 has expired,
the lease renewal will fail. After PC3 goes offline temporarily, it re-obtains an IP address from the DHCP server.
In addition, the two IP addresses obtained by PC3 are different because the IP address pools on the DHCP server
and router have different address ranges.
NOTE
Figure 3-12 Associating the IP address pool with NQA (router and client locating in the same
network segment)
Figure 3-13 Associating the IP address pool with NQA (router and client locating in different
network segments)
Procedure
Step 1 Configure and start NQA test instances.
An IP address pool can be associated with NQA test instances of the DHCP and ICMP types.
NQA test instances of the DHCP type are used to test whether the DHCP server function is
normal; those of the ICMP type are used to test whether routes to the DHCP server are reachable.
When the device uses NQA test instances of the ICMP type, it cannot detect the status of the
DHCP server function. Therefore, the device cannot detect the situation in which the route is
reachable but the DHCP server function is unavailable, and users cannot go online.
An NQA test instance is created and the test instance view is displayed.
By default, no NQA test instance is configured.
3. Run:
test-type dhcp
The automatic test interval is set for the NQA test instance.
By default, no automatic test interval is set. The system performs the test only once.
6. Run:
start
Before using the test instance of the DHCP type, ensure that the DHCP server provides the address
pool for the network segment of the source interface (specified running the source-interface interface-
type interface-number command). You can use the source interface to simulate a DHCP client to send
a DHCP request, and determine the DHCP server status depending on whether an IP address can be
obtained.
l Configuring and starting an NQA test instance of the ICMP type
1. Run:
system-view
An NQA test instance is created and the test instance view is displayed.
By default, no NQA test instance is configured.
3. Run:
test-type icmp
The automatic test interval is set for the NQA test instance.
By default, no automatic test interval is set. The system performs the test only once.
6. Run:
start
l To persistently detect the DHCP server status, you need to perform periodical test for NQA test
instances. Therefore, run the frequency interval command to set the automatic test interval for NQA
test instances.
l This section only mentions basic configuration parameters of the DHCP and ICMP NQA test instances.
For details on how to configure other parameters, see Configuring DHCP Test and Configuring ICMP
Test in the Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide-Network
Management and Monitoring-Configuring the NQA.
Step 2 Run:
ip pool ip-pool-name
Step 3 Run:
excluded-ip-address start-ip-address [ end-ip-address ]
The IP addresses that are not automatically allocated in the address pool are configured.
NOTE
The IP addresses assigned by the backup DHCP server cannot overlap with those assigned by the DHCP
server, which prevents repeated assignment of an IP address. Therefore, you need to run the excluded-ip-
address start-ip-address [ end-ip-address ] command to exclude the IP addresses that are repeated with
those of the remote DHCP service.
Step 4 Run:
lock track nqa admin-name test-name
The IP address pool is associated with the NQA test instance. The device determines whether
to lock the address pool according to the test result of the NQA test instance.
NOTE
When the NQA test instance type is not DHCP and ICMP, the association between the IP address pool and NQA
do not take effect. In this case, the IP address pool is locked.
----End
Procedure
l Run the display ip pool [ name ip-pool-name [ start-ip-address [ end-ip-address ] | all |
conflict | expired | used ] ] command to check information about the specified global
address pool.
l Run the display dhcp server database command to check information about the DHCP
database.
l Run the display ip pool import all command to check parameters that the DHCP server
dynamically allocates to the DHCP client, such as DNS parameters.
l Run the display dhcp option template [ name template-name ] command to check the
configuration of the DHCP Option template.
----End
Pre-configuration Tasks
Before configuring a DHCP server based on an interface address pool, complete the following
tasks:
l Ensuring that the link between the DHCP client and the device works properly and the
DHCP client can communicate with the device
l (Optional) Configuring the DNS server
l (Optional) Configuring the NetBIOS server
l (Optional) Configuring routes from the device to the DNS server and the NetBIOS server
Context
The interface address pool attributes include the IP address lease, IP addresses not to be
automatically allocated, and IP addresses to be statically bound to MAC addresses. IP addresses
in the interface address pool can be assigned dynamically or bound manually as required.
NOTE
Different from parameters configured in the global address pool, network configuration parameters configured
in the interface address pool take effect for both dynamic clients and static clients.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp enable
DHCP is enabled.
NOTE
When the device functions as the DHCP server and the STP function is enabled, address allocation may be slow.
By default, the STP function is enabled. If the STP function is not required, run the undo stp enable command
to disable it.
Step 3 Run:
interface interface-type interface-number [.subinterface-number ]
Step 4 Run:
ip address ip-address { mask | mask-length }
Step 5 Run:
dhcp select interface
The interface address pool is actually the network segment to which the interface belongs, and
such an interface address pool only applies to this interface.
The IP addresses that cannot be automatically allocated in the interface address pool are
configured.
Some IP addresses in the interface address pool are reserved for other services, for example, the
IP address of the DNS server cannot be allocated to clients. If you run this command multiple
times, you can set multiple IP address ranges that cannot be automatically allocated in the DHCP
address pool.
An IP address in the interface address pool is statically bound to the MAC address of a DHCP
client.
When a client requires a fixed IP address, bind an idle IP address in the address pool to the client
MAC address.
NOTE
When the IP address in the interface address pool is statically bound to a MAC address, the IP address must be
in the range of IP addresses that can be allocated dynamically.
A DHCP server is configured to forcibly insert an Option field specified in the global address
pool to a DHCP Response packet that it sends to a DHCP client.
By default, no DHCP server forcibly inserts an Option field to a DHCP Response packet that it
sends to a DHCP client.
Step 10 (Optional) Run the following commands to configure the DHCP client to automatically obtain
the startup configuration file.
1. Run:
dhcp server bootfile bootfile
The name of the startup configuration file is configured for the DHCP client.
By default, the startup configuration file name is not configured for a DHCP client.
2. Run:
dhcp server sname sname
The name of the server from which the DHCP client obtains the startup configuration file
is configured.
By default, the name of the server from which the DHCP client obtains the startup
configuration file is not configured.
NOTE
Besides assigning IP addresses, a DHCP server can also provide the required network configuration parameters,
such as the startup configuration file name for the DHCP client. Usually, the startup configuration file is saved
on a specified file server. Therefore, the route between the DHCP client and the file server must be reachable.
Step 11 Run:
dhcp server next-server ip-address
The IP address of a server is configured for the client after the client automatically obtains the
IP address.
By default, the IP address of a server is not configured for the client after the client automatically
obtains the IP address.
Step 12 Run:
quit
By default, a DHCP server does not dynamically allocate IP addresses to BOOTP clients.
When the device functions as the DHCP server, the device can allocate IP addresses to BOOTP
clients if the BOOTP clients reside on the same network as the DHCP server. You can run the
dhcp server bootp automatic command to dynamically allocate IP addresses. You can also run
the dhcp server static-bind ip-address ip-address mac-address mac-address command to
allocate IP addresses to BOOTP clients in the static binding mode.
----End
3.5.2.2 (Optional) Configuring the DNS Service and NetBIOS Service on the DHCP
Client
Context
The DNS and NetBIOS configurations must be specified before the DHPC server assigns IP
addresses to the DHCP client. If you do not have the configurations assigned by the carrier, the
DHCP server dynamically assigns the DNS and NetBIOS configurations to the DHCP client.
NOTE
When both dynamic and static configurations of DNS and NetBIOS are available in the IP address pool,
the static configurations take effect.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number [.subinterface-number ]
Step 3 Run:
dhcp server import all
The DNS and NetBIOS configurations used by the DHCP client are dynamically configured.
NOTE
If you want to use a specified DNS server and NetBIOS server, you can statically configure parameters of
the DNS server and NetBIOS server for the DHCP client.
The NetBIOS node type cannot be dynamically obtained using this command.
Step 4 Run:
dhcp server domain-name domain-name
Step 5 Run:
dhcp server dns-list ip-address &<1-8>
Each address pool can be configured with a maximum of eight DNS server addresses.
Step 6 Run:
dhcp server nbns-list ip-address &<1-8>
The IP address of the NetBIOS server used by the DHCP client is assigned.
Each address pool can be configured with a maximum of eight NetBIOS server addresses.
Step 7 Run:
dhcp server netbios-type { b-node | h-node | m-node | p-node }
----End
Context
As DHCP develops, new options are emerging. To use these options, add them to the attribute
list of the DHCP server manually. If the DHCP server is configured with the options, the DHCP
client obtains the configuration of the options from the DHCP packet replied by the DHCP server
when the client requests an IP address from the server.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number [.subinterface-number ]
Step 3 Run:
dhcp server option code [ sub-option sub-code ] { ascii ascii-string | hex hex-
string | cipher cipher-string | ip-address ip-address &<1-8>
NOTE
l To ensure accuracy, read the Request For Comments (RFC) before configuring options.
l When the password is contained in option, the ascii or hex type is insecure. Set the option type to cipher.
A secure password should contain at least two types of the following: lowercase letters, uppercase letters,
number, and special characters. In addition, the password must consist of six or more than six characters.
----End
Context
Before assigning an address to a client, the industrial switch router used as the DHCP server
needs to ping the IP address to avoid address conflicts.
After the dhcp server ping command is executed, the DHCP server can prevent repeated IP
address allocation. The DHCP server pings an IP address to be allocated. If there is no response
to the ping packet within a certain period, the DHCP server continues to send ping packets to
this IP address until the number of ping packets reaches the maximum value. If there is still no
response, this IP address is not in use, and the DHCP server allocates the IP address to a client.
Duplicate IP address detection on the DHCP server should not be too long. Otherwise, the client
cannot obtain an IP address. It is recommended that the configured total detection time
(Maximum number of send ping packets x Maximum response time) be smaller than 8s.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp server ping packet number
The maximum number of ping packets to be sent by the industrial switch router is set.
By default, the maximum number of ping packets to be sent by the industrial switch router is 0.
That is, the industrial switch router does not ping the IP addresses to be allocated.
Step 3 Run:
dhcp server ping timeout milliseconds
The period in which the industrial switch router waits for the response to a ping packet is set.
By default, the period in which the industrial switch router waits for the response to a ping packet
is 500 ms.
----End
Context
When the device functions as the DHCP server, you can enable automatic saving of DHCP data
so that IP address information is saved to the storage device periodically.
You can configure the device to save DHCP data to the storage device. When a fault occurs,
you can restore data from the storage device.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp server database enable
The function that saves DHCP data to the storage device is enabled.
After this command is executed, the system generates the lease.txt and conflict.txt files and
saves them in the dhcp folder of the storage device. The two files save the address lease
information and address conflict information. Run the command display dhcp server
database to check the storage device for saving DHCP data.
Step 3 Run:
dhcp server database write-delay interval
After the device is configured to automatically save DHCP data, the device saves data every
300 seconds by default and the latest data overwrites the previous data.
Step 4 Run:
dhcp server database recover
After this command is executed, the device restores DHCP data from the storage device during
a restart.
----End
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp server trust option82
----End
Context
When the DHCP server allocates IP addresses to clients, it records address allocation information
to facilitate routine maintenance and fault location. After the logging function during IP address
allocation of the DHCP server is configured, the DHCP server records logs about address
allocation, conflict, lease renewal, and release.
NOTE
If a large number of DHCP clients request for IP addresses after the logging function during IP address
allocation of the DHCP server is configured, the server frequently records logs and therefore the device
performance may be affected.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number [.subinterface-number ]
Step 3 Run:
dhcp server logging
The logging function during IP address allocation of the DHCP server is enabled.
By default, the logging function during IP address allocation of the DHCP server is disabled.
----End
Follow-up Procedure
Configure the information center to display the IP address allocation logs recorded by the device
on user terminals or log hosts or generate them in log files. For details, see Configuring Log
Output in the Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide -
Device Management Information Center Configuration.
Procedure
l Run the display ip pool [ interface interface-pool-name [ start-ip-address [ end-ip-
address ] | all | conflict | expired | used ] ] command to view information about the IP
address pool.
----End
Pre-configuration Tasks
Before configuring a DHCP relay agent, complete the following tasks:
Configuration Process
Figure 3-14 shows the configuration process.
Configuring a Destination
DHCP Server Group
Context
When the network where a DHCP client resides does not have a DHCP server, a DHCP relay
agent can be configured to forward DHCP messages of the client to a DHCP server.
NOTE
A DHCP message is forwarded between a DHCP client and a DHCP server at most 16 times, and then the
DHCP message is discarded.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp enable
DHCP is enabled.
NOTE
When the device functions as a DHCP relay agent and the STP function is enabled, address allocation may be
slow. By default, the STP function is enabled. If the STP function is not required, run the undo stp enable
command to disable it.
By default, the DHCP server polling function is disabled on the DHCP relay agent.
Step 4 Run:
interface interface-type interface-number [.subinterface-number ]
Step 5 Run:
ip address ip-address { mask | mask-length }
Step 6 Run:
dhcp select relay
NOTE
When the DHCP relay function is enabled on the sub-interface, run arp broadcast enable to enable the ARP
broadcast function on a sub-interface. By default, ARP broadcast is disabled on a VLAN tag termination sub-
interface.
Step 7 Run:
quit
----End
Follow-up Procedure
When the DHCP relay function is enabled on an interface, specify the DHCP server IP address
on the interface in either of the following ways:
l Configure a destination DHCP server group and bind the group to the interface. For details,
see 3.5.3.2 Configuring a Destination DHCP Server Group and 3.5.3.3 Binding an
Interface to a DHCP Server Group.
l Run the dhcp relay server-ip ip-address command in the interface view to configure the
destination DHCP server address.
Context
After a DHCP server group is created and server IP addresses are added to the group, the
industrial switch router used as the DHCP relay agent can forward messages to multiple servers.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp server group group-name
A DHCP server group is created and the DHCP server group view is displayed.
You can configure a maximum of 64 DHCP server groups in the system, and a maximum of 8
DHCP servers in a DHCP server group.
Step 3 Run:
dhcp-server ip-address [ ip-address-index ]
Step 4 (Optional)Run:
gateway ip-address
vpn-instance vpn-instance-name
----End
Context
After the DHCP relay function is enabled on an interface, bind a DHCP server group to the
interface so that DHCP clients can access DHCP servers in the bound server group.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number [.subinterface-number ]
Step 3 Run:
dhcp relay server-select group-name
One interface can be configured with only one DHCP server group.
----End
3.5.3.4 (Optional) Configuring the DHCP Relay Agent to Send DHCP Release
Messages
Context
If a user is forcibly disconnected, you can manually release the IP address assigned to the user
on the DHCP server. You can configure the DHCP relay agent to actively send DHCP Release
messages to the DHCP server. The DHCP server then releases the specified IP addresses.
Procedure
Step 1 Run:
system-view
Step 3 Run:
dhcp relay release client-ip-address mac-address [ vpn-instance vpn-instance-name ]
[ server-ip-address ]
The DHCP relay agent is configured to send DHCP Release messages to the DHCP server.
l When you use the dhcp relay release command in the system view:
– If no DHCP server is specified, the DHCP relay agent will send DHCP Release messages
to the servers in all DHCP server groups bound to the DHCP relay interfaces.
– If a DHCP server is specified, the DHCP relay agent sends DHCP Release messages to
only the specified DHCP server.
l When you use the dhcp relay release command in the interface view:
– If no DHCP server is specified, the DHCP relay agent will send DHCP Release messages
to all the servers in the DHCP server group bound to this interface.
– If a DHCP server is specified, the DHCP relay agent sends DHCP Release messages to
only the specified DHCP server.
NOTE
----End
Procedure
l Run the display dhcp relay { all | interface interface-type interface-number } command
to view the DHCP server group or the DHCP servers on the DHCP relay interface.
l Run the display dhcp server group [ group-name ] command to view the DHCP server
group configuration.
----End
Pre-configuration Tasks
Before configuring the DHCP/BOOTP client function, complete the following tasks:
Context
The DHCP/BOOTP client attributes facilitate communication between the DHCP/BOOTP client
and the DHCP server.
Procedure
Step 1 Run:
system-view
The Option60 field in the DHCP request packet sent by the DHCP client is set.
By default, the default value of the Option60 field depends on the device type, which is huawei-
device name. The device name is configured using the sysname command.
A BOOTP client does not support this configuration.
Step 3 Run:
interface interface-type interface-number
The Option60 field in the DHCP request packet sent by the client is set.
By default, the Option60 field is not configured.
A BOOTP client does not support this configuration.
Step 7 Run:
dhcp client gateway-detect period period retransmit retransmit timeout time
----End
Context
After a client sends a DHCP Request message, the DHCP server assigns an IP address and other
configuration parameters to the client. The DHCP server can also deliver routing entries to a
client to dynamically update the routing table on the client.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ip route ip-address { mask | mask-length } interface-type interface-number dhcp
[ preference-value ]
Step 3 Run:
interface interface-type interface-number
Step 4 Run:
dhcp client default-route preference preference-value
The priority of the routing entry delivered by the DHCP server to a client is set.
By default, the priority of the routing entry delivered by the DHCP server to a client is 60.
----End
Context
The DHCP/BOOTP client function enables an interface to obtain an IP address and other
configurations from the DHCP server.
Procedure
l Enabling the DHCP client function
1. Run:
system-view
----End
Procedure
l Run the display this command on the interface enabled with the DHCP client function to
view configurations of DHCP/BOOTP clients.
l Run the display dhcp client command to view the DHCP/BOOTP client information.
----End
Pre-configuration Tasks
Before limiting the rate of sending packets, complete the following tasks:
l Configuring the DHCP server
l Configuring the DHCP relay agent
Procedure
l Configure the highest rate at which DHCP packets are sent to the protocol stack in the
system view.
1. Run:
system-view
The checking rate of DHCP messages sent to the DHCP protocol stack is configured.
By default, the rate does not exceed 100 pps. The DHCP messages that exceed the
rate are discarded.
l Configure the highest rate at which DHCP packets are sent to the protocol stack in the
VLAN view.
1. Run:
system-view
The checking rate of DHCP messages sent to the DHCP protocol stack is configured.
By default, the checking rate of DHCP messages sent to the DHCP protocol stack is
not configured.
l Configure the highest rate at which DHCP packets are sent to the protocol stack in the
interface view.
1. Run:
system-view
The checking rate of DHCP messages sent to the DHCP protocol stack is configured.
By default, the checking rate of DHCP messages sent to the DHCP protocol stack is
not configured.
5. (Optional) Run:
dhcp alarm dhcp-rate enable
The alarm threshold for the DHCP message checking on an interface is configured.
By default, the alarm threshold for the DHCP message checking on an interface is not
configured.
NOTE
You can set the maximum rate of sending DHCP messages globally, in a VLAN, or on an interface.
If the maximum rate of sending DHCP messages is set globally, in a VLAN, and on an interface
simultaneously, the maximum rate of sending DHCP messages takes effect on an interface, in a
VLAN, and globally in descending order.
----End
Context
During routine maintenance, you can use the reset commands to clear DHCP statistics.
NOTICE
DHCP statistics cannot be restored after they are cleared. Exercise caution when running the
reset commands.
Procedure
l Run the reset dhcp server statistics command in the user view to clear DHCP server
statistics.
l Run the reset dhcp statistics command in the user view to clear the DHCP message
statistics.
l Run the reset dhcp relay statistics [ server-group group-name ] command in the user
view to clear DHCP relay agent statistics.
l Run the reset dhcp client statistics [ interface interface-type interface-number ]
command in the user view to clear DHCP client agent statistics.
----End
Procedure
l Run the reset ip pool { interface interface-name | name ip-pool-name } { low-ip-
address [ high-ip-address ] | all | conflict | expired | used } command to reset the configured
IP address pool on the device.
l Run the reset ip pool import { all | dns | domain-name | nbns } command to clear the
configuration parameters of the DHCP address pool.
----End
Context
DHCP packet statistics contain only the number of packets received and sent by the DHCP
module.
Procedure
l Run the display dhcp statistics command to view DHCP message statistics.
l Run the display dhcp client statistics [ interface interface-type interface-number ]
command to view statistics on the DHCP Client.
l Run the display dhcp relay statistics [ server-group group-name ] command to view
statistics on the DHCP Relay Agent.
l Run the display dhcp server statistics command to view statistics on the DHCP Server.
----End
Networking Requirements
As shown in Figure 3-15, an enterprise has two offices on the same network segment. To reduce
network construction cost, the enterprise uses one DHCP server to assign IP addresses for hosts
in the two offices.
All the hosts in Office1 are on the network segment 10.1.1.0/25 and added to VLAN 10. Hosts
in Office1 only use the DNS service with a lease of ten days. All the hosts in Office2 are on the
network segment 10.1.1.128/25 and added to VLAN 20. Hosts in Office2 use the DNS service
and NetBIOS service with a lease of two days.
You can configure a global address pool on the router and enable the server to dynamically
assign IP addresses to hosts in the two offices.
Figure 3-15 Networking diagram for configuring a DHCP server based on the global address
pool
NetBIOS Server DHCP DHCP DHCP
10.1.1.4/25 Client Client Client
Etherent2/0/0 Etherent2/0/1
VLANIF10 VLANIF20
10.1.1.1/25 10.1.1.129/25
Router
DHCP Server
Configuration Roadmap
The configuration roadmap is as follows:
1. Create two global address pools on the router and set attributes of the pools. Assign IP
addresses to Office1 and Office2 as required.
2. Configure VLANIF interfaces to use the global address pool to assign IP addresses to
clients.
Procedure
Step 1 Enable DHCP.
<Huawei> system-view
[Huawei] sysname Router
[Router] dhcp enable
Step 2 Create address pools and set the attributes of the address pools.
# Set the attributes of IP address pool 1, including the address pool range, DNS server address,
gateway address, and address lease.
[Router] ip pool pool1
[Router-ip-pool-pool1] network 10.1.1.0 mask 255.255.255.128
[Router-ip-pool-pool1] dns-list 10.1.1.2
[Router-ip-pool-pool1] gateway-list 10.1.1.1
[Router-ip-pool-pool1] excluded-ip-address 10.1.1.2
[Router-ip-pool-pool1] excluded-ip-address 10.1.1.4
[Router-ip-pool-pool1] lease day 10
[Router-ip-pool-pool1] quit
# Set the attributes of IP address pool 2, including the address pool range, DNS server address,
egress gateway address, NetBIOS server address, and address lease.
[Router] ip pool pool2
[Router-ip-pool-pool2] network 10.1.1.128 mask 255.255.255.128
[Router-ip-pool-pool2] dns-list 10.1.1.2
[Router-ip-pool-pool2] nbns-list 10.1.1.4
[Router-ip-pool-pool2] gateway-list 10.1.1.129
[Router-ip-pool-pool2] lease day 2
[Router-ip-pool-pool2] quit
# Configure clients on VLANIF 10 to obtain IP addresses from the global address pool.
[Router] interface vlanif 10
[Router-Vlanif10] ip address 10.1.1.1 255.255.255.128
[Router-Vlanif10] dhcp select global
[Router-Vlanif10] quit
# Configure clients on VLANIF 20 to obtain IP addresses from the global address pool.
[Router] interface vlanif 20
[Router-Vlanif20] ip address 10.1.1.129 255.255.255.128
[Router-Vlanif20] dhcp select global
[Router-Vlanif20] quit
# Run the display ip pool command on the router to view the IP address pool configuration.
[Router] display ip pool
-----------------------------------------------------------------------------
Pool-name : pool1
Pool-No : 0
Lease : 10 Days 0 Hours 0 Minutes
Position : Local Status : Unlocked
Gateway-0 : 10.1.1.1
Network : 10.1.1.0
Mask : 255.255.255.128
VPN instance : --
Address Statistic: Total :125 Used :2
Idle :121 Expired :0
Conflict :0 Disable :2
-----------------------------------------------------------------------------
Pool-name : pool2
Pool-No : 1
Lease : 2 Days 0 Hours 0 Minutes
Position : Local Status : Unlocked
Gateway-0 : 10.1.1.129
Network : 10.1.1.128
Mask : 255.255.255.128
VPN instance : --
Address Statistic: Total :125 Used :4
Idle :121 Expired :0
Conflict :0 Disable :0
IP address Statistic
Total :250
Used :6 Idle :242
Expired :0 Conflict :0 Disable :2
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
vlan batch 10 20
#
dhcp enable
#
ip pool pool1
gateway-list 10.1.1.1
network 10.1.1.0 mask 255.255.255.128
excluded-ip-address 10.1.1.2
excluded-ip-address 10.1.1.4
lease day 10 hour 0 minute 0
dns-list 10.1.1.2
#
ip pool pool2
gateway-list 10.1.1.129
network 10.1.1.128 mask 255.255.255.128
lease day 2 hour 0 minute 0
dns-list 10.1.1.2
nbns-list 10.1.1.4
#
interface Vlanif10
ip address 10.1.1.1 255.255.255.128
dhcp select global
#
interface Vlanif20
ip address 10.1.1.129 255.255.255.128
dhcp select global
#
interface Ethernet 2/0/0
port hybrid pvid vlan 10
port hybrid untagged vlan 10
#
interface Ethernet 2/0/1
port hybrid pvid vlan 20
port hybrid untagged vlan 20
#
return
Networking Requirements
As shown in Figure 3-16, the router functions as the enterprise egress gateway. The IP phone
and PCs are devices in an office area. To uniformly manage devices and reduce manual
configuration costs, the administrator needs to configure hosts to dynamically obtain IP
addresses through DHCP. The PCs are the fixed terminal in the duty room. It should always be
online and use domain names to access network devices. Besides obtaining an IP address
dynamically, the PCs requires an unlimited IP address lease and obtains information about the
DNS server. The IP phone uses a fixed IP address 10.1.1.4/24 and its MAC address is dcd2-
fc96-e4c0. Besides obtaining an IP address, the IP phone needs to dynamically obtain the startup
configuration file. The startup configuration file named configuration.ini is saved on the FTP
file server. There are reachable routes between the IP phone and the FTP file server. The gateway
address of the PCs and IP phone is 10.1.1.1/24.
Figure 3-16 Networking diagram of configuring the DHCP server to allocate different network
parameters to dynamic clients and static clients
DNS Server
10.1.1.2/24
Switch GE1/0/0
10.1.1.1/24 Internet
Router
IP Phone DHCP Server
10.1.1.4/24
PC PC PC FTP Server
10.1.1.3/24
Configuration Roadmap
1. Create a DHCP Option template on the router. In the DHCP Option template view,
configure the startup configuration file for the static client IP phone, and configure an IP
address for the network server that provides the startup configuration file.
2. Create a global address pool on the router. In the global address pool view, configure the
IP address lease and information about the DNS server for the dynamic client PCs. Bind
an IP address to the MAC address of the static client IP phone and bind a DHCP Option
template. In this way, the DHCP server can allocate different network parameters to
dynamic and static clients.
Procedure
Step 1 Configure an IP address for the interface.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] ip address 10.1.1.1 24
[Router-GigabitEthernet1/0/0] quit
Step 3 Create a DHCP Option template. In the DHCP Option template view, configure the startup
configuration file for the static client IP phone, and configure an IP address for the network
server that provides the startup configuration file.
[Router] dhcp option template template1
[Router-dhcp-option-template-template1] gateway-list 10.1.1.1
[Router-dhcp-option-template-template1] bootfile configuration.ini
[Router-dhcp-option-template-template1] next-server 10.1.1.3
[Router-dhcp-option-template-template1] quit
Step 4 Create an IP address pool. In the IP address pool view, configure the gateway address, IP address
lease, and IP address of the DNS server for the PCs. Allocate a fixed IP address to the IP phone
and configure the startup configuration file.
[Router] ip pool pool1
[Router-ip-pool-pool1] network 10.1.1.0 mask 255.255.255.0
[Router-ip-pool-pool1] dns-list 10.1.1.2
[Router-ip-pool-pool1] gateway-list 10.1.1.1
[Router-ip-pool-pool1] excluded-ip-address 10.1.1.2 10.1.1.3
[Router-ip-pool-pool1] lease unlimited
[Router-ip-pool-pool1] static-bind ip-address 10.1.1.4 mac-address dcd2-fc96-e4c0
option-template template1
[Router-ip-pool-pool1] quit
# Run the display ip pool name pool1 command on the router to check the IP address pool
configuration.
[Router] display ip pool name pool1
Pool-name : pool1
Pool-No : 0
Lease : unlimited
Domain-name : -
DNS-server0 : 10.1.1.2
NBNS-server0 : -
Netbios-type : -
Position : Local Status : Unlocked
Gateway-0 : 10.1.1.1
Network : 10.1.1.0
Mask : 255.255.255.0
VPN instance : --
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
10.1.1.1 10.1.1.254 253 4 247(0) 0 2
-----------------------------------------------------------------------------
# Run the display dhcp option template name template1 command on the router to check the
DHCP Option template configuration.
[Router] display dhcp option template name template1
-----------------------------------------------------------------------------
Template-Name : template1
Template-No : 0
Next-server : 10.1.1.3
Domain-name : -
DNS-server0 : -
NBNS-server0 : -
Netbios-type : -
Gateway-0 : 10.1.1.1
Bootfile : configuration.ini
----End
Configuration File
Configuration file of the router
#
sysname Router
#
dhcp enable
#
dhcp option template template1
gateway-list 10.1.1.1
next-server 10.1.1.3
bootfile configuration.ini
#
ip pool pool1
gateway-list 10.1.1.1
network 10.1.1.0 mask 255.255.255.0
excluded-ip-address 10.1.1.2 10.1.1.3
static-bind ip-address 10.1.1.4 mac-address dcd2-fc96-e4c0 option-template
template1
lease unlimited
dns-list 10.1.1.2
#
interface GigabitEthernet1/0/0
ip address 10.1.1.1 255.255.255.0
dhcp select global
#
return
Networking Requirements
A DHCP server can assign IP addresses for clients on the same network segment using an
interface address pool.
As shown in Figure 3-17, an enterprise has two offices on the same network segment. To reduce
network construction cost, the enterprise uses one DHCP server to assign IP addresses for hosts
in the two offices.
All the hosts in Office1 are on the network segment 10.1.1.0/24 and added to VLAN 10. Hosts
in Office1 use the DNS service and NetBIOS service with a lease of three days. All the hosts in
Office2 are on the network segment 10.1.2.0/24 and added to VLAN 20. Hosts in Office2 do
not use the DNS service or NetBIOS service. The lease of the IP address is two days.
Figure 3-17 Networking diagram for configuring a DHCP server based on the interface address
pool
NetBIOS DNS DHCP DHCP
Server Server Client Client
10.1.1.3/24 10.1.1.2/24
Router
Configuration Roadmap
The configuration roadmap is as follows:
1. Create two interface address pools on the router and set attributes of the address pool.
Configure the interface address pools to enable the DHCP server to assign IP addresses and
configuration parameters to hosts from different interface address pools.
2. Configure VLANIF interfaces to assign IP addresses to hosts from the interface address
pool.
Procedure
Step 1 Enable DHCP.
<Huawei> system-view
[Huawei] sysname Router
[Router] dhcp enable
# Configure clients on VLANIF 10 to obtain IP addresses from the interface address pool.
[Router] interface vlanif 10
[Router-Vlanif10] ip address 10.1.1.1 255.255.255.0
# Configure clients on VLANIF 20 to obtain IP addresses from the interface address pool.
[Router] interface vlanif 20
[Router-Vlanif20] ip address 10.1.2.1 255.255.255.0
[Router-Vlanif20] dhcp select interface
[Router-Vlanif20] quit
Step 3 Configure the DNS service and NetBIOS service for the interface address pool.
# Configure the DNS service and NetBIOS service for the interface address pool on VLANIF
10.
[Router] interface vlanif 10
[Router-Vlanif10] dhcp server domain-name huawei.com
[Router-Vlanif10] dhcp server dns-list 10.1.1.2
[Router-Vlanif10] dhcp server nbns-list 10.1.1.3
[Router-Vlanif10] dhcp server excluded-ip-address 10.1.1.2
[Router-Vlanif10] dhcp server excluded-ip-address 10.1.1.3
[Router-Vlanif10] dhcp server netbios-type b-node
Run the display ip pool interface command on the router to view configurations of interface
address pools.
[Router] display ip pool interface vlanif10
Pool-name : Vlanif10
Pool-No : 0
Lease : 3 Days 0 Hours 0 Minutes
Domain-name : huawei.com
DNS-server0 : 10.1.1.2
NBNS-server0 : 10.1.1.3
Netbios-type : b-node
Position : Interface Status : Unlocked
Gateway-0 : 10.1.1.1
Network : 10.1.1.0
Mask : 255.255.255.0
VPN instance : --
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
10.1.1.1 10.1.1.254 253 2 249(0) 0 2
-----------------------------------------------------------------------------
[Router] display ip pool interface vlanif20
Pool-name : Vlanif20
Pool-No : 1
Lease : 2 Days 0 Hours 0 Minutes
Domain-name : -
DNS-server0 : -
NBNS-server0 : -
Netbios-type : -
Position : Interface Status : Unlocked
Gateway-0 : 10.1.2.1
Network : 10.1.2.0
Mask : 255.255.255.0
VPN instance : --
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
10.1.2.1 10.1.2.254 253 4 249(0) 0 0
-----------------------------------------------------------------------------
----End
Example
Configuration file of the router
#
sysname Router
#
vlan batch 10 20
#
dhcp enable
#
interface Vlanif10
ip address 10.1.1.1 255.255.255.0
dhcp select interface
dhcp server excluded-ip-address 10.1.1.2 10.1.1.3
dhcp server lease day 3 hour 0 minute 0
dhcp server dns-list 10.1.1.2
dhcp server netbios-type b-node
dhcp server nbns-list 10.1.1.3
dhcp server domain-name huawei.com
#
interface Vlanif20
ip address 10.1.2.1 255.255.255.0
dhcp select interface
dhcp server lease day 2 hour 0 minute 0
#
interface Ethernet 2/0/0
port hybrid pvid vlan 10
port hybrid untagged vlan 10
#
interface Ethernet 2/0/1
port hybrid pvid vlan 20
port hybrid untagged vlan 20
#
return
Networking Requirements
When the DHCP server and clients are on different network segments, a DHCP relay agent is
required.
As shown in Figure 3-18, an enterprise has multiple offices, which are distributed in different
office buildings. The offices in different buildings belong to different VLANs. The enterprise
uses RouterB, which functions as the DHCP server, to assign IP addresses to hosts in different
offices.
Hosts in OfficeA are on 10.20.20.0/24 and the DHCP server is on 10.10.10.0/24. By using
RouterA enabled with DHCP relay, the DHCP clients can obtain IP addresses from the DHCP
server.
On RouterA, the address of GE1/0/0 is 10.10.20.1/24 and the interface address of RouterA
connected to the peer device is 10.10.20.2/24.
On RouterB, the address of GE1/0/0 is 10.10.10.1/24 and the interface address of RouterB
connected to the peer device is 10.10.10.2/24.
GE1/0/0 RouterB
10.10.10.1/24
Internet DHCP Server
GE1/0/0
10.10.20.1/24
OfficeA
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure DHCP relay on RouterA to enable RouterA to forward DHCP messages from
different network segments.
2. Configure a global address pool at 10.20.20.0/24 to enable the DHCP server to assign IP
address to clients on different network segments.
Procedure
Step 1 Configure DHCP relay on RouterA.
1. Create a DHCP server group and add DHCP servers to the group.
# Create a DHCP server group.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] dhcp server group dhcpgroup1
Step 3 Configure the DHCP server based on the global address pool on RouterB.
# Enable DHCP.
<Huawei> system-view
[Huawei] sysname RouterB
[RouterB] dhcp enable
# Create an address pool and set the attributes of the address pool.
[RouterB] ip pool pool1
[RouterB-ip-pool-pool1] network 10.20.20.0 mask 24
[RouterB-ip-pool-pool1] gateway-list 10.20.20.1
[RouterB-ip-pool-pool1] quit
# Run the display ip pool command on RouterB to view the IP address pool configuration.
[RouterB] display ip pool
-----------------------------------------------------------------------------
Pool-name : pool1
Pool-No : 2
Lease : 1 Days 0 Hours 0 Minutes
Position : Local Status : Unlocked
Gateway-0 : 10.20.20.1
Network : 10.20.20.0
Mask : 255.255.255.0
VPN instance : --
Address Statistic: Total :253 Used :3
Idle :250 Expired :0
Conflict :0 Disable :0
IP address Statistic
Total :253
Used :3 Idle :250
Expired :0 Conflict :0 Disable :0
----End
Configuration Files
l Configuration file of RouterA
#
sysname RouterA
#
vlan batch 100
#
dhcp enable
#
dhcp server group dhcpgroup1
dhcp-server 10.10.10.1 0
#
interface Vlanif100
ip address 10.20.20.1 255.255.255.0
dhcp select relay
dhcp relay server-select dhcpgroup1
#
interface Ethernet2/0/0
port hybrid pvid vlan 100
port hybrid untagged vlan 100
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.10.20.1 255.255.255.0
#
ip route-static 0.0.0.0 0.0.0.0
10.10.20.2
#
return
3.7.5 Example for Configuring the DHCP Client and BOOTP Client
Networking Requirements
Users want to configure the DHCP/BOOTP client function on the Layer 3 interface to
dynamically obtain IP addresses and other configurations from the DHCP server using DHCP.
This facilitates user configuration and management.
As shown in Figure 3-19, RouterA functions as a DHCP client, RouterB as a BOOTP client,
and RouterC as the DHCP server. RouterA obtains the dynamically bound IP address, DNS
server address, and gateway address from RouterC, and RouterB obtains the statically bound IP
address, DNS server address, and gateway address from RouterC.
Figure 3-19 Example for configuring the DHCP client and BOOTP client
Gateway
10.1.1.126/24
Eth1/0/0
10.1.1.1/24 10.1.1.2/24 Eth1/0/0 Eth1/0/0
Configuration Roadmap
The configuration roadmap is as follows:
1. Enable the DHCP client function on RouterA so that RouterA can dynamically obtains an
IP address from the DHCP server.
2. Enable the BOOTP client function on RouterB so that RouterB can dynamically obtains
an IP address from the DHCP server.
3. Create a global address pool for the DHCP server on RouterC and set attributes of the
address pool.
Procedure
Step 1 Enable the DHCP client function on RouterA.
Step 3 Create a global address pool for the DHCP server on RouterC and set attributes of the address
pool.
1. Enable DHCP.
<Huawei> system-view
[Huawei] sysname RouterC
[RouterC] dhcp enable
[RouterC] dhcp server bootp
[RouterC] dhcp server bootp automatic
3. Create address pools and set the attributes of the address pools.
[RouterC] ip pool pool1
[RouterC-ip-pool-pool1] network 10.1.1.0 mask 24
[RouterC-ip-pool-pool1] gateway-list 10.1.1.126
[RouterC-ip-pool-pool1] static-bind ip-address 10.1.1.3 mac-address a234-e211-
a256
[RouterC-ip-pool-pool1] dns-list 10.1.1.2
[RouterC-ip-pool-pool1] excluded-ip-address 10.1.1.2
[RouterC-ip-pool-pool1] quit
# Run the display current-configuration command on RouterA to view the DHCP client
configuration.
[RouterA] display current-configuration
...
#
interface Ethernet1/0/0
ip address dhcp-alloc
#
...
# When the IP address is assigned to the interface, run the display dhcp client command on
RouterA to check the IP address.
[RouterA] display dhcp client
DHCP client lease information on interface Ethernet1/0/0 :
Current machine state : Bound
Internet address assigned via : DHCP
Physical address : 80fb-0635-45b6
IP address : 10.1.1.254
Subnet mask : 255.255.255.0
Gateway ip address : 10.1.1.126
DHCP server : 10.1.1.1
Lease obtained at : 2013-12-28 10:58:07
Lease expires at : 2013-12-29 10:58:07
Lease renews at : 2013-12-28 22:58:07
Lease rebinds at : 2013-12-29 07:58:07
DNS : 10.1.1.2
# Run the display current-configuration command on RouterB to view the BOOTP client
configuration.
[RouterB] display current-configuration
...
#
interface Ethernet1/0/0
ip address bootp-alloc
#
...
# When the IP address is assigned to the interface, run the display dhcp client command on
RouterB to check the IP address.
[RouterB] display dhcp client
BOOTP client lease information on interface Ethernet1/0/0 :
Current machine state : Bound
Internet address assigned via : BOOTP
Physical address : a234-e211-a256
IP address : 10.1.1.3
Subnet mask : 255.255.255.0
Gateway ip address : 10.1.1.126
Lease obtained at : 2013-12-28 12:53:17
# Run the display ip pool command on RouterC to view the IP address pool configuration.
[RouterC] display ip pool
-----------------------------------------------------------------------------
Pool-name : pool1
Pool-No : 0
Lease : 1 Days 0 Hours 0 Minutes
Position : Local Status : Unlocked
Gateway-0 : 10.1.1.126
Network : 10.1.1.0
Mask : 255.255.255.0
VPN instance : --
Address Statistic: Total :253 Used :2
Idle :250 Expired :0
Conflict :0 Disable :1
IP address Statistic
Total :253
Used :2 Idle :250
Expired :0 Conflict :0 Disable :1
----End
Example
l Configuration file of RouterA
#
sysname RouterA
#
interface Ethernet1/0/0
undo portswitch
ip address dhcp-alloc
#
return
the attacker sends a large number of DHCP packets to RouterA, the CPU resources of RouterA
will become insufficient. As a result, the requests of authorized users cannot be processed in
time. To avoid this problem, network administrators limit the rate at which DHCP packets are
sent to RouterA. This allows RouterA to effectively defend against DHCP attack packets, and
to process requests of authorized users in time.
DHCP Server
Internet
RouterB
DHCP Relay
RouterA
DHCP DHCP
Attacker
Client Client
Configuration Roadmap
The configuration roadmap is as follows:
l Configure the highest rate at which DHCP packets are sent to RouterA in the system view.
This allows RouterA to limit the rate at which DHCP packets are received within a normal
range.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] dhcp enable
Step 2 Configure the highest rate at which DHCP packets are sent to the protocol stack.
# Enable the system to check the rate at which DHCP packets are sent to the protocol stack.
[RouterA] dhcp check dhcp-rate enable
# Configure the highest rate at which DHCP packets are sent to the protocol stack.
[RouterA] dhcp check dhcp-rate 90
# Run the display current-configuration | include dhcp command on RouterA. You can view
the DHCP function and DHCP rate limit have been enabled in the global view.
[RouterA] display current-configuration | include dhcp
dhcp enable
dhcp check dhcp-rate enable
dhcp check dhcp-rate 90
dhcp alarm dhcp-rate enable
dhcp alarm dhcp-rate threshold 80
----End
Configuration Files
Configuration file of RouterA
#
sysname RouterA
#
dhcp enable
dhcp check dhcp-rate enable
dhcp check dhcp-rate 90
dhcp alarm dhcp-rate enable
dhcp alarm dhcp-rate threshold 80
#
return
Networking Requirements
As shown in Figure 3-21, the router functions as the gateway device of a department in the
enterprise and is connected to the department host through the access switch. The host
dynamically obtains an IP address from the remote DHCP server. The remote DHCP server can
assign IP addresses from 10.1.1.1 to 10.1.1.100. If the remote server is faulty, new hosts will
fail to obtain IP addresses. To prevent this problem, the enterprise requires that a backup server
be deployed to improve reliability and a new server not be deployed to save costs.
IP:10.20.1.1/24
DHCP server
GE0/0/2
IP:10.20.1.2/24
Router
DHCP relay
GE0/0/1
Backup DHCP server
IP:10.1.1.1/24
VLAN10
GE0/0/4
Switch
VLAN10
GE0/0/1-GE0/0/3
Configuration Roadmap
Configure association between an IP address pool and NQA on the router so that the router can
function the backup server of the remote DHCP server. When NQA detects that the remote
DHCP is faulty, new hosts in the department obtain IP addresses through the backup DHCP
server; when NQA detects that the remote DHCP server is recovered, new hosts obtain IP
addresses from the remote DHCP server.
Before configuration, ensure that there are reachable routes from the remote DHCP server to the network
segment 10.1.1.0.
NOTE
Procedure
Step 1 Configure VLANs for interfaces on the switch (using a Huawei S series switch as an example).
<Huawei> system-view
[Huawei] sysname Switch
[Switch] interface gigabitethernet 0/0/1
[Switch-GigabitEthernet0/0/1] port link-type access
[Switch-GigabitEthernet0/0/1] quit
[Switch] interface gigabitethernet 0/0/2
[Switch-GigabitEthernet0/0/2] port link-type access
[Switch-GigabitEthernet0/0/2] quit
[Switch] interface gigabitethernet 0/0/3
[Switch-GigabitEthernet0/0/3] port link-type access
[Switch-GigabitEthernet0/0/3] quit
[Switch] vlan 10
[Switch-vlan10] port gigabitethernet 0/0/1 to 0/0/3
[Switch-vlan10] quit
[Switch] interface gigabitethernet 0/0/4
[Switch-GigabitEthernet0/0/4] port link-type trunk
[Switch-GigabitEthernet0/0/4] port trunk allow-pass vlan 10
[Switch-GigabitEthernet0/0/4] port trunk pvid vlan 10
NOTE
l To persistently detect the remote DHCP server status, you need to perform periodical test for NQA test
instances. Therefore, run the frequency interval command to set the automatic test interval for NQA
test instances.
l The IP addresses assigned by the backup DHCP server cannot overlap with those assigned by the DHCP
server, which prevents repeated assignment of an IP address. Therefore, you need to run the excluded-
ip-address start-ip-address [ end-ip-address ] command to exclude the IP addresses that are repeated
with those of the remote DHCP service.
Step 5 Configure the hosts in the department to automatically obtain IP addresses (using Windows 7
as an example of the operating system).
1. Right-click Network and choose Properties to display the Network and Sharing
Center window.
2. Click Local Area Connection to display the Local Area Connection Status window.
3. Click Properties to display the Local Area Connection Properties window.
4. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties to display the
Internet Protocol Version 4 (TCP/IPv4) Properties window. Select Obtain an IP
address automatically, and click OK.
# On the router, run the display nqa history command to check the NQA detection status, and
run the display ip pool name command to check the locking status of the DHCP address pool.
The command output shows that the address pool is locked when NQA detection succeeds. At
this time, the hosts in the department obtain IP addresses ranging from 10.1.1.1 to 10.1.1.100
through the remote DHCP server.
[Router] display nqa history
NQA entry(admin, test) history:
Index T/H/P Response Status Address Time
1 1/1/1 17ms success 10.20.1.1 2013-12-26 19:40:11.029
2 1/1/2 11ms success 10.20.1.1 2013-12-26 19:40:14.919
3 1/1/3 10ms success 10.20.1.1 2013-12-26 19:40:18.869
[Router] display ip pool name p1
Pool-name : p1
Pool-No : 1
Lease : 1 Days 0 Hours 0 Minutes
Domain-name : -
DNS-server0 : -
NBNS-server0 : -
Netbios-type : -
Position : Local Status : Locked
Gateway-0 : 10.1.1.1
Network : 10.1.1.0
Mask : 255.255.255.0
VPN instance : --
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
10.1.1.1 10.1.1.254 253 0 0(0) 0 253
-----------------------------------------------------------------------------
# On the router, run the shutdown command to disable the interface GE0/0/2 to simulate the
scenario in which a link fault occurs on the remote DHCP server. Run the display nqa
history command to check the NQA detection status, and run the display ip pool name
command to check the locking status of the DHCP address pool. The command output shows
that the address pool is unlocked when NQA detection fails. At this time, the new hosts in the
department obtain IP addresses ranging from 10.1.1.101 to 10.1.1.254 through the router.
[Router] interface gigabitethernet 0/0/2
[Router-GigabitEthernet0/0/2] shutdown
[Router-GigabitEthernet0/0/2] quit
[Router] display nqa history
NQA entry(admin, test) history:
Index T/H/P Response Status Address Time
1 51/1/1 11ms success 10.20.1.1 2013-12-26 20:05:10.919
2 51/1/2 11ms success 10.20.1.1 2013-12-26 20:05:14.879
3 51/1/3 11ms success 10.20.1.1 2013-12-26 20:05:18.899
4 52/1/1 11ms success 10.20.1.1 2013-12-26 20:05:40.929
5 52/1/2 11ms success 10.20.1.1 2013-12-26 20:05:44.859
6 52/1/3 9ms success 10.20.1.1 2013-12-26 20:05:48.919
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
10.1.1.1 10.1.1.254 253 3 150(0) 0 100
-----------------------------------------------------------------------------
----End
Configuration Files
l Configuration file of the switch
#
sysname Switch
#
vlan batch 10
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/4
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
#
return
#
interface GigabitEthernet0/0/1
ip address 10.1.1.1 255.255.255.0
dhcp select relay
dhcp relay server-ip 10.20.1.1
dhcp select global
#
interface GigabitEthernet0/0/2
ip address 10.20.1.2 255.255.255.0
#
nqa test-instance admin test
test-type icmp
destination-address ipv4 10.20.1.1
frequency 30
start now
#
return
Fault Description
When the industrial switch router functions as the DHCP server, the DHCP client cannot obtain
IP addresses.
Procedure
Step 1 Run the display current-configuration | include dhcp enable command to check whether
DHCP is enabled. By default, DHCP is disabled.
l If no DHCP information is displayed, DHCP is disabled. Run the dhcp enable command to
enable DHCP.
l If dhcp enable is displayed, DHCP is enabled. Go to step 2.
Step 2 In the industrial switch router interface view, run the display this command to check whether
the DHCP address assignment mode is set.
The preceding information is The DHCP address Run the dhcp select global or
not displayed. assignment mode is not set on dhcp select interface
the VLANIF interface. command to set the DHCP
address assignment mode on
the interface.
Step 3 Run the display ip pool command to check whether the global address pool has been created.
l If the global address pool has not been created, run the ip pool ip-pool-name and network
ip-address [ mask { mask | mask-length } ] commands to create a global address pool and
set the range of IP addresses that can be dynamically assigned.
l If the global address pool has been created, obtain the value of ip-pool-name. Then run the
display ip pool name ip-pool-name command to check whether the IP addresses in the global
address pool are on the same network segment with the IP address on the interface.
– If the client and server are located on the same network segment and no relay agent is
deployed:
– If IP addresses in the global address pool and the VLANIF interface IP address are
located on different network segments, run the ip address ip-address { mask | mask-
length } command to change the VLANIF interface IP address to be on the same
network segment as IP addresses in the global address pool.
– If IP addresses in the global address pool and the industrial switch router interface IP
address are located on the same network segment, go to step 4.
– If the client and server are located on different network segments and a relay agent is
deployed:
– If IP addresses in the global address pool and the relay agent IP address are located
on different network segments, run the ip address ip-address { mask | mask-length }
command to change the IP address to be on the same network segment as IP addresses
in the global address pool.
– If IP addresses in the global address pool and the relay agent interface IP address are
located on the same network segment, go to step 4.
Step 4 Run the display ip pool [ { interface interface-pool-name | name ip-pool-name } [ start-ip-
address [ end-ip-address ] | all | conflict | expired | used ] ] command to check the usage of IP
addresses in the global or interface address pool. If the value of Idle (Expired) is 0, IP addresses
in the address pool have been used up.
l If the server assigns IP addresses to clients from the global address pool on the interface, re-
create a global address pool where the network segment can be connected to the previous
network segment but cannot overlap with the previous network segment.
l If the DHCP server allocates IP addresses to clients from the interface address pool, you can
reduce the mask length of IP address so that more IP addresses can be allocated.
----End
Fault Description
When the industrial switch router functions as the DHCP relay agent, the DHCP client cannot
obtain IP addresses.
Procedure
Step 1 Run the display current-configuration | include dhcp enable command to check whether
DHCP is enabled. By default, DHCP is disabled.
l If no DHCP information is displayed, DHCP is disabled. Run the dhcp enable command to
enable DHCP.
l If dhcp enable is displayed, DHCP is enabled.
Step 2 In the industrial switch router interface view, run the display this command to check whether
the DHCP relay function is enabled.
l If dhcp select relay is displayed, the DHCP relay function is enabled. Go to step 3.
l If no information is displayed, the DHCP relay function is disabled. Then run the dhcp select
relay command to enable the DHCP relay function.
Step 3 In the industrial switch router interface view, run the display this command to check whether
the DHCP server is configured on the DHCP relay agent.
l If dhcp relay server-ip ip-address is displayed, the DHCP server IP address is configured
on the DHCP relay agent.
l If dhcp relay server-select group-name is displayed, the interface on the DHCP relay agent
is bound to a DHCP server group. Go to step 4.
l If no information is displayed, the DHCP server IP address is not configured on the DHCP
relay agent. Configure the DHCP server using either of the following methods:
– Run the dhcp relay server-ip ip-address command to configure the DHCP server IP
address on the DHCP relay agent.
– Run the dhcp-server command to add DHCP servers to the DHCP server group and run
the dhcp relay server-select group-name command to bind the VLANIF interface to a
DHCP server group.
Step 4 Run the display dhcp server group group-name command to check whether DHCP servers are
configured in the DHCP server group.
l If the Server-IP field is displayed, DHCP servers are configured in the DHCP server group.
l If the Server-IP field is not displayed, DHCP servers are not configured in the DHCP server
group. Then run the dhcp-server command to add DHCP servers to the DHCP server group.
----End
3.9 References
This section lists references of DHCP.
4 DNS Configuration
This chapter describes the principles, basic functions and configuration procedures of DNS, and
provides configuration examples.
4.2 Principles
This section describes the implementation of DNS.
4.3 Applications
This section describes the applicable scenario of DNS.
4.8 References
This section lists references of DNS.
Definition
Domain Name System (DNS) is a distributed database used in TCP and IP applications and
completes resolution between IP addresses and domain names.
Purpose
Each host on the network is identified by an IP address. To access a host, a user must obtain the
host IP address first. It is difficult for users to remember IP addresses of hosts. Therefore, host
names in the format of strings are designed. Each host name maps an IP address. In this way,
users can use the simple and meaningful domain names instead of the complicated IP addresses
to access hosts.
4.2 Principles
This section describes the implementation of DNS.
Domain name resolution is classified into dynamic resolution and static resolution that
complement each other. During domain name resolution, static resolution is preferentially used.
If static resolution fails, dynamic resolution is used. Dynamic DNS resolution takes a period of
time, and the cooperation of the DNS server is required. To improve the domain name resolution
efficiency, you are advised to add commonly used domain names to a static domain name
resolution table.
Static DNS
A static domain name resolution table is manually set up, describing the mappings between
domain names and IP addresses. Some common domain names are added to the table. To obtain
the IP address by resolving a domain name, domain names are resolved based on the static
domain name resolution table. In this manner, the efficiency of domain name resolution is
improved.
Dynamic DNS
User programs, such as ping and tracert, access the DNS server using the resolver of the DNS
client.
Figure 4-1 shows the relationship between user programs, the resolver, the DNS server, and the
cache on the resolver.
Request Request
User Resolver
program
Response Response
Save Read DNS
Server
The DNS client, consisting of the resolver and the cache, is used to accept and respond to the
DNS queries from user programs. Generally, user programs(ping,Tracert), the cache, and the
resolver are on the same host; whereas the DNS server is on another host.
a suffix to the domain name for resolution. For example, a user has set the domain name suffix
com in the suffix list. To visit huawei.com, the user only needs to enter huawei. The system
adds the suffix com to the domain name.
When the domain name suffix list is used, the resolution modes vary according to domain names
entered by users.
l If a user enters a domain name without a dot (.), for example, huawei, the system identifies
it as a host name and adds a suffix to the domain name for resolution. If the resolution fails,
the system resolves the entered domain name.
l If a user enters a domain name with a dot (.), for example, www.huawei or huawei.com.,
the system resolves the domain name. If the resolution fails, the system adds a suffix to the
domain name for resolution.
Query Type
Class-A query is a common type of query, which is used to obtain the IP address corresponding
to a specified domain name. For example, when you ping or tracert a domain name, the ping or
tracert, as a user program, sends a query to the DNS client for the IP address corresponding to
the domain name. If the corresponding IP address does not exist on the DNS client, the DNS
client sends a Class-A query to the DNS server to obtain the corresponding IP address.
DNS relay is similar to DNS proxy. The difference is that the DNS proxy searches for DNS
entries saved in the local domain name cache after receiving DNS query messages from DNS
clients. If requested DNS entries are not saved in the cache, DNS query messages are forwarded
to the DNS server. The DNS relay, however, directly forwards DNS query messages to the DNS
server. This saves DNS cache resources on the DNS relay and ensures that the DNS client obtains
real-time resolution results. (The client obtains wrong resolution results if domain names and
IP addresses change on the DNS server but the cache table on the DNS proxy is not updated in
time.)
The application environments of DNS replay and DNS proxy are similar. Figure 4-2 shows the
typical networking of DNS proxy.
DNS DNS
Proxy Server
Internet
1. The DNS client sends a request packet to the DNS proxy. The DNS proxy IP address is the
destination address of the request packet.
2. After receiving the request packet, the DNS proxy searches for DNS entries saved in the
local domain name resolution tables. If mapping information exists, the DNS proxy sends
a reply packet carrying the resolution result to the DNS client.
3. If no mapping information exists, the DNS proxy sends the request packet to the DNS server
for resolution.
4. After receiving the reply packet from the DNS server, the DNS proxy records the resolution
result and forwards the reply packet to the DNS client.
DNS Server
Host A
Dialer Interface
DNS Client
ISP
DNS Proxy
DNS Spoofing
Host B
HTTP Server
DNS Client
As shown in Figure 4-3, the device functions as the DNS proxy and connects to the network
using the dial-up interface. The dial-up interface is triggered to set up a connection only when
data packets are forwarded by the dial-up interface. When the device functions as the DNS proxy,
hosts A and B consider the device as the DNS server. When the dial-up connection is set up, the
device obtains the DNS server IP address using DHCP.
When receiving a DNS query message from a DNS client, the device not enabled with DNS
spoofing sends a DNS query message to the DNS server when no matching entry is found. If
the dial-up connection is not set up, the device cannot obtain the DNS server IP address. The
device does not send a DNS query message to the DNS server or respond to the request from
the DNS client. The domain name resolution fails. No data packet traffic triggers the dial-up
interface to set up a connection.
DNS spoofing enables the device to send a spoofing IP address to the DNS client that sends a
DNS query message regardless of whether the DNS server IP address is configured or the route
to the DNS server exists on the device. Data packets sent by the DNS client triggers the dial-up
interface to set up a connection.
As shown in Figure 4-3, a DNS client wants to access the HTTP server. The process is described
as follows:
1. A DNS client sends a DNS query message to the DNS proxy for resolving the HTTP server
domain name to an IP address.
2. After receiving the DNS query message, the DNS proxy cannot send the correct IP address
to the DNS client because no matching entry is found locally, no dial-up connection is set
up, and the DNS server IP address is not obtained. The DNS proxy sends the spoofing IP
address as the resolution result to the DNS client. The aging time of a DNS resolution
response message is 0. A reachable route between the DNS client and the IP address in the
response message must exist. The outbound interface of the route is the dial-up interface.
3. After receiving the response message, the host sends an HTTP request to the IP address in
the response message.
4. The DNS proxy forwards the HTTP request using the dial-up interface. The traffic triggers
the dial-up interface to set up a connection with the DNS server. Then the DNS proxy
obtains the DNS server IP address using DHCP.
5. After the DNS resolution response message is aged, the DNS client sends a DNS query
message again.
6. The DNS proxy sends the correct IP address to the DNS client.
7. After obtaining the correct HTTP server IP address, the DNS client can access the HTTP
server.
DDNS Overview
DNS resolves domain names into IP addresses so that you can access network nodes using
domain names. DNS provides static mappings between domain names and IP addresses. When
IP addresses of nodes change, DNS server cannot dynamically update mappings. If a user uses
the original domain name to access the node, the user will fail to access the node because the IP
address mapping the domain name is incorrect. The Dynamic Domain Name System (DDNS)
updates mappings between domain names and the IP addresses on the DNS server to ensure that
the IP address can be resolved correctly.
NOTE
Figure 4-4 Typical DDNS networking for the update mode implemented through the
DDNS server
DNS Server
HTTP Server
DDNS Client 2
Internet
HTTP Client
1
DDNS Server
– DDNS client: When an IP address changes, the DNS server needs to update the mapping
between the domain name and IP address. Internet users use domain names to access
servers that provide application-layer services, such as HTTP and FTP servers. When
the IP address of a server changes, the server functions as a DDNS client and sends a
request for updating the mapping between the domain name and the IP address to the
DDNS server.
– DDNS server: After receiving the DDNS update request, the DDNS server instructs the
DNS server to dynamically update the mapping between the domain name and the IP
address on the DNS server to ensure that the IP address can be resolved correctly and
Internet users can access the DDNS client using the domain name.
No unified standard is defined for the DDNS update process. DDNS update processes are
different on different DDNS servers. DDNS servers provided at www.3322.org,
www.oray.cn, and www.dyndns.com.
4.3 Applications
This section describes the applicable scenario of DNS.
RouterA
DNS Client
DNS Server
RouterB
DNS Client
As shown in Figure 4-5, the device functions as a DNS client and can dynamically obtain the
corresponding IP address of a domain name from a DNS server. This facilitates user
communication.
DNS Client
DNS DNS
Proxy Server
Internet
After being configured with DNS proxy, the device can forward DNS request and reply packets
between the internal DNS clients and external DNS server. When the DNS server address
changes, you only need to configure the DNS proxy, not the DNS clients. This facilitates
centralized network management.
Pre-configuration Tasks
Before configuring a DNS client, complete the following tasks:
l Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
l Configuring a route between the industrial switch router and the DNS server
Context
A static domain name resolution table is manually set up, describing the mappings between
domain names and IP addresses. Some common domain names are added to the table. Static
domain name resolution can be performed based on the static domain name resolution table. To
obtain the IP address by resolving a domain name, the client searches the static domain name
resolution table for the specified domain name. In this manner, the efficiency of domain name
resolution is improved.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ip host host-name ip-address
----End
Follow-up Procedure
Each host name can be mapped to only one IP address. When multiple IP addresses are mapped
to a host name, only the latest configuration takes effect. If multiple host names need to be
resolved, repeat step 2.
Context
For dynamic domain name resolution, the DNS server needs to provide the mapping between
domain names and IP addresses and receive domain name resolution requests from clients.
To implement dynamic DNS, you need to enable dynamic DNS resolution, configure the IP
address of DNS server, configure a source IP address for the local device to receive DNS packets,
and configure a domain name suffix.The DNS server IP address and domain name suffix can be
dynamically obtained using DHCP.
Procedure
Step 1 Run:
system-view
The source IP address is configured for the local device to receive DNS packets.
By default, no source IP address is configured for the local device to receive DNS packets.
Step 5 (Optional) Run:
dns-server-select-algorithm { fixed | auto }
----End
Context
After a DNS server is associated with NQA, the device sends a query packet only to the DNS
server in Up state during dynamic domain name resolution. This improves the domain name
resolution efficiency.
Procedure
Step 1 Configure and start NQA test instances. A DNS server can be associated with NQA test instances
of the DNS and ICMP types. According to the test mechanism, NQA test instances of the DNS
type are used to test whether the DNS server function is normal; those of the ICMP type are used
to test whether routes to the DNS server are reachable. You can select one NQA test instance
type based on the site requirements.
l Configuring and starting an NQA test instance of the DNS type
1. Run:
system-view
An NQA test instance is created and the test instance view is displayed.
By default, no NQA test instance is configured.
3. Run:
test-type dns
The automatic test interval is set for the NQA test instance.
By default, no automatic test interval is set. The system performs the test only once.
7. Run:
start
An NQA test instance is created and the test instance view is displayed.
By default, no NQA test instance is configured.
3. Run:
test-type icmp
The automatic test interval is set for the NQA test instance.
By default, no automatic test interval is set. The system performs the test only once.
6. Run:
start
l To persistently detect the DNS server status, you need to perform periodical test for NQA test instances.
Therefore, run the frequency interval command to set the automatic test interval for NQA test
instances.
l This section only mentions basic configuration parameters of the DNS and ICMP NQA test instances.
For details on how to configure other parameters, see Configuring DNS Test and Configuring ICMP
Test in the Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide-Network
Management and Monitoring-Configuring the NQA.
Step 2 Run:
dns resolve
An IP address for the DNS server is configured and the DNS server is associated with NQA.
During dynamic domain name resolution, the device sends a query request only to the DNS
server in Up state.
By default, no DNS server IP address is configured.
NOTE
You can run the display dns server command to check the DNS server status. When the DNS server is not
associated with NQA, the server is in Up state. After the DNS server is associated with NQA, the server status
depends on the NQA check result. When the NQA test instance type is not DNS and ICMP, the association
between the DNS server and NQA does not take effect and the DNS server is in Up state.
----End
Procedure
l Run the display dns configuration command to display the global DNS configurations.
l Run the display ip host command to check static DNS entries.
l Run the display dns server [ verbose ] command to check the DNS server configuration.
l Run the display dns domain [ verbose ] command to check the domain name suffix
configuration.
----End
Pre-configuration Tasks
Before configuring DNS proxy or relay, complete the following tasks:
l Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
l Configuring the DNS server
l Configuring routes between the device and the DNS server and between the device and the
DNS client
Context
DNS Relay is similar to DNS Proxy. The difference is that the DNS Proxy searches for DNS
entries saved in the domain name cache after receiving DNS query messages from DNS clients.
The DNS Relay, however, directly forwards DNS query messages to the DNS server, reducing
the cache usage.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dns proxy enable or dns relay enable
Step 3 Choose either of the following methods to configure domain name resolution.
l Configure static domain name resolution.
Run:
ip host host-name ip-address
The DNS server that the DNS Proxy or Relay connects to is configured.
By default, no IP address is configured for the DNS server.
3. (Optional) Run:
dns server source-ip ip-address
The source IP address that the device uses to exchange packets with the DNS server is
configured.
By default, no source IP address is configured for the device.
4. (Optional) Run:
dns-server-select-algorithm { fixed | auto }
An algorithm used by the DNS Proxy or Relay to access the destination DNS server is
configured.
By default, the auto algorithm is used.
5. (Optional) Run:
dns forward retry-number number
The number of times for the DNS Proxy or Relay to retransmit query requests to the
destination DNS server is set.
By default, the number of times for the DNS Proxy or Relay to retransmit query requests
to the destination DNS server is 2.
6. (Optional) Run:
dns forward retry-timeout time
The retransmission timeout period that the DNS proxy or DNS relay agent sends Query
packets to the destination DNS server is set.
By default, the retransmission timeout period is 3 seconds.
----End
Context
If the device is enabled with DNS proxy or relay but is not configured with a DNS server address
or has no route to the DNS server, the device does not forward or respond to DNS query messages
from DNS clients. After DNS Spoofing is enabled, the device uses the configured IP address to
respond to all DNS query messages.
In addition to enabling DNS proxy or relay, one of the following requirements must be met to
make DNS Spoofing take effect:
Procedure
Step 1 Run:
system-view
----End
Context
After a DNS server is associated with NQA, the device sends a query packet only to the DNS
server in Up state during dynamic domain name resolution. This improves the domain name
resolution efficiency.
Procedure
Step 1 Configure and start NQA test instances. A DNS server can be associated with NQA test instances
of the DNS and ICMP types. According to the test mechanism, NQA test instances of the DNS
type are used to test whether the DNS server function is normal; those of the ICMP type are used
to test whether routes to the DNS server are reachable. You can select one NQA test instance
type based on the site requirements.
l Configuring and starting an NQA test instance of the DNS type
1. Run:
system-view
An NQA test instance is created and the test instance view is displayed.
By default, no NQA test instance is configured.
3. Run:
test-type dns
The automatic test interval is set for the NQA test instance.
By default, no automatic test interval is set. The system performs the test only once.
7. Run:
start
An NQA test instance is created and the test instance view is displayed.
By default, no NQA test instance is configured.
3. Run:
test-type icmp
The automatic test interval is set for the NQA test instance.
By default, no automatic test interval is set. The system performs the test only once.
6. Run:
start
l To persistently detect the DNS server status, you need to perform periodical test for NQA test instances.
Therefore, run the frequency interval command to set the automatic test interval for NQA test
instances.
l This section only mentions basic configuration parameters of the DNS and ICMP NQA test instances.
For details on how to configure other parameters, see Configuring DNS Test and Configuring ICMP
Test in the Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide-Network
Management and Monitoring-Configuring the NQA.
Step 2 Run:
dns resolve
Step 3 Run:
dns server ip-address track nqa admin-name test-name
An IP address for the DNS server is configured and the DNS server is associated with NQA.
During dynamic domain name resolution, the device sends a query request only to the DNS
server in Up state.
NOTE
You can run the display dns server command to check the DNS server status. When the DNS server is not
associated with NQA, the server is in Up state. After the DNS server is associated with NQA, the server status
depends on the NQA check result. When the NQA test instance type is not DNS and ICMP, the association
between the DNS server and NQA does not take effect and the DNS server is in Up state.
----End
Procedure
l Run the display dns configuration command to display the global DNS configurations.
l Run the display ip host command to check static DNS entries.
l Run the display dns server [ verbose ] command to check the DNS server configuration.
----End
Pre-configuration Tasks
Before configuring a DDNS client, complete the following tasks:
l (Optional) Registering on the DDNS server website
NOTE
The device functioning as the DDNS client supports the following update modes:
l DDNS update mode (defined by the RFC2136): The DDNS client dynamically updates the mapping
between domain names and IP addresses on the DNS server.
l Update mode implemented through the DDNS server: The DDNS client sends the mapping between
domain names and IP addresses to the DDNS server with a specified URL. The DDNS server then
informs the DNS server to dynamically update the mapping between domain names and IP addresses.
When using the update mode implemented through the DDNS server, the DDNS client must register on
the DDNS server website. Currently, the device can be connected to the following DDNS servers: DDNS
servers provided at www.3322.org, www.dyndns.com, and www.oray.cn, Siemens DDNS server, and
HTTP-based common DDNS server.
Authentication steps are implemented in the update process through DDNS servers. All DDNS servers
except Siemens DDNS servers do not encrypt user passwords during the authentication. To improve
security, you are advised to configure IPSec when using these DDNS servers to implement update. For
details, see IPSec Configuration in the Huawei AR530&AR550 Series Industrial Switch Routers
Configuration Guide - VPN.
l Configuring a route between the device and the DDNS server or DNS Server
NOTE
Context
You can specify the DDNS or DNS server to which update requests are sent when configuring
the DDNS policy.
When the device functioning as a DDNS client needs to update the mapping between domain
names and IP addresses on the DNS server, the following update modes are supported:
l DDNS update mode (defined by the RFC2136): The DDNS client dynamically updates the
mapping between domain names and IP addresses on the DNS server. To configure this
mode, run the method ddns [ both ] command.
l Update mode implemented through the DDNS server: The DDNS client sends the mapping
between domain names and IP addresses to the DDNS server with a specified URL. The
DDNS server then informs the DNS server to dynamically update the mapping between
domain names and IP addresses.
– To use the Siemens DDNS server or DDNS servers provided at www.3322.org,
www.dyndns.com, or www.oray.cn, run the method vendor-specific command.
– To use an HTTP-based common DDNS server, run the method http command.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ddns policy policy-name
Step 3 Run:
method { ddns [ both ] | http | vendor-specific }
The update mode is configured for the device functioning as the DDNS client.
By default, the update mode is vendor-specific for the device functioning as the DDNS client.
l Configuring the update mode to ddns (DDNS update mode defined by the RFC2136)
1. Run:
name-server name-server
The DNS server for receiving update messages from the DDNS client is configured.
By default, no DNS server for receiving DDNS update messages is configured.
2. (Optional) Run:
interval interval-time
To ensure password security, you are advised to run the username username password password
command to configure a user name and password. The password information in the configuration file
is displayed in cipher text.
After a DDNS policy is created, enter the URL and specify a DDNS server in the URL.
The processes for the device to request DDNS updates from different DDNS servers
are different; therefore, the URL configurations of DDNS servers are different.
– If username username password password is not specified, the URL contains the
user name and password, and their configurations are displayed in plain text.
– When the device uses HTTP to communicate with the DDNS server provided at
www.3322.org, the URL in a DDNS update request is:
http://username:password@members.3322.org/dyndns/update?
system=dyndns&hostname=<h>&myip=<a>
– When the device uses HTTP to communicate with the DDNS server provided at
www.dyndns.com, the URL in a DDNS update request is:
http://username:password@update.dyndns.com/nic/update?
hostname=<h>&myip=<a>
– When the device uses TCP to communicate with the DDNS server provided at
www.oray.cn, the URL in a DDNS update request is:
oray://username:password@phddnsdev.oray.net
– When the device uses HTTPS to communicate with the Siemens DDNS server,
the URL in a DDNS update request is user-defined, for example,
https://194.138.36.67/nic/update?
group=med&user=huawei_test&password=12345&myip=192.168.19.2
– When the device uses HTTP to communicate with a common DDNS server, the
URL in a DDNS update request is:
http://username:password@merri.s.dnaip.fi/reg/h=<h>&a=<a>
NOTE
In the preceding URLs, username and password indicate the user name and password for
logging in to the DDNS server. Set these parameters based on the registry information. For
example, in http://huawei1:huawei2@merri.s.dnaip.fi/reg/h=<h>&a=<a>, huawei1 and
huawei2 indicate the user name and password for logging in to the DDNS server.
– If username username password password is specified, the URL only contains the
fixed format <username>:<password>, not the user name and password. The user
name and password are specified by username and password, and the password
configuration is displayed in cipher text.
– When the device uses HTTP to communicate with the DDNS server provided at
www.3322.org, the URL in a DDNS update request is:
http://<username>:<password>@members.3322.org/dyndns/update?
system=dyndns&hostname=<h>&myip=<a>
– When the device uses HTTP to communicate with the DDNS server provided at
www.dyndns.com, the URL in a DDNS update request is:
http://<username>:<password>@update.dyndns.com/nic/update?
hostname=<h>&myip=<a>
– When the device uses TCP to communicate with the DDNS server provided at
www.oray.cn, the URL in a DDNS update request is:
oray://<username>:<password>@phddnsdev.oray.net
– When the device uses HTTPS to communicate with the Siemens DDNS server,
the URL in a DDNS update request is user-defined, for example,
https://194.138.36.67/nic/update?
group=med&user=<username>&password=<password>&myip=192.168.19.2
– When the device uses HTTP to communicate with a common DDNS server, the
URL in a DDNS update request is:
http://<username>:<password>@merri.s.dnaip.fi/reg/h=<h>&a=<a>
NOTE
When the device functions as the DDNS client and communicates with the Siemens DDNS server,
the device needs to encrypt packets using SSL. An SSL policy needs to be bound to the Siemens
DDNS policy. To configure an SSL policy, see "SSL Configuration" in the Huawei
AR530&AR550 Series Industrial Switch Routers Configuration Guide - Security.
3. (Optional) Run:
interval interval-time
----End
Context
You can bind a DDNS policy to an interface to update the mapping between the domain name
and an IP address and to start DDNS update.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run:
ddns apply policy policy-name [ fqdn domain-name ]
NOTE
l When the DDNS server is www.3322.org , www.dyndns.com or an HTTP-based common DDNS server,
you must configure the fully qualified domain name ( FQDN ), that is, the fqdn parameter is mandatory.
l The fqdn parameter is mandatory when the DDNS update mode defined by the RFC2136 is configured
using the method ddns [ both ] command.
----End
Procedure
l Run the display ddns policy [ policy-name ] command to view DDNS policy information.
l Run the display ddns interface interface-type interface-number command to view DDNS
policy information on an interface.
----End
Context
NOTICE
Dynamic DNS entries cannot be restored after being deleted. Exercise caution when you run the
command.
Procedure
l Run the reset dns dynamic-host command to delete dynamic DNS entries.
----End
Context
NOTICE
DNS entries of the DNS proxy or relay cannot be restored after being deleted. Exercise caution
when you run the command.
Procedure
l Run the reset dns forward table [ source-ip ip-address ] command to delete DNS entries
of the DNS proxy or relay.
----End
Context
NOTICE
Statistics on sent and received DNS packets cannot be restored after being cleared. Exercise
caution when you run the command.
Procedure
l Run the reset dns statistics command to clear statistics on sent and received DNS packets.
----End
Procedure
l Run:
reset ddns policy policy-name [ interface interface-type interface-num ]
Mappings between all the IP addresses and host names in the DDNS policy are updated.
----End
Procedure
l Run the display dns forward table [ source-ip ip-address ] command to check the DNS
forwarding table.
l Run the display dns dynamic-host [ ip | naptr | srv ] [ domain-name ] command to display
dynamic DNS entries.
----End
RouterB RouterC
GE1/0/0
GE1/0/0 GE1/0/0 10.3.1.1/16
10.1.1.2/16 10.1.1.1/16
GE2/0/0 GE2/0/0
10.2.1.1/16 10.2.1.2/16 DNS Server
DNS Client 10.3.1.2/16
RouterA
huawei.com
10.2.1.3/16
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure static DNS entries on RouterA to access server B and C.
2. Configure the dynamic DNS resolution on RouterA to access the DNS server.
3. Configure the domain name suffix on RouterA to support a domain name suffix list.
4. Configure OSPF on routers to ensure routes are reachable.
Procedure
Step 1 Configure RouterA.
# Configure an IP address for GE1/0/0.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] undo portswitch
[RouterA-GigabitEthernet1/0/0] ip address 10.1.1.2 255.255.0.0
[RouterA-GigabitEthernet1/0/0] quit
# Configure OSPF.
[RouterA] ospf
[RouterA-ospf-1] area 0
[RouterA-ospf-1-area-0.0.0.0] network 10.1.0.0 0.0.255.255
[RouterA-ospf-1-area-0.0.0.0] quit
[RouterA-ospf-1] quit
NOTE
You need to configure OSPF on RouterB and RouterC to ensure reachable routes between them. For details
about OSPF configurations on RouterB and RouterC, see the configuration files.
# Run the ping serverB command on RouterA. You can see that the ping operation succeeds
and the destination IP address is 10.4.1.1.
<RouterA> ping serverB
PING serverB (10.4.1.1): 56 data bytes, press CTRL_C to break
Reply from 10.4.1.1: bytes=56 Sequence=1 ttl=126 time=4 ms
Reply from 10.4.1.1: bytes=56 Sequence=2 ttl=126 time=1 ms
Reply from 10.4.1.1: bytes=56 Sequence=3 ttl=126 time=1 ms
Reply from 10.4.1.1: bytes=56 Sequence=4 ttl=126 time=1 ms
Reply from 10.4.1.1: bytes=56 Sequence=5 ttl=126 time=1 ms
# Run the ping huawei.com command on RouterA. You can see that the ping operation succeeds
and the destination IP address is 10.2.1.3.
<RouterA> ping huawei.com
Trying DNS server (10.3.1.2)
PING huawei.com (10.2.1.3): 56 data bytes, press CTRL_C to break
Reply from 10.2.1.3: bytes=56 Sequence=1 ttl=126 time=6 ms
Reply from 10.2.1.3: bytes=56 Sequence=2 ttl=126 time=4 ms
Reply from 10.2.1.3: bytes=56 Sequence=3 ttl=126 time=4 ms
Reply from 10.2.1.3: bytes=56 Sequence=4 ttl=126 time=4 ms
Reply from 10.2.1.3: bytes=56 Sequence=5 ttl=126 time=4 ms
# Run the ping huawei command on RouterA. You can see that the ping operation succeeds,
the domain name changes to huawei.com, and the destination IP address is 10.2.1.3.
<RouterA> ping huawei
Trying DNS server (10.3.1.2)
PING huawei.com (10.2.1.3): 56 data bytes, press CTRL_C to break
Reply from 10.2.1.3: bytes=56 Sequence=1 ttl=126 time=6 ms
Reply from 10.2.1.3: bytes=56 Sequence=2 ttl=126 time=4 ms
Reply from 10.2.1.3: bytes=56 Sequence=3 ttl=126 time=4 ms
Run the display ip host command on RouterA. You can view mappings between host names
and IP addresses in static DNS entries.
<RouterA> display ip host
Host Age Flags Address
serverB 0 static 10.4.1.1
serverC 0 static 10.4.1.2
# Run the display dns dynamic-host command on RouterA. You can view information about
dynamic DNS entries saved in the cache.
<RouterA> display dns dynamic-host
Host TTL Type Address(es)
huawei.com 114 IP
10.2.1.3
NOTE
The TTL field in the command output indicates the time left before a DNS entry ages out, in seconds.
----End
Configuration File
Configuration file of RouterA
#
sysname RouterA
#
ip host serverB 10.4.1.1
ip host serverC 10.4.1.2
#
dns resolve
dns server 10.3.1.2
dns domain net
dns domain com
#
interface GigabitEthernet 1/0/0
undo portswitch
ip address 10.1.1.2 255.255.0.0
#
ospf 1
area 0.0.0.0
network 10.1.0.0 0.0.255.255
#
return
#
sysname RouterB
#
interface LoopBack0
ip address 10.4.1.1 255.255.255.255
#
#
sysname RouterC
#
interface LoopBack0
ip address 10.4.1.2 255.255.255.255
#
interface GigabitEthernet 1/0/0
undo portswitch
ip address 10.3.1.1 255.255.0.0
#
interface GigabitEthernet 2/0/0
undo portswitch
ip address 10.2.1.2 255.255.0.0
#
ospf 1
area 0.0.0.0
network 10.2.0.0 0.0.255.255
network 10.3.0.0 0.0.255.255
network 10.4.1.2 0.0.0.0
#
return
Networking Requirements
As shown in Figure 4-8, the enterprise does not deploy a DNS server. The route between the
RouterA and the DNS server or between the RouterA and the FTP server is reachable. The
mapping between the domain name (huawei.com) of the FTP server and the IP address 10.2.1.3
is recorded on the DNS server. Enterprise users expect to access the FTP server through the DNS
domain name. To facilitate maintenance, the enterprise users are unaware of the DNS server
address change.
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure DNS Proxy on the AC to implement domain name resolution for clients.
NOTE
After DNS Proxy is enabled, the RouterA can be regarded as the DNS server of HostA. You need to
configure the RouterA's IP address as the IP address of the DNS server on HostA, and configure the IP
address (10.2.1.1) of the DNS server on the Internet network on the RouterA. In this way, when the DNS
server address changes, you only need to modify the configurations on the RouterA, which is not detected
by the users.
Procedure
Step 1 Configure an IP address for GE1/0/0.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] undo portswitch
[RouterA-GigabitEthernet1/0/0] ip address 10.1.1.1 255.255.0.0
[RouterA-GigabitEthernet1/0/0] quit
Step 3 Configure the default route from the DNS proxy to the DNS server.
Assume that the IP address of the next hop from the DNS proxy to the DNS server is 10.1.1.2/16.
[RouterA] ip route-static 0.0.0.0 0.0.0.0 10.1.1.2
[RouterA] quit
# Run the ping huawei.com command on LAN HostA. You can see that the ping operation
succeeds
C:\Documents and Settings\HostA>ping huawei.com
PING huawei.com [10.2.1.3] with 32 bytes of data:
Reply from 10.2.1.3: bytes=32 time=16ms TTL=255
Reply from 10.2.1.3: bytes=32 time<1ms TTL=255
Reply from 10.2.1.3: bytes=32 time<1ms TTL=255
Reply from 10.2.1.3: bytes=32 time<1ms TTL=255
----End
Configuration File
Configuration file of RouterA
#
sysname RouterA
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.1.1.1 255.255.0.0
#
dns resolve
dns server 10.2.1.1
dns proxy enable
#
ip route-static 0.0.0.0 0.0.0.0 10.1.1.2
#
return
4.6.3 Example for Configuring the DDNS Client (Using the Update
Mode Defined by the RFC2136)
Networking Requirements
As shown in Figure 4-9, the router can function as the web server to provide web services for
network users, and the users access the web server by sending DNS requests. The domain name
www.abc.com of the web server corresponds to the interface IP address on the server. The
interface IP address may change. If the mapping between the domain name and IP address of
the web server is not updated on the DNS server in real time, a user access error may occur. The
user requires that the mapping between the domain name and IP address of the web server should
be updated on the DNS server in real time when the DDNS server is not leased. The routes
between the router and DNS server are reachable.
DNS Server
10.3.1.2/16
GE1/0/0
10.1.1.2/16 Internet
Router
DDNS Client
Configuration Roadmap
Configure the DDNS client whose update mode is ddns on the router so that the mapping
between the domain name and IP address of the web server is dynamically updated on the DNS
server when the interface IP address on the router changes.
NOTE
Procedure
Step 1 Create a DDNS policy.
<Huawei> system-view
[Huawei] sysname Router
[Router] ddns policy mypolicy
[Router-ddns-policy-mypolicy] method ddns both
[Router-ddns-policy-mypolicy] name-server 10.3.1.2
[Router-ddns-policy-mypolicy] interval 3600
[Router-ddns-policy-mypolicy] quit
NOTE
When the IP address of GE1/0/0 changes, the router informs the DNS server to update the mapping between the
domain name www.abc.com and new IP address. Internet users then can parse the domain name to obtain the
latest IP address.
Step 2 Configure a default route from the router to the DNS server. Assume that the peer IP address of
the router is 10.1.1.1/16.
[Router] ip route-static 0.0.0.0 0.0.0.0 10.1.1.1
[RouterA] quit
# Run the display ddns policy mypolicy command on the router to check the DDNS policy
named mypolicy.
# Run the display ddns interface gigabitethernet 1/0/0 command on the router to check the
DDNS policy on GE1/0/0.
<Router> display ddns interface gigabitethernet 1/0/0
===== Policy mypolicy =======
Update method : ddns
Name-server : 10.3.1.2
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
ddns policy mypolicy
method ddns both
name-server 10.3.1.2
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.1.1.2 255.255.0.0
ddns apply policy mypolicy fqdn www.abc.com
#
ip route-static 0.0.0.0 0.0.0.0 10.1.1.1
#
return
4.6.4 Example for Configuring the DDNS Client (Using the Update
Mode Implemented Through the DDNS Server)
Networking Requirements
As shown in Figure 4-10, RouterA can function as web server to provide web services for
network users, and the users access the web server by sending DNS requests. The domain name
of RouterA is www.abc.com, the IP address may change. If the mapping between the domain
name and IP address of the web server is not updated on the DNS server in real time, a user
access error may occur. In this case, enable the DDNS client function to obtain the latest mapping
between the domain name and the IP address. The DDNS service provider www.oray.cn is used
as the DDNS server. When the IP address of RouterA changes, RouterA functions as the DDNS
client to send an update request to the DDNS server. Then the DDNS server instructs the DNS
server to reconfigure the mapping between the domain name and the IP address.
DNS Server
10.3.1.2/16
GE3/0/0
RouterA 10.1.1.2/16 RouterB 10.3.1.1/16
GE1/0/0
GE1/0/0
GE2/0/0
DDNS Client 10.1.1.1/16
10.2.1.1/16
DDNS Server
10.2.1.3/16
Configuration Roadmap
Create and bind a DDNS policy on RouterA. When the interface IP address on RouterA changes,
RouterA can send a request for dynamically updating DNS entries.
NOTE
Authentication steps are implemented in the update process through DDNS servers. All DDNS servers except
Siemens DDNS servers do not encrypt user passwords during the authentication. To improve security, you are
advised to configure IPSec when using these DDNS servers to implement update. For details, see IPSec
Configuration in the Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide - VPN.
NOTE
Procedure
Step 1 Configure RouterA.
# Create a DDNS policy.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ddns policy mypolicy
[RouterA-ddns-policy-mypolicy] method vendor-specific
[RouterA-ddns-policy-mypolicy] url oray://<username>:<password>@phddnsdev.oray.net
username steven password nevets
[RouterA-ddns-policy-mypolicy] interval 3600
[RouterA-ddns-policy-mypolicy] quit
NOTE
By default, the update mode of the DDNS client is vendor-specific. If the default update mode is not modified
by running the method command, do not run the method vendor-specific command.
NOTE
If the IP address of GE1/0/0 changes, RouterA notifies the DDNS server of the change, and then the DDNS
server instructs the DNS server to reconfigure the mapping between the domain name www.abc.com and the IP
address to ensure that the IP address can be resolved correctly.
# Configure OSPF.
[RouterA] ospf
[RouterA-ospf-1] area 0
[RouterA-ospf-1-area-0.0.0.0] network 10.1.0.0 0.0.255.255
[RouterA-ospf-1-area-0.0.0.0] quit
[RouterA-ospf-1] quit
NOTE
To implement communication between the DDNS client, DDNS server, and the DNS server, configure
OSPF on RouterB. For details about OSPF configurations on RouterB, see the configuration files.
# Run the display ddns policy mypolicy command on RouterA, and information about the
DDNS policy named mypolicy is displayed.
<RouterA> display ddns policy mypolicy
Policy name : mypolicy
Policy interval time : 3600
Policy URL : oray://<username>:<password>@phddnsdev.oray.net username
steven password %@%@1v13Yj2m`Aeza,9]_.^V*54d%@%@
Policy bind count : 1
# Run the display ddns interface gigabitethernet 1/0/0 command on RouterA, and information
about the DDNS policy on GE1/0/0 is displayed.
<RouterA> display ddns interface gigabitethernet 1/0/0
===== Policy mypolicy =======
URL: oray://<username>:<password>@phddnsdev.oray.net
Status: ESTABLISH
Refresh: enable
----End
Configuration File
l Configuration file of RouterA
#
sysname RouterA
#
dns resolve
dns server 10.3.1.2
#
ddns policy mypolicy
url oray://<username>:<password>@phddnsdev.oray.net username steven password
%@%@1v13Yj2m`Aeza,9]_.^V*54d%@%@
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.1.1.2 255.255.0.0
ddns apply policy mypolicy
#
ospf 1
area 0.0.0.0
network 10.1.0.0 0.0.255.255
#
return
Networking Requirements
As shown in Figure 4-11, RouterA can function as the web server to provide web services for
network users, and the domain name of RouterA is www.abc.com. the IP address may change.
The interface IP address may change. If the mapping between the domain name and IP address
of the web server is not updated on the DNS server in real time, a user access error may occur.
In this case, you need to enable the DDNS client function to obtain the latest mapping between
the domain name and the IP address. The Siemens DDNS server is used. When the IP address
of RouterA changes, RouterA functions as the DDNS client to send a request to the DDNS
server. Then the DDNS server instructs the DNS server to reconfigure the mapping between the
domain name and the IP address.
Figure 4-11 Configuring the DDNS client to communicate with the Siemens DDNS server
DNS Server
10.3.1.2/16
GE3/0/0
RouterA 10.1.1.2/16 RouterB 10.3.1.1/16
GE1/0/0
GE1/0/0
GE2/0/0
DDNS Client 10.1.1.1/16
10.2.1.1/16
DDNS Server
10.2.1.3/16
Configuration Roadmap
Create and bind a DDNS policy on RouterA. When the interface IP address on RouterA changes,
RouterA can send a request for dynamically updating DNS entries.
NOTE
Procedure
Step 1 Configure RouterA.
NOTE
By default, the update mode of the DDNS client is vendor-specific. If the default update mode is not modified
by running the method command, do not run the method vendor-specific command.
# Configure a client SSL policy siemens. Assume that the SSL policy uses the default protocol
version and cipher suite.
[RouterA] pki entity siemens
[RouterA-pki-entity-siemens] common-name hello
[RouterA-pki-entity-siemens] country cn
[RouterA-pki-entity-siemens] state jiangsu
When the IP address of GE1/0/0 changes, RouterA notifies the DNS server to establish the
mapping between the domain name www.abc.com and the new IP address through the DDNS
server so that users on the Internet can resolve the latest IP address mapping www.abc.com.
# Configure OSPF.
[RouterA] ospf
[RouterA-ospf-1] area 0
[RouterA-ospf-1-area-0.0.0.0] network 10.1.0.0 0.0.255.255
[RouterA-ospf-1-area-0.0.0.0] quit
[RouterA-ospf-1] quit
NOTE
To implement communication between the DDNS client, DDNS server, and the DNS server, configure
OSPF on RouterB. For details about OSPF configurations on RouterB, see the configuration files.
# Run the display ddns policy mypolicy command on RouterA, and you can view information
about the DDNS policy named mypolicy.
<RouterA> display ddns policy mypolicy
Policy name : mypolicy
# Run the display ddns interface gigabitethernet 1/0/0 command on RouterA. You can view
information about the DDNS policy on GigabitEthernet1/0/0.
<RouterA> display ddns interface gigabitethernet 1/0/0
===== Policy mypolicy =======
URL: https://10.2.1.3/nic/update?
group=med&user=huawei_test&password=12345&myip=<a>
Status: ESTABLISH
Refresh: enable
----End
Configuration Files
Configuration file of RouterA
#
sysname RouterA
#
dns resolve
dns server 10.3.1.2
#
pki entity siemens
country CN
state jiangsu
organization huawei
organization-unit info
common-name hello
#
pki realm siemens
ca id ca_root
enrollment-url http://10.137.145.158:8080/certsrv/mscep/mscep.dll ra
entity siemens
auto-enroll regenerate
fingerprint sha1 7bb05ada0482273388ed4ec228d79f77309ea3f4
#
ssl policy siemens type client
pki-realm siemens
server-verify enable
#
ddns policy mypolicy
interval 36000
url https://10.2.1.3/nic/update?
group=med&user=<username>&password=<password>&myip=<a> username huawei_test
password %@%@F\RPWGC`G3(THX@X.*DNbc~&%@%@
ssl-policy siemens
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.1.1.2 255.255.0.0
ddns apply policy mypolicy
#
ospf 1
area 0.0.0.0
network 10.1.0.0 0.0.255.255
#
return
Networking Requirements
As shown in Figure 4-12, Router is the enterprise's gateway device; the PC is the host in the
enterprise and is connected to Router through the access switch. At the same time, PC can
function as a DNS client to connect to the network using a domain name; Router can function
as a DNS proxy to uniformly manage the DNS servers that the enterprise can access. The
enterprise can access two DNS servers: Local DNS Server_1 (The mapping between the domain
name www.huawei.com and the IP address 10.82.42.59 is recorded) in the local network segment
and Remote DNS Server_2 (The mapping between the domain name www.huawei123.com and
the IP address 10.46.1.1 is recorded) on the remote end. To improve the domain name resolution
efficiency and speed up network access, the enterprise requires that query requests be sent to
the DNS servers whose dns function is normal.
Figure 4-12 Configuring association between the DNS Server and NQA
Remote DNS Server_2
IP:10.20.1.2
The mapping between the domain name
www.huawei123.com and IP address
10.46.1.1
GE0/0/2 IP:10.20.1.1
Router
DNS Proxy
GE0/0/1 IP:10.1.1.1
GE0/0/1
Switch GE0/0/2
Local DNS Server_1
GE0/0/3 IP:10.1.1.2
The mapping between the domain
name www.huawei.com and IP address
10.82.42.59
PC
DNS Client
IP:10.1.1.3
Configuration Roadmap
Associate DNS servers with NQA on Router, so that query requests are only sent to the DNS
servers whose dns function is normal.
Procedure
Step 1 Configure VLANs for interfaces on the switch (using a Huawei S series switch as an example).
<Huawei> system-view
[Huawei] sysname Switch
[Switch] interface gigabitethernet 0/0/1
[Switch-GigabitEthernet0/0/1] port link-type trunk
[Switch-GigabitEthernet0/0/1] port trunk allow-pass vlan 10
[Switch-GigabitEthernet0/0/1] port trunk pvid vlan 10
[Switch-GigabitEthernet0/0/1] quit
[Switch] interface gigabitethernet 0/0/2
[Switch-GigabitEthernet0/0/2] port link-type trunk
[Switch-GigabitEthernet0/0/2] port trunk allow-pass vlan 10
[Switch-GigabitEthernet0/0/2] port trunk pvid vlan 10
[Switch-GigabitEthernet0/0/2] quit
[Switch] interface gigabitethernet 0/0/3
[Switch-GigabitEthernet0/0/3] port link-type access
[Switch-GigabitEthernet0/0/3] port default vlan 10
[Switch-GigabitEthernet0/0/3] quit
Step 3 Configure the DNS proxy function on Router and associate Router with NQA.
<Huawei> system-view
[Huawei] sysname Router
[Router] dns proxy enable
[Router] dns resolve
[Router] nqa test-instance admin localdns
[Router-nqa-admin-localdns] test-type dns
[Router-nqa-admin-localdns] dns-server ipv4 10.1.1.2
[Router-nqa-admin-localdns] destination-address url www.huawei.com
[Router-nqa-admin-localdns] frequency 30
[Router-nqa-admin-localdns] start now
[Router-nqa-admin-localdns] quit
[Router] nqa test-instance admin remotedns
[Router-nqa-admin-remotedns] test-type dns
[Router-nqa-admin-remotedns] dns-server ipv4 10.20.1.2
[Router-nqa-admin-remotedns] destination-address url www.huawei123.com
[Router-nqa-admin-remotedns] frequency 30
[Router-nqa-admin-remotedns] start now
[Router-nqa-admin-remotedns] quit
[Router] dns server 10.1.1.2 track nqa admin localdns
[Router] dns server 10.20.1.2 track nqa admin remotedns
[Router] interface gigabitethernet 0/0/1
[Router-GigabitEthernet0/0/1] ip address 10.1.1.1 24
[Router-GigabitEthernet0/0/1] quit
[Router] interface gigabitethernet 0/0/2
[Router-GigabitEthernet0/0/2] ip address 10.20.1.1 24
[Router-GigabitEthernet0/0/2] quit
NOTE
To persistently detect the DNS server status, you need to perform periodical test for NQA test instances.
Therefore, run the frequency interval command to set the automatic test interval for NQA test instances.
----End
Configuration Files
l Configuration file of the switch
#
sysname Switch
#
vlan batch 10
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 10
#
return
Fault Description
The industrial switch router functions as a DNS client that is configured with dynamic domain
name resolution but cannot resolve domain names to IP addresses correctly.
Procedure
Step 1 Run the display dns dynamic-host command check whether the specified domain name exists
in the dynamic domain name cache.
l If not, check whether the DNS client communicates with the DNS server properly, the DNS
server runs properly, and dynamic domain name resolution is enabled.
l If so, but the IP address is incorrect, go to step 2.
Step 2 Run the display dns server command to verify that the IP address of the DNS server is correct
on the DNS client.
If the DNS server IP address is incorrect, run the undo dns server ip-address command to delete
the configured DNS server IP address, and run the dns server ip-address command to
reconfigure a correct IP address for the DNS server.
----End
4.8 References
This section lists references of DNS.
5 NAT Configuration
Network Address Translation (NAT) enables translation between private IP addresses and public
IP addresses, alleviates the IPv4 address shortage, and shields the topology of private networks,
therefore improving network security.
NOTE
5.2 Principles
5.3 Applications
5.10 References
Purpose
The rapid development of the Internet brings an increasing number of network applications.
Exhaustion of IPv4 addresses has become a bottleneck for the network development. IPv6 can
solve the problem of IPv4 address shortage, but numerous network devices and applications are
based on IPv4. Major transitional technologies such as classless inter-domain routing (CIDR)
and private network addresses are used before the wide use of IPv6 addresses. NAT enables
users on private networks to access public networks. When a host on a private network accesses
a public network, NAT translates the host's private IP address to a public IP address. Multiple
hosts on a private network can share one public IP address. This implements network
communication while saving public IP addresses. For the classification of private IP addresses,
see 1.2.2 IPv4 Address.
Benefits
As a transitional plan, NAT enables address reuse to meet the demand for IP addresses, therefore
alleviating the IPv4 address shortage. In addition to solving the problem of IP address shortage,
NAT provides the following advantages:
l Protects private networks against external attacks, greatly improving network security.
l This function controls not only access to external networks from internal hosts, but also
access to the internal network from external users.
5.2 Principles
5.2.1 Overview
NAT translates the IP address in an IP datagram header to another IP address, allowing users on
private networks to access public networks. Basic NAT implements one-to-one translation
between one private IP address and one public IP address, whereas Network Address and Port
Translation (NAPT) implements one-to-many translation between one public IP address and
multiple private IP addresses.
Basic NAT
Basic NAT implements one-to-one IP address translation. In this mode, only the IP address is
translated, whereas the TCP/UDP port number remains unchanged. Basic NAT cannot translate
multiple private IP addresses to the same public IP address.
NAT table
1. The Router receives a request packet sent from the host on the private network for accessing
the server on the public network. The source IP address of the packet is 10.1.1.100.
2. The Router selects an idle public IP address (162.105.178.65) from the IP address pool,
and sets up forward and reverse NAT entries that specify the mapping between the source
IP address of the packet and the public IP address. The Router translates the packet's source
IP address to the public IP address based on the forward NAT entry, and sends the packet
to the server on the public network. After the translation, the packet's source IP address is
162.105.178.65, and its destination IP address is 211.100.7.34.
3. After receiving a response packet from the server on the public network, the Router queries
the reverse NAT entry based on the packet's destination IP address. The Router translates
the packet's destination IP address to the private IP address of the host on the private network
based on the reverse NAT entry, and sends the packet to the host. After the translation, the
packet's source IP address is 162.105.178.65, and its destination IP address is 10.1.1.100.
NOTE
Basic NAT cannot solve the problem of public IP address shortage because it cannot implement address
reuse. Therefore, basic NAT is seldom used in practice.
The number of public IP addresses owned by the NAT device is far less than the number of hosts on private
networks because not all the hosts on private networks access public networks at the same time. The number
of public IP addresses needs to be determined based on the number of hosts on private networks that access
public networks during peak hours.
NAPT
In addition to one-to-one address translation, NAPT allows multiple private IP addresses to be
mapped to the same public IP address. It is also called many-to-one address translation or address
reuse.
NAPT translates the IP address and port number of a packet so that multiple users on a private
network can use the same public IP address to access the public network.
Source address
162.105.178.65:16400211.100.7.34/24
Host B Source address
10.1.1.200:1028
Destination address
162.105.178.65:16400
10.1.1.200/8 Destination address
10.1.1.200:1028
NAPT table
NAT address pool and Easy IP are implemented in similar ways. This section describes only
Easy IP. For the implementation of NAT address pool, see NAPT in 5.2.1 Overview.
Easy IP
Easy IP uses access control lists (ACLs) to control the private IP addresses that can be translated.
Easy IP is applied to the scenario where hosts on small-scale LANs access the Internet. Small-
scale LANs are usually deployed at small and medium-sized cybercafes or small-sized offices
where only a few internal hosts are used and the outbound interface obtains a temporary public
IP address through dial-up. The temporary public IP address is used by the internal hosts to
access the Internet. Easy IP allows the hosts to access the Internet using this temporary public
address.
Source address
162.10.2.8/24 162.10.2.8:5481 211.100.7.34/24
Host B Source address
10.1.1.200:1586
Destination address
162.10.2.8:5481
Router translates the packet's destination IP address and port number to the private IP
address and port number of the host on the private network based on the reverse Easy IP
entry, and sends the packet to the host. After the translation, the packet's destination IP
address is 10.1.1.100, and its port number is 1540.
NAT Server
NAT can shield hosts on private networks from public network users. When a private network
needs to provide services such as WWW and FTP services for public network users, servers on
the private network must be accessible to public network users at any time.
The NAT server can address the preceding problem by translating the public IP address and port
number to the private IP address and port number based on the preset mapping.
NAT Server:
Global: 209.102.1.68:80 External host
Local: 192.168.1.68:80 178.16.32.60
Internal server
192.168.1.68 Destination address Router Destination address
192.168.1.68:80 209.102.1.68:80
Internet
NAT table
External host sends a request Way Before Router After Router
As shown in Figure 5-4, the address translation process of the NAT server is as follows:
1. Address translation entries of the NAT server are configured on the Router.
2. The Router receives an access request sent from a host on the public network. The
Router queries the address translation entry based on the packet's destination IP address
and port number. The Router translates the packet's destination IP address and port number
to the private IP address and port number based on the address translation entry, and sends
the packet to the server on the private network. The destination IP address of the packet
sent by the host on the public network is 209.102.1.68, and its port number is 80. After the
translation by the Router, the destination IP address of the packet is 192.168.1.68, and its
port number remains unchanged.
3. After receiving a response packet sent from the server on the private network, the Router
queries the address translation entry based on the packet's source IP address and port
number. The Router translates the packet's source IP address and port number to the public
IP address and port number based on the address translation entry, and sends the packet to
the host on the public network. The source of the response packet sent from the host on the
private network is 192.168.1.68, and its port number is 80. After translation by the
Router, the source IP address of the packet is 209.102.1.68, and its port number remains
unchanged.
Static NAT/NAPT
Static NAT indicates that a private IP address is statically bound to a public IP address when
NAT is performed. Only this private IP address can be translated to this public IP address.
Static NAPT indicates that the combination of a private IP address, protocol number, and port
number is statically bound to the combination of a public IP address, protocol number, and port
number. Multiple private IP addresses can be translated to the same public IP address.
Static NAT/NAPT can also translate host IP addresses in the specified private address range to
host IP addresses in the specified public address range. When an internal host accesses the
external network, static NAT or NAPT translates the IP address of the internal host to a public
address if the IP address of the internal host is in the specified address range. An external host
can directly access an internal host if the private IP address translated from the IP address of the
external host is in the specified internal address range.
For example, when an FTP server with a private IP address sets up a session with a host on the
public network, the server may need to send its IP address to the host. NAT cannot translate this
IP address because the IP address is carried in the Data field. When the host on the public network
attempts to use the received private IP address, it finds that the FTP server is unreachable.
DNS, FTP, SIP, PPTP and RTSP support the ALG function. Table 5-1 lists the NAT fields
supported by different protocols.
DNS mapping can solve the problem by configuring a table that specifies the mapping between
domain names, public IP addresses, public port numbers, and protocol types. In this manner, the
mapping between domain names of servers on the private network and public network
information is established.
211.100.7.34/24
Host www.test.com=162.10.2.5
DNS response=162.10.2.5
DNS Mapping:
162.10.2.5->10.1.1.200
DNS response=10.1.1.200
As shown in Figure 5-5, the host on the private network needs to access the web server using
the domain name, and the Router functions as a NAT server. After receiving a DNS response
packet, the Router searches the DNS mapping table for the information about the web server
based on the domain name carried in the response packet. Then, the Router replaces the public
IP address carried in the DNS response packet with the private IP address of the web server. In
this manner, the DNS response packet received by the host carries the private IP address of the
web server. Then, the host can access the web server using the domain name.
Figure 5-6 Networking diagram for source NAT associated with VPNs
Server
External
外部网络
network
Router Host A
Host B
IP address:10.1.1.1 IP address:10.1.1.1
Private IP
VPN 2 addresses of VPN VPN 1
1 and VPN 2 are
overlapped.
1. The IP addresses of host A in VPN 1 and host B in VPN 2 are 10.1.1.1. Host A and host B
want to access the same server on the public network.
2. When a router functions as a NAT device, the router translates the source IP address of the
packet sent from host A to 202.1.1.1 and the source IP address of the packet sent from host
B to 202.1.2.1. In addition, the router records the VPN information about the hosts in the
NAT translation table.
3. When the response packets sent from the server on the public network to host A and host
B pass through the router:
l The NAT module translates the destination IP address 202.1.1.1 of the packet sent to
host A to 10.1.1.1 based on the NAT translation table, and then sends the packet to host
A in VPN 1.
l The NAT module translates the destination IP address 202.1.2.1 of the packet sent to
host B to 10.1.1.1 based on the NAT translation table, and then sends the packet to host
B in VPN 2.
Figure 5-7 Networking diagram for NAT server associated with VPNs
External
外部网络
network
Router
Server B Server A
IP address: 10.1.1.1 IP address: 10.1.1.1
Private IP
VPN 2 addresses of VPN VPN 1
1 and VPN 2 are
overlapped.
As shown in Figure 5-7, the IP addresses of server A in VPN 1 and server B in VPN 2 are
10.1.1.1. The public address of server A is 202.1.10.1 and that of server B is 202.1.20.1. Hosts
on the public network can access server A using 202.1.10.1 and access server B using 202.1.20.1.
The NAT server associated with VPNs is implemented as follows:
1. A host on the public network sends a packet with the destination IP address as 202.1.10.1
to server A in VPN 1 and sends a packet with the destination IP address as 202.1.20.1 to
server B in VPN 2.
2. The router functions as the NAT server. Based on the packets' destination IP addresses and
VPN information:
l The router translates the destination address 202.1.10.1 to 10.1.1.1 and sends the packet
to server A in VPN 1.
l The router translates the destination address 202.1.20.1 to 10.1.1.1 and sends the packet
to server B in VPN 2.
In addition, the router records the VPN information in the NAT translation table.
3. When the response packets sent from server A and server B to the host on the public network
pass through the router:
l The NAT module translates the source IP address 10.1.1.1 of the packet sent from server
A to 202.1.10.1 based on the NAT translation table, and sends the packet to the host on
the public network.
l The NAT module translates the source IP address 10.1.1.1 of the packet sent from server
B to 202.1.20.1 based on the NAT translation table, and sends the packet to the host on
the public network.
Twice NAT refers to translation of both the source and destination IP addresses of a data packet.
It is applied to the situation where a private IP address is the same as a public IP address.
DNS server
1. Host A with the IP address 1.1.1.1 on the private network wants to access host B with the
same IP address on the public network. Host A sends a DNS request to the DNS server on
the public network. The DNS server sends a response packet containing the IP address
1.1.1.1 of host B. When the response packet passes through the router, the router performs
DNS ALG and translates host B's IP address 1.1.1.1 in the response packet to the unique
temporary IP address 3.3.3.1. Then, the router forwards the response packet to Host A.
2. Host A sends a request packet with the destination IP address as the temporary IP address
3.3.3.1, for accessing host B. When the request packet passes through the router, the
router detects that the destination IP address is the temporary IP address, and translates the
destination IP address to host B's real IP address 1.1.1.1. Meanwhile, the router translates
the source IP address of the request packet to an address in the outbound NAT address pool
using outbound NAT. Then, the router forwards the request packet to host B.
3. Host B sends host A a response packet with the destination IP address as the address in the
outbound NAT address pool and the source IP address as the IP address of host B 1.1.1.1.
When the response packet passes through the router, the router detects that the source IP
address is the same as the real IP address of host A, and translates the source IP address to
the temporary IP address 3.3.3.1 using NAT. Meanwhile, the router translates the
destination IP address of the response packet to the private IP address 1.1.1.1 of host A.
Then, the router forwards the response packet to host A.
Figure 5-9 Networking diagram for twice NAT when multiple VPNs are deployed on a private
network
Host B
Host B 1.1.1.1
1.1.1.1 Address group:
3.3.3.1 www.example.com
4.4.4.1
VPN B
Host A External
1.1.1.1 network
Router
VPN A
DNS server
A private network may consist of multiple VPNs and hosts in the VPNs may have the same IP
address. When configuring DNS ALG on a router, you need to add the VPN information that is
used as the condition for mapping identical IP addresses of the hosts in the VPNs to IP addresses
in the temporary address pool. Figure 5-9 shows the networking for twice NAT when multiple
VPNs are deployed on a private network. When multiple VPNs are deployed on a private
network, the twice NAT process remains unchanged. The source IP address of host A in VPN
A is translated to the temporary address 3.3.3.1, and the source IP address of host B in VPN B
is translated to the temporary address 4.4.4.1.
NAT Filtering
A NAT device filters the traffic from external network to internal network. NAT filtering
includes the following modes:
l Endpoint-independent filtering
l Endpoint-dependent filtering
l Endpoint and port-dependent filtering
Internet
PC 1
Data packet 2'
Data packet 2
Source IP:202.1.20.1
Source IP:202.1.20.1
Source port:4444
Source port:4444 PC 3: 202.1.20.1
Destination IP:202.169.10.1
Destination IP:10.1.1.1
Destination port:1111
Destination port:1111
As shown in the preceding figure, PC-1 on the private network communicates with PC-2 and
PC-3 on the public network using a NAT device. Datagram 1 is sent from PC-1 to PC-2. The
source port number of the datagram is 1111 and the destination port number is 2222. The NAT
device translates the source IP address to 202.169.10.1.
After PC-1 sends an access request to a PC on the public network, the PC on the public network
transmits traffic to PC-1, and the NAT device filters the traffic destined for PC-1. Datagram 2',
datagram 3', and datagram 4' are sent in three scenarios corresponding to the preceding three
NAT filtering modes.
l Datagram 2' is sent from PC-3 to PC-1. The destination address of datagram 2 is different
from that of datagram 1, and the destination port number is 1111. Datagram 2 can pass
through the NAT device only when endpoint-independent filtering is used.
l Datagram 3' is sent from PC-2 to PC-1. The destination address of datagram 3 is the same
as that of datagram 1, and the destination port number is 1111. The source port number of
datagram 3 is 3333, which is different from that of datagram 1. Datagram 3 can pass through
the NAT device only when endpoint-dependent filtering or endpoint-independent filtering
is used.
l Datagram 4' is sent from PC-2 to PC-1. The destination address of datagram 4 is the same
as that of datagram 1, and the destination port number is 1111. The source port number of
datagram 4 is 2222, which is the same as that of datagram 1. In this case, endpoint and port-
dependent filtering is used, which is the default one. Datagram 4 can pass through the NAT
device no matter whether a filtering mode is configured or no matter which filtering mode
is configured.
NAT Mapping
After NAT mapping is enabled on a public network, it seems that all flows from a private network
come from the same IP address because hosts on the private network share the same public IP
address. When a host on the private network initiates a session request to a host on the public
network, the NAT device searches the NAT translation table for the related session record. If
the NAT device finds the session record, it translates the private IP address and port number and
forwards the request. If the NAT device does not find the session record, it translates the private
IP address and port number and meanwhile adds a session record to the NAT translation table.
NAT mapping includes the following modes:
l Endpoint-independent mapping: The NAT uses the same IP address and port mapping for
packets sent from the same private IP address and port to any public IP address and port.
l Endpoint and port-dependent mapping: The NAT uses the same port mapping for packets
sent from the same private IP address and port to the same public IP address and port if the
mapping is still active.
5.3 Applications
Figure 5-11 Networking diagram for private network hosts accessing public network servers
Host A
192.168.1.1/24
Server
Host B Router
External
network
192.168.1.2/24 211.100.7.34/24
Host C
192.168.1.3/24
Figure 5-12 Networking diagram for public network hosts accessing private network servers
Host A
192.168.1.1/24
Router Host C
Host B
External
network
192.168.1.2/24 211.138.7.94/24
Server
192.168.1.100/24
Figure 5-13 Networking diagram for private network hosts accessing private network servers
using the domain name
Host A
192.168.1.1/24
Router DNS server
Host B
External
network
192.168.1.2/24 210.33.5.1/24
www.test.com=211.65.3.1
Web server
192.168.1.100/24
www.test.com
Important During dynamic NAT, it cannot use 5.6.2 Configuring Static NAT
internal fixed public IP addresses and
hosts use interface numbers to replace the
fixed public private IP addresses and interface
IP addresses numbers. When some important hosts
and need to access the external network,
interface they must use fixed public IP
numbers to addresses and interface numbers.
communica Dynamic NAT cannot meet this
te with requirement.
external Static NAT sets up a fixed mapping
hosts. between public and private IP
addresses. A specific private IP
address can be replaced only by the
specified public IP address. In this
way, the important hosts can access
the external network using fixed
public IP addresses.
External NAT can shield IP addresses off 5.6.3 Configuring an Internal NAT
users access internal hosts. When the internal Server
internal network needs to provide services
servers. such as web and FTP services for
external users, internal servers must
be accessible to external users at any
time.
The NAT server enables the internal
servers to be accessible at any time.
By configuring the mapping between
the public and private IP addresses
and between the public and private
interface numbers, the NAT device
can translate public IP addresses to
private IP addresses.
The NAT function is used with a license. To use the NAT function, apply for and purchase the
following license from the Huawei local office:
Procedure
Step 1 Run:
system-view
Step 2 Run:
acl [ number ] acl-number [ match-order { auto | config } ]
An ACL with the specified number is created and the ACL view is displayed.
Step 3 Configure basic or advanced ACLs as required. For details, see Configuring a Basic ACL or
Configuring an Advanced ACL in the Huawei AR530&AR550 Series Industrial Switch Routers
Configuration Guide - Security - ACL Configuration.
NOTE
Only basic ACLs (2000 to 3999) and advanced ACLs can be used to configure the NAT function.
1. When permit is used in the ACL rule, the system uses the address pool to translate addresses for the
packets of which the source IP address is specified in the ACL rule.
2. When permit is not used in the ACL rule, the NAT policy referencing the ACL does not take effect.
That is, the system searches routes for packets, but does not translate addresses.
----End
Context
The address pool used by outbound NAT stores a set of public IP addresses used by dynamic
NAT. When dynamic NAT is performed, an address in the address pool is selected for NAT
address translation.
To access external networks through dynamic NAT, intranet users can choose one of the
following modes based on their public IP address plan:
l After users configure the IP address of outbound ports and other applications on the NAT
device, there are still some available public IP addresses. Users can choose outbound NAT
with an address pool.
l After users configure the IP address of outbound ports on the NAT device and other
applications, there are no available public IP addresses. Users can choose Easy IP that uses
the IP address of outbound ports on the NAT device to implement dynamic NAT.
Procedure
Step 1 Run:
system-view
Step 2 Configure outbound NAT. Users can choose one of the following configuration methods based
on actual situations:
l Configure outbound NAT with an address pool.
1. Run:
nat address-group group-index start-address end-address
1. Run:
interface interface-type [ .subnumber ]
Easy IP is configured.
----End
Context
Generally, NAT translates only the IP address in the IP packet header and the interface number
in the TCP/UDP header. Packets of some protocols such as DNS and FTP contain the IP address
or interface number in the Data field. Such content cannot be translated using NAT. Therefore,
communication between internal and external networks will fail.
The application level gateway (ALG) function enables the NAT device to identify the IP address
or interface number in the Data field, and translate addresses based on the mapping table. In this
way, packets can traverse NAT devices. Currently, the ALG function supports DNS, FTP,
SIP, PPTP and RTSP.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat alg { all | protocol-name } enable
Run the port-mapping protocol to configure port mapping when the application protocol that
is enabled with the NAT ALG function uses a non-well-known port number, namely a non-
default port number.
----End
5.6.1.4 (Optional) Configuring the SIP Call Bandwidth Limit on a NAT Device
Context
When the SIP server is deployed on the public network and SIP phones in public and private
networks are interconnected, the call quality is affected if the bandwidth on the NAT device is
insufficient. You can enable call admission control (CAC) and set the total bandwidth on the
NAT device to limit the bandwidth of SIP calls. If the bandwidth of a SIP exceeds the specified
value, the SIP call is rejected.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat sip cac enable bandwidth { bandwidth-value | percent value interface interface-
type interface-number [ .subnumber ] }
CAC is enabled and the total bandwidth is set to limit the bandwidth of SIP calls.
By default, the bandwidth limit is 0, indicating that the bandwidth is not limited.
----End
Context
NAT conserves IPv4 addresses and improves network security. Different vendors provide
different NAT features. As a result, applications using STUN, TURN, and ICE technologies
may fail to traverse NAT devices because these technologies are implemented using SIP proxy.
SIP proxy is a multi-channel application and needs to create multiple data channels to implement
its function. To ensure connection of multiple data channels, NAT filtering and NAT mapping
must be configured to allow only packets that meet the filtering and mapping conditions to pass
through.
l Endpoint-and-port-independent filtering
l Endpoint-dependent and port-independent filtering
l Endpoint-and-port-dependent filtering
NOTE
Configure endpoint-and-port-dependent NAT mapping and filtering to enable SIP proxy to traverse NAT
devices.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat mapping-mode endpoint-independent [ protocol-name [ dest-port port-number ] ]
Step 3 Run:
nat filter-mode { endpoint-dependent | endpoint-independent | endpoint-and-port-
dependent }
----End
Context
If the external addresses of internal hosts overlap with addresses of external hosts, twice NAT
can be configured. The overlapping addresses are replaced with temporary addresses and then
translated by NAT so that the internal and external hosts can access each other.
l An overlapping address pool specifies which internal IP addresses can overlap with public
IP addresses. Twice NAT is performed only on the addresses in the overlapping address
pool.
l A temporary address pool specifies which temporary IP addresses can replace addresses in
the overlapping address pool.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat overlap-address map-index overlappool-startaddress temppool-startaddress pool-
length length [ inside-vpn-instance inside-vpn-instance-name ]
The mapping between the overlapping address pool and the temporary address pool is
configured.
NOTE
l A maximum of 255 addresses can be configured in the overlapping address pool and the temporary
address pool.
l When the VPN instance specified in the command is deleted, the configuration of twice NAT is also
deleted.
----End
Context
NAT logs are generated when the industrial switch router performs address translation. The logs
record the original source IP addresses, source ports, destination IP addresses, destination ports,
and translated source IP addresses and source ports, as well as user actions and time stamps.
You can view NAT logs to learn about information about users have accessed a network using
NAT.
The industrial switch router can send NAT logs to a specified log host, as shown in Figure
5-14.
Host
NAT logs
Internet
NAT Device
Procedure
Step 1 Run:
system-view
Step 2 Run:
firewall log session enable
Step 3 Run:
firewall log session nat enable
Sets the NAT log format to eLog. The logs are generated in the format specified by the eLog
server.
Step 5 Run the following command to output logs to the information center log host or session log host:
l Output logs to the information center log host
1. Run:
info-center enable
The channel through which logs are output to the log host is configured.
The industrial switch router supports a maximum of eight log hosts to implement backup
among log hosts.
NOTE
For details on how to configure the industrial switch router to send logs to a log host, see Example
for Outputting Log Information to a Log Host in "Information Center Configuration" of the
Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide - Device
Management.
----End
Procedure
Step 1 Run:
system-view
Step 2 Run:
firewall-nat session { dns | ftp | ftp-data | http | icmp | tcp | tcp-proxy | udp
| sip | sip-media | rtsp | rtsp-media | pptp | pptp-data } aging-time time-value
By default, the aging time of NAT mapping entries for each protocol is as follows: 120 seconds
for DNS, 120 seconds for FTP; 120 seconds for FTP-data, 120 seconds for HTTP, 20 seconds
for ICMP, 600 seconds for TCP, 10 seconds for TCP-proxy, 120 seconds for UDP, 1800 seconds
for SIP, 120 seconds for SIP-media, 60 seconds for RTSP, 120 seconds for RTSP-media, 600
seconds for pptp, and 600 seconds for pptp-data.
----End
Procedure
l Run the display nat address-group [ group-index ] [ verbose ] command to check the
configuration of a NAT address pool.
l Run the display nat outbound [ acl acl-number | address-group group-index |
interface interface-type interface-number [ .subnumber ] ] command to check the
configuration of outbound NAT.
l Run the display nat alg command to check the NAT ALG configuration.
l Run the display nat overlap-address { map-index | all | inside-vpn-instance inside-vpn-
instance-name } command to check the configuration of twice NAT.
l Run the display firewall-nat session aging-time command to check the aging time of NAT
mapping entries.
l Run the display nat sip cac bandwidth information [ verbose ] command to check the
current total bandwidth and occupied bandwidth on the device.
l Run the display nat filter-mode command to check the current NAT filtering mode.
l Run the display nat mapping-mode command to check the NAT mapping mode.
l Run the display nat mapping table { all | number } or display nat mapping table inside-
address ip-address protocol protocol-name port port-number [ vpn-instance vpn-
instance-name ] command to check the NAT table information or the number of entries in
the NAT table.
----End
Procedure
Step 1 You can configure static address mapping as follows:
1. Run:
system-view
1. Run:
system-view
l To specify a global VPN, you are advised to configure static NAT in the interface view. Then the device
can automatically obtain information about the VPN instance associated with the interface, and you
do not need to manually specify the VPN instance at the public network side (global). To associate
static NAT with a global VPN in the system view, you can specify a loopback interface as the outbound
interface at the public network side, and then specify a VPN instance.
l When configuring static NAT, ensure that global-address and host-address are different from IP
addresses of interfaces and IP addresses in the user address pool.
l If you run the undo nat static command, static mapping entries are not immediately deleted. To clear
static mapping entries, run the reset nat session command.
l You are advised to use the second method if multiple interfaces use the same static NAT mapping.
l When you configure static one-to-one NAT that borrows an interface IP address (no interface number
is specified and the IP address is mapped to a private network address), other services enabled on the
interface may become unavailable. Confirm your action before performing the configuration. If you
want to enable other applications on the interface, add an ACL rule after the configuration to filter out
the number of the interface on which the applications are enabled.
----End
Context
Generally, NAT translates only the IP address in the IP packet header and the interface number
in the TCP/UDP header. Packets of some protocols such as DNS and FTP contain the IP address
or interface number in the Data field. Such content cannot be translated using NAT. Therefore,
communication between internal and external networks will fail.
The application level gateway (ALG) function enables the NAT device to identify the IP address
or interface number in the Data field, and translate addresses based on the mapping table. In this
way, packets can traverse NAT devices. Currently, the ALG function supports DNS, FTP,
SIP, PPTP and RTSP.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat alg { all | protocol-name } enable
----End
5.6.2.3 (Optional) Configuring the SIP Call Bandwidth Limit on a NAT Device
Context
When the SIP server is deployed on the public network and SIP phones in public and private
networks are interconnected, the call quality is affected if the bandwidth on the NAT device is
insufficient. You can enable call admission control (CAC) and set the total bandwidth on the
NAT device to limit the bandwidth of SIP calls. If the bandwidth of a SIP exceeds the specified
value, the SIP call is rejected.
Procedure
Step 1 Run:
system-view
CAC is enabled and the total bandwidth is set to limit the bandwidth of SIP calls.
By default, the bandwidth limit is 0, indicating that the bandwidth is not limited.
----End
Context
If an enterprise has no internal DNS server but needs to access internal servers using the domain
name, intranet users of the enterprise must use DNS servers on external networks.
Intranet users can use the external DNS server to access an external server by performing NAT;
however, intranet users cannot use the external DNS server to access an internal server because
the IP address resolved by the external DNS server is not the real private IP address of the internal
server.
When configuring static NAT and DNS mapping at the same time, you can create a mapping
entry containing the domain name, public IP address, public interface number, and protocol type.
When receiving a DNS resolution packet, the NAT device searches the private IP address
mapped to the public address in the mapping entry. The NAT device then replaces the address
resolved by the DNS server with the private IP address and forwards the resolution result to
users.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat dns-map domain-name { global-address | interface interface-type interface-
number [ .subnumber ] } global-port protocol-name
A mapping from a domain name to a public IP address, an interface number, and a protocol type
is configured.
NOTE
After DNS mapping is configured, the nat alg dns enable command must be run to enable the ALG DNS
function. In this way, DNS response packets can traverse NAT devices. If the ALG DNS function is
disabled, internal hosts cannot access internal servers using the domain name.
----End
Context
NAT conserves IPv4 addresses and improves network security. Different vendors provide
different NAT features. As a result, applications using STUN, TURN, and ICE technologies
may fail to traverse NAT devices because these technologies are implemented using SIP proxy.
SIP proxy is a multi-channel application and needs to create multiple data channels to implement
its function. To ensure connection of multiple data channels, NAT filtering and NAT mapping
must be configured to allow only packets that meet the filtering and mapping conditions to pass
through.
l Endpoint-and-port-independent filtering
l Endpoint-dependent and port-independent filtering
l Endpoint-and-port-dependent filtering
NOTE
Configure endpoint-and-port-dependent NAT mapping and filtering to enable SIP proxy to traverse NAT
devices.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat mapping-mode endpoint-independent [ protocol-name [ dest-port port-number ] ]
Step 3 Run:
nat filter-mode { endpoint-dependent | endpoint-independent | endpoint-and-port-
dependent }
----End
Context
If the external addresses of internal hosts overlap with addresses of external hosts, twice NAT
can be configured. The overlapping addresses are replaced with temporary addresses and then
translated by NAT so that the internal and external hosts can access each other.
l An overlapping address pool specifies which internal IP addresses can overlap with public
IP addresses. Twice NAT is performed only on the addresses in the overlapping address
pool.
l A temporary address pool specifies which temporary IP addresses can replace addresses in
the overlapping address pool.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat overlap-address map-index overlappool-startaddress temppool-startaddress pool-
length length [ inside-vpn-instance inside-vpn-instance-name ]
The mapping between the overlapping address pool and the temporary address pool is
configured.
NOTE
l A maximum of 255 addresses can be configured in the overlapping address pool and the temporary
address pool.
l When the VPN instance specified in the command is deleted, the configuration of twice NAT is also
deleted.
----End
Context
NAT logs are generated when the industrial switch router performs address translation. The logs
record the original source IP addresses, source ports, destination IP addresses, destination ports,
and translated source IP addresses and source ports, as well as user actions and time stamps.
You can view NAT logs to learn about information about users have accessed a network using
NAT.
The industrial switch router can send NAT logs to a specified log host, as shown in Figure
5-15.
Host
NAT logs
Internet
NAT Device
Procedure
Step 1 Run:
system-view
Step 2 Run:
firewall log session enable
Step 3 Run:
firewall log session nat enable
Sets the NAT log format to eLog. The logs are generated in the format specified by the eLog
server.
Step 5 Run the following command to output logs to the information center log host or session log host:
l Output logs to the information center log host
1. Run:
info-center enable
The channel through which logs are output to the log host is configured.
The industrial switch router supports a maximum of eight log hosts to implement backup
among log hosts.
NOTE
For details on how to configure the industrial switch router to send logs to a log host, see Example
for Outputting Log Information to a Log Host in "Information Center Configuration" of the
Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide - Device
Management.
l Output logs to the session log host
Run:
firewall log binary-log host host-ip-address host-port source source-ip-address
source-port [ vpn-instance vpn-instance-name ]
----End
Procedure
Step 1 Run:
system-view
Step 2 Run:
firewall-nat session { dns | ftp | ftp-data | http | icmp | tcp | tcp-proxy | udp
| sip | sip-media | rtsp | rtsp-media | pptp | pptp-data } aging-time time-value
By default, the aging time of NAT mapping entries for each protocol is as follows: 120 seconds
for DNS, 120 seconds for FTP; 120 seconds for FTP-data, 120 seconds for HTTP, 20 seconds
for ICMP, 600 seconds for TCP, 10 seconds for TCP-proxy, 120 seconds for UDP, 1800 seconds
for SIP, 120 seconds for SIP-media, 60 seconds for RTSP, 120 seconds for RTSP-media, 600
seconds for pptp, and 600 seconds for pptp-data.
----End
Procedure
l Run the display nat alg command to check the NAT ALG configuration.
l Run the display nat dns-map [ domain-name ] command to check the configuration of
DNS mapping.
l Run the display nat overlap-address { map-index | all | inside-vpn-instance inside-vpn-
instance-name } command to check the configuration of twice NAT.
l Run the display firewall-nat session aging-time command to check the aging time of NAT
mapping entries.
l Run the display nat static [ global global-address | inside host-address [ vpn-instance
vpn-instance-name ] | interface interface-type interface-name [ .subnumber ] | acl acl-
number] command to check the configuration of static NAT.
l Run the display nat sip cac bandwidth information [ verbose ] command to check the
current total bandwidth and occupied bandwidth on the device.
l Run the display nat filter-mode command to check the the current NAT filtering mode.
l Run the display nat mapping-mode command to check the NAT mapping mode.
l Run the display nat mapping table { all | number } or display nat mapping table inside-
address ip-address protocol protocol-name port port-number [ vpn-instance vpn-
instance-name ] command to check the NAT table information or the number of entries in
the NAT table.
l Run the display nat static interface enable command to check whether the static NAT
function is enabled.
----End
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number [ .subnumber ]
Step 3 Run either of the following commands to configure an internal NAT server:
l nat server protocol { tcp | udp } global { global-address | current-interface | interface
interface-type interface-number [ .subnumber ] } global-port [ global-port2 ] [ vrrp vrrpid ]
inside host-address [ host-address2 ] [ host-port ] [ vpn-instance vpn-instance-name ]
[ acl acl-number ] [ description description ]
l When configuring an internal NAT server, ensure that global-address and host-address are different
from IP addresses of ports and IP addresses in the user address pool.
l You can use the IP address of current-interface or loopback as the internal server's IP address.
l The undo nat server command does not delete mapping entries immediately. You can run the reset
nat session command to delete mapping entries.
l Compared with static NAT, NAT Server translates only the IP address, but not the port number, when
the private network initiatively accesses the public network.
l When you configure one-to-one NAT Server that borrows an interface IP address (no interface number
is specified and the IP address is mapped to a private network address), other services enabled on the
interface may become unavailable. Confirm your action before performing the configuration. If you
want to enable other applications on the interface, add an ACL rule after the configuration to filter out
the number of the interface on which the applications are enabled.
----End
Context
Generally, NAT translates only the IP address in the IP packet header and the interface number
in the TCP/UDP header. Packets of some protocols such as DNS and FTP contain the IP address
or interface number in the Data field. Such content cannot be translated using NAT. Therefore,
communication between internal and external networks will fail.
The application level gateway (ALG) function enables the NAT device to identify the IP address
or interface number in the Data field, and translate addresses based on the mapping table. In this
way, packets can traverse NAT devices. Currently, the ALG function supports DNS, FTP,
SIP, PPTP and RTSP.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat alg { all | protocol-name } enable
Run the port-mapping protocol to configure port mapping when the application protocol that
is enabled with the NAT ALG function uses a non-well-known port number, namely a non-
default port number.
----End
5.6.3.3 (Optional) Configuring the SIP Call Bandwidth Limit on a NAT Device
Context
When the SIP server is deployed on the public network and SIP phones in public and private
networks are interconnected, the call quality is affected if the bandwidth on the NAT device is
insufficient. You can enable call admission control (CAC) and set the total bandwidth on the
NAT device to limit the bandwidth of SIP calls. If the bandwidth of a SIP exceeds the specified
value, the SIP call is rejected.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat sip cac enable bandwidth { bandwidth-value | percent value interface interface-
type interface-number [ .subnumber ] }
CAC is enabled and the total bandwidth is set to limit the bandwidth of SIP calls.
By default, the bandwidth limit is 0, indicating that the bandwidth is not limited.
----End
Context
If an enterprise has no internal DNS server but needs to access internal servers using the domain
name, intranet users of the enterprise must use DNS servers on external networks.
Intranet users can use the external DNS server to access an external server by performing NAT;
however, intranet users cannot use the external DNS server to access an internal server because
the IP address resolved by the external DNS server is not the real private IP address of the internal
server.
When configuring static NAT and DNS mapping at the same time, you can create a mapping
entry containing the domain name, public IP address, public interface number, and protocol type.
When receiving a DNS resolution packet, the NAT device searches the private IP address
mapped to the public address in the mapping entry. The NAT device then replaces the address
resolved by the DNS server with the private IP address and forwards the resolution result to
users.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat dns-map domain-name { global-address | interface interface-type interface-
number [ .subnumber ] } global-port protocol-name
A mapping from a domain name to a public IP address, an interface number, and a protocol type
is configured.
NOTE
After DNS mapping is configured, the nat alg dns enable command must be run to enable the ALG DNS
function. In this way, DNS response packets can traverse NAT devices. If the ALG DNS function is
disabled, internal hosts cannot access internal servers using the domain name.
----End
Context
NAT conserves IPv4 addresses and improves network security. Different vendors provide
different NAT features. As a result, applications using STUN, TURN, and ICE technologies
may fail to traverse NAT devices because these technologies are implemented using SIP proxy.
SIP proxy is a multi-channel application and needs to create multiple data channels to implement
its function. To ensure connection of multiple data channels, NAT filtering and NAT mapping
must be configured to allow only packets that meet the filtering and mapping conditions to pass
through.
l Endpoint-and-port-independent filtering
l Endpoint-dependent and port-independent filtering
l Endpoint-and-port-dependent filtering
NOTE
Configure endpoint-and-port-dependent NAT mapping and filtering to enable SIP proxy to traverse NAT
devices.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat mapping-mode endpoint-independent [ protocol-name [ dest-port port-number ] ]
Step 3 Run:
nat filter-mode { endpoint-dependent | endpoint-independent | endpoint-and-port-
dependent }
----End
Context
If the external addresses of internal hosts overlap with addresses of external hosts, twice NAT
can be configured. The overlapping addresses are replaced with temporary addresses and then
translated by NAT so that the internal and external hosts can access each other.
l An overlapping address pool specifies which internal IP addresses can overlap with public
IP addresses. Twice NAT is performed only on the addresses in the overlapping address
pool.
l A temporary address pool specifies which temporary IP addresses can replace addresses in
the overlapping address pool.
Procedure
Step 1 Run:
system-view
Step 2 Run:
nat overlap-address map-index overlappool-startaddress temppool-startaddress pool-
length length [ inside-vpn-instance inside-vpn-instance-name ]
The mapping between the overlapping address pool and the temporary address pool is
configured.
NOTE
l A maximum of 255 addresses can be configured in the overlapping address pool and the temporary
address pool.
l When the VPN instance specified in the command is deleted, the configuration of twice NAT is also
deleted.
----End
Context
NAT logs are generated when the industrial switch router performs address translation. The logs
record the original source IP addresses, source ports, destination IP addresses, destination ports,
and translated source IP addresses and source ports, as well as user actions and time stamps.
You can view NAT logs to learn about information about users have accessed a network using
NAT.
The industrial switch router can send NAT logs to a specified log host, as shown in Figure
5-16.
Host
NAT logs
Internet
NAT Device
Procedure
Step 1 Run:
system-view
Step 2 Run:
firewall log session enable
Step 3 Run:
firewall log session nat enable
Sets the NAT log format to eLog. The logs are generated in the format specified by the eLog
server.
Step 5 Run the following command to output logs to the information center log host or session log host:
l Output logs to the information center log host
1. Run:
info-center enable
The channel through which logs are output to the log host is configured.
The industrial switch router supports a maximum of eight log hosts to implement backup
among log hosts.
NOTE
For details on how to configure the industrial switch router to send logs to a log host, see Example
for Outputting Log Information to a Log Host in "Information Center Configuration" of the
Huawei AR530&AR550 Series Industrial Switch Routers Configuration Guide - Device
Management.
l Output logs to the session log host
Run:
firewall log binary-log host host-ip-address host-port source source-ip-address
source-port [ vpn-instance vpn-instance-name ]
----End
Procedure
Step 1 Run:
system-view
Step 2 Run:
firewall-nat session { dns | ftp | ftp-data | http | icmp | tcp | tcp-proxy | udp
| sip | sip-media | rtsp | rtsp-media | pptp | pptp-data } aging-time time-value
By default, the aging time of NAT mapping entries for each protocol is as follows: 120 seconds
for DNS, 120 seconds for FTP; 120 seconds for FTP-data, 120 seconds for HTTP, 20 seconds
for ICMP, 600 seconds for TCP, 10 seconds for TCP-proxy, 120 seconds for UDP, 1800 seconds
for SIP, 120 seconds for SIP-media, 60 seconds for RTSP, 120 seconds for RTSP-media, 600
seconds for pptp, and 600 seconds for pptp-data.
----End
Procedure
l Run the display nat server [ global global-address | inside host-address [ vpn-instance
vpn-instance-name ] | interface interface-type interface-number [ .subnumber ] | acl acl-
number ] command to check the configuration of the NAT server.
l Run the display nat alg command to check the NAT ALG configuration.
l Run the display nat dns-map [ domain-name ] command to check the configuration of
DNS mapping.
l Run the display nat overlap-address { map-index | all | inside-vpn-instance inside-vpn-
instance-name } command to check the configuration of twice NAT.
l Run the display firewall-nat session aging-time command to check the aging time of NAT
mapping entries.
l Run the display nat sip cac bandwidth information [ verbose ] command to check the
current total bandwidth and occupied bandwidth on the device.
l Run the display nat filter-mode command to check the the current NAT filtering mode.
l Run the display nat mapping-mode command to check the NAT mapping mode.
l Run the display nat mapping table { all | number } or display nat mapping table inside-
address ip-address protocol protocol-name port port-number [ vpn-instance vpn-
instance-name ] command to check the NAT table information or the number of entries in
the NAT table.
----End
Context
NOTE
The cleared entries cannot be restored; therefore, confirm the action before you use the command.
Procedure
l After you are determined to clear NAT mapping entries, run the reset nat session { all |
transit interface interface-type interface-number [ .subnumber ] } command in the system
view.
----End
Networking Requirements
As shown in Figure 5-17, private network users in Area A and Area B of a company connect
to the Internet. The public IP address of GigabitEthernet3/0/0 on the router is 202.169.10.1/24.
The IP address of the carrier device connected to the router is 202.169.10.2/24. Users in Area
A want to use addresses in the public address pool (202.169.10.100 to 202.169.10.200) to replace
IP addresses (192.168.20.0/24) of hosts in Area A in NAT mode to access the Internet. Users in
Area B want to use addresses in the public address pool (202.169.10.80 to 202.169.10.83) to
replace IP addresses (10.0.0.0/24) of hosts in Area B to access the Internet.
Area A
PC 1...PC n
192.168.20.0/24
202.169.10.2/24
Router
VLAN 100
Eth2/0/0 GE3/0/0
Internet
202.169.10.1/24
Eth2/0/1
VLAN 200
Area B
PC 1...PC n
10.0.0.0/24
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure IP addresses for ports, default route, and outbound NAT on the WAN interface
to allow internal hosts to access external networks.
Procedure
Step 1 Configure an IP address for ports on the router.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 100
[Router-vlan100] quit
[Router] interface vlanif 100
[Router-Vlanif100] ip address 192.168.20.1 24
[Router-Vlanif100] quit
[Router] interface ethernet 2/0/0
[Router-Ethernet2/0/0] port link-type access
[Router-Ethernet2/0/0] port default vlan 100
[Router-Ethernet2/0/0] quit
[Router] vlan 200
[Router-vlan200] quit
[Router] interface vlanif 200
[Router-Vlanif200] ip address 10.0.0.1 24
[Router-Vlanif200] quit
[Router] interface ethernet 2/0/1
[Router-Ethernet2/0/1] port link-type access
[Router-Ethernet2/0/1] port default vlan 200
[Router-Ethernet2/0/1] quit
[Router] interface gigabitethernet 3/0/0
[Router-GigabitEthernet3/0/0] undo portswitch
[Router-GigabitEthernet3/0/0] ip address 202.169.10.1 24
[Router-GigabitEthernet3/0/0] quit
Step 2 Configure a default route with next hop address 202.169.10.2 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
NOTE
To run the ping -a source-ip-address command that has a source IP address specified on the router to verify that
intranet users can access the Internet, you need to run the ip soft-forward enhance enable command to enable
the enhanced forwarding function for control packets generated by the device so that the private source IP
addresses can be translated into public IP addresses by the NAT function. By default, the the enhanced forwarding
function for control packets generated by the device is enabled. If the function has been disabled using the undo
ip soft-forward enhance enable command, you need to run the ip soft-forward enhance enable command in
the system view to enable the function again.
# Run the display nat outbound command on the router to check the address translation result.
<Router> display nat outbound
NAT Outbound Information:
-----------------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
-----------------------------------------------------------------
GigabitEthernet3/0/0 2000 1 no-pat
GigabitEthernet3/0/0 2001 2 pat
-----------------------------------------------------------------
Total : 2
# Run the ping command on the router to verify that users on the internal network can access
the Internet.
<Router> ping -a 192.168.20.1 202.169.10.2
PING 202.169.10.2: 56 data bytes, press CTRL_C to break
Reply from 202.169.10.2: bytes=56 Sequence=1 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=2 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=3 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=4 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=5 ttl=255 time=1 ms
-- 202.169.10.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/2 ms
<Router> ping -a 10.0.0.1 202.169.10.2
PING 202.169.10.2: 56 data bytes, press CTRL_C to break
Reply from 202.169.10.2: bytes=56 Sequence=1 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=2 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=3 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=4 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=5 ttl=255 time=1 ms
-- 202.169.10.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/2 ms
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
vlan batch 100 200
#
acl number 2000
rule 5 permit source 192.168.20.0 0.0.0.255
#
acl number 2001
rule 5 permit source 10.0.0.0 0.0.0.255
#
nat address-group 1 202.169.10.100 202.169.10.200
nat address-group 2 202.169.10.80 202.169.10.83
#
interface Vlanif100
ip address 192.168.20.1 255.255.255.0
#
interface Vlanif200
ip address 10.0.0.1 255.255.255.0
#
interface Ethernet2/0/0
port link-type access
port default vlan 100
#
interface Ethernet2/0/1
port link-type access
port default vlan 200
#
interface GigabitEthernet3/0/0
undo portswitch
ip address 202.169.10.1
255.255.255.0
nat outbound 2000 address-group 1 no-pat
nat outbound 2001 address-group 2
#
ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
#
return
Networking Requirements
As shown in Figure 5-18, the IP address of outbound interface GE2/0/0 on the router is
202.10.1.2/24 and the LAN gateway address is 192.168.0.1/24. The IP address of the carrier
device connected to the router is 202.10.1.1/24. The private IP address of the host is
192.168.0.2/24 and the fixed IP address the host needs to use is 202.10.1.3/24. In this case, the
private IP address of this company must be translated to a public IP address to allow the host to
access the WAN.
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure the IP address of ports, default route, and static NAT on the WAN interface to
implements one-to-one translation between a private IP address and a public IP address.
Procedure
Step 1 Configure an IP address for ports on the router.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] undo portswitch
[Router-GigabitEthernet2/0/0] ip address 202.10.1.2 24
[Router-GigabitEthernet2/0/0] quit
Step 2 Configure a default route with next hop address 202.10.1.1 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
Step 3 Configure one-to-one NAT mapping on uplink interface GE2/0/0 on the router.
Run the display nat static command on the router to check the mapping between address pools.
<Router> display nat static
Static Nat Information:
Interface :
GigabitEthernet2/0/0
Global IP/Port : 202.10.1.3/----
Inside IP/Port : 192.168.0.2/----
Protocol : ----
VPN instance-name : ----
Acl number : ----
Vrrp id : ----
Netmask : 255.255.255.255
Description : ----
Total : 1
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
interface
GigabitEthernet1/0/0
undo portswitch
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet2/0/0
undo portswitch
ip address 202.10.1.2 255.255.255.0
nat static global 202.10.1.3 inside 192.168.0.2 netmask 255.255.255.255
#
ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
#
return
Networking Requirements
As shown in Figure 5-19, the network of a company provides the WWW server and FTP server
for external network users to access the internal network. The web server uses private IP address
192.168.20.2/24, port 8080, and public address 202.169.10.5/24. The private IP address of the
FTP server is 10.0.0.3/24 and its public address is 202.169.10.33/24. The IP address of the carrier
device connected to the router is 202.169.10.2/24. In this case, the NAT function of the router
enables the internal network of the company to connect to the Internet.
Eth2/0/1 External
user
FTP server
10.0.0.3/24
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure an IP address for ports on the router and configure an NAT server on
Gigabitethernet 3/0/0 to allow external users to access internal servers.
2. Configure a default route on the router.
3. Enable the FTP NAT ALG function to allow external FTP packets to traverse the NAT
server.
Procedure
Step 1 Configure an IP address for the ports on the router and configure a NAT server.
<Huawei> system-view
[Huawei] sysname Router
[Router] vlan 100
[Router-vlan100] quit
[Router] interface vlanif 100
[Router-Vlanif100] ip address 192.168.20.1 24
[Router-Vlanif100] quit
[Router] interface ethernet 2/0/0
[Router-Ethernet2/0/0] port link-type access
[Router-Ethernet2/0/0] port default vlan 100
[Router-Ethernet2/0/0] quit
[Router] vlan 200
[Router-vlan200] quit
[Router] interface vlanif 200
[Router-Vlanif200] ip address 10.0.0.1 24
[Router-Vlanif200] quit
[Router] interface ethernet 2/0/1
[Router-Ethernet2/0/1] port link-type access
[Router-Ethernet2/0/1] port default vlan 200
[Router-Ethernet2/0/1] quit
Step 2 Configure a default route with next hop address 202.169.10.2 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
Step 3 Enable the NAT ALG function for FTP packets on the router.
[Router] nat alg ftp enable
# Run the display nat server command on the router. The command output is as follows:
<Router> display nat server
Nat Server Information:
Interface : gigabitethernet 3/0/0
Global IP/Port : 202.169.10.5/80(www)
Inside IP/Port : 192.168.20.2/8080
Protocol : 6(tcp)
VPN instance-name : ----
Acl number : ----
Vrrp id : ----
Description : ----
Total : 2
# Run the display nat alg command on the router. The command output is as follows:
<Router> display nat alg
NAT Application Level Gateway Information:
----------------------------------
Application Status
----------------------------------
dns Disabled
ftp Enabled
rtsp Disabled
sip Disabled
pptp Disabled
----------------------------------
# Verify that external users can access the WWW server and FTP server.The details are not
provided here.
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
vlan batch 100 200
#
nat alg ftp enable
#
interface Vlanif100
ip address 192.168.20.1 255.255.255.0
#
interface Vlanif200
ip address 10.0.0.1 255.255.255.0
#
interface Ethernet2/0/0
port link-type access
port default vlan 100
#
interface Ethernet2/0/1
port link-type access
port default vlan 200
#
interface gigabitethernet 3/0/0
undo portswitch
ip address 202.169.10.1 255.255.255.0
nat server protocol tcp global 202.169.10.5 www inside 192.168.20.2 8080
nat server protocol tcp global 202.169.10.33 ftp inside 10.0.0.3 ftp
#
ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
#
return
Networking Requirements
As shown in Figure 5-20, the IP address of the outbound interface on the router is 202.11.1.2/24.
The IP address of the LAN gateway is 202.10.0.1/24 and that of the carrier device connected to
the router is 202.11.1.1/24. IP addresses of internal hosts are not assigned properly. The IP
address of PC1 on the internal network overlaps with that of Server A on the external network.
In this case, PC2 can access this server using the domain name of Server A, but PC2 may access
PC1 on the same network segment based on the DNS resolution result. Users want packets to
be forwarded correctly.
202.10.0.100/24
Server A
Router
202.10.0.1/24 202.11.1.2/24
GE2/0/0 GE1/0/0
Internet
DNS server
PC 2
202.10.0.16/24
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure an IP address for ports on the router.
2. Configure a default route on the router.
3. Configure the DNS ALG function to enable DNS packets to traverse the NAT device.
4. Map the overlapped address pool to the temporary address pool.
5. Configure outbound NAT to allow internal users to access external networks.
Procedure
Step 1 Configure an IP address for ports on the router.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] undo portswitch
[Router-GigabitEthernet1/0/0] ip address 202.11.1.2 24
[Router-GigabitEthernet1/0/0] quit
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] undo portswitch
[Router-GigabitEthernet2/0/0] ip address 202.10.0.1 24
[Router-GigabitEthernet2/0/0] quit
Step 2 Configure a default route with next hop address 202.11.1.1 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.11.1.1
Step 3 Configure the mapping between the overlapped address pool and the temporary address pool on
the router.
[Router] nat overlap-address 0 202.10.0.100 202.12.1.100 pool-length 254
Step 4 Configure a static route on the router from the temporary address pool to outbound interface
GE1/0/0.
Step 5 Configure the DNS NAT ALG function in the system view.
[Router] nat alg dns enable
# Run the display nat overlap-address all command on the router to check the mapping between
the overlapped address pool and the temporary address pool.
<Router> display nat overlap-address all
Nat Overlap Address Pool To Temp Address Pool Map Information:
-------------------------------------------------------------------------------
Id Overlap-Address Temp-Address Pool-Length Inside-VPN-Instance-Name
-------------------------------------------------------------------------------
0 202.10.0.100 202.12.1.100 254
-------------------------------------------------------------------------------
Total : 1
# Run the display nat outbound command to display the configuration of NAT.
[Router] display nat outbound
NAT Outbound Information:
-----------------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
-----------------------------------------------------------------
GigabitEthernet1/0/0 3180 1 pat
-----------------------------------------------------------------
Total : 1
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
acl number 3180
rule 5 permit ip source 202.10.0.0 0.0.0.255
#
nat alg dns enable
#
nat address-group 1 202.11.1.100 202.11.1.200
#
nat overlap-address 0 202.10.0.100 202.12.1.100 pool-length 254
#
interface GigabitEthernet2/0/0
undo portswitch
Networking Requirements
As shown in Figure 5-21, the web server uses private IP address 192.168.0.100/24 and port
8080. The public address of the web server is 202.10.1.3/24 and its domain name is
www.TestNat.com. The IP address of outbound interface GE1/0/0 on the router is 202.10.1.2/24
and the LAN gateway address is 192.168.0.1. The company has no other public IP addresses.
The IP address of the carrier device connected to the router is 202.10.1.1/24. The internal web
server provides web services for external users. Internal users of the company can access external
networks. They can also access internal web servers using an external DNS server.
192.168.0.100/24
Web server
External user
Router
202.10.1.2/24
GE2/0/0 GE1/0/0
Internet
DNS server
Internal user
192.168.0.200/24
Configuration Roadmap
The configuration roadmap is as follows:
l Configure a NAT server on the WAN interface to allow internal hosts to access external
networks.
l Configure DNS mapping and DNS NAT ALG on the router to allow internal users to access
internal servers using the domain name of an external DNS server.
Procedure
Step 1 Configure an IP address for ports on the router.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] undo portswitch
[Router-GigabitEthernet1/0/0] ip address 202.10.1.2 24
[Router-GigabitEthernet1/0/0] quit
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] undo portswitch
[Router-GigabitEthernet2/0/0] ip address 192.168.0.1 24
[Router-GigabitEthernet2/0/0] quit
Step 2 Configure a default route with next hop address 202.10.1.1 on the router.
[Router] ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
Step 3 Configure outbound NAT in Easy IP mode on uplink interface GE1/0/0 of the router.
[Router] acl 2000
[Router-acl-basic-2000] rule 5 permit source 192.168.0.0 0.0.0.255
[Router-acl-basic-2000] quit
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] nat outbound 2000
[Router-GigabitEthernet1/0/0] quit
Step 5 Configure the DNS NAT ALG function and DNS mapping on the router.
[Router] nat alg dns enable
[Router] nat dns-map www.TestNat.com 202.10.1.3 80 tcp
[Router] quit
Run the display nat server command on the router. The command output is as follows:
<Router> display nat server
Nat Server Information:
Interface : GigabitEthernet 1/0/0
Global IP/Port : 202.10.1.3/80(www)
Inside IP/Port : 192.168.0.100/8080
Protocol : 6(tcp)
VPN instance-name : ----
Run the display nat alg command on the router. The command output is as follows:
<Router> display nat alg
NAT Application Level Gateway Information:
----------------------------------
Application Status
----------------------------------
dns Enabled
ftp Disabled
rtsp Disabled
sip Disabled
pptp Disabled
----------------------------------
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
acl number 2000
rule 5 permit source 192.168.0.0 0.0.0.255
#
nat alg dns enable
#
nat dns-map www.testnat.com 202.10.1.3 80 tcp
#
interface
GigabitEthernet2/0/0
undo portswitch
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 202.10.1.2 255.255.255.0
nat server protocol tcp global 202.10.1.3 www inside 192.168.0.100 8080
nat outbound 2000
#
ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
#
return
Networking Requirements
The command output is as follows: As shown in Figure 5-22, the router obtains an IP address
from the PPPoE server. The IP address of Eth2/0/1 on the router is 192.168.0.1/24 and the IP
address of the PPPoE server is 178.18.1.1/16. Internal hosts connect to the network using routers.
The router obtains a public IP address from the PPPoE server in PPPoE dialup mode. Users hope
that internal hosts can access external networks.
Figure 5-22 Networking diagram for configuring PPPoE dialup access in Easy IP mode
Host 1
Eth2/0/1 GE1/0/0
Host 2 Internet
……
Host n
Configuration Roadmap
The configuration roadmap is as follows:
Create a dialer interface and set parameters of the dialer port, establish a PPPoE session,
configure a static route on the router, and configure Easy IP on the dialer interface to implement
external network access by configuring PPPoE dialup in Easy IP mode.
Procedure
Step 1 Configure a PPPoE server.
Configure the authentication mode, IP address allocation mode, and IP address or IP address
pool for the PPPoE client. For details about the configuration procedure, see the documentation
of the PPPoE server. If the router functions as a PPPoE server, see Example for Configuring the
PPPoE Server.
# Run the display nat outbound command on the router. The command output is as follows:
<Router> display nat outbound
NAT Outbound Information:
---------------------------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
---------------------------------------------------------------------------
Dialer1 2000 178.18.1.2 easyip
---------------------------------------------------------------------------
Total : 1
----End
Configuration Files
Configuration file of the router
#
sysname Router
#
acl number 2000
rule 5 permit source 192.168.0.0 0.0.0.255
#
dialer-rule
dialer-rule 1 ip permit
#
interface Dialer1
link-protocol ppp
ppp chap user user1@system
ppp chap password cipher %@%@t^cV#p7O3JZd9oD{d3h8%ay3%@%@
ip address ppp-negotiate
dialer user user2
dialer bundle 1
dialer queue-length 8
dialer timer idle 300
dialer-group 1
nat outbound 2000
#
interface GigabitEthernet1/0/0
undo portswitch
pppoe-client dial-bundle-number 1 on-demand
#
ip route-static 0.0.0.0 0.0.0.0 Dialer1
#
return
Networking Requirements
As shown in Figure 5-23, the Router functions as the NAT gateway to connect to the enterprise
internal network and Internet. Multiple SIP phones on the enterprise internal network often call
the SIP phone, UserA, on the Internet. For example, multiple users on the enterprise internal
network often hold call conferences with the SIP phone on the Internet. The voice configurations
of the SIP phones and NAT configuration of the Router are complete, and enterprise internal
users can call the user on the Internet. The NAT device has limited bandwidth, so the SIP call
bandwidth limit needs to be configured on the NAT device to reject the SIP calls that exceed
the configured bandwidth limit.
Figure 5-23 Configuring the SIP call bandwidth limit on a NAT device
User 1
192.168.0.2/24 User A
202.10.1.8/24
Router
192.168.0.1/24 202.10.1.1/24
User 2 GE1/0/0 GE2/0/0
192.168.0.3/24 Internet
……
SIP Server
User n 202.10.1.10/24
192.168.0.44/24
Configuration Roadmap
The configuration roadmap is as follows:
Enable CAC and set the total bandwidth to limit the bandwidth of SIP calls.
Procedure
Step 1 Enable CAC on the Router and set the total bandwidth of the Router to 2000 Kbps.
<Huawei> system-view
[Huawei] sysname Router
[Router] nat sip cac enable bandwidth 2000
[Router] quit
# Run the display nat sip cac bandwidth information verbose command on the Router to
check detailed information about the configured total bandwidth and occupied bandwidth.
<Router> display nat sip cac bandwidth information verbose
-------------------------------------------------------------------------------
Total Bandwidth(Kbps) Used Bandwidth(Kbps)
2000
1900
-------------------------------------------------------------------------------
Src-IP Src-Port Dest-IP Dest-Port Protocol Used Bandwidth(Kbps)
192.168.0.2 50 202.10.1.10 5060 udp 600
192.168.0.3 50 202.10.1.10 5060 udp 700
192.168.0.4 50 202.10.1.10 5060 udp 600
-------------------------------------------------------------------------------
# User 1, User 2, and User 3 in the enterprise's intranet can concurrently have a conference call
with User A on the Internet (the bandwidth does not exceed 2000 Kbps). If the total bandwidth
of the users who attempt to access the conference exceeds 2000 Kbps, the call fails.
----End
Configuration Files
Configuration file of the Router
#
sysname Router
#
nat sip cac enable bandwidth
2000
#
return
Fault Description
This fault is commonly caused by one of the following:
l Outbound NAT is not properly configured on the outbound interface connected to the public
network.
l The configuration of the ACL bound to outbound NAT is incorrect.
Procedure
Step 1 Check whether packets are received on interfaces of device.
Run the display interface interface-type interface-number command on the device to display
the value of the Input field.
l If the value of the Input field is 0, the device does not receive any packets. Check the interface
configuration to ensure that the interface can receive packets.
l If the value of the Input field is not 0, go to step 2.
NOTE
The device supports GE, FE, Eth-Trunk, and sub-interfaces. If an Eth-Trunk sub-interface is used, run the
display interface eth-trunk [ trunk-id [.subnumber ] ] command to check whether the Eth-Trunk sub-
interface receives packets.
Step 2 Check whether the ACL rule bound to outbound NAT allows NAT service packets to pass
through.
Run the display nat outbound command on the device to check whether outbound NAT is
correctly configured.
[Huawei]display nat outbound
NAT Outbound Information:
---------------------------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
---------------------------------------------------------------------------
GigabitEthernet0/0/0 2000 1 no-pat
---------------------------------------------------------------------------
Total : 1
The preceding information indicates that ACL 2000 is bound to outbound NAT on
GigabitEthernet0/0/0.
Check whether the rule of ACL 2000 is configured correctly. If the IP address, interface number,
or protocol type in the rule of ACL 2000 is configured incorrectly, packets cannot be transmitted
correctly.
Run thedisplay acl 2000 command to check the configuration of outbound NAT bound to ACL
2000.
[Huawei] display acl 2000
Basic ACL2000, 1 rule
Acl's step is 5
rule 5 permit source 192.168.1.100 0
The rule of ACL 2000 matches packets with the source address 192.168.1.100.
Run the display nat address-group command on the device to check whether the address pool
bound to outbound NAT on the outbound interface is correct.
[Huawei] display nat address-group 1
NAT Address-Group Information:
--------------------------------------
Index Start-address End-address
--------------------------------------
1 10.0.0.100 10.0.0.110
--------------------------------------
Total : 1
To check Easy IP information on the outbound port, run the display nat outbound command
on the device. For example:
[Huawei] display nat outbound
NAT Outbound Information:
--------------------------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
--------------------------------------------------------------------------
GigabitEthernet0/0/1 2000 30.30.30.1 easyip
--------------------------------------------------------------------------
Total : 1
The preceding information indicates that Easy IP is configured on GigabitEthernet0/0/1 and the
address pool 30.30.30.1 bound to the interface is the address pool advertised on the interface. If
NAT is disabled, you perform the following steps:
l If the bound IP address is the interface address, ensure that the interface address is valid.
----End
Fault Description
This fault is commonly caused by one of the following:
l The NAT server is configured on an incorrect interface such as an outbound port or other
irrelated interfaces. The NAT server must be configured on the inbound interface of an
external host that connects to the internal network.
l The NAT server configuration is incorrect. For example, the corresponding public and
private IP addresses of internal servers are incorrect, and private ports and enabled ports
of internal servers are different.
Procedure
Step 1 Check whether services on the internal NAT server are running properly.
When the external network cannot access the internal NAT server, check whether services such
as HTTP server and FTP server are enabled on the internal NAT server. Access the internal NAT
server from an internal host to check whether the services are running properly.
l If services on the internal NAT server are not running properly, enable the services.
l If services on the internal NAT server are running properly but the fault persists, go to step
2.
Run the display nat server command on the device to check that the NAT server is configured
on the correct NAT interface and the correct protocol type, interface number, and IP address are
configured.
[Huawei] display nat server
Nat Server Information:
Interface : GigabitEthernet 2/0/0
Global IP/Port : 202.10.1.3/80 (www)
Inside IP/Port : 192.168.0.100/8080
Protocol : 6(tcp)
VPN instance-name : ----
Acl number : ----
Vrrp id : ----
Description : ----
Total : 1
Ensure that the mapped internal address and interface are correct. When some services such as
FTP and TFTP transmit data packets, several interfaces (some of them are randomly generated)
are used. Therefore, to configure the NAT server providing such services, cancel the limitation
on the ports so that the internal server can provide services normally.
l If the NAT server is configured incorrectly, reconfigure the NAT server.
l If the NAT server is configured correctly but the fault persists, go to step 3.
Step 3 Check the connection between the external host and NAT server and the configurations of the
connected ports.
Check that the IP address of the outbound interface on the NAT server is correct and the external
IP address of the NAT server is correct. The IP addresses cannot conflict with the addresses on
other network segments. Ping the external interface of the NAT server on an external host. Ensure
that the external host can ping the NAT server successfully.
l If the external host cannot connect to the NAT server, check the connection.
l If the external host and NAT server are connected correctly but the fault persists, go to step
4.
Step 4 Check that the internal NAT server is configured with the correct gateway address or route.
The internal NAT server must be configured with the correct route or gateway address so that
packets destined for the external host can be sent to the gateway.
l If the gateway address or route on the internal NAT server is configured incorrectly,
reconfigure it.
l If the gateway address or route on the internal NAT server is configured correctly but the
fault persists, contact Huawei technical support personnel.
----End
Fault Description
This fault is commonly caused by one of the following:
l Outbound NAT is incorrectly configured on the outbound port.
l NAT ALG is disabled for the DNS protocol.
l The DNS mapping entry is configured incorrectly. For example, the corresponding public
address is different from the IP address of an external server.
l The route between the temporary address pool and the outbound interface is not configured.
Procedure
Step 1 Check that outbound NAT is configured correctly.
Run the display nat outbound command on the device to check whether outbound NAT is
configured correctly.
[Huawei]display nat outbound
NAT Outbound Information:
---------------------------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
---------------------------------------------------------------------------
GigabitEthernet0/0/1 3180 1 pat
---------------------------------------------------------------------------
Total : 1
The preceding information indicates that ACL 3180 is bound to outbound NAT and the address
pool index is 1. Check that outbound NAT references a correct address pool. When configuring
an address pool, ensure that the destination address on the external network is different from
any address in the address pool. Run the display nat address-group command to check the
configuration of the address pool.
[Huawei]display nat address-group 1
NAT Address-Group Information:
--------------------------------------
Index Start-address End-address
--------------------------------------
1 202.10.10.10 202.10.10.100
--------------------------------------
Total : 1
Check that ACL rules bound to outbound NAT are correct. Generally, incorrect addresses,
protocol types, or interface numbers are defined in ACL rules. When an ACL problem occurs,
packets on the internal network cannot be sent out or packets on the external network cannot be
sent to the internal network.
Run the display acl 3180 command to check the ACL bound to outbound NAT.
[Huawei]display acl 3180
Advanced ACL 3180, 1 rule
Acl's step is 5
rule 5 permit tcp source 1.1.1.1 0
NOTE
An ACL strictly controls the permitted address segments, protocols, and ports based on the networking
requirements. If certain protocol packets are rejected by the NAT gateway, check whether the packets of
this protocol are permitted by the ACL.
l If outbound NAT is configured incorrectly, correct the configuration.
l If outbound NAT is configured correctly but the fault persists, go to step 2.
Run the display nat dns-map command on the device to check whether the NAT server is
configured on the correct NAT interface and check whether the protocol type, interface number,
and IP address are correctly configured.
[Huawei]display nat dns-map
NAT DNS mapping information:
Domain-name : test1
Global IP : 10.1.1.1
Global port : 2012
Protocol : tcp
Total : 1
l If the DNS mapping entry is configured incorrectly, run the nat dns-map command in the
system view to configure a DNS mapping entry correctly.
l If the DNS mapping entry is configured correctly but the fault persists, go to step 3.
Step 3 Check that NAT ALG is enabled for the DNS protocol.
Run the display nat alg command on the device to check whether NAT ALG is enabled for the
DNS protocol.
[Huawei]display nat alg
NAT Application Level Gateway Information:
----------------------------------
Application Status
----------------------------------
dns Disabled
ftp Disabled
rtsp Enabled
sip Disabled
pptp Disabled
----------------------------------
l If NAT ALG is disabled for the DNS protocol, run the nat alg command to enable it.
l If NAT ALG is enabled for the DNS protocol but the fault persists, go to step 4.
Step 4 Check that the mappings between overlapped address pools and temporary address pools are
correct.
Run the display nat overlap-address command on the device to check whether all the mappings
between overlapped address pools and temporary address pools are correct.
[Huawei]display nat overlap-address all
Nat Overlap Address Pool To Temp Address Pool Map Information:
----------------------------------------------------------------------
Id Overlap-Address Temp-Address Pool-Length Inside-VPN-Instance-Name
----------------------------------------------------------------------
1 1.1.1.1 20.20.20.20 34
-----------------------------------------------------------------------
Total : 1
NOTE
The temporary address pool contains available IP addresses on the device. The IP addresses in the address
pool cannot conflict with any interface address, VRRP address, or NAT address. In the preceding
information, Inside-VPN-Instance-Name specifies the VPN instance to which the internal interface
connected to the host belongs.
Step 5 Check that the route between the temporary address pool and the outbound interface is
configured.
Run the display ip routing-table command on the device to check all the routes on the public
network.
[Huawei]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 2 Routes : 2
NOTE
If the name of the VPN instance where the internal interface is located has been configured, run the display
ip routing-table vpn-instance vpn-name command to check the routes.
l If the route is correct but the fault persists, contact Huawei technical support personnel.
----End
5.10 References
The following table lists the references of this document.
Document Description
This chapter describes the principle and configuration of UDP helper, and provides configuration
examples.
Context
NOTE
Background
Hosts on a network may need to obtain the network configuration or resolve host names by
sending UDP broadcast packets to the server. If the hosts and server are located in different
broadcast domains, broadcast packets cannot reach the server and the hosts cannot obtain the
required information from the server.
The industrial switch router provides the UDP helper function to solve this problem. UDP helper
can relay the UDP broadcast packets with specified destination ports. It converts the broadcast
packets into unicast packets and sends the unicast packets to the specified destination servers.
As shown in Figure 6-1, HostA uses a host name to access HostB, and the NetBIOS Name
Service (NetBIOS-NS) server resolves the host name of HostB. The NetBIOS-NS server and
HostA are in different broadcast domains, so the UDP broadcast packet with destination port
UDP 137 sent by HostA cannot reach the NetBIOS-NS server. After UDP helper is enabled on
the Router, the Router can forward the packet with destination port UDP 137 to the NetBIOS-
NS server through unicast so that the NetBIOS-NS server can resolve the host name of HostB.
NetBIOS-NS
HostB
Domain Name 53
System (DNS)
Time Service 37
Terminal Access 49
Controller Access
Control System
(TACACS)
NOTE
UDP helper does not relay DHCP packets. That is, the destination port number cannot be 67 or 68. To relay
DHCP packets, enable the DHCP relay function on the industrial switch router. For details about DHCP
relay, see Configuring DHCP Relay Agent.
Pre-configuration Tasks
Before configuring UDP helper, complete the following task:
l Configuring a reachable route from the industrial switch router to the destination server
Procedure
Step 1 Run:
system-view
Step 2 Run:
udp-helper enable
The UDP destination port to which UDP broadcast packets are relayed is specified.
NOTE
After UDP helper is enabled, the industrial switch router relays the UDP packets with the following
destination ports by default: Time (37), TACACS (49), DNS (53), TFTP (69), NetBIOS-NS (137), and
NetBIOS-DS (138). If the UDP destination port you want to specify is among the six ports, skip this step.
Step 4 Run:
interface interface-type interface-number
The interface must be a VLANIF interface, Layer 3 Ethernet interface, or Layer 3 Ethernet sub-
interface.
Step 5 Run:
udp-helper server ip-address
----End
Procedure
l Run the display udp-helper server command to display the packet relay interface,
destination server address, and number of forwarded packets.
----End
Context
NOTICE
UDP helper statistics cannot be restored after being cleared. Exercise caution when you run the
reset udp-helper packet command.
Procedure
l Run the reset udp-helper packet command in the user view to clear UDP helper statistics.
----End
Networking Requirements
As shown in Figure 6-2, Router connects to a local area network (LAN) through GE1/0/0. The
IP address of GE1/0/0 is 10.110.1.1/16. NetBIOS-NS is connected to GE2/0/0 on Router. The
IP address of the NetBIOS-NS server is 202.2.1.1/16 and the IP address of GE2/0/0 is
202.2.1.2/16. PC1 and PC2 on the LAN need to access each other using host names.
GE2/0/0
202.2.1.2/16
Router
GE1/0/0
10.110.1.1/16
LSW
PC1 PC2
Configuration Roadmap
1. Because the PCs on the LAN need to access each other using host names, the host names
must be resolved into IP addresses. However, the NetBIOS-NS and PCs are in different
broadcast domains. The NetBIOS-NS Register packets cannot reach the NetBIOS-NS
server. The Router must be enabled with UDP helper to forward the UDP packets with
destination port 137 (NetBIOS-NS port) to the NetBIOS-NS server.
2. After UDP helper is enabled, specify the IP address of destination NetBIOS-NS server on
GE1/0/0 of Router.
NOTE
After UDP helper is enabled on the Router, the Router relays the broadcast packets with UDP destination port
137 by default. The UDP port number, therefore, does not need to be configured in this example.
Procedure
Step 1 Assign an IP address to GE1/0/0 on Router.
<Huawei> system-view
[Huawei] sysname Router
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] undo portswitch
[Router-GigabitEthernet1/0/0] ip address 10.110.1.1 16
[Router-GigabitEthernet1/0/0] quit
# Run the display udp-helper server command to check UDP Helper statistics.
<Router> display udp-helper server
Server-interface Server-Ip packet-num
------------------------------------------------------------------------
GigabitEthernet1/0/0 202.2.1.1 201
# Run the display udp-helper port command to check the configured destination port number
of UDP packets to be forwarded using the UDP Helper.
<Router> display udp-helper port
Udp-Port-Number Description
-------------------------------------------------------------
37 Time
49 TAC Access Control System
53 Domain Name Server
69 Trivial File Transfer Protocol
137 NETBIOS Name Service
138 NETBIOS Datagram Service
----End
Configuration Files
Configuration file of the Router
#
sysname Router
#
udp-helper enable
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.110.1.1 255.255.0.0
udp-helper server 202.2.1.1
#
interface GigabitEthernet2/0/0
undo portswitch
ip address 202.2.1.2 255.255.0.0
#
return
7 IP Performance Configuration
A large number of packets need to be forwarded on the network, which may cause network
congestion and degrade network performance.IP performance optimization can solve the
problem. You can adjust parameters or forwarding modes for IP packets to achieve optimal
network performance.
Prerequisite
Before optimizing IP performance, complete the following task:
Context
Configuring source IP address verification enables an interface to check validity of source IP
addresses of received packets. Packets with invalid addresses are discarded. The interface only
check validity of source IP addresses of the packets that are forwarded to the CPU and does not
check validity of source IP addresses of the packets that will be directly forwarded according to
the FIB table.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run:
ip verify source-address
By default, an interface does not check validity of source IP addresses of received packets.
----End
Context
During actual packet forwarding, the length of an IP packet may exceed the MTU value. Packets
whose length exceeds the MTU value and the DF field is 1 are discarded. Therefore, IP packet
fragmentation can be enabled so that the system sets the DF field of IP packets to 0 and fragments
the packets. In this way, all IP packets can be forwarded.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
NOTE
The function that clears the DF field is valid for outgoing packets; therefore, this function must be
configured on the outbound interface.
Step 3 Run:
clear ip df
----End
Context
During network transmission, IP packets are fragmented if they have a long length. The
forwarding device forwards the fragmented packets, and the destination device receives the
fragmented packets and reassembles them. If some fragmented packets are discarded during
transmission due to the bandwidth limitation, the packets cannot be reassembled on the
destination device. To solve the problem, you can enable virtual fragment reassembly of IP
packets on the device functioning as the intermediate of fragmented packets. After that, the
device checks, sorts, and caches the fragmented packets received to ensure complete packet
forwarding or scheduling.
NOTE
If the NAT, firewall, smart application control (SAC), or in-depth security defense functions is configured on
the device, virtual fragment reassembly is enabled by default and cannot be disabled. That is, the undo ip virtual-
reassembly command does not take effect.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ip virtual-reassembly
----End
Context
ECMP evenly load balances traffic over multiple equal-cost links, regardless of the bandwidth.
Consequently, traffic congestion may occur on low-speed links and bandwidth of high-speed
links cannot be used efficiently. To solve this problem, you can configure Unequal Cost Multiple
Path (UCMP) on an interface so that proportional traffic can be loaded over equal-cost links
based on the bandwidth. This configuration can achieve proper load balancing.
You are advised to configure the bandwidth of each link participating in UCMP to an integral
multiple of the minimum bandwidth. If the bandwidth of each link is not configured to an integral
multiple of the minimum bandwidth, the system still uses an integral multiple of the minimum
bandwidth to process. For example, if the bandwidths of four links participating in UCMP are
configured to 2 Kbps, 3 Kbps, 4 Kbps, and 5 Kbps, the final bandwidths of the links are 2 Kbps,
2 Kbps, 4 Kbps, and 4 Kbps.
Procedure
Step 1 Run:
system-view
NOTE
Among all subinterfaces, only the Ethernet sub-interfaces (Dot1q and QinQ termination sub-interfaces) and Eth-
trunk sub-interfaces (Dot1q termination sub-interfaces) support configuration of unequal cost multiple path.
NOTE
Equal-cost links load balance proportional traffic based on the configured bandwidth only when UCMP is
enabled on the outbound interfaces of all equal-cost links and the shutdown and undo shutdown
commands are executed on the outbound interfaces in sequence to trigger FIB entry update. If UCMP is
not enabled on any outbound interface, the equal-cost links evenly load balance traffic even though FIB
entry update is triggered.
----End
Context
IP packets can carry route options including the route alert option, route record option, source
route option, and timestamp option. These route options are used to diagnose network paths and
temporarily transmit special services. These options, however, may be used by attackers to spy
on the network structure for initiating attacks. This degrades network security and device
performance. To solve this problem, you can perform the following configurations to configure
the device to discard the IP packets that contain the route options.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
----End
Context
By controlling broadcast packet forwarding through interfaces, you can improve the security of
the network.
Procedure
Step 1 Configure the basic or advanced ACL. For details, see Configuring a Basic ACL or Configuring
an Advanced ACL in the Huawei AR530&AR550 Series Industrial Switch Routers
Configuration Guide - Security - ACL Configuration.
Step 2 Run:
system-view
Step 3 Run:
interface interface-type interface-number
Step 4 Run:
ip forward-broadcast [ acl acl-number ]
Only broadcast packets that match the permit action defined in the ACL are forwarded.
Broadcast packets that match the deny action defined in the ACL or do not match any ACL rules
are not forwarded.
----End
Context
QoS policies take effect only for data packets. In certain cases, control packets need to be
managed. For example, bandwidth limitation is required for the control packets generated by
Telnet applications. The enhanced forwarding function can meet the requirement. You can
configure this function to apply QoS policies to the control packets generated by the device.
Currently, the enhanced forwarding function is valid only for the control packets generated by
the device.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ip soft-forward enhance enable
l Run the set priority acl acl-number dscp dscp-value command to set the DSCP priority
for the control packets according to the ACL rule.
You can set the priority of BGP, FTP, ICMP, SNMP, SSH, and Telnet control packets
according to the protocol type. To set the priority of other types of control packets, configure
advanced ACL rules according to Configuring an Advanced ACL Rule and then set the
DSCP priority of the control packets according to the ACL rules.
NOTE
If you set the DSCP priority for control packets according to both the protocol type and ACL rule, the
DSCP priority configured according to the protocol type takes effect.
Step 4 (Optional) Configure the control packets to support QoS policies using one or more of the
following commands.
1. Run:
undo control-packet { bgp | icmp | igmp | ospf | pim | rip | snmp | ssh |
telnet | vrrp| other-protocols } * output car bypass or undo control-packet
all output car bypass
Control packets are configured to support QoS queue functions (including traffic shaping,
congestion management, and congestion avoidance).
The device is configured to discard control packets when the traffic policy or ACL-based
simplified traffic policy contain the deny action.
By default, the device does not discard control packets when the traffic policy and ACL-
based simplified traffic policy contain the deny action.
----End
Follow-up Procedures
After the enhanced forwarding function is configured for control packets, you can only make
QoS policies take effect for the control packets. To implement differentiated services for control
packets, configure QoS policies. For details, see Huawei AR530&AR550 Series Industrial Switch
Routers Configuration Guide - QoS.
NOTICE
If an interface is not enabled to send ICMP redirection packets, the AR530&AR550 does not
send ICMP redirection packets.
Procedure
Step 1 Run:
system-view
NOTE
After the fast ICMP reply function is enabled on the device, the local policy-based routing function does not
take effect for ICMP packets. Therefore, if the local policy-based routing function is configured on the device,
you are advised to disable the fast ICMP reply function.
Step 3 Run:
icmp ttl-exceeded drop
The device is configured to discard the ICMP packets whose TTL values are 1.
By default, the function of discarding ICMP packets with TTL values 1 is disabled.
Step 4 Run:
icmp with-options drop
The device is configured to discard the ICMP packets that carry options.
By default, the function of discarding ICMP packets that carry options is disabled.
Step 5 Run:
icmp unreachable drop
Step 7 Run:
icmp time-exceed { extension { compliant | non-compliant } | classic }
By default, ICMP Time Exceeded packets carry extension headers in compliant mode and
original datagrams are of variable length.
Step 8 Run:
icmp blackhole unreachable send
The BRAS is disabled from sending a Destination Unreachable ICMP packet to an initiator when
a tracert packet matches an IPv4 blackhole route.
By default, the BRAS is disabled from sending a Destination Unreachable ICMP packet to an
initiator when a tracert packet matches an IPv4 blackhole route.
Step 9 Run:
interface interface-type interface-number
Step 10 Run:
icmp redirect send
Step 11 Run:
undo icmp ttl-exceeded send
Step 12 Run:
icmp host-unreachable send
----End
Context
When a TCP connection is set up between industrial switch router and other devices, TCP
properties such as TCP connection for BGP need to be configured.
l SYN-Wait timer: When SYN packets are sent, the SYN-Wait timer is started. If no response
packet is received after the SYN-Wait timer expires, the TCP connection is closed.
l FIN-Wait timer: When the TCP connection status changes from FIN_WAIT_1 to
FIN_WAIT_2, the FIN-Wait timer is started. If no response packet is received after the
FIN-Wait timer expires, the TCP connection is closed.
l Receive/send buffer size of connection-oriented socket.
l Minimum Maximum Segment Size (MSS) value: Setting a minimum MSS value for a TCP
connection defines the smallest TCP packet size, preventing DoS attacks caused by packets
with small MSS values.
l Aging time of the TCP Path MTU.
l the MSS of TCP Packets on an Interface.
Procedure
Step 1 Run:
system-view
Step 2 Run:
tcp timer syn-timeout interval
Step 3 Run:
tcp timer fin-timeout interval
Step 4 Run:
tcp window window-size
By default, the size of the receive or send buffer of a connection-oriented socket is 8k bytes.
Step 5 Run:
tcp min-mss mss-value
By default, the minimum MSS value for a TCP connection is 216 bytes.
Step 6 Run:
interface interface-type interface-number
Step 7 Run:
tcp adjust-mss value
The MSS of TCP packets is an option defined in TCP. It refers to the maximum length of a TCP
packet segment that can be received by the peer device. When establishing the TCP connection,
the local and peer ends negotiate the MSS value to determine the maximum data length of TCP
packets. If the length of a TCP packet sent by the peer device exceeds the negotiated MSS, the
TCP packet is fragmented.
When configuring the MSS of TCP packets, pay attention to the following points:
l To ensure that TCP packets are not fragmented, pay attention to the relationship between the
MSS and MTU during configuration. MTU is an option defined by the data link layer to
identify whether IP packets need to be fragmented. If the size of an IP packet sent by the peer
device exceeds the MTU, the IP packet is fragmented. To ensure that the packet transmission
is not affected, the MSS value plus the header lengths (such as the TCP header and IP header)
does not exceed the MTU value. For example, the default MTU value of an Ethernet interface
is 1500 bytes. To ensure that packets are not fragmented, the MSS value can be set to 1460
bytes. The formula is as follows: Default MTU value (1500 bytes) – Minimum length of the
TCP header (20 bytes) – Minimum length of the IP header (20 bytes). The recommended
MSS value is 1200 bytes.
l The tcp adjust-mss command does not only take effect for the industrial switch router
functioning as the client or server used for TCP connections. When another device functions
as the client to perform MSS negotiation through the industrial switch router, the negotiation
result is modified based on the MSS configured on the industrial switch router. In addition,
the MSS value is changed to the value configured using the tcp adjust-mss command only
when the MSS value received by the industrial switch router is larger than the value
configured using the tcp adjust-mss command executed on the industrial switch router.
l If you run the tcp adjust-mss multiple times in the same interface view, only the latest
configuration takes effect.
Step 8 Run:
tcp timer pathmtu-age age-time
By default, the aging time of the PMTU is 0 minutes, that is, the PMTU never ages.
----End
Procedure
l Run the display tcp status [ [ task-id task-id ] [ socket-id socket-id ] | [ local-ip ip-
address ] [ local-port local-port-number ] [ remote-ip ip-address ] [ remote-port remote-
port-number ] ] command to check the TCP connection status.
l Run the display tcp statistics command to view the TCP traffic statistics.
l Run the display udp statistics command to view the UDP traffic statistics.
l Run the display ip statistics command to view the IP traffic statistics.
l Run the display ip [ ha ] socket [ monitor ] [ task-id task-id socket-id socket-id | socket-
type socket-type ] command to view information about the created IPv4 socket.
l Run the display icmp statistics command to view the ICMP traffic statistics.
l Run the display load-sharing ip-address ip-address mask vrf vrf-id to check the UCMP
configuration.
----End
Context
NOTICE
The IP/TCP/UDP traffic statistics cannot be restored after being cleared. Therefore, confirm
your operation before clearing the IP performance statistics.
Procedure
l After you are determined to clear IP statistics, run the reset ip statistics [ interface
interface-type interface-number ] command in the user view.
l After you are determined to clear statistics in a socket monitor, run the reset ip socket
monitor [ task-id task-id socket-id socket-id ] command in the user view.
l After you are determined to clear statistics on the dual receive buffer of the socket, run the
reset ip socket pktsort task-id task-id socket-id socket-id command in the user view.
l After you are determined to clear statistics about RawIP packets, run the reset rawip
statistics command in the user view.
l After you are determined to clear TCP statistics, run the reset tcp statistics command in
the user view.
l After you are determined to clear UDP statistics, run the reset udp statistics command in
the user view.
----End
The IPv6 protocol stack supports routing protocols and application protocols on an IPv6 network.
8.2 Principles
This section describes the implementation of IPv6.
8.7 References
This section lists references of IPv6.
Definition
Internet Protocol version 6 (IPv6), also called IP Next Generation (IPng), is a second-generation
network layer protocol. It was designed by the Internet Engineering Task Force (IETF) as an
upgraded version of Internet Protocol version 4 (IPv4).
Purpose
IPv4 is the widely used Internet protocol. During initial development of the Internet, IPv4 rapidly
developed because of its simplicity, ease of implementation, and good interoperability.
However, as the Internet rapidly develops, deficiency in IPv4 design becomes obvious. To
overcome the deficiency, IPv6 emerges. IPv6 has the following advantages over IPv4.
Address An IPv4 address is 32 bits long. A An IPv6 address is 128 bits long. A
space maximum of 4.3 billion IPv4 addresses 128-bit address structure allows for
can be provided. Actually, less than 4.3 2128 (4.3 billion x 4.3 billion x 4.3
billion addresses are available, and IPv4 billion x 4.3 billion) possible
address resources are allocated addresses. The biggest advantage of
unevenly. USA address resources IPv6 is its almost infinite address
account for almost half of the global space.
address space, with barely enough
addresses left for Europe, and still fewer
for the Asia-Pacific area. Furthermore,
the development of mobile IP and
broadband technologies still requires
more IP addresses. Currently, IPv4
addresses are being exhausted.
There are several solutions to IPv4
address exhaustion. Classless Inter-
domain Routing (CIDR) and Network
Address Translator (NAT) are two such
solutions. CIDR and NAT, however,
have their disadvantages and
unsolvable problems, which helped
encourage the development of IPv6.
Packet The IPv4 packet header carries the Compared with the IPv4 packet
format Options field, including security, header, the IPv6 packet header does
timestamp, and record route options. not carry IHL, identifier, flag,
The variable length of the Options field fragment offset, header checksum,
makes the IPv4 packet header length option, and paddiing fields but
range from 20 bytes to 60 bytes. IPv4 carries the flow label field. This
packets with the Options field often facilitates IPv6 packet processing
need to be forwarded by intermediate and improves processing efficiency.
devices, so many resources are To support various options without
occupied. Therefore, these IPv4 packets changing the existing packet format,
are seldom used in practice. the Extension Header information
field is added to the IPv6 packet
header. This improves IPv6
flexibility.
Route Many non-contiguous IPv4 addresses A huge address space allows for the
summarizat are allocated, so routes cannot be hierarchical network design in IPv6.
ion summarized effectively due to incorrect The hierarchical network design
IPv4 address allocation and planning. facilitates route summarization and
The increasingly large routing table improves forwarding efficiency.
consumes a lot of memory and affects
forwarding efficiency. Device
manufacturers have to keep upgrading
devices to improve route addressing
and forwarding performance.
End-to-end Security is not fully considered in the IPv6 supports IP Security (IPSec)
security design of IPv4. Therefore, the original authentication and encryption at the
support IPv4 framework does not support end- network layer, so it provides end-to-
to-end security. end security.
Quality of The increasing popularity of network IPv6 has the Flow Label field, which
Service conferences, network telephones, and guarantees QoS for voice, data, and
(QoS) network TVs requires better QoS to video services.
support ensure real-time forwarding of these
voice, data, and video services.
However, IPv4 has no native
mechanism to support QoS.
Mobility As the Internet develops, mobile IPv4 IPv6 has the native capability to
experiences some problems, such as support mobility. Compared to
triangle routing and source address mobile IPv4, mobile IPv6 uses the
filtering. neighbor discovery function to
discover a foreign network and
obtain a care-of address without
using any foreign agent. The mobile
node and peer node can
communicate using the routing
header and destination options
header. This function solves the
problems of triangle routing and
source address filtering in mobile
IPv4. Mobile IPv6 improves mobile
communication efficiency and is
transparent to the application layer.
8.2 Principles
This section describes the implementation of IPv6.
For convenience, IPv6 provides the compressed format. The following uses IPv6 address
FC00:0000:130F:0000:0000:09C0:876A:130B as an example to describe the compressed
format:
l Any zeros at the beginning of a group can be omitted. Then the given example becomes
FC00:0:130F:0:0:9C0:876A:130B.
l A double colon (::) can be used in an IPv6 address when two or more consecutive groups
contain all zeros. Then the given example can be written as FC00:0:130F::9C0:876A:130B.
NOTE
An IPv6 address can contain only one double colon (::). Otherwise, a computer cannot determine the number
of zeros in a group when restoring the compressed address to the original 128-bit address.
If the first 3 bits of an IPv6 unicast address are not 000, the interface ID must be of 64 bits. If the first 3
bits are 000, there is no such limitation.
The interface ID can be manually configured, generated through the system software, or
generated in IEEE 64-bit Extended Unique Identifier (EUI-64) format. It is most common to
generate the interface ID in EUI-64 format.
IEEE EUI-64 standards convert an interface MAC address into an IPv6 interface ID. As shown
in Figure 8-1, if a 48-bit MAC address is used as an interface ID, the first 24 bits (expressed by
c) is a vendor identifier, and the last 24 bits (expressed by m) is an extension identifier. If the
higher seventh bit is 0, the MAC address is locally unique. During conversion, EUI-64 inserts
FFFE between the vendor identifier and extension identifier of the MAC address, and then the
higher seventh bit 0 is changed to 1 to indicate that the interface ID is globally unique.
1111111111111110
Insert
FFFE cccccc 0 ccccccccccccccccc 1111111111111110mmmm ...mmmm
Change the
seventh high
bit to 1 cccccc 1ccccccccccccccccc 1111111111111110mmm m...mmmm
l Unspecified address
An IPv6 unspecified address is 0:0:0:0:0:0:0:0/128 or ::/128, indicating that an interface or
a node does not have an IP address. It can be used as the source IP address of some packets,
such as Neighbor Solicitation (NS) message in duplicate address detection. Devices do not
forward the packets with the source IP address as an unspecified address.
l Loopback address
An IPv6 loopback address is 0:0:0:0:0:0:0:1/128 or ::1/128. Similar to IPv4 loopback
address 127.0.0.1, IPv6 loopback address is used when a node needs to send IPv6 packets
to itself. This IPv6 loopback address is usually used as the IP address of a virtual interface
(a loopback interface for example). The loopback address cannot be used as the source or
destination IP address of packets that need to be forwarded.
l Global unicast address
An IPv6 global unicast address is an IPv6 address with a global unicast prefix, which is
similar to an IPv4 public address. IPv6 global unicast addresses support route prefix
summarization, helping limit the number of global routing entries.
A global unicast address consists of a global routing prefix, subnet ID, and interface ID, as
shown in Figure 8-2.
001
0 Interface ID
1111 1110 10
FE80::/10
10 bit
1111 110
FC00::/7
– Has a well-known prefix (FC00::/7) that allows for easy route filtering at site boundaries.
– Does not conflict with any other addresses if it is leaked outside of the site through
routing.
– Functions as a global unicast address to applications.
– Is independent of the Internet Service Provider (ISP).
IPv6 Multicast Address
Like an IPv4 multicast address, an IPv6 multicast address identifies a group of interfaces, which
usually belong to different nodes. A node may belong to any number of multicast groups. Packets
sent to an IPv6 multicast address are delivered to all the interfaces identified by the multicast
address. For example, the multicast address FF02::1 indicates all nodes within the link-local
scope and FF02::2 indicates all routers within the link-local scope.
An IPv6 multicast address is composed of a prefix, flag, scope, and group ID (global ID):
l Prefix: is fixed as FF00::/8.
l Flag: is 4 bits long. The high-order 3 bits are reserved and must be set to 0s. The last bit 0
indicates a permanently-assigned (well-known) multicast address allocated by the Internet
Assigned Numbers Authority (IANA). The last bit 1 indicates a non-permanently-assigned
(transient) multicast address.
l Scope: is 4 bits long. It limits the scope where multicast data flows are sent on the network.
Figure 8-5 shows the field values and meanings.
l Group ID (global ID): is 112 bits long. It identifies a multicast group. RFC 2373 does not
define all the 112 bits as a group ID but recommends using the low-order 32 bits as the
group ID and setting all the remaining 80 bits to 0s. In this case, each multicast group ID
maps to a unique Ethernet multicast MAC address (for details, see RFC 2464).
Figure 8-5 shows the IPv6 multicast address format.
fieldvalue description
1111 1111 1 temporary multicast address
Flag
FF Flag Scope 0 permanent multicast address
1 node
8 bit 4 bit 4 bit link
2
4 management
Scope 5 site
8 organization
E global
the rest unsigned or reserved
address is generated for the node, and the node joins the multicast group that corresponds
to the IPv6 unicast or anycast address. A unicast or anycast address corresponds to a
solicited-node multicast address, which is often used in neighbor discovery and duplicate
address detection.
IPv6 does not support broadcast addresses or Address Resolution Protocol (ARP). In IPv6,
Neighbor Solicitation (NS) packets are used to resolve IP addresses to MAC addresses.
When a node needs to resolve an IPv6 address to a MAC address, it sends an NS packet in
which the destination IP address is the solicited-node multicast address corresponding to
the IPv6 address.
The solicited-node multicast address consists of the prefix FF02::1:FF00:0/104 and the last
24 bits of the corresponding unicast address.
IPv6 Anycast Address
An anycast address identifies a group of network interfaces, which usually belong to different
nodes. Packets sent to an anycast address are delivered to the nearest interface that is identified
by the anycast address, depending on the routing protocols.
Anycast addresses are designed to implement the redundancy and load balancing functions when
multiple hosts or nodes are provided with the same services. Currently, a unicast address is
assigned to more than one interface to make a unicast address become an anycast address. When
a unicast address is assigned to multiple hosts or nodes, the sender cannot determine which
device can receive the sent data packets with the destination IP address as the anycast address,
if there are multiple routes to the anycast address. This depends on the routing protocols running
on the network. Anycast addresses are used in stateless applications, such as Domain Name
Service (DNS).
IPv6 anycast addresses are allocated from the unicast address space. Anycast addresses are used
in mobile IPv6 applications.
NOTE
IPv6 anycast addresses can be assigned only to devices but not hosts. Anycast addresses cannot be used as
the source IP addresses of IPv6 packets.
l Subnet-router anycast address
A subnet-router anycast address is predefined in RFC 3513. Packets sent to a subnet-router
anycast address are delivered to the nearest device on the subnet identified by the anycast
address, depending on the routing protocols. All devices must support subnet-router anycast
addresses. A subnet-router anycast address is used when a node needs to communicate with
any of the devices on the subnet identified by the anycast address. For example, a mobile
node needs to communicate with one of the mobile agents on the home subnet.
In a subnet-router anycast address, the n-bit subnet prefix identifies a subnet and the
remaining bits are padded with 0s. Figure 8-6 shows the subnet-router anycast address
format.
Subnet prefix 0
An upper-layer PDU is composed of the upper-layer protocol header and its payload such as an
ICMPv6 packet, a TCP packet, or a UDP packet.
Source 40 octets
Address Basic Header
Destination
Address
65535 bytes. If the payload length exceeds 65535 bytes, the field is set to 0. The payload
length is expressed by the Jumbo Payload option in the Hop-by-Hop Options header.
l Next Header: is 8 bits long. This field identifies the type of the first extension header that
follows the IPv6 basic header or the protocol type in the upper-layer PDU.
l Hop Limit: is 8 bits long. This field is similar to the Time to Live field in an IPv4 packet,
defining the maximum number of hops that an IP packet can pass through. The field value
is decremented by 1 by each device that forwards the IP packet. When the field value
becomes 0, the packet is discarded.
l Source Address: is 128 bits long, which indicates the address of the packet originator.
l Destination Address: is 128 bits long, which indicates the address of the packet recipient.
Compared with the IPv4 packet header, the IPv6 packet header does not carry IHL, identifier,
flag, fragment offset, header checksum, option, and paddiing fields but carries the flow label
field. This facilitates IPv6 packet processing and improves processing efficiency. To support
various options without changing the existing packet format, the Extension Header information
field is added to the IPv6 packet header. This improves IPv6 flexibility. The following describes
IPv6 extension headers.
To improve packet processing efficiency, IPv6 uses extension headers to replace the Options
field in the IPv4 header. Extension headers are placed between the IPv6 basic header and upper-
layer PDU. An IPv6 packet may carry zero, one, or more extension headers. The sender of a
packet adds one or more extension headers to the packet only when the sender requests other
devices or the destination device to perform special handling. Unlike IPv4, IPv6 has variable-
length extension headers, which are not limited to 40 bytes. This facilitates further extension.
To improve extension header processing efficiency and transport protocol performance, IPv6
requires that the extension header length be an integer multiple of 8 bytes.
When multiple extension headers are used, the Next Header field of an extension header indicates
the type of the next header following this extension header. As shown in Figure 8-8, the Next
Header field in the IPv6 basic header indicates the type of the first extension header, and the
Next Header field in the first extension header indicates the type of the next extension header.
If the next extension header does not exist, the Next Header field indicates the upper-layer
protocol type. Figure 8-8 shows the IPv6 extension header format.
...
Header
Next Header Extension Header Len
Extension Head Data(last)
... Data
RFC 2460 defines six IPv6 extension headers: Hop-by-Hop Options header, Destination Options
header, Routing header, Fragment header, Authentication header, and Encapsulating Security
Payload header.
Hop- 0 This header carries information that must be examined by every node
by- along the delivery path of a packet. This header is used in the following
Hop applications:
Option l Jumbo payload (the payload length exceeds 65535 bytes)
s
header l Prompting devices to check this option before the devices forward
packets.
l Resource Reservation Protocol (RSVP)
Destin 60 This header carries information that needs to be examined only by the
ation destination node of a packet. Currently, this header is used in mobile IPv6.
Option
s
header
Routin 43 Similar to the Loose Source and Record Route option in IPv4, this header
g is used by an IPv6 source node to specify the intermediate nodes that a
header packet must pass through on the way to the destination of the packet.
Fragm 44 Like IPv4 packets, IPv6 packets to be forwarded cannot exceed the MTU.
ent When the packet length exceeds the MTU, the packet needs to be
header fragmented. In IPv6, the Fragment header is used by an IPv6 source node
to send a packet larger than the MTU.
Authen 51 This header is used in IPSec to provide data origin authentication, data
tication integrity check, and packet anti-replay. It also protects some fields in the
header IPv6 basic header.
When more than one extension header is used in the same packet, the headers must be listed in
the following order:
8.2.3 ICMPv6
The Internet Control Message Protocol version 6 (ICMPv6) is one of the basic IPv6 protocols.
In IPv4, ICMP reports IP packet forwarding information and errors to the source node. ICMP
defines certain messages such as Destination Unreachable, Packet Too Big, Time Exceeded, and
Echo Request or Echo Reply to facilitate fault diagnosis and information management. In
addition to the common functions provided by ICMPv4, ICMPv6 provides mechanisms such as
Neighbor Discovery (ID), stateless address configuration including duplicate address detection,
and Path Maximum Transmission Unit (PMTU) discovery.
The protocol number of ICMPv6, namely, the value of the Next Header field in an IPv6 packet
is 58. Figure 8-9 shows the ICMPv6 packet format.
IPv6 basic
header
Next header = 58
ICMPv6 packet
ICMPv6 packet
ICMPv6 Data
l Type: specifies the message type. Values 0 to 127 indicate the error message type, and
values 128 to 255 indicate the informational message type.
l Code: indicates a specific message type.
l Checksum: indicates the checksum of an ICMPv6 packet.
Address Resolution
In IPv4, a host needs to obtain the link-layer address of the destination host through the ARP
protocol for communication. Similar to IPv4, the IPv6 NDP protocol parses the IP address to
obtain the link-layer address.
ARP packets are encapsulated in Ethernet packets. The Ethernet type value is 0x0806. ARP is
defined as a protocol that runs between Layer 2 and Layer 3. ND is implemented through
ICMPv6 packets. The Ethernet type value is 0x86dd. The Next Header value in the IPv6 header
is 58, indicating that the packets are ICMPv6 packets. NDP packets are encapsulated in ICMPv6
packets. Therefore, NDP is taken as a Layer 3 protocol. Layer 3 address resolution brings the
following advantages:
l Layer 3 address resolution enables Layer 2 devices to use the same address resolution
protocol.
l Layer 3 security mechanisms are used to prevent address resolution attacks.
l Request packets are sent in multicast mode, reducing performance requirements on Layer
2 networks.
Neighbor Solicitation (NS) packets and Neighbor Advertisement (NA) packets are used during
address resolution.
l In an NS packet, the value of the Type field is 135 and the value of the Code field is 0. An
NS packet is similar to the ARP Request packet in IPv4.
l In an NA packet, the value of the Type field is 136 and the value of the Code field is 0. An
NA packet is similar to the ARP Reply packet in IPv4.
Host A needs to parse the link-layer address of Host B before sending packets to Host B.
Therefore, Host A sends an NS message on the network. In the NS message, the source IP address
is the IPv6 address of Host A, and the destination IP address is the solicited-node multicast
address of Host B. The destination IP address to be parsed is the IPv6 address of Host B. This
indicates that Host A wants to know the link-layer address of Host B. The Options field in the
NS message carries the link-layer address of Host A.
After receiving the NS message, Host B replies with an NA Reply message. In the NA reply
message, the source address is the IPv6 address of Host B, and the destination address is the
IPv6 address of Host A (the NS message is sent to Host A in unicast mode using the link-layer
address of Host A). The Options field carries the link-layer address of Host B. This is the whole
address resolution process.
Neighbor Tracking
Communication with neighboring devices will be interrupted because of various reasons such
as hardware fault and hot swapping of interface cards. If the destination address of a neighboring
device becomes invalid, communication cannot be restored. If the path fails, communication
can be restored. Therefore, nodes need to maintain the neighbor table to monitor the status of
each neighboring device. A neighbor state can transit from one to another.
Five neighbor states are defined in RFC2461: Incomplete, Reachable, Stale, Delay, and Probe.
Figure 8-11 shows the transition of neighbor states. The Empty state indicates that the neighbor
table is empty.
The following example describes the neighbor state changes of node A during the first
communication with node B.
1. Node A sends an NS message and generates a cache entry. The neighbor state of node A
is Incomplete.
2. If node B replies with an NA message, the neighbor state of node A changes from
Incomplete to Reachable; otherwise, the neighbor state changes from Incomplete to Empty
after a certain period of time. Node A deletes this entry.
3. After the neighbor reachable time times out, the neighbor state changes from Reachable to
Stale, indicating that whether the neighbor is reachable is unknown.
4. If node A in the Reachable state receives a non-NA Request message from node B, and the
link-layer address of node B carried in the message is different from that learned by node
A, the neighbor state of node A immediately goes to Stale.
5. If node A in the Stale state sends data to node B, the state of node A changes from Stale to
Delay. Node A sends an NS Request message.
6. After a certain period of time, the neighbor state changes from Delay to Probe. During this
time, if node A receives an NA Reply message, the neighbor state of node A changes to
Reachable.
7. Node A in the Probe state sends unicast NS messages at the configured interval for several
times. If node A receives a Reply message, the neighbor state of node A changes from
Probe to Reachable; otherwise, the state changes to Empty. Node A deletes this entry.
IPv6 DAD is similar to IPv4 gratuitous ARP. A node sends an NS message that requests the
tentative address as the destination address to the Solicited-node multicast group. If the node
receives an NA message, the tentative address is being used by another node. This node will not
use this tentative address for communication.
Host A Host B
tentative address: FC00::1 FC00::1
An IPv6 address FC00::1 is assigned to Host A as a tentative IPv6 address. To check the validity
of FC00::1, Host A sends an NS message to the Solicited-node multicast group to which FC00::1
belongs. The NS message contains the requested address FC00::1. Since FC00::1 is not specified,
the source address of the NS message is an unspecified address. After receiving the NS message,
Host B processes the message in the following ways:
l If FC00::1 is one tentative address of Host B, Host B will not use this address as an interface
address and not send the NA message.
l If FC00::1 is being used on Host B, Host B sends an NA message to FF02::1. The NA
message carries IP address FC00::1. In this way, Host A can find that the tentative address
is duplicated after receiving the message. The tentative address then does not take effect
on Host A and is marked as duplicated.
Router Discovery
Router discovery is used to locate a neighboring device and learn the address prefix and
configuration parameters for address autoconfiguration.
IPv6 supports stateless address autoconfiguration. Hosts obtain IPv6 prefixes and automatically
generate interface IDs. Router Discovery is the basics for IPv6 address autoconfiguration and
is implemented through the following two packets:
RA RS RA
Address Autoconfiguration
IPv4 uses DHCP to automatically configure IP addresses and default gateways. This simplifies
network management. The length of an IPv6 address is increased to 128 bits. Multiple terminal
nodes require the function of automatic configuration. IPv6 allows both stateful and stateless
address autoconfiguration. Stateless autoconfiguration enables hosts to automatically generate
link-local addresses. Based on the prefixes in the RA message, hosts automatically configure
global unicast addresses and obtain other information.
1. A host automatically configures the link-local address based on the interface ID.
2. The host sends an NS message for duplicate address detection.
3. If address conflict occurs, the host stops address autoconfiguration. Then addresses need
to be configured manually.
4. If addresses do not conflict, the link-local address takes effect. The host is connected to the
network and can communicate with the local node.
5. The host sends an RS message or receives RA messages devices periodically send.
6. The host obtains the IPv6 address based on the prefixes carried in the RA message and the
interface ID.
Default Router Priority and Route Information Discovery
If multiple devices exist on the Internet where hosts reside, hosts need to select forwarding
devices based on the destination address of the packet. In such a case, devices advertise default
router priorities and route information, which allows hosts to select the optimal forwarding
device based on the packet destination address.
The fields of default router priority and route information are defined in an RA message. These
two fields enable hosts to select the optimal forwarding device.
After receiving an RA message that contains route information, hosts update their routing tables.
When sending packets to other devices, hosts check the route in the routing table and select the
optimal route.
When receiving an RA message that carries default router priorities, hosts update their default
router lists. When sending packets to other devices, hosts check the router list to select the device
with the highest priority to forward packets. If the selected router does not work, hosts select
the device in descending order of priorities.
Redirection
To choose an optimal gateway device, the gateway device sends a Redirection message to notify
the sender that packets can be sent from another gateway device. A Redirection message is
contained in an ICMPv6 message. A Redirection message has the value of 137 in the Type field
and carries a better next hop address and destination address of packets that need to be redirected.
IPv6 packet
Host A needs to communicate with Host B. By default, packets sent from Host A to Host B are
sent through Router A. After receiving packets from Host A, Router A finds that sending packets
to Router B is much better. Router A sends a Redirection message to Host A to notify Host A
that Router B is a better next hop address. The destination address of Host B is carried in the
Redirection message. After receiving the Redirection message, Host A adds a host route to the
default routing table. Packets sent to Host B will be directly sent to Router B.
l After route calculation, the outbound interface of the next hop is the interface that receives
the packets.
l The device finds that a better next hop IP address of the packet is on the same network
segment as the source IP address of the packet.
l After checking the source address of the packet, the device finds a neighboring device in
the neighbor entries that uses this address as the global unicast address or the link-local
unicast address.
The PMTU protocol is implemented through ICMPv6 Packet Too Big messages. A source node
first uses the MTU of its outbound interface as the PMTU and sends a probe packet. If a smaller
PMTU exists on the transmission path, the transit device sends a Packet Too Big message to the
source node. The Packet Too Big message contains the MTU value of the outbound interface
on the transit device. After receiving the message, the source node changes the PMTU value to
the received MTU value and sends packets based on the new MTU. This process is repeated
until packets are sent to the destination address. Then the source node obtains the PMTU of the
destination address.
Packet received
Path MTU=1300
Packets are transmitted through four links. The MTU values of the four links are 1500, 1500,
1400, and 1300 bytes respectively. Before sending a packet, the source node fragments the packet
based on PMTU 1500. When the packet is sent to the outbound interface with MTU 1400, the
device returns a Packet Too Big message that carries MTU 1400. After receiving the message,
the source node fragments the packet based on MTU 1400 and sends the fragmented packet
again. When the packet is sent to the outbound interface with MTU 1300, the device returns
another Packet Too Big message that carries MTU 1300. The source node receives the message
and fragments the packet based on MTU 1300. In this way, the source node sends the packet to
the destination address and discovers the PMTU of the transmission path.
NOTE
IPv6 allows a minimum MTU of 1280 bytes. Therefore, the PMTU must be greater than 1280 bytes. PMTU
of 1500 bytes is recommended.
Default Configuration
Parameter Default Configuration
Interval for sending RA packets Maximum interval: 600s; minimum interval: 200s
Pre-configuration Tasks
Before configuring IPv6 addresses for interfaces, complete the following task:
l Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
Context
A global unicast address is similar to an IPv4 public address and provided for the Internet Service
Provider (ISP). A global unicast address can be generated using either of the following methods:
l Generated in the EUI-64 format: An IPv6 global unicast address in the EUI-64 format
contains a manually configured prefix and an automatically generated interface identifier.
l Configured manually: An IPv6 global unicast address can be manually configured.
NOTE
l An interface can be configured with multiple global unicast addresses with different network prefixes.
l Manually configured global unicast addresses have higher priority than automatically generated ones.
Manually configured addresses can overwrite automatically generated ones with the same prefix. The
overwritten automatically generated addresses do not take effect even if manually configured addresses
are deleted. A device needs to generate a new global unicast address based on the IP prefix carried in
the received RA packet.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ipv6
Step 3 Run:
interface interface-type interface-number
Step 4 Run:
ipv6 enable
Step 5 You can run either of the following commands to configure an IPv6 global unicast address for
an interface:
l Run:
ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }
----End
Context
Link-local addresses are used in neighbor discovery or stateless autoconfiguration. An IPv6 link-
local address can be obtained using either of the following methods:
l Each interface can be configured with only one link-local address. To prevent link-local address
conflict, automatically generated link-local addresses are recommended. After an interface is
configured with an IPv6 global unicast address, it automatically generates a link-local address.
l Manually configured link-local addresses have higher priority than automatically generated ones.
Manually configured addresses can overwrite automatically generated ones, but automatically
generated addresses cannot overwrite manually configured ones. If manually configured addresses are
deleted, the overwritten automatically generated ones take effect.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ipv6
Step 3 Run:
interface interface-type interface-number
Step 4 Run:
ipv6 enable
Step 5 You can run either of the following commands to configure a link-local address for an interface:
l Run:
ipv6 address ipv6-address link-local
----End
Context
IPv6 anycast addresses are allocated from the unicast address space. An anycast address
identifies a group of interfaces, which usually belong to different nodes. When using anycast
addresses, pay attention to the following points:
Procedure
Step 1 Run:
system-view
Step 2 ipv6
Step 3 Run:
interface interface-type interface-number
Step 4 Run:
ipv6 enable
Step 5 Run:
ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } anycast
----End
Context
If a large number of ICMPv6 error packets are sent on the network in a short period, network
congestion may occur. To prevent network congestion, you can limit the maximum number of
ICMPv6 error packets sent in a specified period using the token bucket algorithm.
You can set the bucket size and interval for placing tokens into the bucket. The bucket size
indicates the maximum number of tokens that a bucket can hold. One token represents an
ICMPv6 error packet. When an ICMPv6 error packet is sent, one token is taken out of the token
bucket. When there is no token, ICMPv6 error packets cannot be sent until new tokens are placed
into the token bucket after the interval.
If transmission of too many ICMPv6 error packets causes network congestion or the network is
attacked by forged ICMPv6 error packets, you can disable the system from ICMPv6 error
packets, Host Unreachable packets, and Port Unreachable packets.
Pre-configuration Tasks
Before setting rate limit for sending ICMPv6 error packets, complete the following task:
Procedure
l Control ICMPv6 error messages in the system view.
1. Run:
system-view
By default, a token bucket can hold a maximum of 10 tokens and the interval for
placing tokens into the bucket is 100 ms.
4. Run:
ipv6 icmp too-big-rate-limit
By default, the device is disabled from rejecting jumbo ICMPv6 error messages.
5. Run:
undo ipv6 icmp { icmpv6-type icmpv6-code | icmpv6-name | all } receive
5. Run:
undo ipv6 icmp hop-limit-exceeded send
----End
Pre-configuration Tasks
Before configuring IPv6 ND, complete the following task:
Context
To communicate with a destination host, a host needs to obtain the link-layer address of the
destination host. The link-layer address of a neighbor node can be obtained using the neighbor
discovery mechanism or by manually configuring static neighbor entries. A device identifies a
static neighbor entry based on the IPv6 address of this neighbor and number of the Layer 3
interface connected to this neighbor. To filter invalid packets, you can create static neighbor
entries, binding the destination IPv6 addresses of these packets to nonexistent MAC addresses.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run one of the following commands based on the interface type:
l Run:
ipv6 neighbor ipv6-address mac-address
----End
Context
IPv6 NDP provides the following functions: address resolution, neighbor unreachability
detection, DAD, router/prefix discovery, address autoconfiguration, and redirection.
NOTE
After the IPv6 function is enabled on the industrial switch router, the industrial switch router automatically
implements address resolution, DAD, and redirection. Neighbor unreachability detection, router/prefix
discovery, and address autoconfiguration need to be manually configured. You can also configure the
industrial switch router to send RA packets to enable router/prefix discovery and address autoconfiguration,
and enable the automatic detection of ND entries to check whether neighbors are reachable.
After the automatic detection of ND entries is enabled on the industrial switch router, the
industrial switch router can send NS packets to check whether neighbors are reachable before
aging ND entries. If neighbors are reachable, the industrial switch router updates ND entries;
otherwise, the industrial switch router ages ND entries.
You can enable the industrial switch router to send RA packets. After receiving the RA packets,
network nodes perform address autoconfiguration and router/prefix discovery based on the
prefix and other configuration information in the RA packets.
After the preceding configurations are complete, NDP functions work properly. You can also
adjust ND parameters based on service requirements.
Procedure
Step 1 You can run the following commands to enable NDP functions to work properly.
1. Run:
system-view
The hop limit for IPv6 unicast packets initially sent by a device is set.
By default, the IPv6 unicast packets initially sent by a device can travel 64 hops.
l In the system view, run:
ipv6 nd stale-timeout timeout-value
By default, the prefix in RA packets is the network prefix of the link where the interface
sending RA packets resides.
The prefix configuring using the ipv6 nd ra prefix command takes precedence over the
default prefix generated based on the interface IPv6 address. An RA packet can carry a
maximum of 10 prefixes. If exactly 10 prefixes have been manually configured, the default
prefix will not be carried.
l Run:
ipv6 nd autoconfig managed-address-flag
The managed address configuration flag (M flag) for stateful autoconfiguration in RA packets
is set.
By default, the M flag in an RA packet is not set.
l Run:
ipv6 nd autoconfig other-flag
The other configuration flag (O flag) for stateful autoconfiguration in RA packets is set.
By default, the O flag in an RA packet is not set.
l Run:
ipv6 nd nud reachable-time value
The number of times NS packets are sent when the system performs Duplicate Address
Detection is set.
By default, the number of times NS packets are sent when the system performs DAD is 1.
----End
Procedure
l Run the display ipv6 interface [ interface-type interface-number | brief ] command to
check IPv6 information on an interface.
l Run the display ipv6 neighbors [ ipv6-address | [ vid vid ] interface-type interface-
number | vpn-instance vpn-instance-name ] command to check information about neighbor
entries.
Pre-configuration Tasks
Before configuring PMTU, complete the following tasks:
l 8.4.1 Configuring IPv6 Addresses for Interfaces
Context
Generally, the PMTU is dynamically negotiated according to the IPv6 MTU value of an
interface. In special situations, to protect devices on the network and avoid attacks from large-
sized packets, you can manually configure the PMTU to a specified destination node to control
the maximum length of packets forwarded from the device to the destination node.
NOTE
When the PMTU from the device to a specified destination node is set, the IPv6 MTU values for interfaces on
all intermediate devices cannot be smaller than the configured PMTU value. Otherwise, packets are discarded.
Procedure
Step 1 Run:
system-view
l After the MTU value is changed, run the shutdown and undo shutdown or restart (interface
view) commands to restart the interface to make the changed MTU take effect.
3. Run:
quit
Step 3 Run:
ipv6 pathmtu ipv6-address [ vpn-instance vpn-instance-name ] [ path-mtu ]
If the parameter path-mtu is not specified, the PMTU for a specified IPv6 address is 1500 bytes.
----End
Context
When the device functions as the source node and sends packets to the destination node, the
device dynamically negotiates the PMTU with the destination node according to the IPv6 MTU
values of interfaces and fragments packets based on the PMTU. After the PMTU ages out, the
dynamic PMTU is deleted. The source node dynamically renegotiates the PMTU with the
destination node.
NOTE
When both static PMTU and dynamic PMTU are configured, only static PMTU takes effect. Static PMTU
entries never age.
The interface MTU, IPv6 interface MTU, and PMTU are valid only for the packets generated on the device
but not for the packets forwarded by the host.
Procedure
Step 1 Run:
system-view
l After the MTU value is changed, run the shutdown and undo shutdown or restart (interface
view) commands to restart the interface to make the changed MTU take effect.
3. Run:
quit
----End
Procedure
l Run the display ipv6 pathmtu [ vpn-instance vpn-instance-name ]{ ipv6-address | all |
dynamic | static } command to check all PMTU entries.
l Run the display ipv6 interface [ interface-type interface-number | brief ] command to
check the IPv6 information on the interface.
Pre-configuration Tasks
Before configuring TCP6, complete the following task:
l Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
Context
You need to set the following TCP6 timers:
l SYN-Wait timer: When SYN packets are sent, the SYN-Wait timer is started. If no response
packet is received after the SYN-Wait timer expires, the TCP6 connection is terminated.
l FIN-Wait timer: When the TCP connection status changes from FIN_WAIT_1 to
FIN_WAIT_2, the FIN-Wait timer is started. If no response packet is received after the
FIN-Wait timer expires, the TCP6 connection is terminated.
Procedure
Step 1 Run:
system-view
Step 3 Run:
tcp ipv6 timer fin-timeout interval
----End
Context
You can set the TCP6 sliding window size to improve network performance. The sliding window
size indicates the receive or send buffer size of a TCP6 socket.
Procedure
Step 1 Run:
system-view
Step 2 Run:
tcp ipv6 window window-size
The receive and send buffer sizes of a TCP6 socket are set.
The receive or send buffer size of a TCP6 socket ranges from 1 KB to 32 KB. By default, the
receive or send buffer size of a TCP6 socket is 8 KB.
----End
Context
Setting a minimum Maximum Segment Size (MSS) value for a TCP6 connection defines the
smallest TCP6 packet size, preventing Denial of Service (DoS) attacks caused by packets with
small MSS values.
Setting a maximum MSS value for a TCP6 connection defines the largest TCP6 packet size,
allowing TCP6 packets to be successfully forwarded by intermediate devices when no Path MTU
is available.
Procedure
Step 1 Run:
system-view
Step 2 Run:
By default, the minimum MSS value for a TCP6 connection is 216 bytes.
Step 3 Run:
tcp ipv6 max-mss mss-value
By default, the maximum MSS value is not configured for TCP6 connections.
NOTE
The maximum MSS value configured using the tcp ipv6 max-mss command must be greater than the
minimum MSS value configured using the tcp ipv6 min-mss command.
----End
Procedure
l Run the display tcp ipv6 status [ [ task-id task-id ] [ socket-id socket-id ] | [ local-ip ipv6-
address ] [ local-port local-port-number ] [ remote-ip ipv6-address ] [ remote-port
remote-port-number ] ] command to check the status of all IPv6 TCP connections.
l Run the display tcp ipv6 statistics command to check TCP6 traffic statistics.
l Run the display ipv6 [ ha ] socket [ socketype socket-type | task-id task-id socket-id
socket-id ] command to check information about a specified socket.
----End
Context
NOTICE
IPv6 statistics cannot be restored after being cleared. Therefore, exercise caution before clearing
IPv6 statistics.
Procedure
l Run the reset ipv6 statistics command in the user view to clear IPv6 traffic statistics.
l Run the reset tcp ipv6 statistics command in the user view to clear TCP6 statistics.
l Run the reset udp ipv6 statistics command in the user view to clear UDP6 statistics.
l Run the reset ipv6 pathmtu [ vpn-instance vpn-instance-name ] { all | dynamic |
static } command in the user view to clear PMTU entries.
l Run the reset ipv6 neighbors { all | dynamic | static | vid vlan-id [ interface-type interface-
number] | interface-type interface-number [ dynamic | static ] } command in the user view
to clear IPv6 neighbor entries.
----End
Procedure
l Run the display ipv6 interface [ interface-type interface-number | brief ] command to
check IPv6 information on an interface.
l Run the display ipv6 statistics [ interface interface-type interface-number ] command to
check IPv6 traffic statistics.
l Run the display icmpv6 statistics [ interface interface-type interface-number ] command
to check ICMPv6 traffic statistics.
l Run the display tcp ipv6 statistics command to check IPv6 TCP traffic statistics.
l Run the display ipv6 neighbors [ ipv6-address | [ vid vid ] interface-type interface-
number | vpn-instance vpn-instance-name ] command to check neighbor entries.
l Run the display ipv6 pathmtu [ vpn-instance vpn-instance-name ] { ipv6-address | all |
dynamic | static } command to check all PMTU entries.
----End
GE1/0/0 GE1/0/0
fc01::1/64
RouterA RouterB
Configuration Roadmap
The configuration roadmap is as follows:
1. Enable the IPv6 forwarding function on RouterA and configure an IPv6 address for
RouterA so that RouterA can forward IPv6 packets.
2. Configure RouterA to send RA packets and allow GE1/0/0 of RouterB to automatically
configure an IPv6 address based on the route prefix carried in the received RA packets.
Procedure
Step 1 Configure RouterA.
If the preceding configurations are successful, you can view the configured global unicast
addresses. The interface status and the IPv6 protocol are Up. You can also check the neighbor
of the interfaces.
----End
Configuration File
l Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
interface GigabitEthernet1/0/0
undo portswitch
ipv6 enable
ipv6 address fc01::1/64
undo ipv6 nd ra halt
#
return
8.7 References
This section lists references of IPv6.
RFC4193 Unique Local IPv6 Unicast Addresses Currently, the part relating
to DNS cannot be
implemented.
9 DHCPv6 Configuration
This section describes how to configure the DHCPv6 function. Currently, the industrial switch
router can function as the DHCPv6 server, DHCPv6 PD server, DHCPv6 relay, DHCPv6 client,
and DHCPv6 PD client.
9.2 Principles
This section describes the implementation of DHCPv6.
9.3 Applications
This section describes the applicable scenario of DHCPv6.
9.8 References
This section lists references of DHCPv6.
Definition
Dynamic Host Configuration Protocol for IPv6 (DHCPv6) is designed to assign IPv6 addresses,
prefixes, and other network configuration parameters to hosts.
Purpose
The IPv6 protocol provides huge address space formed by 128-bit IPv6 addresses that require
proper and efficient assignment and management policies. IPv6 stateless address
autoconfiguration defined in RFC2462 is widely used. Hosts configured with the stateless
address autoconfiguration function automatically configure IPv6 addresses based on prefixes
carried in Route Advertisement (RA) packets sent from a neighboring device.
When stateless address autoconfiguration is used, devices do not record IPv6 addresses of hosts.
Therefore, stateless address autoconfiguration has poor manageability. In addition, hosts
configured with stateless address autoconfiguration cannot obtain other configuration
parameters such as the DNS server address. Internet service providers (ISPs) do not provide
instructions for automatic allocation of IPv6 prefixes for devices. Therefore, users need to
manually configure IPv6 addresses for devices during IPv6 network deployment.
DHCPv6 solves this problem. DHCPv6 is a stateful protocol for configuring IPv6 addresses
automatically.
Compared with manual address configuration and IPv6 stateless address autoconfiguration that
uses network prefixes in RA packets, DHCPv6 has the following advantages:
l Controls IPv6 address assignment better. A DHCPv6 device can record addresses assigned
to hosts and assign requested addresses. This function facilitates network management.
l Assigns IPv6 address prefixes to network devices. This function facilitates automatic
configuration and hierarchical network management.
l Provides other network configuration parameters such as the DNS server address.
9.2 Principles
This section describes the implementation of DHCPv6.
DHCPv6 runs between a client and a server. Similar to DHCP for IPv4, DHCPv6 clients and
DHCPv6 servers exchange DHCPv6 packets using the User Datagram Protocol (UDP). In IPv6,
packets cannot be broadcast; therefore, DHCPv6 uses multicast packets. In this case, DHCPv6
clients do not need to be configured with IPv6 addresses of DHCPv6 servers.
DHCPv6 Architecture
Figure 9-1 shows the DHCPv6 architecture.
IPv6
Network
DHCPv6 Relay
DHCPv6 Clients
DHCPv6 Server
l DHCPv6 client
A DHCPv6 client applies to a DHCPv6 server for IPv6 addresses, prefixes, and network
configuration parameters to complete its address configuration.
l DHCPv6 relay
A DHCPv6 relay agent relays DHCPv6 packets between a DHCPv6 client and a DHCPv6
server to help the DHCPv6 client complete its address configuration. Generally, a DHCPv6
client communicates with a DHCPv6 server through the link-local multicast address to
obtain IPv6 addresses, prefixes, and other network configuration parameters. If a DHCPv6
server and a DHCPv6 client are on different links, a DHCPv6 relay agent is required to
forward DHCPv6 packets. In this case, you do not need to deploy a DHCPv6 server on
each link, which saves costs and facilitates centralized management.
A DHCPv6 relay agent is optional. If a DHCPv6 client and a DHCPv6 server are on the
same link or a DHCPv6 client communicates with a DHCPv6 server in unicast mode to
complete address allocation or information configuration, you do not need to deploy a
DHCPv6 relay agent. A DHCPv6 relay agent is required only when a DHCPv6 client and
a DHCPv6 server are located on different links or a DHCPv6 client cannot communicate
with a DHCPv6 server in unicast mode.
l DHCPv6 server
A DHCPv6 server processes requests of address allocation, address lease extension, and
address release from a DHCPv6 client or a DHCPv6 relay agent, and assigns IPv6 addresses
and other network configuration parameters to the DHCPv6 client.
Server Identifier option have the same format and are distinguished by the option-code
field value.
l Identity association (IA)
– An IA enables a DHCPv6 server and a DHCPv6 client to identify, group, and manage
IPv6 addresses. Each IA consists of an identity association identifier (IAID) and
associated configuration information.
– A DHCPv6 client must associate at least one IA with each of its network interfaces for
which the DHCPv6 client requests IPv6 addresses from a DHCP server. The DHCPv6
client uses IAs associated with network interfaces to obtain configuration information
from a DHCPv6 server. Each IA must be associated with at least one interface.
– The IAID identifies an IA, and IAIDs on the same DHCPv6 client must be unique. The
IAID is not lost or changed because of factors such as DHCPv6 client reboot.
– The configuration information in an IA consists of one or more IPv6 addresses along
with the lifetimes T1 and T2. Each address in an IA has a preferred lifetime and a valid
lifetime.
– An interface must be associated with at least one IA; an IA can contain information
about one or more addresses.
0 7 31
msg-type transaction-ID
options (variable)
msg-type 1 byte Indicates the packet type. The value ranges from 1 to 13. For details,
see the DHCPv6 Packet Type.
transaction- 3 bytes Identifies packet transaction between DHCPv6 clients and servers.
ID For example, a DHCPv6 client initiates a Solicit/Advertise
transaction or a Request/Reply transaction. Their transaction IDs are
different. Transaction IDs have the following characteristics:
l The transaction ID is randomly generated by a DHCPv6 client.
l Transaction IDs of request and reply packets must be the same.
l The transaction ID of a packet initiated by a DHCPv6 server is
0.
Options Variabl Indicates the option field in a DHCPv6 packet. The option field
e contains configurations that the DHCPv6 server assigns to IPv6
hosts, such as the IPv6 address of the DNS server.
A DHCPv6 server assigns addresses and prefixes to a DHCPv6 client in the following ways:
Four-message exchange applies to a network where multiple DHCPv6 servers are available. A
DHCPv6 client first multicasts a Solicit packet to locate DHCPv6 servers that can provide
DHCPv6 services. After receiving Advertise packets from multiple DHCPv6 servers, the
DHCPv6 client selects one of the DHCPv6 servers according to priorities of DHCPv6 servers.
Then the DHCPv6 client and the selected DHCPv6 server complete address application and
allocation by exchanging Request and Reply packets.
If a DHCPv6 server does not have two-message exchange enabled, the DHCPv6 server allocates
addresses and configuration parameters through four-message exchange, regardless of whether
the Solicit packet contains the Rapid Commit option.
Figure 9-3 shows the process of address allocation using four-message exchange.
DHCPv6 DHCPv6
Client Server
(1)Solicit
(2)Advertise
(3)Request
(4)Reply
1. A DHCPv6 client sends a Solicit packet to request a DHCPv6 server to allocate IPv6
addresses and network configuration parameters.
2. If the DHCPv6 server does not support fast address allocation, the DHCPv6 server returns
an Advertise packet containing the allocated addresses and network configuration
parameters regardless of whether the Solicit packet contains the Rapid Commit option.
3. If receiving Advertise packets from multiple DHCPv6 servers, the DHCPv6 client selects
the DHCPv6 server with the highest priority and sends Request multicast packets to all
DHCPv6 servers. The Request multicast packets carry the DUID of the selected DHCPv6
server.
4. The DHCPv6 server responds with a Reply packet that contains the addresses and network
configuration parameters allocated to the client.
Two-message exchange applies to a network where only one DHCPv6 server is available. A
DHCPv6 client multicasts a Solicit packet to locate the DHCPv6 server that can allocate
addresses and configuration parameters. After receiving the Solicit packet, the DHCPv6 server
responds with a Reply packet carrying addresses and configuration parameters allocated to the
DHCPv6 client.
This packet exchange improves address allocation efficiency. On the network where multiple
DHCPv6 servers are available, multiple DHCPv6 servers can allocate addresses to DHCPv6
clients and respond with Reply packets. The DHCPv6 clients, however, use the addresses and
configuration parameters allocated by one DHCPv6 server. To prevent the preceding situation,
the administrator can configure only one DHCPv6 server to support two-message exchange.
NOTE
l If a DHCPv6 server is configured with two-message exchange and the Solicit packet from a DHCPv6
client contains the Rapid Commit option, the DHCPv6 server allocates IPv6 addresses and
configuration parameters in two-message exchange mode.
l If a DHCPv6 server does not support fast address allocation, the DHCPv6 server allocates IPv6
addresses and other network configuration parameters to clients using four-message exchange.
Figure 9-4 shows the process of address allocation using two-message exchange.
DHCPv6 DHCPv6
Client Server
(2)Reply
1. A DHCPv6 client sends a Solicit packet carrying the Rapid Commit option, indicating that
the DHCPv6 client requires fast address allocation and network configuration parameters
from a DHCPv6 server.
2. DHCPv6 server receives the Solicit message, it will processed as follows:
l If the DHCPv6 server supports fast address allocation, it returns a Reply packet and
allocates IPv6 addresses and other network configuration parameters to the DHCPv6
client.
l If the DHCPv6 server does not support fast address allocation, the DHCPv6 server uses
four-message exchange to allocate IPv6 addresses, prefixes, and other network
configuration parameters.
Information-request:
includes an Option Request option
Reply:
includes the requested options
1. A DHCPv6 client multicasts an Information-Request packet with the Option Request option
to DHCPv6 servers. The Option Request option specifies the configuration parameters that
the DHCPv6 client needs to obtain from a DHCPv6 server.
2. After receiving the Information-Request packet, the DHCPv6 server sends a Reply packet
to the client in unicast mode. The Reply packet carries the allocated network configuration
parameters. The DHCPv6 client performs stateless autoconfiguration based on parameters
carried in the Reply packet.
The DHCPv6 PD mechanism allows a downstream device to request IPv6 prefixes from the
upstream device and an upstream device to assign appropriate prefixes for the downstream
device. In this way, you do not need to configure IPv6 prefixes for user-side links on the
downstream device. The downstream device divides the obtained prefix (the length of the
obtained prefix is smaller than 64 bits) into 64-bit prefix of subnet segments and sends a Route
Advertisement (RA) packet on the link that IPv6 hosts directly connect to. This enables hosts
to automatically configure addresses, completing IPv6 network deployment.
Router A Router B
DHCPv6 PD Client
DHCPv6 PD Server
1. A DHCPv6 PD client sends a Solicit packet, requesting an IPv6 address prefix from a
DHCPv6 PD server.
2. If the DHCPv6 PD server does not support fast address allocation, the DHCPv6 PD server
returns an Advertise packet containing the allocated address prefixes regardless of whether
the Solicit packet contains the Rapid Commit option.
3. If receiving Advertise packets from multiple DHCPv6 PD servers, the DHCPv6 PD client
selects the DHCPv6 PD server with the highest priority and sends a Request packet to this
DHCPv6 PD server to request address prefixes.
4. The DHCPv6 PD server responds with a Reply packet to assign an IPv6 address prefix to
the DHCPv6 PD client.
DHCPv6 PD also supports two-message exchange using packets carrying the Rapid Commit
option. For details, see DHCPv6 Two-Message Exchange
(2)Relay-forward
(3)Relay-reply
1. A DHCPv6 client sends DHCPv6 Request packets with the destination multicast address
FF02::1:2 to all DHCPv6 servers and DHCPv6 relay agents.
2. A DHCPv6 relay agent processes packets in the following two ways:
l If a DHCPv6 relay agent and a DHCPv6 client are located on the same link, that is, the
DHCPv6 relay agent is the first-hop relay agent of the DHCPv6 client, the DHCPv6
relay agent is the IPv6 gateway of the DHCPv6 client. After receiving a packet from
the DHCPv6 client, the DHCPv6 relay agent encapsulates the packet in the Relay
Message option of a Relay-Forward packet. Then the DHCPv6 relay agent sends the
Relay-forward packet to a DHCPv6 server or the next hop relay agent.
l If the DHCPv6 relay agent and DHCPv6 client are on different links, the DHCPv6 relay
agent receives Relay-Forward packets sent from other relay agents. The DHCPv6 relay
agent constructs a new Relay-Forward packet and sends the packet to the DHCPv6
server or the next hop relay agent.
3. The DHCPv6 server parses the request of the DHCPv6 client in the Relay-Forward packet
and selects IPv6 addresses and other network configuration parameters to construct a reply
packet. Then the DHCPv6 server encapsulates the reply packet in the Relay Message option
in a Relay-Reply packet and sends the Relay-reply packet to the DHCPv6 relay agent.
4. The DHCPv6 relay agent parses the reply packet of the DHCPv6 server in the Relay-Reply
packet and forwards the reply packet to the DHCPv6 client. If the DHCPv6 client receives
reply packets from multiple DHCPv6 servers, the DHCPv6 client selects the DHCPv6
server with the highest priority, and obtains the IPv6 address and other network
configuration parameters from the DHCPv6 server.
To extend the valid lifetime and preferred lifetime for the addresses associated with an IA, a
DHCPv6 client sends a Renew packet to the DHCPv6 server at T1. The IA option in the Renew
packet carries the addresses whose leases need to be extended. If the DHCPv6 client does not
receive a response packet, it sends a Rebind packet at T2 to the DHCPv6 server to continue to
extend the address lease.
Figure 9-8 shows the process of updating the address lease at T1.
DHCPv6 DHCPv6
Client Server
(1)Renew
T1
(2)Reply
1. A DHCPv6 client sends a Renew packet to request to update the address lease at T1 (the
recommended value of T1 is half the preferred lifetime).
2. A DHCPv6 server responds with a Reply packet.
l If the DHCPv6 client can continue to use the address, the DHCPv6 server responds with
a Reply packet indicating that the address lease is extended successfully. In addition,
the DHCPv6 server informs the DHCPv6 client that the address lease is updated
successfully.
l If the DHCPv6 client cannot use the address, the DHCPv6 server responds with a Reply
packet indicating that address lease extension fails. In addition, the DHCPv6 server
informs the DHCPv6 client that the DHCPv6 client cannot obtain a new address lease.
Figure 9-9 shows the process of updating the address lease at T2.
DHCPv6 DHCPv6
Client Server
(1)Renew
T1
(2)Rebind
T2
(3)Reply
1. A DHCPv6 client sends a Renew packet to request to update the address lease at T1, but
does not receive a response packet from a DHCPv6 server.
2. The DHCPv6 client multicasts a Rebind packet to all the DHCPv6 servers to request them
to update the address lease at T2 (the recommended value of T2 is 0.8 times the preferred
lifetime).
3. A DHCPv6 server responds with a Reply packet.
l If the DHCPv6 client can continue to use the address, the DHCPv6 server responds with
a Reply packet indicating that the address lease is extended successfully. In addition,
the DHCPv6 server informs the DHCPv6 client that the address or prefix lease is
updated successfully.
l If the DHCPv6 client cannot use the address, the DHCPv6 server responds with a Reply
packet indicating that address lease extension fails. In addition, the DHCPv6 server
informs the DHCPv6 client that the DHCPv6 client cannot obtain a new address lease.
NOTE
If the DHCPv6 client does not receive a response packet from the DHCPv6 server, the DHCPv6
client stops using this address after the valid lifetime is reached.
IP Address Reservation
The DHCPv6 server supports reserved IPv6 addresses that cannot be dynamically allocated. For
example, an IPv6 address can be reserved for a DNS server.
9.3 Applications
This section describes the applicable scenario of DHCPv6.
The device functions as the DHCPv6 server to assign IPv6 addresses to clients. The DHCPv6
client applies to the DHCPv6 server for configurations including an IPv6 address and DNS server
address. The DHCPv6 server replies with related configurations according to policies.
The DHCPv6 server assigns a complete IPv6 address to a host and provides other configuration
parameters such as the DNS server address. The DHCPv6 server also provides stateless DHCPv6
services. That is, the DHCPv6 server does not assign IPv6 addresses but provides hosts with
configuration parameters such as the DNS server address and domain name. Hosts automatically
configure IPv6 addresses based on RA messages. This overcomes the limitations of IPv6
stateless address autoconfiguration.
RouterB RouterA
The device functions as the DHCPv6 PD server to assign IPv6 address prefixes to DHCPv6 PD
clients.
The DHCPv6 PD mechanism allows RouterB to function as a DHCPv6 PD client to request
IPv6 prefixes from the DHCPv6 PD server and allows the DHCPv6 PD server to assign prefixes
to RouterB. In this way, RouterB does not need to assign IPv6 prefixes for user-side links.
RouterB divides the obtained prefix (the length of the obtained prefix is smaller than 64 bits)
into 64-bit prefix of subnet segments and sends an RA message on the link that hosts directly
connect to. The RA message contains 64-bit prefix of subnet segments. This enables hosts to
automatically configure addresses.
Internet
The device functions as a DHCPv6 relay agent, the client can communicate with a DHCPv6
server on another network segment through the DHCPv6 relay agent, and obtain an IPv6 address
and other configuration parameters from the global address pool on the DHCP server. In this
manner, DHCPv6 clients on multiple network segments can share one DHCPv6 server. This
reduces costs and facilitates centralized management.
RouterA
DHCPv6 Client
RouterC
DHCPv6 Server
RouterB
DHCPv6 Client
When the DHCPv6 client function is configured on the device, the device dynamically obtains
IPv6 addresses and other network configuration parameters from the DHCPv6 server. This
operation facilitates user configurations and centralized management.
Router A Router B
GE0/0/1
GE0/0/1
DHCPv6 PD Client
DHCPv6 PD Server
The DHCPv6 PD client function is configured on the device, the device dynamically obtains
IPv6 addresses and other network configuration parameters from the DHCPv6 PD server. This
operation facilitates user configurations and centralized management. The device divides the
obtained IPv6 prefix (the length of the obtained prefix is smaller than 64 bits) into 64-bit prefix
of subnet segments and sends an RA message on the link that hosts directly connect to. The RA
message contains 64-bit prefix of subnet segments. This enables hosts to automatically configure
addresses.
Pre-configuration Tasks
Before configuring the DHCPv6 server, complete the following tasks:
l Ensuring that the link between the DHCPv6 client and the industrial switch router works
properly and the DHCPv6 client can communicate with the industrial switch router
l (Optional) In the scenario where the DHCPv6 relay exists, configuring the route between
the industrial switch router and DHCPv6 relay agent or client
Configuration Process
The configuration tasks are performed in sequence.
Context
The DUID identifies a DHCPv6 device. Each DHCPv6 server or client has a unique DUID.
DHCPv6 servers use DUIDs to identify DHCPv6 clients and DHCPv6 clients use DUIDs to
identify DHCPv6 servers.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 duid { ll | llt }
By default, the device generates a DUID based on the link-layer (LL) address.
----End
Context
To implement the DHCPv6 function, you need to create an IPv6 address pool and configure its
attributes including the IPv6 address range, IPv6 configuration update time, IPv6 addresses not
to be automatically allocated, and IP addresses to be statically bound to clients. IPv6 addresses
can be dynamically assigned or statically bound to clients based on client requirements.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 pool pool-name
An IPv6 address pool is created and the address pool view is displayed.
Step 3 Run the commands in the IPv6 address pool view to configure the network prefix.
When functioning as a DHCPv6 server, the device supports the DHCPv6 stateful mode and
DHCPv6 stateless mode to assign network parameters to clients. In DHCPv6 stateful mode, the
DHCPv6 server automatically provides IPv6 addresses, prefixes, and other network
configuration parameters, such as DNS, NIS, and SNTP server addresses. In DHCPv6 stateless
mode, the DHCPv6 server does not provide IPv6 addresses but provides other configuration
parameters about the DNS, NIS, and SNTP servers. IPv6 addresses for clients are still generated
based on Route Advertisement (RA) packets.
l When the DHCPv6 service needs to automatically assign network parameters in DHCPv6
stateful mode, run the address prefix ipv6-prefix/ipv6-prefix-length [ life-time { valid-
lifetime | infinite } { preferred-lifetime | infinite } ] command to configure network prefixes
and lifetimes in the IPv6 address pool view.
By default, no network prefix and lifetime are configured in the address pool view.
l When the DHCPv6 service needs to automatically assign network parameters in DHCPv6
stateless mode, run the link-address ipv6-prefix/ipv6-prefix-length command to configure
networks prefixes in the IPv6 address pool view.
By default, no network prefix is configured in the IPv6 address pool view.
The DHCPv6 server determines the clients on network segments to which the server assigns
network configuration parameters from an address pool based on the configured network
prefixes.
By default, no IPv6 address is bound to client DUID in the address pool view.
To statically assign specified IPv6 addresses to some specific clients, specify the mapping
between IPv6 addresses and client DUIDs. When such a client requests an IPv6 address from
the DHCPv6 server, the device functioning as the DHCPv6 server assigns the specified IPv6
address to the client.
Configure the specified IPv6 addresses to be assigned only to the clients with specified DUIDs.
The range of the IPv6 addresses that cannot be automatically assigned is specified in the IPv6
address pool. If only one IPv6 address is not automatically assigned, you can specify only the
value of start-ipv6-address.
By default, all IPv6 addresses in the address pool can be automatically assigned to clients.
The time is configured for updating configuration parameters assigned to clients through
stateless DHCPv6 address autoconfiguration.
By default, the time for updating IPv6 address pool configuration is 86400s (24 hours).
By default, the AC's IPv6 address is not configured in the IPv6 address pool view.
In the AC+Fit AP scenario, the AC needs to establish connections with APs. The device
functioning as a DHCPv6 server can specify the AC's IPv6 address for an AP. The AP then can
connect to the specified AC. If the AC and AP are located in the same network segment, this
step is optional because the AP will send a broadcast packet to automatically discover the AC.
If the AC and AP are located in different network segments, this step is mandatory.
----End
9.5.1.3 (Optional) Configuring Network Server Addresses for the IPv6 Address
Pool
Context
To successfully connect DHCPv6 clients to the Internet, the DHCPv6 server needs to specify
network service configurations such as the DNS server address and SIP server address when
assigning IPv6 addresses to the clients. The DHCPv6 server dynamically allocates carrier-
assigned configurations such as the DNS server address and SIP server address to DHCPv6
clients.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 pool pool-name
An IPv6 address pool is created and the address pool view is displayed.
Step 3 In the IPv6 address pool view, you can run one or multiple following commands to configure
network server addresses.
l Run dns-server ipv6-address command to configure the DNS server address for the DHCPv6
address pool.
l Run dns-domain-name dns-domain-name command to configure the DNS domain name
suffix allocated by the DHCPv6 server to the client.
l Run sip-server ipv6-address command to configure the SIP server IPv6 address for the
DHCPv6 address pool.
l Run sip-domain-name sip-domain-name command to configure the SIP domain name suffix
allocated by the DHCPv6 server to the client.
l Run nis-server ipv6-address command to configure the NIS server IPv6 address for the
DHCPv6 address pool.
l Run nis-domain-name nis-domain-name command to configure the NIS domain name
suffix allocated by the DHCPv6 server to the client.
l Run nisp-server ipv6-address command to configure the NISP server IPv6 address for the
DHCPv6 address pool.
l Run nisp-domain-name nisp-domain-name command to configure the NISP domain name
suffix allocated by the DHCPv6 server to the client.
l Run sntp-server ipv6-address command to configure the SNTP server IPv6 address for the
DHCPv6 address pool.
NOTE
By default, DNS, SIP, NIS, NISP, and SNTP server addresses are not configured for the IPv6 address pool.
----End
Context
DHCPv6 provides various options. To use these options, add them to the attribute list of the
DHCPv6 server manually. If the DHCPv6 server is configured with the vendor-defined Option
field, the client can obtain the configuration information in the Option field of the DHCPv6 reply
packet from the server when a DHCPv6 client applies for an IPv6 address.
Procedure
Step 1 Run:
system-view
An IPv6 address pool is created and the address pool view is displayed.
By default, no IPv6 address pool is created on the device.
Step 3 Run:
vendor-specific vendor-id
Vendor-defined options are configured for the IPv6 address pool and the vendor-defined mode
view is displayed.
By default, no vendor-defined option is configured. A maximum of eight vendor-defined options
can be configured for one IPv6 address pool.
vendor-id indicates the vendor identifier ID, which is assigned by the IANA. The identifier ID
of Huawei is 2011.
Step 4 Run:
suboption suboption-code { address ipv6-address &<1-4> | ascii ascii-string |
hex hex-string }
----End
Context
When the device functions as a DHCPv6 or DHCPv6 PD server, you can configure the DHCPv6
data saving function to prevent data loss caused by device faults. After the DHCPv6 data saving
function is enabled, the device periodically saves DHCPv6 data. The data includes the last data
recording time, address pool name, client DUID, IAID, address and prefix bound to the client
DUID and IAID, conflicted address, and address detection time.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 server database url [ write-delay interval ]
You can specify write-delay to modify the DHCPv6 data saving interval. By default, the device
saves DHCPv6 data every 86400 seconds.
----End
Context
When the device functions as a DHCPv6 server, the DHCPv6 server function can be enabled in
the system view or interface view.
l Enable the DHCPv6 server function in the interface view.
Enable the DHCPv6 server function and specify the IPv6 address pool on the interface that
connects the device to the DHCPv6 clients. After receiving the DHCPv6 request packets
sent by the clients from the interface, the device assigns configuration parameters such as
IPv6 addresses or DNS server addresses to the DHCPv6 clients from the IPv6 address pool
bound to the interface.
– If the DHCPv6 server and DHCPv6 clients are in the same link scope (that is, no
DHCPv6 relay exists), configuration parameters such as IPv6 addresses or DNS server
addresses are assigned to the DHCPv6 clients on the interface of the DHCPv6 server.
– If the DHCPv6 server and DHCPv6 clients are in different link scopes (that is, a
DHCPv6 relay exists), configuration parameters such as IPv6 addresses or DNS server
addresses are assigned to the DHCPv6 clients in one network segment connected to the
DHCPv6 relay.
NOTE
connected to the DHCPv6 relay, because only one IPv6 address pool can be specified on
an interface. If configuration parameters such as IPv6 addresses need to be assigned to the
DHCPv6 clients in multiple network segments through the DHCPv6 relay, enable the
DHCPv6 server function in the system view.
The configuration method of enabling the DHCPv6 server function in the interface view
is affected by the physical interface status. If the interface status is Down, the DHCPv6
server cannot successfully assign network configuration parameters to clients through the
DHCPv6 relay. When the DHCPv6 server function is enabled in the system view and there
are multiple reachable routes between the DHCPv6 relay and DHCPv6 server,
configuration parameters such as IPv6 addresses can be assigned to clients through the
DHCPv6 relay as long as one route between the DHCPv6 relay and DHCPv6 server is
reachable. This improves reliability of the configuration information obtained by the
clients. In addition, no configuration is required on the interface, which reduces the
administrator's maintenance workload.
NOTE
l If the DHCPv6 server function is enabled in the system view, the configuration information takes
effect on all interfaces of the device.
l If the DHCPv6 server function is enabled concurrently in the system view and interface view, the
configuration in the interface view takes precedence over that in the system view.
Procedure
l Enable the DHCPv6 server function in the interface view.
1. Run:
system-view
When functioning as a DHCPv6 server, the device may be configured with multiple
IPv6 address pools. After receiving the DHCPv6 request packets, the DHCPv6 server
chooses the IPv6 address pool based on the following rules:
– If a relay exists, the server chooses the address pool that belongs to the same link
scope with the configured network prefix (using the link-address command) or
IPv6 address prefix (using the address prefix command) based on the first link-
address field that is not 0. The link-address field identifies the link scope of the
DHCPv6 clients.
– If no relay exists, the device that functions as the DHCPv6 server only assigns
configuration parameters to clients in DHCPv6 stateless mode. This indicates that
the DHCPv6 server only assigns configuration parameters excluding IPv6
addresses and including DNS, NIS, and SNTP servers, and the IPv6 addresses for
clients are automatically generated based on the Route Advertisement (RA)
packets. To enable the DHCPv6 server to assign network parameters in DHCPv6
stateful mode, enable the DHCPv6 server function in the interface view.
----End
Follow-up Procedure
For clients (such as PCs) that automatically obtain IPv6 addresses based on IPv6 RA packets by
default, flags in RA messages need to be configured on the client gateways so that the clients
can obtain IPv6 addresses using DHCPv6.
l When the DHCPv6 relay does not exist and the device function as the client gateway:
1. Run:
system-view
9.5.1.7 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm
Function of DHCPv6 Messages Discarded
Context
To prevent clients from sending a large number of messages to attack the device, the device
limits the rate of DHCPv6 messages.
After rate limit of DHCPv6 messages is enabled, the DHCPv6 messages are discarded when the
rate threshold is exceeded. After the alarm function of DHCPv6 messages discarded is enabled,
the device sends alarms when the number of discarded DHCPv6 messages exceeds the threshold.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp enable
DHCP is enabled.
Step 3 Run:
dhcpv6 packet-rate packet-rate
Rate limit of DHCPv6 packets is enabled and the rate threshold is configured.
By default, rate limit of DHCPv6 messages is disabled on the industrial switch router.
Step 4 Run:
dhcpv6 packet-rate drop-alarm enable
Step 5 Run:
dhcpv6 packet-rate drop-alarm threshold threshold
A alarm threshold for the number of discarded DHCPv6 messages when the DHCPv6 message
rate exceeds the rate threshold is set.
By default, the alarm threshold is 100 when the alarm function of DHCPv6 messages discarded
is enabled.
----End
Procedure
l Run the display dhcpv6 duid command to check the DUID of the DHCPv6 device on the
network.
l Run the display dhcpv6 pool pool-name [ allocated { address | prefix } | binding
[ duid ] | conflict address | ipv6-address | ipv6-prefix/prefix-length ] command to check
IPv6 address pool configurations.
l Run the display dhcpv6 server [ database | [ statistics ] [ interface interface-type
interface-number ] ] command to check information about the DHCPv6 server function.
----End
Pre-configuration Tasks
Before configuring the DHCPv6 PD server, complete the following tasks:
l Ensuring that the link between the DHCPv6 client and the industrial switch router works
properly and the DHCPv6 client can communicate with the industrial switch router
l (Optional) In the scenario where the DHCPv6 relay exists, configuring the route between
the industrial switch router and DHCPv6 relay agent or client
Configuration Logic
The configuration tasks are performed in sequence.
Context
The DUID identifies a DHCPv6 device. Each DHCPv6 server or client has a unique DUID.
DHCPv6 servers use DUIDs to identify DHCPv6 clients and DHCPv6 clients use DUIDs to
identify DHCPv6 servers.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 duid { ll | llt }
By default, the device generates a DUID based on the link-layer (LL) address.
----End
Context
IPv6 PD address pool refers to an IPv6 address pool used by a DHCPv6 server to assign IPv6
address prefixes to DHCPv6 clients.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 pool pool-name
An IPv6 PD address pool is created and the address pool view is displayed.
Step 3 Run:
prefix-delegation ipv6-prefix/ipv6-prefix-length assign-prefix-length [ life-time
{ valid-lifetime | infinite } { preferred-lifetime | infinite }]
By default, no IPv6 address prefix agent is bound to the IPv6 address pool.
To enable the DHCPv6 PD server function in the system view, you must perform this step to
determine the network segment where the clients need to be assigned IPv6 addresses prefixes
by the PD address pool.
An IPv6 address prefix agent is statically bound to the DHCPv6 PD client in the address pool
view.
To statically assign specified IPv6 address prefixes to some specific clients, specify the mapping
between IPv6 address prefixes and client DUIDs. When such a client requests an IPv6 address
from the DHCPv6 PD server, the device functioning as the DHCPv6 PD server assigns the
specified IPv6 address to the client.
Configure the specified IPv6 address prefixes to be assigned only to the clients with specified
DUIDs.
----End
9.5.2.3 (Optional) Configuring Network Server Addresses for the IPv6 Address
Pool
Context
To successfully connect DHCPv6 clients to the Internet, the DHCPv6 server needs to specify
network service configurations such as the DNS server address and SIP server address when
assigning IPv6 addresses to the clients. The DHCPv6 server dynamically allocates carrier-
assigned configurations such as the DNS server address and SIP server address to DHCPv6
clients.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 pool pool-name
An IPv6 address pool is created and the address pool view is displayed.
Step 3 In the IPv6 address pool view, you can run one or multiple following commands to configure
network server addresses.
l Run dns-server ipv6-address command to configure the DNS server address for the DHCPv6
address pool.
l Run dns-domain-name dns-domain-name command to configure the DNS domain name
suffix allocated by the DHCPv6 server to the client.
l Run sip-server ipv6-address command to configure the SIP server IPv6 address for the
DHCPv6 address pool.
l Run sip-domain-name sip-domain-name command to configure the SIP domain name suffix
allocated by the DHCPv6 server to the client.
l Run nis-server ipv6-address command to configure the NIS server IPv6 address for the
DHCPv6 address pool.
l Run nis-domain-name nis-domain-name command to configure the NIS domain name
suffix allocated by the DHCPv6 server to the client.
l Run nisp-server ipv6-address command to configure the NISP server IPv6 address for the
DHCPv6 address pool.
l Run nisp-domain-name nisp-domain-name command to configure the NISP domain name
suffix allocated by the DHCPv6 server to the client.
l Run sntp-server ipv6-address command to configure the SNTP server IPv6 address for the
DHCPv6 address pool.
NOTE
By default, DNS, SIP, NIS, NISP, and SNTP server addresses are not configured for the IPv6 address pool.
----End
Context
DHCPv6 provides various options. To use these options, add them to the attribute list of the
DHCPv6 server manually. If the DHCPv6 server is configured with the vendor-defined Option
field, the client can obtain the configuration information in the Option field of the DHCPv6 reply
packet from the server when a DHCPv6 client applies for an IPv6 address.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 pool pool-name
An IPv6 address pool is created and the address pool view is displayed.
Step 3 Run:
vendor-specific vendor-id
Vendor-defined options are configured for the IPv6 address pool and the vendor-defined mode
view is displayed.
vendor-id indicates the vendor identifier ID, which is assigned by the IANA. The identifier ID
of Huawei is 2011.
Step 4 Run:
suboption suboption-code { address ipv6-address &<1-4> | ascii ascii-string |
hex hex-string }
----End
Context
When the device functions as a DHCPv6 or DHCPv6 PD server, you can configure the DHCPv6
data saving function to prevent data loss caused by device faults. After the DHCPv6 data saving
function is enabled, the device periodically saves DHCPv6 data. The data includes the last data
recording time, address pool name, client DUID, IAID, address and prefix bound to the client
DUID and IAID, conflicted address, and address detection time.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 server database url [ write-delay interval ]
You can specify write-delay to modify the DHCPv6 data saving interval. By default, the device
saves DHCPv6 data every 86400 seconds.
----End
Context
When the device functions as a DHCPv6 PD server, the DHCPv6 server function can be enabled
in the system view or interface view.
l Enable the DHCPv6 PD server function in the interface view.
Enable the DHCPv6 PD server function and specify the IPv6 PD address pool on the
interface that connects the device to the DHCPv6 clients. After receiving the DHCPv6
request packets sent by the clients from the interface, the device assigns configuration
parameters such as IPv6 address prefixes or DNS server addresses to the DHCPv6 clients
from the IPv6 address pool bound to the interface.
– If the DHCPv6 PD server and DHCPv6 PD clients are in the same link scope (that is,
no DHCPv6 relay exists), configuration parameters such as IPv6 address prefixes or
DNS server addresses are assigned to the DHCPv6 PD clients on the interface of the
DHCPv6 PD server.
– If the DHCPv6 PD server and DHCPv6 PD clients are in different link scopes (that is,
a DHCPv6 relay exists), configuration parameters such as IPv6 address prefixes or DNS
server addresses are assigned to the DHCPv6 PD clients in one network segment
connected to the DHCPv6 relay.
NOTE
l If the DHCPv6 PD server function is enabled in the system view, the configuration information takes
effect on all interfaces of the device.
l If the DHCPv6 PD server function is enabled concurrently in the system view and interface view, the
configuration in the interface view takes precedence over that in the system view.
Procedure
l Enable the DHCPv6 PD server function in the interface view.
1. Run:
system-view
----End
9.5.2.7 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm
Function of DHCPv6 Messages Discarded
Context
To prevent clients from sending a large number of messages to attack the device, the device
limits the rate of DHCPv6 messages.
After rate limit of DHCPv6 messages is enabled, the DHCPv6 messages are discarded when the
rate threshold is exceeded. After the alarm function of DHCPv6 messages discarded is enabled,
the device sends alarms when the number of discarded DHCPv6 messages exceeds the threshold.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp enable
DHCP is enabled.
Step 3 Run:
dhcpv6 packet-rate packet-rate
Rate limit of DHCPv6 packets is enabled and the rate threshold is configured.
By default, rate limit of DHCPv6 messages is disabled on the industrial switch router.
Step 4 Run:
dhcpv6 packet-rate drop-alarm enable
Step 5 Run:
dhcpv6 packet-rate drop-alarm threshold threshold
A alarm threshold for the number of discarded DHCPv6 messages when the DHCPv6 message
rate exceeds the rate threshold is set.
By default, the alarm threshold is 100 when the alarm function of DHCPv6 messages discarded
is enabled.
----End
Procedure
l Run the display dhcpv6 duid command to check the DUID of the DHCPv6 device on the
network.
l Run the display dhcpv6 pool pool-name [ allocated { address | prefix } | binding
[ duid ] | conflict address | ipv6-address | ipv6-prefix/prefix-length ] command to check
IPv6 address pool configurations.
l Run the display dhcpv6 server [ database | [ statistics ] [ interface interface-type
interface-number ] ] command to check information about the DHCPv6 server function.
----End
Pre-configuration Tasks
Before configuring the DHCPv6 relay agent, complete the following tasks:
Context
The DUID identifies a DHCPv6 device. Each DHCPv6 server or client has a unique DUID.
DHCPv6 servers use DUIDs to identify DHCPv6 clients and DHCPv6 clients use DUIDs to
identify DHCPv6 servers.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcpv6 duid { ll | llt }
By default, the device generates a DUID based on the link-layer (LL) address.
----End
Context
The device supports the following methods of configuring the DHCPv6 relay function:
l Configure an IPv6 address for a DHCPv6 server or next-hop relay on an interface. This
method applies to the scenario in which the peer of the DHCPv6 relay is connected to one
DHCPv6 server or next-hop relay.
l Bind a DHCPv6 server group to an interface. The detailed procedure is as follows: Create
a DHCPv6 server group in the system view, add IPv6 addresses of multiple DHCPv6
servers or next-hop relays to the DHCPv6 server group, and specify the DHCPv6 server
group for the DHCPv6 relay on an interface. This method applies to the scenario in which
the peer of the DHCPv6 relay is connected to multiple DHCPv6 servers or next-hop relays.
In this way, the DHCPv6 relay can flexibly select and uniformly manage the DHCPv6
servers or next-hop relays.
Multiple DHCPv6 relays can be connected between the DHCPv6 client and server. If the device
functions as a DHCPv6 relay and the peer is connected to the DHCPv6 server, you must specify
the IPv6 address for the DHCPv6 server when enabling the DHCPv6 relay. If the peer is
connected to the next-hop relay, you must specify the IPv6 address for the next-hop relay and
specify the IPv6 address for the peer DHCPv6 server or next-hop relay on the next-hop relay.
Procedure
l Configure an IPv6 address for a DHCPv6 server or next-hop relay on an interface.
1. Run:
system-view
5. Run:
ipv6 enable
The DHCPv6 relay function is enabled on the interface, and the IPv6 address for the
DHCPv6 server or next-hop relay is configured.
The configured IPv6 address is a global unicast address or unique local address. The
device finds the route and sends relay packets to the configured IPv6 address.
If the peer of the DHCPv6 relay is connected to multiple DHCPv6 servers or next-
hop relays, you must repeat this step. The device supports a maximum of eight
DHCPv6 servers or next-hop relays.
l Bind a DHCPv6 server group to an interface.
1. Run:
system-view
The member address of the DHCPv6 server or next-hop relay is added to the DHCPv6
server group.
If the peer of the DHCPv6 relay is connected to multiple DHCPv6 servers or next-
hop relays, you must repeat this step. The device supports a maximum of 20 DHCPv6
servers or next-hop relays.
6. Run:
quit
----End
Context
Some DHCPv6 servers can allocate IPv6 addresses and other network parameters to clients
according to the client location information. The DHCPv6 protocol defines the Interface-ID
option and Remote-ID option that can record the client location information, including the
inbound interface on the device that receives DHCPv6 Request packets and DUID information
of clients. If the device functions as a DHCPv6 relay agent, the Interface-ID option or Remote-
ID option can be added in DHCPv6 packets.
After the Interface-ID option or Remote-ID option is configured to be added in DHCPv6 packets,
the device adds the Interface-ID option or Remote-ID option in DHCPv6 Request packets sent
by clients according to the configuration, constructs Relay-Forward packets, and sends the
packets to the DHCPv6 server. The DHCPv6 server allocates IPv6 addresses and other network
parameters to clients according to the options, and sends Relay-Reply packets to the DHCPv6
relay agent. After receiving the Relay-Reply packets, the DHCPv6 relay agent removes the
Interface-ID option or Remote-ID option, and forwards the packets to clients or other relay
agents.
Procedure
Step 1 Run:
system-view
Step 2 (Optional) Run the following commands to configure the format of the Interface-ID option or
Remote-ID option.
1. Run:
dhcpv6 interface-id format { default | user-defined text }
By default, the Interface-ID option format in DHCPv6 packets is default, that is, %04svlan.
%04cvlan.%mac:%portname.
If the user-defined parameter is specified, you can define the option format using the
following defining methods:
l Keyword defining method: You can define the format according to keywords supported
by the self-defined format. For example, you can define the format as %sysname %
svlan when you need to record the name of the device that users connect to and the outer
VLAN that users belong to. If the name of the device that users connect to is HUAWEI
and the outer VLAN that users belong to is 100, the user location information recorded
in the Interface-ID option is HUAWEI 100.
[Huawei] dhcpv6 interface-id format user-defined "%sysname %svlan"
l Common character string defining method: The Interface-ID option can be defined as
a character string. For example, if all users connected to the interface are in an office
building named N8, you can define the content of the Interface-ID option as N8.
[Huawei] dhcpv6 interface-id format user-defined "N8"
l Mixed defining method: The Interface-ID option format is defined based on keywords
and common character strings. For example, the Interface-ID option format can be
defined as %sysname N8.
[Huawei] dhcpv6 interface-id format user-defined "%sysname N8"
2. Run:
dhcpv6 remote-id format { default | user-defined text }
By default, the Remote-ID option format in DHCPv6 packets is default, that is, %duid %
portname:%04svlan.%04cvlan.
The configuration of the self-defined option format is the same as that of the Interface-ID
option.
By default, the device adds the Interface-ID option in DHCPv6 packets. If the Remote-ID
option needs to be added, run the following commands to enable the function of adding the
Remote-ID option in DHCPv6 packets.
Step 3 Run:
interface interface-type interface-number
Step 4 Run:
dhcpv6 remote-id insert enable
By default, the function of adding the Remote-ID option in DHCPv6 packets is disabled.
----End
9.5.3.4 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm
Function of DHCPv6 Messages Discarded
Context
To prevent clients from sending a large number of messages to attack the device, the device
limits the rate of DHCPv6 messages.
After rate limit of DHCPv6 messages is enabled, the DHCPv6 messages are discarded when the
rate threshold is exceeded. After the alarm function of DHCPv6 messages discarded is enabled,
the device sends alarms when the number of discarded DHCPv6 messages exceeds the threshold.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp enable
DHCP is enabled.
Step 3 Run:
dhcpv6 packet-rate packet-rate
Rate limit of DHCPv6 packets is enabled and the rate threshold is configured.
By default, rate limit of DHCPv6 messages is disabled on the industrial switch router.
Step 4 Run:
dhcpv6 packet-rate drop-alarm enable
Step 5 Run:
dhcpv6 packet-rate drop-alarm threshold threshold
A alarm threshold for the number of discarded DHCPv6 messages when the DHCPv6 message
rate exceeds the rate threshold is set.
By default, the alarm threshold is 100 when the alarm function of DHCPv6 messages discarded
is enabled.
----End
Procedure
l Run the display dhcpv6 relay [ statistics ] [ interface interface-type interface-number ]
command to check the interface configuration of the DHCPv6 relay agent function.
l Run the display dhcpv6 server group [ group-name ] command to check the configuration
of the DHCPv6 server group.
l Run the display dhcpv6 relay statistics [ interface interface-type interface-number ]
command to check the packet statistics of the DHCPv6 relay agent function.
----End
Pre-configuration Tasks
Before configuring the DHCPv6 client function, complete the following tasks:
Context
When the DHCPv6 client function is configured on the WAN-side Layer 3 interface or sub-
interface of the industrial switch router, the industrial switch router dynamically obtains IPv6
addresses and other configuration parameters from the DHCPv6 server. This operation facilitates
user configurations and management.
Procedure
Step 1 Configure IPv6 functions on interfaces.
1. Run:
system-view
By default, the device generates a DUID based on the link-layer (LL) address.
3. Run:
dhcp enable
WAN-side Layer 3 interfaces and Layer 3 sub-interfaces on the industrial switch router can
work in DHCP client mode.
5. Run:
ipv6 address auto dhcp [ rapid-commit ]
The DHCPv6 client is enabled and stateful DHCPv6 address autoconfiguration is used to
assign an IPv6 address and other configuration parameters (IPv6 addresses of the DNS
server and SNTP server) to the client.
Or run:
dhcpv6 client information-request
The DHCPv6 client is enabled and stateless DHCPv6 address autoconfiguration is used to
assign configuration parameters (not including IPv6 addresses) to the client.
The service can use the two-message exchange method to assign IPv6 addresses and other
configuration parameters to clients only when two-message exchange is enabled on the
DHCPv6 clients and server. Otherwise, the server assigns IPv6 addresses and other
configuration parameters to the clients using the four-message exchange method.
NOTE
To modify the DHCPv6 address autoconfiguration mode, you must disable the original mode. For example,
the DHCPv6 client is enabled to use the stateful DHCPv6 address autoconfiguration mode to obtain an
IPv6 address and other network configuration parameters including the IPv6 addresses of the DNS and
SNTP servers. To enable the DHCPv6 client to use the stateless DHCPv6 address autoconfiguration mode
to obtain network configuration parameters (excluding IPv6 addresses), run the undo ipv6 address auto
dhcp command to disable stateful DHCPv6 address autoconfiguration and then run the dhcpv6 client
information-request command to enable stateless DHCPv6 address autoconfiguration.
----End
9.5.4.2 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm
Function of DHCPv6 Messages Discarded
Context
To prevent clients from sending a large number of messages to attack the device, the device
limits the rate of DHCPv6 messages.
After rate limit of DHCPv6 messages is enabled, the DHCPv6 messages are discarded when the
rate threshold is exceeded. After the alarm function of DHCPv6 messages discarded is enabled,
the device sends alarms when the number of discarded DHCPv6 messages exceeds the threshold.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp enable
DHCP is enabled.
Step 3 Run:
dhcpv6 packet-rate packet-rate
Rate limit of DHCPv6 packets is enabled and the rate threshold is configured.
By default, rate limit of DHCPv6 messages is disabled on the industrial switch router.
Step 4 Run:
Step 5 Run:
dhcpv6 packet-rate drop-alarm threshold threshold
A alarm threshold for the number of discarded DHCPv6 messages when the DHCPv6 message
rate exceeds the rate threshold is set.
By default, the alarm threshold is 100 when the alarm function of DHCPv6 messages discarded
is enabled.
----End
Pre-configuration Tasks
Before configuring the DHCPv6 PD client function, complete the following tasks:
Context
When the WAN-side Layer 3 interface or sub-interface of the device is configured as the
DHCPv6 PD client, the client uses the DHCPv6 protocol to dynamically obtain an IPv6 address
prefix from the DHCPv6 PD server. The downlink interface is bound to the obtained IPv6 address
prefix, so that the IPv6 address can be automatically generated for the user in route advertising
mode.
Procedure
Step 1 Configure the IPv6 function on the uplink interface.
1. Run:
system-view
When the DHCPv6 PD client and server are located on the same network segment, you only need to
run the ipv6 address auto link-local or ipv6 address ipv6-address link-local command to configure
the link-local address on the interface.
WAN-side Layer 3 interfaces and Layer 3 sub-interfaces on the industrial switch router can
work in DHCP client mode.
5. Run:
dhcpv6 client pd prefix-name [ hint ipv6-prefix/ipv6-prefix-length ] [ rapid-
commit ]
You can specify the rapid-commit parameter to set the DHCPv6 PD client to request an
IPv6 address prefix using the two-message exchange. The service can use two-message
exchange to assign IPv6 address prefix to client only when two-message exchange is
enabled on the DHCPv6 PD client and server. Otherwise, the server assigns IPv6 address
prefix to the client using the four-message exchange method.
----End
Follow-up Procedure
Bind the downlink interface to the obtained IPv6 address prefix and enable the downlink
interface to send RA packets, so that the IPv6 address can be automatically generated for the
user in route advertising mode.
1. Run the system-view command to enter the system view.
2. Run the interface interface-type interface-number command to enter the interface view.
3. Run the ipv6 enable command to enable the IPv6 function on the interface.
By default, the IPv6 function is disabled on an interface.
4. Run the ipv6 address auto link-local or ipv6 address ipv6-address link-local command
to automatically or manually configure the link-local address on the interface.
By default, no link-local address is configured for an interface.
5. Run the ipv6 address dhcpv6-prefix { ipv6-address prefix-length | ipv6-address/prefix-
length } command to bind the interface to the IPv6 address prefix obtained by the DHCPv6
PD client.
By default, the interface is not bound to the IPv6 address prefix obtained by the DHCPv6
PD client.
NOTE
The value of prefix-length for the IPv6 address prefix bound to the interface must be greater than the
length of the prefix obtained by the DHCPv6 PD client; otherwise, the interface cannot generate the
global unicast IPv6 address based on the bound IPv6 address prefix and record the log DHCP/4/
DHCPv6_CHECK_PREFIX_LENGTH.
You can run the display dhcpv6 client prefix [ name prefix-name ] command to check the length
of the prefix obtained by the DHCPv6 PD client.
6. Run the undo ipv6 nd ra halt command to enable the interface to send RA packets.
By default, the interface is disabled from sending RA packets.
9.5.5.2 (Optional) Configuring the DHCPv6 Message Rate Limit and Alarm
Function of DHCPv6 Messages Discarded
Context
To prevent clients from sending a large number of messages to attack the device, the device
limits the rate of DHCPv6 messages.
After rate limit of DHCPv6 messages is enabled, the DHCPv6 messages are discarded when the
rate threshold is exceeded. After the alarm function of DHCPv6 messages discarded is enabled,
the device sends alarms when the number of discarded DHCPv6 messages exceeds the threshold.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dhcp enable
DHCP is enabled.
Step 3 Run:
dhcpv6 packet-rate packet-rate
Rate limit of DHCPv6 packets is enabled and the rate threshold is configured.
By default, rate limit of DHCPv6 messages is disabled on the industrial switch router.
Step 4 Run:
dhcpv6 packet-rate drop-alarm enable
Step 5 Run:
dhcpv6 packet-rate drop-alarm threshold threshold
A alarm threshold for the number of discarded DHCPv6 messages when the DHCPv6 message
rate exceeds the rate threshold is set.
By default, the alarm threshold is 100 when the alarm function of DHCPv6 messages discarded
is enabled.
----End
Procedure
l Run the display dhcpv6 statistics command to check statistics on DHCPv6 packets.
l Run the display dhcpv6 server [ database | [ statistics ] [ interface interface-type
interface-number ] ] command to check information about the DHCPv6 server function.
l Run the display dhcpv6 relay [ interface interface-type interface-number ] command to
check the configuration of the interface where the DHCPv6 relay function is configured.
l Run the display dhcpv6 relay statistics [ interface interface-type interface-number ]
command to check DHCPv6 packet statistics on the DHCPv6 relay.
l Run the display dhcpv6 client statistics [ interface interface-type interface-number ]
command to check packet statistics on the DHCPv6 client.
l Run the display dhcpv6 client prefix [ name prefix-name ] command to check the IPv6
address prefix obtained by the DHCPv6 client.
----End
Context
NOTICE
The DHCPv6 packet statistics cannot be restored after being cleared.
Procedure
l Run the reset dhcpv6 server statistics [ interface interface-type interface-number ]
command to clear packet statistics of the DHCPv6 server.
l Run the reset dhcpv6 relay statistics [ interface interface-type interface-number ]
command to clear packet statistics of the DHCPv6 relay agent.
l Run the reset dhcpv6 client statistics [ interface interface-type interface-number ]
command to clear packet statistics of the DHCPv6 clients.
l Run the reset dhcpv6 statistics command to clear statistics on DHCPv6 packets.
----End
Context
When the client addresses conflict due to repeated IPv6 address assignment or IPv6 addresses
need to be re-assigned to clients based on the network plan, you can reset the status of the IPv6
address pool. In this way, the IPv6 addresses in the address pool return to the idle state and the
clients can re-apply for these IPv6 addresses.
Procedure
l Run the reset dhcpv6 pool pool-name [ allocated { address | prefix } | binding [ duid ]
| conflict address | ipv6-address [ to ipv6-address ] | ipv6-prefix/prefix-length ] command
to clear IPv6 address pool configurations.
----End
Router B Router A
GE0/0/1 fc00:3::1/64
GE0/0/1
DHCPv6 Client DHCPv6 Server
Configuration Roadmap
The configuration roadmap is as follows:
1. Enable IPv6 functions on the interface so that devices can communicate using IPv6.
2. Enable the DHCPv6 Server function so that devices can assign IPv6 addresses using
DHCPv6.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
Run the display dhcpv6 server command on the industrial switch router to check information
about the DHCPv6 server.
<Router A> display dhcpv6 server
Interface DHCPv6 pool
GigabitEthernet0/0/1 pool1
----End
Configuration File
Configuration file of Router A
#
sysname Router A
#
ipv6
#
dhcp enable
#
dhcpv6 pool pool1
address prefix FC00:3::/64
excluded-address FC00:3::1
dns-server FC00:3::1
#
interface GigabitEthernet0/0/1
undo portswitch
ipv6 enable
ipv6 address FC00:3::1/64
dhcpv6 server pool1
#
return
Router B Router A
GE0/0/1 fc00:1::1/64
GE0/0/1
DHCPv6 PD Client
DHCPv6 PD Server
Configuration Roadmap
The configuration roadmap is as follows:
1. Enable IPv6 functions on the interface so that devices can communicate using IPv6.
2. Enable the DHCPv6 PD server function so that DHCPv6 PD server can assign IPv6 address
using DHCPv6.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
# Run the display dhcpv6 pool command on the industrial switch router to check information
about the DHCPv6 address pool.
<Router A> display dhcpv6 pool
DHCPv6 pool: pool1
Prefix delegation: FC00:1::/60 63
Lifetime valid 172800 seconds, preferred 86400 seconds
0 in use
Information refresh time: 86400
DNS server address: FC00:2::1
Conflict-address expire-time: 172800
Active pd clients: 0
# Run the display dhcpv6 server command on the industrial switch router to check information
about the DHCPv6 server.
<Router A> display dhcpv6 server
Interface DHCPv6 pool
GigabitEthernet0/0/1 pool1
----End
Configuration File
Configuration file of Router A
#
sysname Router A
#
ipv6
#
dhcp enable
#
dhcpv6 pool pool1
prefix-delegation FC00:1::/60 63
dns-server FC00:2::1
#
interface GigabitEthernet0/0/1
undo portswitch
ipv6 enable
ipv6 address FC00:1::1/64
dhcpv6 server pool1
#
return
Networking Requirements
As shown in Figure 9-17, the IPv6 network segment address is fc00:1::/64 and the DHCPv6
server address is fc00:2::3/64. Users expect to obtain IPv6 addresses using DHCPv6. The
DHCPv6 client and server are on different network segments; therefore, a DHCPv6 relay agent
is required to forward DHCPv6 messages.
It is required that the industrial switch router should function as the DHCPv6 relay agent to
forward DHCPv6 messages between the DHCPv6 client and the DHCPv6 server. In addition,
the industrial switch router functions as the gateway device of the network at fc00:1::/64. The
M flag bit and O flag bit in RA messages allow hosts on the network to obtain IPv6 addresses
and other network configuration parameters through DHCPv6.
Configuration Roadmap
The configuration roadmap is as follows:
1. Enable IPv6 functions on the interface so that devices can implement IPv6 communication.
2. Enable the DHCPv6 relay function so that the DHCPv6 server and client on different links
can transmit packets.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
Run the display dhcpv6 relay statistics on RouterA to check DHCP message statistics on the
DHCPv6 relay agent.
[Router A] display dhcpv6 relay statistics
MessageType Receive Send Error
Solicit 0 0 0
Advertise 0 0 0
Request 0 0 0
Confirm 0 0 0
Renew 0 0 0
Rebind 0 0 0
Reply 0 0 0
Release 0 0 0
Decline 0 0 0
Reconfigure 0 0 0
Information-request 0 0 0
Relay-forward 0 0 0
Relay-reply 0 0 0
UnknownType 0 0 0
----End
Configuration File
Configuration file of RouterA
#
sysname Router A
#
ipv6
#
dhcp enable
#
interface GigabitEthernet1/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:1::1/64
dhcpv6 relay destination FC00:2::3
undo ipv6 nd ra halt
ipv6 nd autoconfig managed-address-flag
ipv6 nd autoconfig other-flag
#
interface GigabitEthernet2/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:2::1/64
#
return
Networking Requirements
As shown in Figure 9-18, the DHCPv6 server needs to dynamically assign IPv6 addresses to
the clients on two network segments fc00:1::/64 and fc00:2::/64, and the DHCPv6 server and
clients are in different links. The addresses fc00:1::1/64 and fc00:2::1/64 on RouterA are used
as the gateway addresses of the clients on the network segments fc00:1::/64 and fc00:2::/64.
Figure 9-18 Networking diagram for configuring a DHCPv6 relay to assign IPv6 addresses to
the clients in multiple network segments connected to the relay
GE2/0/0 RouterB
fc00:2::1/64 DHCPv6 server
Configuration Roadmap
Configure the DHCPv6 relay function on RouterA to forward DHCPv6 packets between the
DHCPv6 server and clients so that the clients can dynamically obtain IPv6 addresses.
NOTE
The AR530 is used as an example to describe the DHCPv6 server configuration procedure.
Procedure
Step 1 Configure RouterA as the DHCPv6 relay.
# Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] dhcp enable
# Configure RouterA to function as the gateway to send the M and O flags of RA messages to
clients so that the clients can obtain IPv6 addresses through DHCPv6.
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] undo ipv6 nd ra halt
[RouterA-GigabitEthernet1/0/0] ipv6 nd autoconfig managed-address-flag
[RouterA-GigabitEthernet1/0/0] ipv6 nd autoconfig other-flag
[RouterA-GigabitEthernet1/0/0] quit
[RouterA] interface gigabitethernet 2/0/0
[RouterA-GigabitEthernet2/0/0] undo ipv6 nd ra halt
[RouterA-GigabitEthernet2/0/0] ipv6 nd autoconfig managed-address-flag
[RouterA-GigabitEthernet2/0/0] ipv6 nd autoconfig other-flag
[RouterA-GigabitEthernet2/0/0] quit
[RouterB] ipv6
[RouterB] interface gigabitethernet 1/0/0
[RouterB-GigabitEthernet1/0/0] ipv6 enable
[RouterB-GigabitEthernet1/0/0] ipv6 address fc00:3::3 64
[RouterB-GigabitEthernet1/0/0] quit
[RouterB] dhcpv6 pool pool1
[RouterB-dhcpv6-pool-pool1] address prefix fc00:1::/64
[RouterB-dhcpv6-pool-pool1] excluded-address fc00:1::1
[RouterB-dhcpv6-pool-pool1] quit
[RouterB] dhcpv6 pool pool2
[RouterB-dhcpv6-pool-pool2] address prefix fc00:2::/64
[RouterB-dhcpv6-pool-pool1] excluded-address fc00:2::1
[RouterB-dhcpv6-pool-pool2] quit
[RouterB] dhcpv6 server preference 255
[RouterB] ipv6 route-static :: 0 fc00:3::1
Step 3 Configure the DHCPv6 client (Windows 7 is used as an example of the operating system on the
PC).
1. Right-click Network and choose Properties to display the Network and Sharing
Center window.
2. Click Local Area Connection to display the Local Area Connection Status window.
3. Click Properties to display the Local Area Connection Properties window.
4. Select Internet Protocol Version 6 (TCP/IPv6) and click Properties to display the
Internet Protocol Version 6 (TCP/IPv6) Properties window. Select Obtain an IPv6
address automatically and Obtain DNS server address automatically, and click OK.
# Run the display dhcpv6 relay command on RouterA to check the DHCPv6 relay
configuration.
[RouterA] display dhcpv6 relay
Interface Mode Destination
--------------------------------------------------------------------------------
GigabitEthernet1/0/0 Relay FC00:3::3
GigabitEthernet2/0/0 Relay FC00:3::3
--------------------------------------------------------------------------------
dhcpv6 server group
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Total count : 0
# Run the display dhcpv6 pool command on RouterB to check the DHCPv6 address pool
configuration.
[RouterB] display dhcpv6 pool
DHCPv6 pool: pool1
Address prefix: FC00:1::/64
Lifetime valid 172800 seconds, preferred 86400 seconds
4 in use, 0 conflicts
Excluded-address FC00:1::1
1 excluded addresses
Information refresh time: 86400
Conflict-address expire-time: 172800
Active normal clients: 4
# Run the display dhcpv6 pool pool1 allocated address and display dhcpv6 pool pool2
allocated address commands on RouterB to check the assignment of IPv6 addresses in the
DHCPv6 address pool.
[RouterB] display dhcpv6 pool pool1 allocated address
Address Valid Expires Left
-------------------------------------------------------------------------------
FC00:1::2 172800 2013-09-06 03:09:02 166610
FC00:1::3 172800 2013-09-06 03:09:02 166610
FC00:1::4 172800 2013-09-06 03:09:02 166610
FC00:1::5 172800 2013-09-06 03:09:02 166610
-------------------------------------------------------------------------------
Total : 4
[RouterB] display dhcpv6 pool pool2 allocated address
Address Valid Expires Left
-------------------------------------------------------------------------------
FC00:2::2 172800 2013-09-06 03:09:02 166610
FC00:2::3 172800 2013-09-06 03:09:02 166610
-------------------------------------------------------------------------------
Total : 2
----End
Configuration Files
l Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
dhcp enable
#
interface
GigabitEthernet1/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:1::1/64
undo ipv6 nd ra halt
ipv6 nd autoconfig managed-address-flag
ipv6 nd autoconfig other-flag
dhcpv6 relay destination FC00:3::3
#
interface
GigabitEthernet2/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:2::1/64
undo ipv6 nd ra halt
ipv6 nd autoconfig managed-address-flag
ipv6 nd autoconfig other-flag
dhcpv6 relay destination FC00:3::3
#
interface
GigabitEthernet3/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:3::1/64
#
return
#
ipv6
#
dhcp enable
#
dhcpv6 server preference 255
#
dhcpv6 pool
pool1
address prefix
FC00:1::/64
excluded-address FC00:1::1
#
dhcpv6 pool
pool2
address prefix FC00:2::/64
excluded-address FC00:2::1
#
interface GigabitEthernet1/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:3::3/64
#
ipv6 route-static :: 0 FC00:3::1
#
return
Networking Requirements
In Figure 9-19, the industrial switch router is required to function as a DHCPv6 PD client and
obtain an IPv6 address prefix from the DHCPv6 PD server. Configure the industrial switch
router as a DHCPv6 PD client to assign IPv6 addresses and other network configuration
parameters to DHCPv6 clients. This reduces pressure on the DHCPv6 server and facilitates
layered IPv6 network deployment. The address of the DHCPv6 PD server is fc00:1::1/64. The
DHCPv6 PD server and client are on the same link.
Router A Router B
GE0/0/2 GE0/0/1 fc00:1::1/64
GE0/0/1
DHCPv6 PD Client DHCPv6 PD Server
Configuration Roadmap
The configuration roadmap is as follows:
1. Enable IPv6 functions on the interface so that devices can communicate using IPv6.
2. Enable the DHCPv6 PD client function so that devices can obtain IPv6 address prefixes
using DHCPv6.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
# Configure the device to send RA messages and configure M and O flag bits.
Run the display dhcpv6 client command on the Router A to check the DHCPv6 client
configurations.
<Router A> display dhcpv6 client
GigabitEthernet0/0/1 is in DHCPv6-PD client mode.
State is BOUND.
Preferred server DUID : 000300060819A6CDA894
Reachable via address : FE80::A19:A6FF:FECD:A897
IA PD IA ID 0x00000051 T1 43200 T2 69120
Prefix name : myprefix
Obtained : 2012-12-22 09:33:09
Renews : 2012-12-22 21:33:09
Rebinds : 2012-12-23 04:45:09
Prefix : FC00:1::/48
Lifetime valid 172800 seconds, preferred 86400 seconds
Expires at 2012-12-24 09:33:09(172792 seconds left)
DNS server : FC00:2::1
Run the display dhcpv6 client statistics on the Router A to check DHCPv6 message statistics
on the DHCPv6 client.
<Router A> display dhcpv6 client statistics
Message statistics of interface GigabitEthernet0/0/1:
Message Received
Advertise 1
Reply 1
Reconfigure 0
Invalid 0
Message Sent
Solicit 1
Request 1
Confirm 0
Renew 0
Rebind 0
Release 0
Decline 0
Information-request 0
----End
Configuration File
Configuration file of Router A
#
sysname Router A
#
ipv6
#
dhcp enable
#
interface GigabitEthernet0/0/1
undo portswitch
ipv6 enable
ipv6 address auto link-local
dhcpv6 client pd
myprefix
#
interface GigabitEthernet0/0/2
undo portswitch
ipv6 enable
ipv6 address auto link-local
undo ipv6 nd ra halt
ipv6 nd autoconfig other-flag
ipv6 address myprefix ::
1:0:0:0:1/64
#
return
Networking Requirements
In Figure 9-20, the industrial switch router is required to function as a DHCPv6 client and obtain
an IPv6 address and other configuration parameters from the DHCPv6 server. The address of
the DHCPv6 server is fc00:3::1/64. The DHCPv6 server and client are on the same link.
Router A Router B
GE0/0/1 fc00:3::1/64
GE0/0/1
DHCPv6 Client DHCPv6 Server
Configuration Roadmap
The configuration roadmap is as follows:
1. Enable IPv6 functions on the interface so that devices can communicate using IPv6.
2. Enable the DHCPv6 client function so that devices can obtain IPv6 addresses using
DHCPv6.
Procedure
Step 1 Enable the DHCP service.
<Huawei> system-view
[Huawei] sysname Router A
[Router A] dhcp enable
Run the display dhcpv6 client command on the Router A to check the DHCPv6 client
configurations.
<Router A> display dhcpv6 client
GigabitEthernet0/0/1 is in stateful DHCPv6 client mode.
State is BOUND.
Preferred server DUID : 000300060819A6CDA894
Reachable via address : FE80::A19:A6FF:FECD:A897
IA NA IA ID 0x00000051 T1 43200 T2 69120
Obtained : 2012-12-22 09:15:54
Renews : 2012-12-22 21:15:54
Rebinds : 2012-12-23 04:27:54
Address : FC00:3::2
Lifetime valid 172800 seconds, preferred 86400 seconds
Expires at 2012-12-24 09:15:54(172795 seconds left)
Run the display dhcpv6 client statistics command on the Router A to check message statistics
on the DHCPv6 client.
<Router A> display dhcpv6 client statistics
Message statistics of interface GigabitEthernet0/0/1:
Message Received
Advertise 1
Reply 1
Reconfigure 0
Invalid 0
Message Sent
Solicit 1
Request 1
Confirm 0
Renew 0
Rebind 0
Release 0
Decline 0
Information-request 0
----End
Configuration File
Configuration file of Router A
#
sysname Router A
#
ipv6
#
dhcp enable
#
interface GigabitEthernet0/0/1
undo portswitch
ipv6 enable
ipv6 address auto link-local
ipv6 address auto
dhcp
#
return
9.8 References
This section lists references of DHCPv6.
This chapter describes the principles, basic functions and configuration procedures of IPv6 DNS,
and provides configuration examples.
Each host on the IPv6 network is identified by an IPv6 address. To access a host, a user must
obtain the host IPv6 address first. It is difficult for users to remember IPv6 addresses of hosts.
Therefore, host names in the format of strings are designed. In this way, users can use the simple
and meaningful domain names instead of the complicated IPv6 addresses to access hosts by
resolution of the DNS server on the network.
The device can function as an IPv6 DNS client and IPv6 DNS proxy or relay.
RouterA
IPv6 DNS Client
RouterB
IPv6 DNS Client
As shown in Figure 10-1, the industrial switch router functions as an IPv6 DNS client and
supports static and dynamic domain name resolution.
l Static domain name resolution: Mappings between domain names and IPv6 addresses are
configured manually. To obtain the IPv6 address by resolving a domain name, the DNS
client searches the static domain name resolution table for the specified domain name.
l Dynamic domain name resolution: Dynamic domain name resolution is implemented by a
DNS server. The DNS server receives domain name resolution requests from DNS clients.
The DNS server searches for the corresponding IPv6 address of the domain name in its
DNS database. If no matching entry is found, it sends a query message to a higher-level
DNS server. This process continues until the DNS server finds the corresponding IPv6
address or detects that the corresponding IPv6 address of the domain name does not exist.
Then the DNS server returns a result to the DNS client.
The industrial switch router IPv6 domain name resolution system must support the
following DNS query modes:
– AAAA query
– IPv6 PTR query.
– A6 query
Internet
As shown in Figure 10-2, an IPv6 DNS client on the LAN can connect to an external IPv6 DNS
server through the industrial switch router enabled with IPv6 DNS proxy or relay. After the
external DNS server translates the domain name of the IPv6 DNS client to an IP address, the
IPv6 DNS client can access the Internet.
IPv6 DNS relay is similar to IPv6 DNS proxy. The difference is that the IPv6 DNS proxy searches
for DNS entries saved in the domain name cache after receiving DNS query messages from DNS
clients. The IPv6 DNS relay, however, directly forwards DNS query messages to the DNS server,
reducing the cache usage.
Context
A static domain name resolution table is manually set up, describing the mappings between
domain names and IPv6 addresses. Some common domain names are added to the table. Static
domain name resolution can be performed based on the static domain name resolution table. To
obtain the IPv6 address by resolving a domain name, the client searches the static domain name
resolution table for the specified domain name. In this manner, the efficiency of domain name
resolution is improved.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ipv6
Step 3 Run:
ipv6 host host-name ipv6-address
----End
Context
The DNS client needs to complete dynamic domain name resolution through the DNS server.
During dynamic domain name resolution, the DNS server needs to provide the mapping between
domain names and IPv6 addresses and receive domain name resolution requests from clients.
Configuring dynamic domain name resolution involves enabling dynamic domain name
resolution, configuring an IPv6 address for the DNS server, configuring an source IPv6 address
for the local device, and configuring a domain name suffix. If the local device uses an IPv6
address allocated by the DHCPv6 server and the information delivered by the DHCPv6 server
to the local device contains the DNS server IPv6 address and the domain name suffix list, you
only need to enable dynamic DNS resolution.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dns resolve
Step 3 Run:
dns server ipv6 ipv6-address [ interface-type interface-number ]
A maximum of six DNS server IP (IPv4 and IPv6) addresses can be configured on the device.
During dynamic domain name resolution, the device sends a query packet to the DNS servers
according to the order in which they were configured. If the domain name query on the first
DNS server times out, the device sends the query request to the second DNS server.
After the IPv6 address of the local device is specified, the device uses the specified IPv6 address
to communicate with the DNS server. If no source IPv6 address is configured, the DNS client
needs to select a source IPv6 address according to the destination address each time it sends an
IPv6 DNS request. If only one route from the DNS server to the device with an IPv6 address is
reachable, you need to specify the source IPv6 address in the DNS query message when the
device sends a DNS query to the DNS server.
----End
Procedure
l Run the display dns configuration command to display the global DNS configurations.
l Run the display ipv6 host command to check the IPv6 static domain name resolution table.
l Run the display dns server command to check the DNS server configuration.
l Run the display dns domain command to check the domain name suffix list.
----End
Pre-configuration Tasks
Before configuring IPv6 DNS proxy or relay, complete the following tasks:
l Connecting interfaces and setting physical parameters for the interfaces to ensure that the
physical status of the interfaces is Up
l Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
l Configuring a DNS server
l Configuring routes between the local routing device and the DNS server and between the
local routing device and the IPv6 DNS client
Context
IPv6 DNS relay is similar to IPv6 DNS proxy. The IPv6 DNS proxy searches for DNS entries
saved in the domain name cache after receiving IPv6 DNS query packets from IPv6 DNS clients.
The IPv6 DNS relay, however, directly forwards IPv6 DNS query packets to the DNS server,
reducing the cache usage.
Procedure
Step 1 Run:
system-view
The DNS server that the IPv6 DNS proxy or relay connects to is configured.
----End
Context
A static domain name resolution table is manually set up, describing the mappings between
domain names and IPv6 addresses. Some common domain names are added to the table. Static
domain name resolution can be performed based on the static domain name resolution table. To
obtain the IPv6 address by resolving a domain name, the DNS server searches the static domain
name resolution table. In this manner, the efficiency of domain name resolution is improved.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ipv6 host host-name ipv6-address
----End
Context
If the device is enabled with IPv6 DNS proxy or relay but is not configured with a DNS server
address or has no route to the DNS server, the device does not forward or respond to DNS query
messages from DNS clients. If IPv6 DNS spoofing is enabled, the device uses the configured
IPv6 address to respond to all DNS query messages.
In addition to enabling IPv6 DNS proxy or relay, one of the following requirements must be met
to make IPv6 DNS spoofing take effect:
l No DNS server is configured.
l A DNS server is configured, but dynamic DNS resolution is disabled.
l No route is reachable to the DNS server.
l No source IPv6 address is available for the outbound interface connected to the DNS server.
If one of the preceding requirements is met, when receiving an AAAA or A6 query, the IPv6
DNS proxy or relay return spoofing reply messages using the configured IPv6 address.
Procedure
Step 1 Run:
system-view
Step 2 Run:
dns spoofing ipv6 ipv6-address
IPv6 DNS spoofing is enabled and the IPv6 address in response packets is specified.
----End
Procedure
l Run the display dns configuration command to display the global DNS configurations.
l Run the display ipv6 host command to view the static IPv6 DNS table.
l Run the display dns server command to check the DNS server configuration.
----End
Context
NOTICE
IPv6 DNS entries in the domain name cache cannot be restored after being cleared. Exercise
caution when you run the command.
Procedure
l Run the reset dns ipv6 dynamic-host command to clear dynamic IPv6 DNS entries in the
domain name cache.
----End
Context
NOTICE
IPv6 DNS forwarding entries cannot be restored after being cleared. Exercise caution when you
run the command.
Procedure
l Run the reset dns ipv6 forward table [ source-ip ipv6-address ]command in the user
view to clear IPv6 DNS forwarding entries.
----End
Context
NOTICE
Statistics on sent and received IPv6 DNS packets cannot be restored after being cleared. Exercise
caution when you run the command.
Procedure
l Run the reset dns statistics command to clear statistics on sent and received IPv6 DNS
packets.
----End
Context
In routine maintenance, you can run the following commands in any view to check the running
status of IPv6 DNS.
Procedure
l Run the display dns ipv6 dynamic-host [ domain-name | a6 ] command to check dynamic
IPv6 DNS entries in the domain name cache.
----End
Networking Requirements
As shown in Figure 10-3, RouterA functions as a DNS client and cooperates with a DNS server
so that RouterA can access the host at fc00:2::1/64 using the domain name huawei.com.
Static IPv6 DNS entries of RouterB and RouterC are configured on RouterA so that RouterA
can manage RouterB and RouterC.
RouterB RouterC
GE1/0/0
GE1/0/0
fc00:1::1/64 fc00:3::1/64
GE1/0/0
fc00:1::2/64 GE2/0/0 GE2/0/0
IPv6 DNS client fc00:2::3/64 DNS server
fc00:2::2/64
RouterA fc00:3::2/64
huawei.com
fc00:2::1/64
Configuration Roadmap
The configuration roadmap is as follows:
Procedure
Step 1 Configure RouterA.
NOTE
To resolve the domain name, you need to configure the route from RouterA to the IPv6 DNS server. For
details on how to configure the route, see Configure static route example in the Configuration Guide-
IP Routing.
# Run the ping ipv6 huawei.com command on RouterA. You can find that the ping operation
succeeds, and the destination IPv6 address is fc00:2::1.
<RouterA> ping ipv6 huawei.com
Resolved Host ( huawei.com -> FC00:2::1)
PING huawei.com : 56 data bytes, press CTRL_C to break
Reply from FC00:2::1
bytes=56 Sequence=1 hop limit=64 time = 1 ms
Reply from FC00:2::1
bytes=56 Sequence=2 hop limit=64 time = 1 ms
Reply from FC00:2::1
bytes=56 Sequence=3 hop limit=64 time = 1 ms
Reply from FC00:2::1
bytes=56 Sequence=4 hop limit=64 time = 1 ms
Reply from FC00:2::1
bytes=56 Sequence=5 hop limit=64 time = 1 ms
--- huawei.com ping statistics
---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms
# Run the display ipv6 host command on RouterA. You can view mappings between host names
and IPv6 addresses in static DNS entries.
<RouterA> display ipv6 host
Host Age Flags IPv6Address (es)
RouterB 0 static FC00:1::2
RouterC 0 static FC00:2::3
Run the display dns ipv6 dynamic-host command on RouterA. You can view information about
dynamic IPv6 DNS entries saved in the cache.
<RouterA> display dns ipv6 dynamic-host
Host TTL Type Address(es)
huawei.com 3579 IPv6 FC00:2::1
NOTE
The TTL field in the command output indicates the lifetime of a DNS entry, in seconds.
----End
Configuration File
l Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
ipv6 host RouterB FC00:1::2
ipv6 host RouterC FC00:2::3
#
dns resolve
dns server ipv6 FC00:3::2
Networking Requirements
As shown in Figure 10-4, Users access the DNS server to resolve domain names through
RouterA enabled with DNS proxy. If the route from RouterA to the DNS server is unreachable,
the IPv6 address configured for DNS spoofing is used to respond to the DNS query packets.
HostA
RouterA
GE1/0/0 GE2/0/0
DNS Proxy
fc00:1::2/64 fc00:2::1/64
GE1/0/0
fc00:1::1/64 RouterB DNS Server
fc00:2::2/64
HostB
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure the IPv6 address for the DNS server on RouterA to forward DNS packets.
2. Configure IPv6 DNS spoofing on RouterA.
Procedure
Step 1 Configure an IPv6 address for GE1/0/0.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] ipv6
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] undo portswitch
[RouterA-GigabitEthernet1/0/0] ipv6 enable
[RouterA-GigabitEthernet1/0/0] ipv6 address fc00:1::1 64
[RouterA-GigabitEthernet1/0/0] quit
# Configure a DNS server that the DNS proxy or relay connects to.
[RouterA] dns server ipv6 fc00:2::2
Step 3 Configure DNS spoofing and specify the IPv6 address in response messages as fc00:3::3.
[RouterA] dns spoofing ipv6 fc00:3::3
NOTE
You need to configure a static IPv6 route on the DNS server so that DNS packets can be sent and received
properly.
# Run the display current-configuration command to view the DNS proxy configuration on
RouterA.
<RouterA> display current-configuration | include dns
dns resolve
dns server ipv6
FC00:2::2
dns proxy enable
dns spoofing ipv6
FC00:3::3
----End
Configuration File
Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
interface GigabitEthernet1/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:1::1/64
#
dns resolve
dns server ipv6 FC00:2::2
dns proxy enable
dns spoofing ipv6 FC00:3::3
#
ipv6 route-static FC00:2:: 64 FC00:1::2
#
return
#
sysname RouterB
#
ipv6
#
interface GigabitEthernet1/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:1::2/64
#
interface GigabitEthernet2/0/0
undo portswitch
ipv6 enable
ipv6 address FC00:2::1/64
#
return
IPv6 over IPv4 tunnel technology enables transition from the IPv4 network to the IPv6 network.
11.2 Principles
This section describes the implementation of IPv6 over IPv4 Tunnel.
Exhaustion of IPv4 addresses urgently requires IPv4 to IPv6 transition. IPv6 is incompatible
with IPv4, so original IPv4 devices need to be replaced. This solution is infeasible because the
replacement requires huge capital expenditures, and will interrupt services on the live network.
In this situation, IPv4 needs to transit to IPv6 gradually. During early transition, IPv4 networks
are widely deployed and IPv6 networks are isolated sites. An IPv6 over IPv4 tunnel allows IPv6
packets to be transmitted on an IPv4 network and connects all IPv6 sites.
11.2 Principles
This section describes the implementation of IPv6 over IPv4 Tunnel.
the network layer receives IPv4 packets. If the value of the Protocol ID field is 0x86DD,
the network layer receives IPv6 packets.
l Supported by multiple applications.
Multiple applications, such as the DNS, FTP, and Telnet, support dual protocol stacks. The
upper layer applications, such as the DNS, can use TCP or UDP as the transport layer
protocol. However, they prefer the IPv6 protocol stack rather than the IPv4 protocol stack
as the network layer protocol.
Figure 11-2 shows a typical application of the dual IPv4/IPv6 protocol stack.
www.example.com=?
IPv4
10.1.1.1
DNS
Network
Server
10.1.1.1 or Router
3ffe:yyyy::1
IPv6
3ffe:yyyy::1
As shown in Figure 11-2, an application that supports dual protocol stack requests an IP address
corresponding to the domain name www.example.com from the DNS server. As shown in the
figure, a host sends a DNS request packet to the DNS server, requesting the IP address
corresponding to the domain name www.example.com. The DNS server responds with the
requested IP address. The IP address can be 10.1.1.1 or 3ffe:yyyy::1. If the host sends a class A
query packet, it requests the IPv4 address from the DNS server. If the host sends a class AAAA
query packet, it requests the IPv6 address from the DNS server.
Router in the figure supports the dual protocol stack. Router uses the IPv4 protocol stack to
connect the host to the network server with the IPv4 address 10.1.1.1. Router uses the IPv6
protocol stack to connect the host to the network server with the IPv6 address 3ffe:yyyy::1.
Exhaustion of IPv4 addresses brings an urgent demand for transition to IPv6. As IPv6 is not
compatible with IPv4, you need to replace devices on the original IPv4 network. Replacing a
large number of devices on the IPv4 network costs a lot and causes service interruption of the
current network. Therefore, transition from IPv4 networks to IPv6 networks must be performed
step by step. During the early transition, a large number of IPv4 networks have been deployed,
whereas IPv6 networks are isolated sites over the world. You can create tunnels on the IPv4
networks to connect to IPv6 isolated sites. These tunnels are called IPv6 over IPv4 tunnels.
Figure 11-3 shows how to apply the IPv6 over IPv4 tunnel.
Figure 11-3 Networking diagram for applying the IPv6 over IPv4 tunnel
1. On the border device, the dual IPv4/IPv6 protocol stack is enabled, and an IPv6 over IPv4
tunnel is configured.
2. After the border device receives a packet from the IPv6 network, the device appends an
IPv4 header to the IPv6 packet to encapsulate the IPv6 packet as an IPv4 packet if the
destination address of the IPv6 packet is not the device and the outbound interface of the
next hop is the tunnel interface.
3. On the IPv4 network, the encapsulated packet is transmitted to the remote border device.
4. The remote border device decapsulates the packet, removes the IPv4 header, and sends the
decapsulated IPv6 packet to the IPv6 network.
A tunnel is established when its start and end points are determined. You must manually
configure an IPv4 address at the start point of an IPv6 over IPv4 tunnel. The IPv4 address at the
end point of the tunnel can be determined manually or automatically. Based on the mode in
which the end point IPv4 address is obtained, IPv6 over IPv4 tunnels are classified into manual
tunnels and automatic tunnels.
l Manual tunnel: If a tunnel is created manually, a border router cannot automatically obtain
an IPv4 address at the end point. You must manually configure an end point IPv4 address
before packets can be transmitted to the remote border router.
l Automatic tunnel: If a tunnel is created automatically, a border router can automatically
obtain an IPv4 address at the end point. The addresses of two interfaces on both ends of
the tunnel are IPv6 addresses with IPv4 addresses embedded. The border router extracts
IPv4 addresses from destination IPv6 addresses.
Manual Tunnel
Based on encapsulation modes of IPv6 packets, manual tunnels are classified into IPv6 over
IPv4 manual tunnels and IPv6 over IPv4 Generic Routing Encapsulation (GRE) tunnels.
The border router uses the received IPv6 packet as the payload and encapsulates the IPv6 packet
as an IPv4 packet. You must manually specify the source and destination addresses of a manual
tunnel. A manual tunnel is a P2P connection. It can be created between two border routers to
connect IPv4 isolated IPv6 sites, or created between a border router and a host to enable the host
to access an IPv6 network. Hosts and border routers on both ends of a manual tunnel must support
the IPv4/IPv6 dual protocol stack. Other devices only need to support a single protocol stack. If
you create multiple IPv6 over IPv4 manual tunnels between one border router and multiple hosts,
the configuration workload is heavy. Therefore, an IPv6 over IPv4 manual tunnel is commonly
created between two border routers to connect IPv6 networks.
Figure 11-4 shows the encapsulation format of an IPv6 over IPv4 packet.
The forwarding mechanism of an IPv6 over IPv4 manual tunnel is as follows: After a border
router receives an packet from the IPv6 network, it searches the destination address of the IPv6
packet in the routing and forwarding table. If the packet is forwarded from this virtual tunnel
interface, the router encapsulates the packet based on the source and destination IPv4 addresses
configured on the interface. The IPv6 packet is encapsulated as an IPv4 packet and processed
by the IPv4 protocol stack. The encapsulated packet is forwarded through the IPv4 network to
the remote end of the tunnel. After the border router on the remote end of the tunnel receives
the encapsulated packet, it decapsulates the packet and processes the packet using the IPv6
protocol stack.
An IPv6 over IPv4 GRE tunnel uses the standard GRE tunnel technology to provide P2P
connections. You must manually specify addresses for both ends of the tunnel. Any types of
protocol packets that GRE supports can be encapsulated and transmitted through a GRE tunnel.
The protocols may include IPv4, IPv6, Open Systems Interconnection (OSI), and Multiprotocol
Label Switching (MPLS).
Figure 11-5 shows the encapsulation and transmission process on an IPv6 over IPv4 GRE tunnel.
IPv4
The forwarding mechanism of an IPv6 over IPv4 GRE tunnel is the same as that of an IPv6 over
IPv4 manual tunnel. For details, see the Configuration Guide - VPN.
Automatic Tunnel
You only need to configure the start point of an automatic tunnel, and the device automatically
obtains the end point of the tunnel. The tunnel interface uses a special form of IPv6 address with
an IPv4 address embedded. The device obtains the IPv4 address from the destination IPv6
address and uses the IPv4 address as the end point address of the tunnel.
Based on the encapsulation modes of IPv6 packets, automatic tunnels are classified into IPv4-
compatible IPv6 automatic tunnels, IPv6-to-IPv4 tunnels, and Intra-Site Automatic Tunnel
Addressing Protocol (ISATAP) tunnels.
For an IPv4-compatible IPv6 automatic tunnel, the destination address contained in an IPv6
packet is an IPv4-compatible IPv6 address. The first 96 bits of an IPv4-compatible IPv6 address
are all 0s and the last 32 bits are the IPv4 address. Figure 11-6 shows the format of an IPv4-
compatible IPv6 address.
0 IPv4 address
96 bit 32 bit
Figure 11-7 shows the forwarding mechanism of an IPv4-compatible IPv6 automatic tunnel.
IPv4
1.1.1.1/24 2.1.1.1/24
IPv4-Compatible IPv6 Tunnel
::2.1.1.1/96
::1.1.1.1/96
Router A Router B
After receiving an IPv6 packet, Router A searches the routing table for the destination address ::
2.1.1.1 and finds that the next hop address is a virtual tunnel interface address. Router A then
encapsulates the IPv6 packet as an IPv4 address because the tunnel configured on Router A is
an IPv4-compatible IPv6 automatic tunnel. The source address of the encapsulated IPv4 address
is the start point address of the tunnel 1.1.1.1, and the destination address is 2.1.1.1, which is the
last 32 bits of the IPv4-compatible IPv6 address. Router A sends the packet through the tunnel
interface and forwards it on an IPv4 network to the destination address 2.1.1.1 (Router B). Router
B receives the packet, obtains the IPv6 packet, and processes the IPv6 packet using the IPv6
protocol stack. Router B returns packets to Router A in the same way.
NOTE
If the IPv4 address contained in an IPv4-compatible IPv6 address is a broadcast address, multicast address,
network broadcast address, subnet broadcast address of an outbound interface, address of all 0s, or loopback
address, the IPv6 packet will be discarded.
To deploy an IPv4-compatible IPv6 tunnel, each host must have a valid IP address, and hosts
that communicate with each other must support dual protocol stacks and IPv4-compatible IPv6
tunnels. Therefore, it is unsuitable for large-scale networks. Currently, the IPv4-compatible IPv6
tunnel has been replaced by the IPv6-to-IPv4 tunnel.
IPv6-to-IPv4 Tunnel
An IPv6-to-IPv4 tunnel also uses an IPv4 address that is embedded in an IPv6 address. Unlike
IPv4-compatible IPv6 tunnels, you can create IPv6-to-IPv4 tunnels between two routers, a router
and a host, and two hosts. An IPv6-to-IPv4 address uses the IPv4 address as the network ID.
Figure 11-8 shows the format of an IPv6-to-IPv4 address.
FP TLA
IPv4 address SLA ID Interface ID
001 0x0002
IPv4-Addr 1 IPv4-Addr 2
IPv6 Header Data IPv6 Header Data
IPv4
One IPv4 address can be used as the source address of only one IPv6-to-IPv4 tunnel. When a
border device is connected to multiple IPv6-to-IPv4 networks that use the same IPv4 address as
the source address of the tunnel, the IPv6-to-IPv4 networks share a tunnel and are identified by
SLA ID in the IPv6-to-IPv4 address. Figure 11-10 shows the case.
IPv4-Addr 1 IPv4-Addr 2
6to4
IPv4
6to4
6to4 tunnel
2002:IPv4-Addr1:2::/64
Backed by the advance of IPv6 networks, IPv6 hosts need to communicate with IPv4 hosts
through IPv6-to-IPv4 networks. It can be implemented by deploying IPv6-to-IPv4 relays. When
the destination address of an IPv6 packet forwarded through an IPv6-to-IPv4 tunnel is not an
IPv6-to-IPv4 address, but the next hop address is an IPv6-to-IPv4 address, the next hop router
is an IPv6-to-IPv4 relay. The device obtains the destination IPv4 address from the next hop IPv6-
to-IPv4 address. Figure 11-11 shows an IPv6-to-IPv4 relay.
IPv4-Addr 1 IPv4-Addr 2
IPv6 Network
IPv4
6to4 Net-2
6to4 tunnel
2002:IPv4-Addr1::/48
When hosts on IPv6-to-IPv4 network 2 want to communicate with hosts on the IPv6 network,
configure the next hop address as the IPv6-to-IPv4 address of the IPv6-to-IPv4 relay on the
border router. The IPv6-to-IPv4 address matches the source address of the IPv6-to-IPv4 tunnel.
Packets sent from IPv6-to-IPv4 network 2 to the IPv6 network are sent to the IPv6-to-IPv4 relay
router according to the routing table. The IPv6-to-IPv4 relay router then forwards packets to the
pure IPv6 network. When hosts on the IPv6 network send packets to IPv6-to-IPv4 network 2,
the IPv6-to-IPv4 relay router appends IPv4 headers to the packets and forwards the packets to
the destination addresses (IPv6-to-IPv4 addresses).
ISATAP Tunnel
ISATAP is another automatic tunnel technology. The ISATAP tunnel uses a special format of
IPv6 address with an IPv4 address embedded. Different from the IPv6-to-IPv4 address that uses
the IPv4 address as the network prefix, the ISATAP address uses the IPv4 address as the interface
ID. Figure 11-12 shows the format of the interface ID of an ISATAP address.
The "u" bit in the IPv4 address that is globally unique is set to 1. Otherwise, the "u" bit is set to
0. "g" is the individual/group bit. An ISATAP address contains an interface ID and it can be a
global unicast address, link-local address, ULA address, or multicast address. The device obtains
the first 64 bits of an ISATAP address by sending Request packets to the ISATAP router. Devices
on both ends of the ISATAP tunnel run the Neighbor Discovery (ND) protocol. The ISATAP
tunnel considers the IPv4 network as a non-broadcast multiple access (NBMA) network.
ISATAP allows IPv6 networks to be deployed within existing IPv4 networks. The deployment
is simple and networks can be easily expanded. Therefore, ISATAP is suitable for transition of
local sites. ISATAP supports local routing within IPv6 sites, global IPv6 routing domains, and
automatic IPv6 tunnels. ISATAP can be used together with NAT to allow the use of an IPv4
address that is not globally unique within the site. Typically, an ISATAP tunnel is used within
the site, and does not require a globally unique IPv4 address embedded.
Host B
10.1.2.5
FE80::5EFE:0A01:0205
1::5EFE:0A01:0205
GE1/0/0
10.1.2.1 el
nn
ISATAP Tunnel
Host A T u
3::8 T AP
I SA
IPv4
IPv6
ISATAP Router
Host C
Tunnel 1
10.1.2.6
FE80::5EFE:0A01:0201
FE80::5EFE:0A01:0206
1::5EFE:0A01:0201
1::5EFE:0A01:0206
As shown in Figure 11-13, Host B and Host C are located on an IPv4 network. They both support
dual protocol stacks and have private IPv4 addresses. Perform the following operations to enable
the ISATAP function on Host B and Host C:
Pre-configuration Tasks
Before configuring an IPv4/IPv6 dual stack, complete the following tasks:
l Configuring link layer protocol parameters for interfaces to ensure that the link layer
protocol status on the interfaces is Up
Context
To enable an interface to forward IPv6 packets, enable IPv6 packet forwarding in the system
view and in the interface view.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ipv6
To enable a device to forward IPv6 packets, enable IPv6 packet forwarding in the system view;
otherwise, the device fails to forward IPv6 packets even if an IPv6 address is configured for an
interface on the device.
Step 3 Run:
interface interface-type interface-number
Step 4 Run:
ipv6 enable
Before performing IPv6 configurations in the interface view, enable the IPv6 function in the
interface view.
----End
Context
The device to be enabled with the dual stack must be configured with an IPv4 address on the
IPv4 network-side interface and an IPv6 address on the IPv6 network-side interface.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface interface-type interface-number
Step 3 Run:
ip address ip-address { mask | mask-length }
Step 4 Run:
quit
Step 5 Run:
interface interface-type interface-number
----End
Prerequisites
All configurations of the IPv4/IPv6 dual stack are complete.
Procedure
l Run the display ipv6 interface [ interface-type interface-number | brief ] command to
check IPv6 attributes of an interface.
----End
Prerequisites
Source and destination devices of an IPv6 over IPv4 tunnel have forwarding routes.
Pre-configuration Tasks
Before configuring an IPv6 over IPv4 tunnel, complete the following task:
Configuration Process
You can perform the following configuration tasks in any sequence according to usage scenarios
shown in Table 11-1.
Manual Manual IPv6 over Source and IPv6 address Applies to simple
tunnel IPv4 tunnel destination IP IPv6 networks or
addresses use point-to-point
manually connections.
configured IPv4 Only IPv6
addresses. packets can be
transmitted over
the manual IPv6
over IPv4 tunnel.
Automati Automatic IPv6 The source IP IPv6 address that Applies to point-
c tunnel over IPv4 tunnel address uses a is compatible to-multipoint
manually with an IPv4 connections of
configured IPv4 address in the IPv6 hosts.
address, and the format of ::IPv4-
destination source-address/
address is 96
automatically
generated.
Context
When configuring a manual IPv6 over IPv4 tunnel, pay attention to the following points:
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface tunnel interface-number
Step 3 Run:
tunnel-protocol ipv6-ipv4
Step 4 Run:
source { ip-address | interface-type interface-number }
NOTE
You can specify a physical interface or a loopback interface as the source interface of a tunnel. Similarly,
you can specify the IP address of a physical interface or loopback interface as the source address of the
tunnel.
Step 5 Run:
destination dest-ip-address
NOTE
The destination address of a tunnel can be the IP address of a physical interface or loopback interface.
Step 6 Run:
ipv6 enable
Step 7 Run:
ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }
----End
Context
When configuring an automatic IPv6 over IPv4 tunnel, pay attention to the following points:
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface tunnel interface-number
Step 3 Run:
tunnel-protocol ipv6-ipv4 auto-tunnel
Step 4 Run:
source { ip-address | interface-type interface-number }
Step 5 Run:
ipv6 enable
Step 6 Run:
ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }
----End
Context
When configuring a 6to4 tunnel, pay attention to the following points:
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface tunnel interface-number
Step 3 Run:
tunnel-protocol ipv6-ipv4 6to4
Step 4 Run:
source { source-ip-address | interface-type interface-number }
Step 5 Run:
ipv6 enable
Step 6 Run:
ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }
NOTE
The IPv6 address prefix of the specified tunnel interface must be the same as the address prefix of the 6to4
network that the device belongs to.
----End
Follow-up Procedure
Connect to an IPv6 network through a 6to4 relay agent. The procedure for connecting to an IPv6
network through a 6to4 relay agent is similar to the procedure for configuring a 6to4 tunnel. For
details, see Example for Configuring 6to4 Relay.
Context
When configuring an ISATAP tunnel, pay attention to the following points:
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface tunnel interface-number
Step 3 Run:
tunnel-protocol ipv6-ipv4 isatap
Step 4 Run:
source { source-ip-address | interface-type interface-number }
Step 5 Run:
ipv6 enable
Step 6 Run:
ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }
Step 7 Run:
undo ipv6 nd ra halt
----End
Prerequisites
All configurations of the IPv6 over IPv4 tunnel are complete.
Procedure
l Run the display ipv6 interface tunnel interface-number command to check IPv6 attributes
of a tunnel interface.
----End
11.4.1 Monitoring the Running Status of the IPv6 over IPv4 Tunnel
Context
In routine maintenance, you can run the following command in any view to monitor the running
status of the IPv6 over IPv4 tunnel.
Procedure
l Run the display ipv6 interface tunnel interface-number command in any view to view
the running status of the tunnel interface.
----End
Networking Requirements
As shown in Figure 11-14, two IPv6 networks connect to RouterB on an IPv4 backbone network
through RouterA and RouterC respectively. Hosts on the two IPv6 networks are required to
communicate through the IPv4 backbone network.
Figure 11-14 Networking diagram for configuring a manual IPv6 over IPv4 tunnel
IPv4
network
GE1/0/0 GE2/0/0
192.168.50.1/24 192.168.51.1/24
Router B
GE1/0/0 GE1/0/0
192.168.50.2/24 192.168.51.2/24
Dual Dual
Stack Stack
IPv6 RouterC IPv6
RouterA
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure IP addresses for physical interfaces so that devices can communicate on the IPv4
backbone network.
2. Configure IPv6 addresses, source interfaces, and destination addresses for tunnel interfaces
so that devices can communicate with hosts on the two IPv6 networks.
3. Set the tunnel protocol to IPv6-IPv4 so that hosts on the two IPv6 networks can
communicate through the IPv4 backbone network.
Procedure
Step 1 Configure RouterA.
# Configure an IP address for an interface.
<Huawei>system-view
[Huawei] sysname RouterA
[RouterA] ipv6
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] undo portswitch
[RouterA-GigabitEthernet1/0/0] ip address 192.168.50.2 255.255.255.0
[RouterA-GigabitEthernet1/0/0] quit
# Configure an IPv6 address, a source interface, and a destination address for the tunnel interface.
[RouterA-Tunnel0/0/1] ipv6 enable
[RouterA-Tunnel0/0/1] ipv6 address 3001::1/64
[RouterA-Tunnel0/0/1] source gigabitethernet 1/0/0
[RouterA-Tunnel0/0/1] destination 192.168.51.2
[RouterA-Tunnel0/0/1] quit
# Configure an IPv6 address, a source interface, and a destination address for the tunnel interface.
[RouterC-Tunnel0/0/1] ipv6 enable
[RouterC-Tunnel0/0/1] ipv6 address 3001::2/64
[RouterC-Tunnel0/0/1] source gigabitethernet 1/0/0
[RouterC-Tunnel0/0/1] destination 192.168.50.2
[RouterC-Tunnel0/0/1] quit
# Ping the IPv6 address of Tunnel0/0/1 on RouterA from RouterC. RouterC can receive a Reply
packet from RouterA.
[RouterC] ping ipv6 3001::1
----End
Configuration Files
l Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 192.168.50.2 255.255.255.0
#
interface Tunnel0/0/1
ipv6 enable
ipv6 address 3001::1/64
tunnel-protocol ipv6-ipv4
source GigabitEthernet1/0/0
destination 192.168.51.2
#
ip route-static 192.168.51.0 255.255.255.0 192.168.50.1
#
return
interface Tunnel0/0/1
ipv6 enable
ipv6 address 3001::2/64
tunnel-protocol ipv6-ipv4
source GigabitEthernet1/0/0
destination 192.168.50.2
#
ip route-static 192.168.50.0 255.255.255.0 192.168.51.1
#
return
Networking Requirements
As shown in Figure 11-15, two IPv6 networks connect to RouterB on an IPv4 backbone network
respectively through RouterA and RouterC. An IPv6 over IPv4 GRE tunnel needs to be set up
between RouterA and RouterC so that hosts on the two IPv6 networks can communicate.
Figure 11-15 Networking diagram for configuring an IPv6 over IPv4 GRE tunnel
RouterB
GE1/0/0 GE2/0/0
10.1.1.2/24 10.1.2.1/24
GE1/0/0 GE1/0/0
10.1.1.1/24 10.1.2.2/24
RouterA GRE Tunnel RouterC
GE2/0/0 Tunnel0/0/1 Tunnel0/0/1 GE2/0/0
fc01::1/64 fc02::1/64 fc02::2/64 fc03::1/64
PC1 PC2
fc01::2/64 fc03::2/64
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure IP addresses for physical interfaces so that devices can communicate on the IPv4
network.
2. Create tunnel interfaces on RouterA and RouterC, set up a GRE tunnel between them, and
specify the source and destination addresses of the tunnel interfaces, so that encapsulated
packets can be forwarded using OSPF routes. The source address is the IP address of the
interface sending packets, and the destination address is the IP address of the interface
receiving packets.
3. Configure static routes on RouterA and RouterC, so that traffic between PC1 and PC2 can
be forwarded through the GRE tunnel. Set the destination address to the network segment
connected to the peer PC and the outbound interface to the tunnel interface on the local
device.
Procedure
Step 1 Configure an IP address for each physical interface.
# Configure RouterA.
<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] undo portswitch
[RouterA-GigabitEthernet1/0/0] ip address 10.1.1.1 255.255.255.0
[RouterA-GigabitEthernet1/0/0] quit
[RouterA] ipv6
[RouterA] interface gigabitethernet 2/0/0
[RouterA-GigabitEthernet2/0/0] undo portswitch
[RouterA-GigabitEthernet2/0/0] ipv6 enable
[RouterA-GigabitEthernet2/0/0] ipv6 address fc01::1 64
[RouterA-GigabitEthernet2/0/0] quit
# Configure RouterB.
<Huawei> system-view
[Huawei] sysname RouterB
[RouterB] interface gigabitethernet 1/0/0
[RouterB-GigabitEthernet1/0/0] undo portswitch
[RouterB-GigabitEthernet1/0/0] ip address 10.1.1.2 255.255.255.0
[RouterB-GigabitEthernet1/0/0] quit
[RouterB] interface gigabitethernet 2/0/0
[RouterB-GigabitEthernet2/0/0] undo portswitch
[RouterB-GigabitEthernet2/0/0] ip address 10.1.2.1 255.255.255.0
[RouterB-GigabitEthernet2/0/0] quit
# Configure RouterC.
<Huawei> system-view
[Huawei] sysname RouterC
[RouterC] interface gigabitethernet 1/0/0
[RouterC-GigabitEthernet1/0/0] undo portswitch
[RouterC-GigabitEthernet1/0/0] ip address 10.1.2.2 255.255.255.0
[RouterC-GigabitEthernet1/0/0] quit
[RouterC] ipv6
[RouterC] interface gigabitethernet 2/0/0
[RouterC-GigabitEthernet2/0/0] undo portswitch
[RouterC-GigabitEthernet2/0/0] ipv6 enable
[RouterC-GigabitEthernet2/0/0] ipv6 address fc03::1 64
[RouterC-GigabitEthernet2/0/0] quit
# Configure RouterC.
[RouterC] ip route-static 10.1.1.1 255.255.255.0 10.1.2.1
# Configure RouterC.
[RouterC] interface tunnel 0/0/1
[RouterC-Tunnel0/0/1] tunnel-protocol gre
[RouterC-Tunnel0/0/1] ipv6 enable
[RouterC-Tunnel0/0/1] ipv6 address fc02::2 64
[RouterC-Tunnel0/0/1] source 10.1.2.2
[RouterC-Tunnel0/0/1] destination 10.1.1.1
[RouterC-Tunnel0/0/1] quit
# Configure RouterA.
[RouterA] ipv6 route-static fc03::1 64 tunnel 0/0/1
# Configure RouterC.
[RouterC] ipv6 route-static fc01::1 64 tunnel 0/0/1
# Ping the IPv4 address of RouterA from RouterC. RouterC can receive a Reply packet from
RouterA.
[RouterC] ping 10.1.1.1
PING 10.1.1.1: 56 data bytes, press CTRL_C to break
Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=255 time=84 ms
Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=255 time=27 ms
Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=255 time=25 ms
Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=255 time=3 ms
Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=255 time=24 ms
--- 10.1.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/32/84 ms
# Ping the IPv6 address of RouterA from RouterC. RouterC can receive a Reply packet from
RouterA.
[RouterC] ping ipv6 fc01::1
PING fc01::1 : 56 data bytes, press CTRL_C to break
Reply from fc01::1
bytes=56 Sequence=1 hop limit=64 time = 28 ms
Reply from fc01::1
bytes=56 Sequence=2 hop limit=64 time = 27 ms
Reply from fc01::1
bytes=56 Sequence=3 hop limit=64 time = 26 ms
Reply from fc01::1
bytes=56 Sequence=4 hop limit=64 time = 27 ms
Reply from fc01::1
bytes=56 Sequence=5 hop limit=64 time = 26 ms
--- fc01::1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 26/26/28 ms
----End
Configuration Files
l Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.1.1.1 255.255.255.0
#
interface GigabitEthernet2/0/0
undo portswitch
ipv6 enable
ipv6 address fc01::1/64
#
interface Tunnel0/0/1
ipv6 enable
ipv6 address fc02::1/64
tunnel-protocol gre
source 10.1.1.1
destination 10.1.2.2
#
ip route-static 10.1.2.0 255.255.255.0 10.1.1.2
#
ipv6 route-static fc03:: 64 Tunnel0/0/1
#
return
#
ipv6 route-static fc01:: 64 Tunnel0/0/1
#
return
Figure 11-16 Networking diagram for configuring an automatic IPv6 over IPv4 tunnel
IPv4
Dual Dual
Stack Stack
RouterA GE1/0/0 GE1/0/0
2.1.1.1/8
RouterB
2.1.1.2/8
Tunnel0/0/1 Tunnel0/0/1
IPv6 ::2.1.1.1/96 ::2.1.1.2/96 IPv6
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure IP addresses for physical interfaces so that devices can communicate on the IPv4
backbone network.
2. Configure IPv6 addresses and source interfaces for tunnel interfaces so that devices can
communicate with hosts on the two IPv6 networks.
3. Set the tunnel protocol to automatic so that hosts on the two IPv6 networks can
communicate through the IPv4 network.
Procedure
Step 1 Configure RouterA.
[RouterA-GigabitEthernet1/0/0] quit
# View the IPv6 status of tunnel0/0/1 on RouterA. You can see that the tunnel status is Up.
[RouterA] display ipv6 interface tunnel 0/0/1
Tunnel0/0/1 current state : UP
IPv6 protocol current state : UP
IPv6 is enabled, link-local address is FE80::201:101
Global unicast address(es):
::2.1.1.1, subnet is ::/96
Joined group address(es):
FF02::1:FF01:101
FF02::2
FF02::1
MTU is 1500 bytes
ND reachable time is 30000 milliseconds
ND retransmit interval is 1000 milliseconds
# Ping the IPv6 address of the peer device that is compatible with the IPv4 address from RouterA.
The IPv6 address is pinged successfully.
[RouterA] ping ipv6 ::2.1.1.2
PING ::2.1.1.2 : 56 data bytes, press CTRL_C to break
Reply from ::2.1.1.2
bytes=56 Sequence=1 hop limit=64 time = 30 ms
Reply from ::2.1.1.2
bytes=56 Sequence=2 hop limit=64 time = 40 ms
Reply from ::2.1.1.2
bytes=56 Sequence=3 hop limit=64 time = 50 ms
Reply from ::2.1.1.2
bytes=56 Sequence=4 hop limit=64 time = 1 ms
Reply from ::2.1.1.2
bytes=56 Sequence=5 hop limit=64 time = 50 ms
--- ::2.1.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/34/50 ms
----End
Configuration Files
l Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 2.1.1.1 255.0.0.0
#
interface Tunnel 0/0/1
ipv6 enable
ipv6 address ::2.1.1.1/96
tunnel-protocol ipv6-ipv4 auto-tunnel
source GigabitEthernet1/0/0
#
return
Networking Requirements
As shown in Figure 11-17, the IPv6 network-side interface of 6to4 router RouterA connects to
a 6to4 network. RouterB is a 6to4 relay agent and connects to the IPv6 Internet (2001::/64).
RouterA and RouterB are connected through an IPv4 backbone network. A 6to4 tunnel needs
to be set up between RouterA and RouterB so that hosts on the 6to4 network and the IPv6 network
can communicate.
IPv4
GE1/0/0 GE1/0/0
2.1.1.1 2.1.1.2
RouterA RouterB
GE2/0/0 GE2/0/0
2002:201:101:1::1/64 2001::1/64
Tunnel 0/0/1 Tunnel0/0/1
2002:201:101::1/64 2002:201:102::1/64
PC1 2002:201:101:1::2 2002:201:102:1::2 PC2
IPv6 IPv6
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure an IPv4/IPv6 dual stack on routers so that they can access the IPv4 network and
the IPv6 network.
2. Configure a 6to4 tunnel on routers to connect IPv6 networks through the IPv4 backbone
network.
3. Configure a static route between RouterA and RouterB so that they can communicate
through the IPv4 backbone network.
Procedure
Step 1 Configure RouterA.
# Ping the IPv6 address of GE2/0/0 on RouterB from RouterA. The IPv6 address is pinged
successfully.
[RouterA] ping ipv6 2001::1
PING 2001::1 : 56 data bytes, press CTRL_C to break
Reply from 2001::1
bytes=56 Sequence=1 hop limit=64 time = 29 ms
Reply from 2001::1
bytes=56 Sequence=2 hop limit=64 time = 5 ms
Reply from 2001::1
bytes=56 Sequence=3 hop limit=64 time = 5 ms
Reply from 2001::1
bytes=56 Sequence=4 hop limit=64 time = 5 ms
Reply from 2001::1
bytes=56 Sequence=5 hop limit=64 time = 26 ms
--- 2001::1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 5/14/29 ms
----End
Configuration Files
l Configuration file of RouterA
#
sysname RouterA
#
ipv6
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 2.1.1.1 255.0.0.0
#
interface GigabitEthernet2/0/0
undo portswitch
ipv6 enable
ipv6 address 2002:201:101:1::1/64
#
interface Tunnel 0/0/1
ipv6 enable
ipv6 address 2002:201:101::1/64
tunnel-protocol ipv6-ipv4 6to4
source pos1/0/0
#
ipv6 route-static :: 0 2002:201:102::1
#
ipv6 route-static 2002:: 16 Tunnel 0/0/1
#
return
Networking Requirements
As shown in Figure 11-18, The IPv6 host needs to be connected to the IPv6 network through a
border router. The IPv6 host and border router support ISATAP. An ISATAP tunnel needs to
be set up between the IPv6 host and the border router.
ISATAP
IPv6 Router
IPv4
network network
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure an IPv4/IPv6 dual stack on the router so that the router can communicate with
devices on the IPv4 network and the IPv6 network.
2. Configure an ISATAP tunnel on the router so that IPv6 hosts on the IPv4 network can
communicate with IPv6 hosts on the IPv6 network.
3. Configure a static route.
Procedure
Step 1 Configure the ISATAP router.
# Enable the IPv4/IPv6 dual stack and configure an IP address for each interface.
<Huawei> system-view
[Huawei] sysname Router
[Router] ipv6
[Router] interface gigabitethernet 1/0/0
[Router-GigabitEthernet1/0/0] undo portswitch
[Router-GigabitEthernet1/0/0] ipv6 enable
[Router-GigabitEthernet1/0/0] ipv6 address 3001::1/64
[Router-GigabitEthernet1/0/0] quit
[Router] interface gigabitethernet 2/0/0
[Router-GigabitEthernet2/0/0] undo portswitch
[Router-GigabitEthernet2/0/0] ip address 2.1.1.1 255.0.0.0
[Router-GigabitEthernet2/0/0] quit
The ISATAP host is relevant to the operating system. The host running Windows 7 is used as
an example.
# Run the following command to add a static route to the border router. IPv6 has been installed
by default in Windows 7 operating system.
C:\> netsh interface ipv6 isatap set router 2.1.1.1
C:\> netsh interface ipv6 isatap set router 2.1.1.1 enabled
The preceding information shows that the host obtains the prefix 2001::/64 and generates the
address 2001::200:5efe:2.1.1.2, and the ISATAP tunnel has been set up successfully.
Step 3 Configure the IPv6 host.
# Configure a static route to the border router tunnel on the IPv6 host so that PCs on two different
networks can communicate through the ISATAP tunnel.
C:\> netsh interface ipv6 set route 2001::/64 3001::1
# Ping the global unicast address of the tunnel interface on the ISATAP host running Windows
XP operating system from the ISATAP router.
[Router] ping ipv6 2001::5efe:2.1.1.2
PING 2001::5efe:2.1.1.2 : 56 data bytes, press CTRL_C to break
Reply from 2001::5EFE:201:102
bytes=56 Sequence=1 hop limit=64 time = 4 ms
Reply from 2001::5EFE:201:102
# Ping the global unicast address of the ISATAP router from the ISATAP host running Windows
XP operating system.
C:\> ping6 2001::5efe:2.1.1.1
Pinging 2001::5efe:2.1.1.1
from 2001::5efe:2.1.1.2 with 32 bytes of data:
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
Reply from 2001::5efe:2.1.1.1: bytes=32 time=1ms
Ping statistics for 2001::5efe:2.1.1.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms
# Ping the IPv6 host from the ISATAP host running Windows XP operating system. They can
ping each other.
C:\> ping6 3001::2
Pinging 3001::2 with 32 bytes of data:
Reply from 3001::2: time<1ms
Reply from 3001::2: time<1ms
Reply from 3001::2: time<1ms
Reply from 3001::2: time<1ms
Ping statistics for 3001::2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
----End
Configuration Files
Configuration file of the ISATAP router
#
sysname ISATAP
#
ipv6
#
interface GigabitEthernet1/0/0
undo portswitch
ipv6 enable
ipv6 address 3001::1/64
#
interface GigabitEthernet2/0/0
undo portswitch
ip address 2.1.1.1 255.0.0.0
#
interface Tunnel0/0/2
ipv6 enable
ipv6 address 2001::/64 eui-64
undo ipv6 nd ra halt
During the later stage of IPv4 to IPv6 transition, the IPv4 over IPv6 tunnel is used to connect
isolated IPv4 sites.
During the later stage of IPv4 to IPv6 transition, a large number of IPv6 networks have been
deployed and isolated IPv4 sites may exist. You can create a tunnel on an IPv6 network to connect
isolated IPv4 sites, which is similar to deploying the VPN on the IP network using tunnel
technology. The tunnel connecting IPv4 isolated sites on the IPv6 network is called an IPv4 over
IPv6 tunnel.
Figure 12-1 shows how to apply the IPv4 over IPv6 tunnel.
Figure 12-1 Networking diagram for applying the IPv4 over IPv6 tunnel
1. On the border device, the IPv4/IPv6 dual protocol stack is enabled and the IPv4 over IPv6
tunnel is configured.
2. After the border device receives a packet not destined for the device from the IPv4 network,
the device appends an IPv6 header to the IPv4 packet and encapsulates the IPv4 packet as
an IPv6 packet.
3. On the IPv6 network, the encapsulated packet is transmitted to the remote border device.
4. The remote border device decapsulates the packet, removes the IPv6 header, and sends the
decapsulated IPv4 packet to the IPv4 network.
Pre-configuration Tasks
Before configuring an IPv4 over IPv6 tunnel, complete the following task:
Context
Configuring a tunnel interface includes configuring the protocol type, source address, and
destination address and IP address.
NOTE
The device does not support fragmentation of packets that are transmitted over the IPv4 over IPv6 tunnel.
Therefore, the IPv4 MTU of the tunnel interface must meet the following conditions:
IPv4 MTU of the tunnel interface < ( IPv6 MTU of the physical interface - Header length of IPv6 packets
on the IPv4 over IPv6 tunnel )
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface tunnel interface-number
Step 3 Run:
tunnel-protocol ipv4-ipv6
Step 4 Run:
source { source-ip-address | interface-type interface-number }
Step 5 Run:
destination dest-ip-address
----End
Context
Packets can be forwarded correctly only when devices at the two ends of a tunnel are configured
with forwarding routes. Perform the following configurations on devices at the two ends of the
tunnel.
Procedure
Step 1 Run:
system-view
Step 2 Use either of the following methods to configure routes passing through a tunnel interface.
l Run:
ip route-static ip-address { mask | mask-length } tunnel interface-number
----End
Context
You can perform one or more following configurations to optimize IPv4 over IPv6 tunnel
performance.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface tunnel interface-number
Step 3 Run:
tunnel ipv4-ipv6 encapsulation-limit encapsulation-limit
Step 4 Run:
tunnel ipv4-ipv6 flow-label label-value
Step 5 Run:
tunnel ipv4-ipv6 hop-limit hop-limit
Step 6 Run:
tunnel ipv4-ipv6 traffic-class { original | class-value }
----End
Prerequisites
All configurations of the IPv4 over IPv6 tunnel are complete.
Procedure
l Run the display interface tunnel [ interface-number ] command to check the running status
of the tunnel interface.
l Run the display ip routing-table command to check the routing table.
----End
12.3.1 Monitoring the Running Status of the IPv4 over IPv6 Tunnel
Context
In routine maintenance, you can run the following commands in any view to monitor the running
status of the IPv4 over IPv6 tunnel.
Procedure
l Run the display interface tunnel [ interface-number ] command in any view to view the
running status of the tunnel interface.
----End
Networking Requirements
As shown in Figure 12-2, two IPv4 networks are connected to an IPv6 network through RT1
and RT5. Border devices RT2 and RT4 on the IPv6 network support the IPv4/IPv6 dual stack.
An IPv4 over IPv6 tunnel needs to be set up between RT2 and RT4 so that physically isolated
IPv4 networks can communicate.
Figure 12-2 Networking diagram for configuring an IPv4 over IPv6 tunnel
IPv6
IPv4 network
network RT2 GE1/0/0 GE1/0/0
GE1/0/0 2001::2/64 RT3 2002::2/64 RT4
10.1.2.1/30
GE1/0/0 GE2/0/0
RT1 10.1.2.2/30 GE2/0/0 GE2/0/0
2001::1/64 2002::1/64 10.1.3.1/30
GE1/0/0
10.1.3.2/30
RT5
IPv4
network
Configuration Roadmap
The configuration roadmap is as follows:
1. Configure an IPv4 over IPv6 tunnel on the border devices at both ends of the IPv6 network.
2. Use a dynamic routing protocol to configure a route for the tunnel interface to forward
packets.
Configuration Procedures
1. Configure an IPv6 address for the physical interface and enable IPv6 capability for IS-IS
on the IPv6 network to implement IP connectivity of the IPv6 network.
# Configure RT2.
<Huawei> system-view
[Huawei] sysname RT2
[RT2] ipv6
[RT2] interface gigabitethernet 2/0/0
[RT2-GigabitEthernet2/0/0] undo portswitch
[RT2-GigabitEthernet2/0/0] ipv6 enable
[RT2-GigabitEthernet2/0/0] ipv6 address 2001::1 64
[RT2-GigabitEthernet2/0/0] quit
[RT2] isis 1
[RT2-isis-1] network-entity 10.0000.0000.0001.00
[RT2-isis-1] ipv6 enable topology standard
[RT2-isis-1] quit
[RT2] interface gigabitethernet 2/0/0
[RT2-GigabitEthernet2/0/0] isis ipv6 enable 1
[RT2-GigabitEthernet2/0/0] quit
# Configure RT3.
<Huawei> system-view
[Huawei] sysname RT3
[RT3] ipv6
[RT3] interface gigabitethernet 1/0/0
[RT3-GigabitEthernet1/0/0] undo portswitch
[RT3-GigabitEthernet1/0/0] ipv6 enable
[RT3-GigabitEthernet1/0/0] ipv6 address 2001::2 64
[RT3-GigabitEthernet1/0/0] quit
[RT3] interface gigabitethernet 2/0/0
[RT3-GigabitEthernet2/0/0] undo portswitch
[RT3-GigabitEthernet2/0/0] ipv6 enable
[RT3-GigabitEthernet2/0/0] ipv6 address 2002::1 64
[RT3-GigabitEthernet2/0/0] quit
[RT3] isis 1
[RT3-isis-1] network-entity 10.0000.0000.0002.00
[RT3-isis-1] ipv6 enable topology standard
[RT3-isis-1] quit
[RT3] interface gigabitethernet 1/0/0
[RT3-GigabitEthernet1/0/0] isis ipv6 enable 1
[RT3-GigabitEthernet1/0/0] quit
[RT3] interface gigabitethernet 2/0/0
[RT3-GigabitEthernet2/0/0] isis ipv6 enable 1
[RT3-GigabitEthernet2/0/0] quit
# Configure RT4.
<Huawei> system-view
[Huawei] sysname RT4
[RT4] ipv6
[RT4] interface gigabitethernet 1/0/0
[RT4-GigabitEthernet1/0/0] undo portswitch
[RT4-GigabitEthernet1/0/0] ipv6 enable
[RT4-GigabitEthernet1/0/0] ipv6 address 2002::2 64
[RT4-GigabitEthernet1/0/0] quit
[RT4] isis 1
[RT4-isis-1] network-entity 10.0000.0000.0003.00
[RT4-isis-1] ipv6 enable topology standard
[RT4-isis-1] quit
[RT4] interface gigabitethernet 1/0/0
[RT4-GigabitEthernet1/0/0] isis ipv6 enable 1
[RT4-GigabitEthernet1/0/0] quit
2. Configure an IPv4 address for the physical interface and configure OSPF on the IPv4
network to implement IP connectivity of the IPv4 network.
# Configure RT1.
<Huawei> system-view
[Huawei] sysname RT1
[RT1] interface gigabitethernet 1/0/0
[RT1-GigabitEthernet1/0/0] undo portswitch
[RT1-GigabitEthernet1/0/0] ip address 10.1.2.2 30
[RT1-GigabitEthernet1/0/0] quit
[RT1] ospf 1
[RT1-ospf-1] area 0
[RT1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.3
# Configure RT2.
[RT2] interface gigabitethernet 1/0/0
[RT2-GigabitEthernet1/0/0] undo portswitch
[RT2-GigabitEthernet1/0/0] ip address 10.1.2.1 30
[RT2-GigabitEthernet1/0/0] quit
[RT2] ospf 1
[RT2-ospf-1] area 0
[RT2-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.3
# Configure RT4.
[RT4] interface gigabitethernet 1/0/0
[RT4-GigabitEthernet1/0/0] ip address 10.1.3.1 30
[RT4-GigabitEthernet1/0/0] quit
[RT4] ospf 1
[RT4-ospf-1] area 0
[RT4-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.3
# Configure RT5.
<Huawei> system-view
[Huawei] sysname RT5
[RT5] interface gigabitethernet 1/0/0
[RT5-GigabitEthernet1/0/0] undo portswitch
[RT5-GigabitEthernet1/0/0] ip address 10.1.3.2 30
[RT5-GigabitEthernet1/0/0] quit
[RT5] ospf 1
[RT5-ospf-1] area 0
[RT5-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.3
# Configure RT4.
[RT4] interface tunnel 0/0/1
[RT4-Tunnel0/0/1] tunnel-protocol ipv4-ipv6
[RT4-Tunnel0/0/1] ip address 10.1.1.2 30
[RT4-Tunnel0/0/1] source gigabitethernet 1/0/0
[ET4-Tunnel0/0/1] destination 2001::1
4. Use a dynamic routing protocol to configure a route for the tunnel interface to forward
packets.
# Configure RT2.
[RT2] ospf 1
[RT2-ospf-1] area 0
[RT2-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.3
[RT2-ospf-1-area-0.0.0.0] quit
[RT2-ospf-1] quit
# Configure RT4.
[RT4] ospf 1
[RT4-ospf-1] area 0
[RT4-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.3
Check the IPv4 routing table on RT2 and RT4. You can see that the outbound interface of
the route to the remote IPv4 network is a tunnel interface.
[RT2] display ip routing-table
Routing Tables: Public
Destinations : 9 Routes : 9
Destination/Mask Proto Pre Cost NextHop Interface
1.1.1.1/32 Direct 0 0 127.0.0.1 InLoopBack0
10.1.1.0/30 Direct 0 0 10.1.1.1 Tunnel0/0/2
10.1.1.1/32 Direct 0 0 127.0.0.1 Tunnel2/0/0
10.1.2.0/30 Direct 0 0 10.1.2.1 GigabitEthernet1/0/0
10.1.2.1/32 Direct 0 0 127.0.0.1 GigabitEthernet1/0/0
10.1.2.2/32 Direct 0 0 10.1.2.2 GigabitEthernet1/0/0
10.1.3.0/24 OSPF 10 2 10.1.1.2 Tunnel0/0/2
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoopBack0
Configuration Files
l Configuration file of RT1
#
sysname RT1
#
interface GigabitEthernet1/0/0
undo portswitch
ip address 10.1.2.2 255.255.255.252
#
ospf 1
area 0.0.0.0
network 10.1.2.0 0.0.0.3
#
return