Configuration Guide - Ethernet (V100R006C00 - 01)

Quidway S2700 Series Ethernet Switches
V100R006C00
Configuration Guide - Ethernet

Issue
01
Date
2011-07-15
HUAWEI TECHNOLOGIES CO., LTD.
Copyright Huawei Technologies Co., Ltd. 2011. All rights reserved.

No part of this document may be reproduced or transmitted in any form or by any means without prior written
consent of Huawei Technologies Co., Ltd.
Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the
customer. All or part of the products, services and features described in this document may not be within the
purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,
and recommendations in this document are provided "AS IS" without warranties, guarantees or representations
of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Huawei Technologies Co., Ltd.

Address:
Huawei Industrial Base

Bantian, Longgang
Shenzhen 518129
People's Republic of China
Website:
http://www.huawei.com
Email:
support@huawei.com
Issue 01 (2011-07-15)
Huawei Proprietary and Confidential

Copyright Huawei Technologies Co., Ltd.

About This Document
About This Document

Intended Audience
This document provides the basic concepts, configuration procedures, and configuration
examples in different application scenarios of the Ethernet feature supported by the S2700
device.
This document describes how to configure the Ethernet feature.
This document is intended for:
l
Data configuration engineers
Commissioning engineers
Network monitoring engineers
System maintenance engineers
Symbol Conventions
The symbols that may be found in this document are defined as follows.
Symbol
Description
DANGER
WARNING
CAUTION
Issue 01 (2011-07-15)
Indicates a hazard with a high level of risk, which if not

avoided, will result in death or serious injury.
Indicates a hazard with a medium or low level of risk, which
if not avoided, could result in minor or moderate injury.
Indicates a potentially hazardous situation, which if not
avoided, could result in equipment damage, data loss,
performance degradation, or unexpected results.
TIP
Indicates a tip that may help you solve a problem or save

time.
NOTE
Provides additional information to emphasize or supplement

important points of the main text.

ii

About This Document
Command Conventions
The command conventions that may be found in this document are defined as follows.
Convention
Description
Boldface
The keywords of a command line are in boldface.
Italic
Command arguments are in italics.
[]
Items (keywords or arguments) in brackets [ ] are optional.
{ x | y | ... }
Optional items are grouped in braces and separated by vertical

bars. One item is selected.
[ x | y | ... ]
Optional items are grouped in brackets and separated by vertical

bars. One item is selected or no item is selected.
{ x | y | ... }*
Optional items are grouped in braces and separated by vertical

bars. A minimum of one item or a maximum of all items can be
selected.
[ x | y | ... ]*
Optional items are grouped in brackets and separated by vertical

bars. Several items or no item can be selected.
&<1-n>
The parameter before the & sign can be repeated 1 to n times.
A line starting with the # sign is comments.
Change History
Updates between document issues are cumulative. Therefore, the latest document issue contains
all updates made in previous issues.
Changes in Issue 01 (2011-07-15)

Initial commercial release.
Issue 01 (2011-07-15)

iii

Contents
Contents
About This Document.....................................................................................................................ii
1 Ethernet Interface Configuration...............................................................................................1
1.1 Introduction to Ethernet Interfaces.....................................................................................................................2
1.2 Ethernet Interface Features Supported by the S2700.........................................................................................2
1.3 Configuring Basic Attributes of the Ethernet Interface......................................................................................3
1.3.1 Establishing the Configuration Task.........................................................................................................3
1.3.2 (Optional) Configuring a Description for an Interface..............................................................................3
1.3.3 (Optional) Configuring the Cable Type on an Interface............................................................................4
1.3.4 (Optional) Setting the Duplex Mode.........................................................................................................5
1.3.5 (Optional) Setting the Rate of an Interface................................................................................................5
1.3.6 (Optional) Enabling Auto-Negotiation......................................................................................................6
1.3.7 (Optional) Switching Between Optical and Electrical Interfaces..............................................................6
1.3.8 Checking the Configuration.......................................................................................................................7
1.4 Configuring Advanced Attributes of an Ethernet Interface................................................................................7
1.4.1 Establishing the Configuration Task.........................................................................................................7
1.4.2 (Optional) Configuring Loopback on the Ethernet Interface....................................................................8
1.4.3 (Optional) Configuring the Interface Group..............................................................................................8
1.4.4 (Optional) Enabling Flow Control.............................................................................................................9
1.4.5 (Optional) Enabling Auto-Negotiation of Flow Control...........................................................................9
1.4.6 (Optional) Enabling Port Isolation..........................................................................................................10
1.4.7 (Optional) Performing a Cable Test on an Interface...............................................................................10
1.4.8 (Optional) Configuring a Loopback Test on an Interface.......................................................................11
1.4.9 Checking the Configuration.....................................................................................................................12
1.5 Maintaining Ethernet Interfaces.......................................................................................................................12
1.5.1 Debugging Ethernet Interfaces................................................................................................................12
1.6 Configuration Examples...................................................................................................................................12
1.6.1 Example for Configuring Port Isolation..................................................................................................12
2 Link Aggregation Configuration..............................................................................................15

2.1 Introduction to Link Aggregation.....................................................................................................................16
2.2 Link Aggregation Supported by the S2700......................................................................................................16
2.3 Configuring Link Aggregation in Manual Load Balancing Mode...................................................................17
2.3.1 Establishing the Configuration Task.......................................................................................................17
Issue 01 (2011-07-15)

iv

Contents
2.3.2 Configuring the Eth-Trunk to Work in Manual Load Balancing Mode..................................................18

2.3.3 Adding Member Interfaces to an Eth-Trunk...........................................................................................19
2.3.4 (Optional) Configuring the Load Balancing Mode.................................................................................20
2.3.5 (Optional) Limiting the Number of Active Interfaces.............................................................................21
2.4 Configuring Link Aggregation in Static LACP Mode.....................................................................................23
2.4.2 Configuring the Eth-Trunk to Work in Static LACP Mode....................................................................23
2.4.3 Adding Member Interfaces to an Eth-Trunk...........................................................................................24
2.4.4 (Optional) Configuring the Load Balancing Mode.................................................................................25
2.4.5 (Optional) Limiting the Number of Active Interfaces.............................................................................27
2.4.6 (Optional) Setting the LACP Priority of the System...............................................................................28
2.4.7 (Optional) Setting the LACP Priority of an Interface..............................................................................28
2.4.8 (Optional) Enabling LACP Preemption and Setting the Delay for LACP Preemption...........................29
2.4.9 (Optional) Setting the Timeout Interval for Receiving LACP Packets...................................................30
2.4.10 Checking the Configuration...................................................................................................................30
2.5 Maintaining Link Aggregation.........................................................................................................................31
2.5.1 Clearing Statistics of LACP Packets.......................................................................................................31
2.5.2 Debugging the Link Aggregation Group.................................................................................................31
2.5.3 Monitoring the Operation Status of the Link Aggregation Group..........................................................32
2.6.1 Example for Configuring Link Aggregation in Manual Load Balancing Mode.....................................32
2.6.2 Example for Configuring Link Aggregation in Static LACP Mode.......................................................35
3 VLAN Configuration..................................................................................................................39
3.1 Introduction......................................................................................................................................................41
3.2 VLAN Features Supported by the S2700.........................................................................................................48
3.3 Dividing a LAN into VLANs...........................................................................................................................50
3.3.2 Dividing a LAN into VLANs Based on Ports.........................................................................................52
3.3.3 Dividing a LAN into VLANs Based on MAC Addresses.......................................................................54
3.4 Creating a VLANIF Interface...........................................................................................................................55
3.4.2 Creating a VLANIF Interface..................................................................................................................56
3.4.3 Assigning an IP Address to a VLANIF Interface....................................................................................57
3.4.4 (Optional) Setting a Delay After Which a VLANIF Interface Goes Down............................................57
3.4.5 (Optional) Setting the MTU of a VLANIF Interface...............................................................................58
3.5 Configuring Inter-VLAN Communication.......................................................................................................59
3.5.2 Configuring VLANIF Interfaces for Inter-VLAN Communication........................................................60
Issue 01 (2011-07-15)


Contents
3.6 Configuring VLAN Aggregation to Save IP Addresses...................................................................................62

3.6.2 Creating a Sub-VLAN.............................................................................................................................63
3.6.3 Creating a Super-VLAN..........................................................................................................................64
3.6.4 Assigning an IP Address to the VLANIF Interface of a Super-VLAN...................................................65
3.6.5 (Optional) Enabling Proxy ARP on the VLANIF Interface of a Super-VLAN......................................65
3.7 Configuring a Voice VLAN to Transmit Voice Data.......................................................................................67
3.7.2 Enabling the Voice VLAN Function.......................................................................................................69
3.7.3 Configuring an OUI for a Voice VLAN..................................................................................................69
3.7.4 (Optional) Setting an Aging Timer for a Voice VLAN...........................................................................70
3.7.5 (Optional) Configuring an 802.1p Priority and a DSCP Value for the Voice VLAN.............................71
3.7.6 (Optional) Configuring the Mode in Which Ports Are Added to a Voice VLAN...................................71
3.7.7 (Optional) Configuring the Working Mode for a Voice VLAN..............................................................72
3.7.8 (Optional) Configuring a Port to Communicate with a Voice Device of Another Vendor.....................73
3.8 Configuring an mVLAN to Implement Integrated Management.....................................................................74
3.8.2 Configuring an mVLAN..........................................................................................................................75
3.8.3 Configuring a VLANIF Interface for an mVLAN..................................................................................76
3.9 Maintaining VLAN...........................................................................................................................................76
3.9.1 Clearing the Statistics of VLAN Packets................................................................................................77
3.10 Configuration Examples.................................................................................................................................77
3.10.1 Example for Configuring Interface-based VLANs................................................................................77
3.10.2 Example for Configuring MAC Address-based VLAN Assignment....................................................80
3.10.3 Example for Implementing Communication Between VLANs by Using VLANIF Interfaces.............82
3.10.4 Example for Configuring VLAN Aggregation......................................................................................84
3.10.5 Example for Configuring a Voice VLAN in Auto Mode......................................................................87
3.10.6 Example for Configuring a Voice VLAN in Manual Mode..................................................................90
4 VLAN Mapping Configuration................................................................................................94

4.1 Introduction to VLAN Mapping.......................................................................................................................95
4.2 VLAN Mapping Features Supported by the S2700..........................................................................................95
4.3 Configuring VLAN Mapping of Single VLAN Tag........................................................................................95
4.3.2 Replacing a Single Tag............................................................................................................................96
4.4 Configuring Global VLAN Mapping...............................................................................................................97
4.4.2 Configuring Global VLAN Mapping......................................................................................................98
Issue 01 (2011-07-15)

vi

Contents

4.5.1 Example for Configuring Single-Tag VLAN Mapping..........................................................................99
4.5.2 Example for Configuring N:1 VLAN Mapping....................................................................................102
4.5.3 Example for Configuring Global VLAN Mapping...............................................................................104
5 QinQ Configuration..................................................................................................................107
5.1 Concept of QinQ.............................................................................................................................................108
5.2 QinQ Features Supported by the S2700.........................................................................................................108
5.3 Configuring QinQ on an Interface..................................................................................................................108
5.3.1 Establishing the Configuration Task.....................................................................................................108
5.3.2 Setting the Link Type of an Interface....................................................................................................109
5.3.3 Specifying the Outer VLAN ID.............................................................................................................109
5.4 Configuring QinQ Stacking on a VLANIF Interface.....................................................................................110
5.4.2 Configuring QinQ Stacking on a VLANIF Interface............................................................................112
5.5 Setting the Protocol Type in the Outer VLAN Tag........................................................................................113
5.5.2 Configuring the Type of an Interface....................................................................................................113
5.5.3 Setting the Protocol Type in the Outer VLAN Tag...............................................................................114
5.6.1 Example for Configuring QinQ on Interfaces.......................................................................................115
5.6.2 Example for Configuring QinQ Stacking on the VLANIF Interface....................................................118
6 GVRP Configuration................................................................................................................121
6.1 GVRP Overview.............................................................................................................................................122
6.2 GVRP Features Supported by the S2700.......................................................................................................125
6.3 Configuring GVRP.........................................................................................................................................126
6.3.2 Enabling GVRP.....................................................................................................................................126
6.3.3 (Optional) Setting the Registration Mode of a GVRP Interface............................................................127
6.3.4 (Optional) Setting the GARP Timers....................................................................................................128
6.4 Maintaining GVRP.........................................................................................................................................129
6.4.1 Clearing GARP Statistics......................................................................................................................129
6.5.1 Example for Configuring GVRP...........................................................................................................130
7 MAC Address Table Configuration.......................................................................................134

7.1 MAC Address Table Overview......................................................................................................................136
7.2 MAC Address Features Supported by the S2700...........................................................................................137
7.3 Configuring a Static MAC Address Entry......................................................................................................138
Issue 01 (2011-07-15)

vii

Contents
7.4 Configuring a Blackhole MAC Address Entry...............................................................................................140

7.5 Setting the Aging Time of Dynamic MAC Address Entries..........................................................................141
7.6 Disabling MAC Address Learning.................................................................................................................142
7.6.2 Disabling MAC Address Learning on an Interface...............................................................................143
7.6.3 Disabling MAC Address Learning in a VLAN.....................................................................................144
7.7 Limiting the Number of Learned MAC Addresses........................................................................................144
7.7.2 Limiting the Number of MAC Addresses Learned on an Interface......................................................146
7.8 Configuring Port Security...............................................................................................................................147
7.8.2 Configuring the Secure Dynamic MAC Function on an Interface........................................................148
7.8.3 Configuring the Sticky MAC Function on an Interface........................................................................149
7.9 Configuring the S2700 to Discard Packets with an All-0 MAC Address......................................................150
7.10 Configuration Examples...............................................................................................................................151
7.10.1 Example for Configuring the MAC Address Table.............................................................................151
7.10.2 Example for Configuring Interface Security.......................................................................................154
8 STP/RSTP Configuration.........................................................................................................157
8.1 STP/RSTP Overview......................................................................................................................................158
8.1.1 STP/RSTP Overview.............................................................................................................................158
8.1.2 STP/RSTP Features Supported by the S2700........................................................................................163
8.2 Configuring Basic STP/RSTP Functions.......................................................................................................165
8.2.2 Configuring the STP/RSTP Mode.........................................................................................................167
8.2.3 (Optional) Configuring Switching Device Priorities.............................................................................167
8.2.4 (Optional) Setting the Path Cost for a Port............................................................................................168
8.2.5 (Optional) Configuring Port Priorities...................................................................................................169
8.2.6 Enabling STP/RSTP..............................................................................................................................170
8.3 Configuring STP/RSTP Parameters on an Interface......................................................................................171
8.3.2 Setting System Parameters....................................................................................................................174
8.3.3 Setting Port Parameters.........................................................................................................................175
8.4 Configuring RSTP Protection Functions........................................................................................................177
8.4.2 Configuring BPDU Protection on a Switching Device.........................................................................179
8.4.3 Configuring TC Protection on a Switching Device...............................................................................180
8.4.4 Configuring Root Protection on a Port..................................................................................................180
Issue 01 (2011-07-15)

viii

Contents
8.4.5 Configuring Loop Protection on a Port.................................................................................................181

8.5 Configuring STP/RSTP Interoperability Between Huawei Devices and Non-Huawei Devices....................182
8.5.2 Configuring the Proposal/Agreement Mechanism................................................................................183
8.6 Maintaining STP/RSTP..................................................................................................................................184
8.6.1 Clearing STP/RSTP Statistics...............................................................................................................185
8.7.1 Example for Configuring Basic STP Functions....................................................................................185
8.7.2 Example for Configuring Basic RSTP Functions..................................................................................189
9 MSTP Configuration.................................................................................................................194
9.1 MSTP Overview.............................................................................................................................................195
9.1.1 MSTP Introduction................................................................................................................................195
9.1.2 MSTP Features Supported by the S2700...............................................................................................203
9.2 Configuring Basic MSTP Functions...............................................................................................................205
9.2.2 Configuring the MSTP Mode................................................................................................................208
9.2.3 Configuring and Activating an MST Region........................................................................................208
9.2.4 (Optional) Setting a Priority for a Switching Device in an MSTI.........................................................210
9.2.5 (Optional) Setting a Path Cost of a Port in an MSTI.............................................................................211
9.2.6 (Optional) Setting a Port Priority in an MSTI.......................................................................................212
9.2.7 Enabling MSTP.....................................................................................................................................213
9.3 Configuring MSTP Parameters on an Interface.............................................................................................213
9.3.2 Configuring System Parameters............................................................................................................214
9.3.3 Configuring Port Parameters.................................................................................................................216
9.4 Configuring MSTP Protection Functions.......................................................................................................218
9.4.2 Configuring BPDU Protection on a Switching Device.........................................................................220
9.4.3 Configuring TC Protection on a Switching Device...............................................................................220
9.4.4 Configuring Root Protection on an Interface........................................................................................221
9.4.5 Configuring Loop Protection on an Interface........................................................................................222
9.5 Configuring MSTP Interoperability Between Huawei Devices and Non-Huawei Devices...........................223
9.5.2 Configuring a Proposal/Agreement Mechanism...................................................................................224
9.5.3 Configuring the MSTP Protocol Packet Format on an Interface...........................................................225
9.5.4 Enabling the Digest Snooping Function................................................................................................226
Issue 01 (2011-07-15)

ix

Contents
9.6 Maintaining MSTP.........................................................................................................................................226

9.6.1 Clearing MSTP Statistics.......................................................................................................................227
9.7.1 Example for Configuring Basic MSTP Functions.................................................................................227
10 Layer 2 Protocol Transparent Transmission Configuration............................................235

10.1 Overview of Layer 2 Protocol Transparent Transmission............................................................................236
10.2 Layer 2 Protocol Transparent Transmission Features Supported by the S2700...........................................237
10.3 Configuring Interface-based Layer 2 Protocol Transparent Transmission...................................................241
10.3.1 Establishing the Configuration Task...................................................................................................241
10.3.2 (Optional) Defining Characteristic Information About a Layer 2 Protocol........................................242
10.3.3 Configuring the Transparent Transmission Mode of Layer 2 Protocol Packets.................................242
10.3.4 Enabling Layer 2 Protocol Transparent Transmission on an Interface...............................................243
10.3.5 Checking Configuration......................................................................................................................244
10.4 Configuring VLAN-based Layer 2 Protocol Transparent Transmission......................................................245
10.4.2 (Optional) Defining Characteristic Information About a Layer 2 Protocol........................................245
10.4.3 Configuring the Transparent Transmission Mode of Layer 2 Protocol Packets.................................246
10.4.4 Enabling VLAN-based Layer 2 Protocol Transparent Transmission on an Interface.........................247
10.4.5 Checking the Configuration.................................................................................................................248
10.5 Maintaining Layer 2 Protocol Transparent Transmission............................................................................248
10.5.1 Debugging Layer 2 Protocol Transparent Transmission.....................................................................248
10.6.1 Example for Configuring Interface-based Layer 2 Protocol Transparent Transmission.....................249
10.6.2 Example for Configuring VLAN-based Layer 2 Protocol Transparent Transmission........................256
11 Loopback Detection Configuration.....................................................................................263

11.1 Loopback Detection Overview.....................................................................................................................264
11.2 Configuring Loopback Detection.................................................................................................................264
11.2.2 Enabling Loopback Detection.............................................................................................................266
11.2.3 Specifying VLAN IDs of Loopback Detection Packets......................................................................266
11.2.4 (Optional) Configuring an Action to Perform After a Loopback Is Detected.....................................267
11.2.5 (Optional) Setting the Interface Recovery Time After a Loop Is Removed........................................268
11.2.6 (Optional) Setting the Interval for Sending Loopback Detection Packets on an Interface.................269
11.2.7 Checking the Configuration.................................................................................................................269
11.3.1 Example for Configuring Loopback Detection...................................................................................269
Issue 01 (2011-07-15)


1 Ethernet Interface Configuration
Ethernet Interface Configuration
About This Chapter

This chapter describes the basic knowledge, methods, and examples for configuring the Ethernet
interface.
1.1 Introduction to Ethernet Interfaces
This section describes the Ethernet interfaces.
1.2 Ethernet Interface Features Supported by the S2700
This section describes the Ethernet interface features supported by the S2700.
1.3 Configuring Basic Attributes of the Ethernet Interface
This section describes how to configure the description, cable type, duplex mode, rate, and autonegotiation an Ethernet interface, and switch between the optical and electrical interfaces.
1.4 Configuring Advanced Attributes of an Ethernet Interface
This section describes how to configure the loopback on the Ethernet Interface, port group,
maximum frame size, flow control, flow control auto-negotiation, cable test, loopback test, and
port isolation.
1.5 Maintaining Ethernet Interfaces
This section describes how to maintain Ethernet interfaces.
1.6 Configuration Examples
This section provides several configuration examples of Ethernet interfaces.
Issue 01 (2011-07-15)


1.1 Introduction to Ethernet Interfaces

This section describes the Ethernet interfaces.
The Ethernet is flexible, simple, and easy to implement; therefore, it becomes an important local
area network (LAN) networking technology.
Ethernet interfaces are classified into Ethernet electrical interfaces and Ethernet optical
interfaces.
Table 1-1 shows the attributes of Ethernet electrical interfaces and Ethernet optical interfaces.
Table 1-1 Attributes of Ethernet interfaces
Interface
Type
Rate (Mbit/
s)
Auto-negotiation
Non-negotiation
Full
Duplex
Half
Duplex
Full
Duplex
Half
Duplex
Ethernet
electrical
interface
10
Yes
Yes
Yes
Yes
100
Yes
Yes
Yes
Yes
1000
Yes
No
Yes
No
100
No
No
Yes
No
1000
Yes
No
Yes
No
Ethernet
optical
interface
If the local interface works in auto-negotiation mode, the peer interface must also work in autonegotiation mode; otherwise, packet loss may occur.
1.2 Ethernet Interface Features Supported by the S2700

This section describes the Ethernet interface features supported by the S2700.
Port Group
The port group function enables you to configure multiple interfaces at the same time. You can
run commands in the port group view to configure all the interfaces in the group.
Auto-Negotiation
The auto-negotiation function allows interfaces on both ends of a link to select the same operating
parameters by exchanging capability information. Each interface sends its capability information
to the remote end and checks capabilities of the remote end. After both interfaces receive the
capability information from each other, they adopt the highest capability they support to
communicate with each other.
The interfaces negotiate the duplex mode, speed, and flow control parameters. After a successful
negotiation, the interfaces use the same duplex mode, speed, and flow control parameters.
Issue 01 (2011-07-15)


Port Isolation
The port isolation function isolates Layer 2 and Layer 3 communication between ports in the
same VLAN. This function restricts packet transmission between ports flexibly, providing a
secure and flexible network solution.
1.3 Configuring Basic Attributes of the Ethernet Interface

This section describes how to configure the description, cable type, duplex mode, rate, and autonegotiation an Ethernet interface, and switch between the optical and electrical interfaces.
1.3.1 Establishing the Configuration Task

Applicable Environment
The configuration task is applicable to the following situations:
l
You can configure the description of interfaces to facilitate the identification, maintenance,
and configuration of the interfaces.
By default, an FE electrical interface automatically identifies the network cable type. If the
interface cannot identify the cable type properly, set the cable type for the interface
manually.
By default, an FE electrical interface negotiates the duplex mode and rate with the
equipment that is directly connected to the interface. If the connected equipment does not
have the auto-negotiation capability, set the duplex mode and rate for the FE interface
manually so that the interface can work with the connected equipment.
Pre-configuration Tasks
None
Data Preparation
To configure the basic functions of Ethernet interfaces, you need the following data.
No.
Data
Number of an Ethernet interface
(Optional) Description of an interface
(Optional) Cable type of an ethernet electrical interface
(Optional) Duplex mode of an ethernet electrical interface
(Optional) Rate of an ethernet interface
1.3.2 (Optional) Configuring a Description for an Interface

Issue 01 (2011-07-15)


Context
Perform the following steps on the S2700.
Procedure
Step 1 Run:
system-view
The system view is displayed.

Step 2 Run:
interface interface-type interface-number
The interface view is displayed.

Step 3 Run:
description description
A description is configured for the interface.

By default, the description of an interface is "HUAWEI, Quidway Series, X interface". X
specifies the interface type and number.
----End
1.3.3 (Optional) Configuring the Cable Type on an Interface

Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
The Ethernet electrical interface view is displayed.

Step 3 Run:
mdi { across | auto | normal }
The cable type is configured for the Ethernet electrical interface.

By default, an Ethernet electrical interface automatically identifies the cable type.
An electrical interface can use a crossover cable or a straight through cable. If across is specified,
the interface can use a crossover cable; if normal is specified, the interface can use a straight
through cable; if auto is specified, the interface can use both types of network cables.
----End
Issue 01 (2011-07-15)


1.3.4 (Optional) Setting the Duplex Mode

Context
Do as follows on the S2700 where you need to set the duplex mode of interfaces.
Procedure
Step 1 Run:
system-view

Step 2 Run:
The Ethernet electrical interface view is displayed.

Step 3 Run:
undo negotiation auto
The auto-negotiation mode is disabled on the Ethernet electrical interface.

Step 4 Run:
duplex { full | half }
The duplex mode is set for the Ethernet electrical interface.

By default, the duplex mode of an Ethernet electrical interface is full-duplex when autonegotiation is disabled on the interface.
----End
1.3.5 (Optional) Setting the Rate of an Interface

Context
Do as follows on the S2700 where you need to set the rate of interfaces.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
undo negotiation auto
The auto-negotiation mode is disabled on the interface.

Issue 01 (2011-07-15)


Step 4 Run:
speed { 10 | 100 | 1000 }
The rate is set for the interface.

By default, an Ethernet interface works at its maximum rate when auto-negotiation is disabled
on the interface.
----End
1.3.6 (Optional) Enabling Auto-Negotiation

Context
Do as follows on the S2700 where you want to enable auto-negotiation and on the switch
connected to this S2700.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
negotiation auto
Auto-negotiation is enabled on the interface.

By default, an interface works in auto-negotiation mode.
The local interface and peer interface must work in the same mode, that is, both in autonegotiation mode or not.
----End
1.3.7 (Optional) Switching Between Optical and Electrical

Interfaces
Context
Do as follows on the S2700 where you need to switch between optical and electrical interfaces.
Procedure
Step 1 Run:
system-view

Issue 01 (2011-07-15)


Step 2 Run:
interface gigabitethernet interface-number
The GigabitEthernet interface view is displayed.

Step 3 Run:
combo-port { auto | copper | fiber }
The interface is changed to an optical interface or an electrical interface.

By default, a combo port selects the working mode automatically.
----End
1.3.8 Checking the Configuration

Procedure
Step 1 Run the display interface [ interface-type [ interface-number ] ] command to display the
description, duplex mode, and rate of an Ethernet interface.
----End
1.4 Configuring Advanced Attributes of an Ethernet

Interface
This section describes how to configure the loopback on the Ethernet Interface, port group,
maximum frame size, flow control, flow control auto-negotiation, cable test, loopback test, and
port isolation.

The configuration task is applicable to the following situations:
l
The S2700 provides the interface group function, which enables you to configure multiple
interfaces at the same time.
If the traffic volume received on an interface of the S2700 may exceed the processing
capability of the interface and the directly connected interface supports traffic control,
enable the traffic control function on the interface. When the rate of received traffic reaches
the threshold, the interface sends a Pause frame (in full duplex mode) or sends a back
pressure signal (in half duplex mode) to notify the peer interface. If the peer interface
supports traffic control, it decreases the rate of at which it sends traffic so that the local
interface can properly process received traffic.
Ports enabled with port isolation cannot communicate with each other so that ports on the
same VLAN can be isolated. Port isolation provides secure and flexible networking
schemes for customers.
Issue 01 (2011-07-15)


None.
Data Preparation
To configure the advanced functions of Ethernet interfaces, you need the following data.
No.
Data
Interface number
(Optional) Maximum frame length allowed on the interface
1.4.2 (Optional) Configuring Loopback on the Ethernet Interface

Context
Do as follows on the S2700 where you need to configure the loopback.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
loopback internal
The loopback is configured on the Ethernet interface.

By default, loopback is not configured on an Ethernet interface.
----End
1.4.3 (Optional) Configuring the Interface Group

Context
Do as follows on the S2700 where you need to configure interface groups.
Procedure
Step 1 Run:
system-view
Issue 01 (2011-07-15)



Step 2 Run:
port-group port-group-name
The interface group view is displayed.

Step 3 Run:
group-member interface-type interface-number
The Ethernet interface is added to the interface group.

----End
1.4.4 (Optional) Enabling Flow Control

Context
Do as follows on the S2700 where you need to enable flow control.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
flow-control
Flow control is enabled on the Ethernet interface.

By default, flow control is disabled on an Ethernet interface.
To implement flow control, you must enable this function on both the local interface and peer
interface.
----End
1.4.5 (Optional) Enabling Auto-Negotiation of Flow Control

Context
Do as follows on the S2700 whose interface needs to be configured with auto-negotiation of
flow control.
GE interfaces support auto-negotiation of flow control, but FE interfaces do not support this
function.
Procedure
Step 1 Run:
system-view
Issue 01 (2011-07-15)



Step 2 Run:
interface gigabitethernet interface-number
The GE interface view is displayed.

Step 3 Run:
flow-control negotiation
Auto-negotiation of flow control is enabled on the GE interface.

By default, auto-negotiation of flow control is disabled on a GE interface.
You also need to configure auto-negotiation of flow control on the peer interface.
----End
1.4.6 (Optional) Enabling Port Isolation

Context
Do as follows on the S2700 where you need to enable port isolation.
Procedure
Step 1 Run:
system-view

Step 2 Run:
The Ethernet interface view is displayed.

Step 3 (Optional) Run:
am isolate interface-type interface-number [ to interface-number ]
The Ethernet interface is isolated from another interface unidirectionally.

NOTE
After interface A is isolated from interface B unidirectionally, packets sent by interface A cannot reach
interface B, whereas packets sent from interface B can reach interface A.
Step 4 Run:
port-isolate enable [ group group-id ]
Port isolation is enabled.

NOTE
Ports in a port isolation group are isolated from each other, and ports in different port isolation groups can
communicate with each other. If group-id is not specified, a port is added to port isolation group 1.
----End
1.4.7 (Optional) Performing a Cable Test on an Interface

Issue 01 (2011-07-15)

10

Context
A cable test detects faults on the cable connected to an interface. If the cable is working properly,
the total length of the cable is displayed. If the cable cannot work properly, the distance between
the interface and the fault point is displayed.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
virtual-cable-test
A cable test is performed on the interface.

NOTE
l The test result is only for reference.

l Running the virtual-cable-test command may affect services on the interface in a short period of time.
l Combo electrical interfaces support cable tests.
l Before performing a cable test, shut down the remote interface or remove the network cable from the
remote interface. Otherwise, signals from the remote interface may make the test result inaccurate.
----End
1.4.8 (Optional) Configuring a Loopback Test on an Interface

Context
Perform the following steps on the S2700 where a loopback test needs to be performed.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
loopbacktest internal
A loopback test is configured on the interface.

Issue 01 (2011-07-15)

11

By default, no loopback test is configured on an interface.

----End

Procedure
l
Run the display port-group [ all | port-group-name ] command to check information about
a port group.
Run the display interface [ interface-type [ interface-number ] ] command to check

information about auto-negotiation capability on an Ethernet interface.
Run the display virtual-cable-test interface-type interface-number command to check the

cable test result on an Ethernet interface.
----End
1.5 Maintaining Ethernet Interfaces

This section describes how to maintain Ethernet interfaces.
1.5.1 Debugging Ethernet Interfaces

Context
CAUTION
Debugging affects the performance of the system. So, after debugging, run the undo debugging
all command to disable it immediately.
When an Ethernet interface or Eth-Trunk fault occurs, run the following debugging commands
in the user view to locate the fault.
Procedure
Step 1 Run the debugging l2if [ error | event | msg | updown ] command to enable the debugging of
link layer features.
----End

This section provides several configuration examples of Ethernet interfaces.
1.6.1 Example for Configuring Port Isolation

Issue 01 (2011-07-15)

12

Networking Requirements
As shown in Figure 1-1, it is required that PC1 and PC2 cannot communicate with each other,
but they can communicate with PC3.
Figure 1-1 Networking diagram for configuring port isolation
Switch
Eth0/0/2
Eth0/0/1
Eth0/0/3
PC1
PC2
PC3
10.10.10.1/24 10.10.10.2/24 10.10.10.3/24
Configuration Roadmap
The configuration roadmap is as follows:
1.
Enable port isolation on the ports connected to PC1 and PC2 respectively to prevent PC1
and PC2 from communicating with each other.
Data Preparation
To complete the configuration, you need the following data:
l
Number of the port connected to PC1
Number of the port connected to PC2
ID of the VLAN that the ports connected to PC1, PC2, and PC3 belong to (VLAN 1 by
default)
Port isolation group that the ports connected to PC1 and PC2 belong to (group 1 by default)
Procedure
Step 1 Enable port isolation.
# Enable port isolation on Ethernet 0/0/1.
<Quidway> system-view
[Quidway] interface ethernet 0/0/1
[Quidway-Ethernet0/0/1] port-isolate enable
[Quidway-Ethernet0/0/1] quit
# Enable port isolation on Ethernet 0/0/2.

Issue 01 (2011-07-15)

13

[Quidway-Ethernet0/0/2] port-isolate enable

Step 2 Verify the configuration.

PC1 and PC2 cannot ping each other.
PC1 and PC3 can ping each other.
PC2 and PC3 can ping each other.
----End
Configuration Files
Configuration file of the Switch
#
sysname Quidway
#
interface Ethernet0/0/1
port-isolate enable group 1
#
port-isolate enable group 1
#
#
return
Issue 01 (2011-07-15)

14

2 Link Aggregation Configuration
Link Aggregation Configuration
About This Chapter

This chapter describes the concepts, configuration procedures, and configuration examples of
link aggregation.
2.1 Introduction to Link Aggregation
This section describes the concept of link aggregation.
2.2 Link Aggregation Supported by the S2700
This section describes link aggregation features supported by the S2700.
2.3 Configuring Link Aggregation in Manual Load Balancing Mode
This section describes how to configure link aggregation in manual load balancing mode.
2.4 Configuring Link Aggregation in Static LACP Mode
This section describes how to configure link aggregation in static LACP mode.
2.5 Maintaining Link Aggregation
This section describes how to clear the statistics of received and sent LACP packets, debug the
link aggregation group, and monitor the running status of the link aggregation group.
This section provides several configuration examples of link aggregation in manual load
balancing mode and in static LACP mode.
Issue 01 (2011-07-15)

15

2.1 Introduction to Link Aggregation

This section describes the concept of link aggregation.
Link aggregation refers to a method of bundling a group of physical interfaces into a logical
interface to increase bandwidth. It is also called multi-interface load sharing group or link
aggregation group. For details, refer to IEEE802.3ad.
By setting up a link aggregation group between two devices, you can obtain higher bandwidth
and reliability. Link aggregation provides redundancy protection for communication among
devices without upgrading the hardware.
2.2 Link Aggregation Supported by the S2700

This section describes link aggregation features supported by the S2700.
Manual Load Balancing Mode

In load balancing mode, you can manually add member interfaces to the link aggregation group.
All the interfaces configured with load balancing are in forwarding state. The S2700 can perform
load balancing based on destination MAC addresses, source MAC addresses, source MAC
address exclusive-or destination MAC address, source IP addresses, destination IP addresses,
source address exclusive-or destination IP address.
You must set up the Eth-Trunk and add an interface to the Eth-Trunk manually. The Link
Aggregation Control Protocol (LACP) is not used.
The manual load balancing mode is usually used when the peer device does not support LACP.
Static LACP Mode

The static LACP mode is a link aggregation mode in which the two parties negotiate aggregation
parameters by exchanging LACP packets. After the negotiation, the two parties determine the
active interface and the inactive interface. In static LACP mode, you need to create an Eth-Trunk
manually and add members to the Eth-Trunk. The active interfaces and inactive interfaces are
determined by LACP negotiation.
The static LACP mode is also called the M:N mode. In this mode, links can implement load
balancing and redundancy at the same time. In a link aggregation group, M links are active and
they forward data in load balancing mode. N links are inactive and they function as backup links.
The backup links do not forward data. When an active link fails, the backup link with the highest
priority replaces the failed link to forward data and its status changes to active.
In static LACP mode, some links function as backup links. In manual load balancing mode, all
member interfaces work in forwarding state to share the traffic. This is the main difference
between the two modes.
Link aggregation can also be implemented in dynamic LACP mode. In dynamic LACP mode,
LACP creates the Eth-Trunk and adds member interfaces automatically without human
intervention. This mode is easy for users, but is too flexible and hard for management; therefore,
the S2700 does not support dynamic LACP mode.
Issue 01 (2011-07-15)

16

Active Interface and Inactive Interface

Active interfaces refer to the interfaces that are in active state and are responsible for forwarding
data. The interfaces that do not forward data and are in inactive state are called inactive interfaces.
According to the operation modes, active and inactive interfaces are classified as follows:
l
Manual load balancing mode: Generally, all member interfaces are active interfaces unless
a fault occurs on these interfaces.
Static LACP mode: The interfaces connected to M links are active interfaces that are
responsible for forwarding data; the interfaces connected to N links are inactive interfaces
that are used for redundancy backup.
Actor and Partner

In static LACP mode, the device in the link aggregation group with a higher LACP priority is
the Actor and the device with a lower LACP priority is the Partner.
If the two devices have the same LACP priority, the Actor is selected based on the MAC
addresses of the devices. The device with a smaller MAC address becomes the Actor.
Differentiating the Actor and the Partner is to keep the active interfaces of devices at both ends
consistent. If the devices at both ends select active interfaces according to the priority of their
own interfaces, the active interfaces may be different and the active links cannot be set up.
Therefore, the Actor is first determined. The Partner selects active interfaces according to the
priority of the interfaces of the Actor. Figure 2-1 shows the process of selecting active interfaces.
Figure 2-1 Determining the active links in static LACP mode
SwitchA
SwitchB
Device with high

priority
SwitchA
Device with low

priority
The Actor determines
the active link
SwitchB
Active interface selected by SwitchA

Active interface selected by SwitchB
2.3 Configuring Link Aggregation in Manual Load

Balancing Mode
This section describes how to configure link aggregation in manual load balancing mode.

Issue 01 (2011-07-15)

17

When the bandwidth or the reliability of two devices should be increased and either of the two
devices does not support LACP, you should create an Eth-Trunk in manual load balancing mode
on Switches and add member interfaces to the Eth-Trunk to increase the bandwidth and improve
reliability of devices.
As shown in Figure 2-2, Eth-Trunks are created between SwitchA and SwitchB.
Figure 2-2 Networking diagram for configuring link aggregation in load balancing mode
Eth-Trunk 1
Eth-Trunk 1
Eth-Trunk
SwitchA
SwitchB
Before configuring an Eth-Trunk in manual load balancing mode, complete the following tasks:
l
Powering on the S2700
Creating the Eth-Trunks
Data Preparation
To configure an Eth-Trunk in manual load balancing mode, you need the following data.
No.
Data
Number of the Eth-Trunk in manual load balancing mode
Type and number of the member interface
2.3.2 Configuring the Eth-Trunk to Work in Manual Load Balancing

Mode
Context
NOTE
Check whether the Eth-Trunk contains member interfaces before you configure the operation mode of the
Eth-Trunk. If the Eth-Trunk contains member interfaces, the operation mode of the Eth-Trunk cannot be
changed. To delete member interfaces from the Eth-Trunk, run the undo eth-trunk trunk-id command in
the interface view or run the undo trunkport interface-type interface-number command in the Eth-Trunk
view.
Do as follows on the S2700 where you need to configure an Eth-Trunk in manual load balancing
mode.
Issue 01 (2011-07-15)

18

Procedure
Step 1 Run:
system-view

Step 2 Run:
interface eth-trunk trunk-id
The Eth-Trunk view is displayed.

Step 3 Run:
mode manual [ load-balance ]
The operation mode of the Eth-Trunk is set to load balancing.

By default, an Eth-Trunk works in manual load balancing mode.
If the local device is configured with the Eth-Trunk in manual load balancing mode, you need
to configure the Eth-Trunk in manual load balancing mode on the peer device.
----End
2.3.3 Adding Member Interfaces to an Eth-Trunk

Context
Do as follows on the S2700 where you need to configure member interfaces of an Eth-Trunk.
Procedure
l
Configuration in the Eth-Trunk interface view

1.
Run:
system-view

2.
Run:
The Eth-Trunk interface view is displayed.

3.
Run:
trunkport interface-type { interface-number1 [ to interface-number2 ] }
&<1-8>
Member interfaces are added to the Eth-Trunk.

l
Configuration in the member interface view

1.
Run:
system-view

2.
Run:

Issue 01 (2011-07-15)

19

3.
Run:
eth-trunk trunk-id
The interface is added to the Eth-Trunk.

When adding an interface to an Eth-Trunk, pay attention to the following points:
An Eth-Trunk of the S2700EI contains a maximum of eight member interfaces.
An Eth-Trunk of the S2700SI contains a maximum of four member interfaces.
A member interface cannot be configured with any service or static MAC address.
When adding an interface to an Eth-Trunk, ensure that the interface is a hybrid interface,
which is the default interface type.
An Eth-Trunk cannot be nested, that is, its member interfaces cannot be Eth-Trunk.
An Ethernet interface can be added to only one Eth-trunk interface. To add the Ethernet
interface to another Eth-trunk, delete the Ethernet interface from the current Eth-Trunk
first.
The member interfaces of an Eth-trunk must be of the same type. For example, the FE
interface and the GE interface cannot be added to the same Eth-trunk.
Ethernet interfaces on different LPUs can be added to the same Eth-Trunk.
The peer interface directly connected to the Eth-Trunk on the local end must also be
added to an Eth-Trunk; otherwise, the two ends cannot communicate.
When the rates of member interfaces are different, the interfaces with a smaller rate may
be congested, and packets may be lost.
After an interface is added to an Eth-Trunk, MAC address learning is performed by the
Eth-Trunk rather than the member interfaces.
----End
2.3.4 (Optional) Configuring the Load Balancing Mode

Context
Do as follows on the S2700 where the Eth-Trunk load balancing mode needs to be configured.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
load-balance { dst-ip | dst-mac | src-ip | src-mac | src-dst-ip | src-dst-mac }
The load balancing mode is configured for the Eth-Trunk.

The default load balancing mode is src-dst-mac.
Issue 01 (2011-07-15)

20

The S2700 supports the following load balancing modes:

l dst-ip: load balancing based on the destination IP address. In this mode, the system obtains
the specified three bits from each of the destination IP address and the TCP or UDP port
number in outgoing packets to perform the Exclusive-OR calculation, and then selects the
outgoing interface from the Eth-Trunk table according to the calculation result.
l dst-mac: load balancing based on the destination MAC address. In this mode, the system
obtains the specified three bits from each of the destination MAC address, VLAN ID,
Ethernet type, and incoming interface information to perform the Exclusive-OR calculation,
and then selects the outgoing interface from the Eth-Trunk table according to the calculation
result.
l src-ip: load balancing based on the source IP address. In this mode, the system obtains the
specified three bits from each of the source IP address and the TCP or UDP port number in
incoming packets to perform the Exclusive-OR calculation, and then selects the outgoing
interface from the Eth-Trunk table according to the calculation result.
l src-mac: load balancing based on the source MAC address. In this mode, the system obtains
the specified three bits from each of the source MAC address, VLAN ID, Ethernet type, and
incoming interface information to perform the Exclusive-OR calculation, and then selects
the outgoing interface from the Eth-Trunk table according to the calculation result.
l src-dst-ip: load balancing based on the Exclusive-OR result of the source IP address and
destination IP address. In this mode, the system performs the Exclusive-OR calculation
between the Exclusive-OR results of the dip and dmac modes, and then selects the outgoing
l src-dst-mac: load balancing based on the Exclusive-OR result of the source MAC address
and destination MAC address. In this mode, the system obtains three bits from each of the
source MAC address, destination MAC address, VLAN ID, Ethernet type, and incoming
interface information to perform the Exclusive-OR calculation, and then selects the outgoing
Member interfaces of an Eth-Trunk perform per-flow load balancing. The local end and the
remote end can use different load balancing modes, and the load balancing mode on one end
does not affect load balancing on the other end.
----End
2.3.5 (Optional) Limiting the Number of Active Interfaces

Context
Do as follows on the S2700 where you need to limit the number of active interfaces.
Procedure
l
Setting the upper threshold of the number of interfaces that determine bandwidth of the
Eth-Trunk
1.
Run:
system-view

2.
Run:
Issue 01 (2011-07-15)

21


3.
Run:
max bandwidth-affected-linknumber link-number
The maximum number of interfaces that determine bandwidth of the Eth-Trunk is set.
By default, the maximum number of interfaces that determine bandwidth of the EthTrunk is 8 on the S2700EI.
By default, the maximum number of interfaces that determine bandwidth of the EthTrunk is 4 on the S2700SI.
NOTE
l The upper threshold the number of interfaces that determine bandwidth of the Eth-Trunk of the
local S2700 and that of the remote S2700 can be different. If the upper thresholds at two ends
are different, the smaller one is used.
Setting the lower threshold of the number of active interfaces

1.
Run:
system-view

2.
Run:

3.
Run:
least active-linknumber link-number
The lower threshold of the number of active interfaces is set.

By default, the lower threshold of the number of active interfaces is 1.
In manual load balancing mode, you can determine the minimum number of active
interfaces in the Eth-Trunk by setting the lower threshold. If the number of active interfaces
is smaller than the value in manual load balancing mode, the status the Eth-Trunk becomes
Down.
NOTE
l The lower threshold of the number of active interfaces of the local S2700 and that of the remote
S2700 can be different. If the lower thresholds at two ends are different, the larger one is used.
----End

Procedure
l
Run the display trunkmembership eth-trunk trunk-id command to display the member
interfaces of the Eth-Trunk.
Run the display eth-trunk trunk-id command to display the load balancing status of the
Eth-Trunk.
----End
Issue 01 (2011-07-15)

22

2.4 Configuring Link Aggregation in Static LACP Mode

This section describes how to configure link aggregation in static LACP mode.

To increase the bandwidth and improve the connection reliability, you can configure a link
aggregation group on two directly connected Switches. The requirements are as follows:
l
The links between two devices can implement redundancy backup. When a fault occurs on
some links, the backup links replace the faulty ones to keep data transmission uninterrupted.
The active links have the load balancing capability.
Figure 2-3 Typical networking of link aggregation in static LACP mode
Eth-Trunk 1
Eth-Trunk 1
Eth-Trunk
SwitchA
Active link
Standby link
SwitchB
Before configuring an Eth-Trunk in static LACP mode, complete the following tasks:
l
Powering on the S2700
Creating the Eth-Trunk
Data Preparation
To configure an Eth-Trunk in static LACP mode, you need the following data.
No.
Data
Number of the Eth-Trunk
Type and number of the member interface
Maximum number of active interfaces
2.4.2 Configuring the Eth-Trunk to Work in Static LACP Mode

Issue 01 (2011-07-15)

23

Context
NOTE
Check whether the Eth-Trunk contains member interfaces before you configure the operation mode of the
Eth-Trunk. If the Eth-Trunk contains member interfaces, the operation mode of the Eth-Trunk cannot be
changed. To delete member interfaces from the Eth-Trunk, run the undo eth-trunk trunk-id command in
the interface view or run the undo trunkport interface-type interface-number command in the Eth-Trunk
view.
Do as follows on the S2700 where you need to configure an Eth-Trunk of static LACP mode.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
bpdu enable
The Eth-Trunk member interfaces are configured to send received BPDUs to the CPU.
Step 4 Run:
mode lacp-static
The Eth-Trunk is configured to work in static LACP mode.

By default, an Eth-Trunk works in manual load balancing mode.
If the local device is configured with an Eth-Trunk of static LACP mode, you must configure
the Eth-Trunk of static LACP mode on the peer device.
----End
2.4.3 Adding Member Interfaces to an Eth-Trunk

Context
Do as follows on the S2700 where you need to configure member interfaces of an Eth-Trunk.
Procedure
l
Configuration in the Eth-Trunk interface view

1.
Run:
system-view

2.
Run:
The Eth-Trunk interface view is displayed.

Issue 01 (2011-07-15)

24

3.
Run:
trunkport interface-type { interface-number1 [ to interface-number2 ] }
&<1-8>
Member interfaces are added to the Eth-Trunk.

l
Configuration in the member interface view

1.
Run:
system-view

2.
Run:

3.
Run:
eth-trunk trunk-id
The interface is added to the Eth-Trunk.

When adding an interface to an Eth-Trunk, pay attention to the following points:
An Eth-Trunk of the S2700EI contains a maximum of eight member interfaces.
An Eth-Trunk of the S2700SI contains a maximum of four member interfaces.
A member interface cannot be configured with any service or static MAC address.
When adding an interface to an Eth-Trunk, ensure that the interface is a hybrid interface,
which is the default interface type.
An Eth-Trunk cannot be nested, that is, its member interfaces cannot be Eth-Trunk.
An Ethernet interface can be added to only one Eth-Trunk interface. To add the Ethernet
interface to another Eth-Trunk, delete the Ethernet interface from the current Eth-Trunk
first.
The member interfaces of an Eth-Trunk must be of the same type. For example, the FE
interface and the GE interface cannot be added to the same Eth-Trunk.
Ethernet interfaces on different LPUs can be added to the same Eth-Trunk.
The peer interface directly connected to the Eth-Trunk on the local end must also be
added to an Eth-Trunk; otherwise, the two ends cannot communicate.
When the rates of member interfaces are different, the interfaces with a smaller rate may
be congested, and packets may be lost.
After an interface is added to an Eth-Trunk, MAC address learning is performed by the
Eth-Trunk rather than the member interfaces.
----End
2.4.4 (Optional) Configuring the Load Balancing Mode

Context
Do as follows on the S2700 where you need to configure the Eth-Trunk load balancing mode.
Issue 01 (2011-07-15)

25

Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
load-balance { dst-ip | dst-mac | src-ip | src-mac | src-dst-ip | src-dst-mac }
The load balancing mode is configured for the Eth-Trunk.

The default load balancing mode is src-dst-mac.
The S2700 supports the following load balancing modes:
l dst-ip: load balancing based on the destination IP address. In this mode, the system obtains
the specified three bits from each of the destination IP address and the TCP or UDP port
number in outgoing packets to perform the Exclusive-OR calculation, and then selects the
outgoing interface from the Eth-Trunk table according to the calculation result.
l dst-mac: load balancing based on the destination MAC address. In this mode, the system
obtains the specified three bits from each of the destination MAC address, VLAN ID,
Ethernet type, and incoming interface information to perform the Exclusive-OR calculation,
and then selects the outgoing interface from the Eth-Trunk table according to the calculation
result.
l src-ip: load balancing based on the source IP address. In this mode, the system obtains the
specified three bits from each of the source IP address and the TCP or UDP port number in
incoming packets to perform the Exclusive-OR calculation, and then selects the outgoing
l src-mac: load balancing based on the source MAC address. In this mode, the system obtains
the specified three bits from each of the source MAC address, VLAN ID, Ethernet type, and
incoming interface information to perform the Exclusive-OR calculation, and then selects
the outgoing interface from the Eth-Trunk table according to the calculation result.
l src-dst-ip: load balancing based on the Exclusive-OR result of the source IP address and
destination IP address. In this mode, the system performs the Exclusive-OR calculation
between the Exclusive-OR results of the dip and dmac modes, and then selects the outgoing
l src-dst-mac: load balancing based on the Exclusive-OR result of the source MAC address
and destination MAC address. In this mode, the system obtains three bits from each of the
source MAC address, destination MAC address, VLAN ID, Ethernet type, and incoming
interface information to perform the Exclusive-OR calculation, and then selects the outgoing
Member interfaces of an Eth-Trunk perform per-flow load balancing. The local end and the
remote end can use different load balancing modes, and the load balancing mode on one end
does not affect load balancing on the other end.
----End
Issue 01 (2011-07-15)

26

2.4.5 (Optional) Limiting the Number of Active Interfaces

Context
Do as follows on the S2700 where you need to limit the number of active interfaces.
Procedure
l
Setting the upper threshold of the number of active interfaces

1.
Run:
system-view

2.
Run:

3.
Run:
max active-linknumber link-number
The upper threshold of the number of active interfaces is set.

By default, the upper threshold of the number of active interfaces on the S2700EI is
8.
By default, the upper threshold of the number of active interfaces on the S2700SI is
4.
In static LACP mode, you can limit the maximum number (M) of active interfaces in the
Eth-Trunk by setting the upper threshold. The other member interfaces function as backup.
If the upper threshold is not set on the S2700EI, an Eth-Trunk can contain a maximum of
eight active interfaces.
If the upper threshold is not set on the S2700SI, an Eth-Trunk can contain a maximum of
four active interfaces.
NOTE
l The upper threshold of the number of active interfaces should not be smaller the lower threshold
for the number of active interfaces.
l The upper threshold of the number of active interfaces of the local S2700 and that of the remote
S2700 can be different. If the upper thresholds at two ends are different, the smaller one is used.
Setting the lower threshold of the number of active interfaces

1.
Run:
system-view

2.
Run:

3.
Run:
least active-linknumber link-number
The lower threshold of the number of active interfaces is set.

Issue 01 (2011-07-15)

27

By default, the lower threshold of the number of active interfaces is 1.

In static LACP mode, you can determine the minimum number of active interfaces in the
Eth-Trunk by setting the lower threshold. If the number of active interfaces is smaller than
the value in static mode, the status of the Eth-Trunk becomes Down.
NOTE
l The lower threshold of the number of active interfaces should not be larger than the upper
threshold of the number of active interfaces.
l The lower threshold of the number of active interfaces of the local S2700 and that of the remote
S2700 can be different. If the lower thresholds at two ends are different, the larger one is used.
----End
2.4.6 (Optional) Setting the LACP Priority of the System

Context
Do as follows on the S2700 where you need to set the LACP priority of the system.
Procedure
Step 1 Run:
system-view

Step 2 Run:
lacp priority priority
The system LACP priority of the S2700 is set.

The smaller the LACP priority value of the system is, the higher the priority is. By default, the
LACP priority of the system is 32768.
The end of a smaller priority value functions as the Actor. If the two ends have the same priority,
the end with a smaller MAC address functions as the Actor.
----End
2.4.7 (Optional) Setting the LACP Priority of an Interface

Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
Issue 01 (2011-07-15)

28


Step 3 Run:
lacp priority priority
The LACP priority of the interface is set.

By default, the interface LACP priority is 32768. A smaller priority value indicates a higher
LACP priority.
----End
2.4.8 (Optional) Enabling LACP Preemption and Setting the Delay

for LACP Preemption
Context
Do as follows on the S2700 where you need to enable LACP preemption mode and set the delay
for LACP preemption.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
lacp preempt enable
The LACP preemption function is enabled on the Eth-Trunk.

By default, the LACP preemption function is disabled.
NOTE
To ensure normal running of an Eth-Trunk, it is recommended that you enable or disable LACP preemption
on both ends of the Eth-Trunk.
Step 4 Run:
lacp preempt delay delay-time
The delay for LACP preemption on the Eth-Trunk is set.

By default, the delay for LACP preemption is 30 seconds.
Enabling the LACP preemption function ensures that the interface with the highest LACP
priority can be an active interface. For example, when an interface with the highest priority
becomes inactive due to a failure, and then recovers, the interface can become an active interface
if the LACP preemption function is enabled; if the LACP preemption function is disabled, the
interface cannot become an active interface again.
Issue 01 (2011-07-15)

29

The delay for LACP preemption refers to the period in which an inactive interface of the EthTrunk in static LACP mode waits before it becomes active.
----End
2.4.9 (Optional) Setting the Timeout Interval for Receiving LACP

Packets
Context
Do as follows on the S2700 where you need to set the timeout interval for receiving LACP
packets.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
lacp timeout { fast | slow }
The timeout for receiving LACP protocol packets the Eth-Trunk is set.
NOTE
l After the lacp timeout command is used, the local end informs the peer end of the timeout interval
through LACP packets. If the fast is selected, the interval for sending LACP packets is 1 second. If
the slow keyword is selected, the interval for sending LACP packets is 30 seconds.
l The timeout interval for receiving LACP packets is three times the interval for sending LACP packets.
That is, when the fast keyword is used, the timeout interval for receiving LACP packets is 3s; when
the slow keyword is used, the timeout interval for receiving LACP packets is 90s.
l You can select different keywords on the two ends. To facilitate the maintenance, however, it is
recommended that you select the same keyword on both ends.
----End

Procedure
l
Run the display eth-trunk [ trunk-id [interface interface-type interface-number ] ]

command to display information about the Eth-Trunk and member interfaces.
----End
Issue 01 (2011-07-15)

30

2.5 Maintaining Link Aggregation

This section describes how to clear the statistics of received and sent LACP packets, debug the
link aggregation group, and monitor the running status of the link aggregation group.
2.5.1 Clearing Statistics of LACP Packets

Context
CAUTION
The statistics of LACP packets cannot be restored after you clear them. So, confirm the action
before you use the command.
Procedure
l
Run the reset lacp statistics eth-trunk [ trunk-id ] command to clear statistics of received
and sent LACP packets.
----End
2.5.2 Debugging the Link Aggregation Group

Context
CAUTION
When a running fault occurs in the link aggregation group, run the following debugging
commands in the user view to check the debugging information, and locate and analyze the fault.
Procedure
l
Run the debugging trunk error command to enable the debugging of Eth-Trunk errors.
Run the debugging trunk event command to enable the debugging of Eth-Trunk events.
Run the debugging trunk lacp-pdu command to enable the debugging of LACP packets.
Run the debugging trunk lagmsg command to enable the debugging of LACP protocol
messages.
Run the debugging trunk msg command to enable the debugging of Eth-Trunk messages.
Issue 01 (2011-07-15)

31

Run the debugging trunk state-machine command to enable the debugging of Eth-Trunk
status machine.
Run the debugging trunk updown command to enable the debugging of Eth-Trunk Up
and Down messages.
Run the debugging trunk command to enable the debugging of Eth-Trunk messages.
----End
2.5.3 Monitoring the Operation Status of the Link Aggregation

Group
Context
During the daily maintenance, you can run the following commands in any view to check the
operation status of the link aggregation group.
Procedure
l
Run the display eth-trunk [ trunk-id [ interface interface-type interface-number ] ]

command to display the status of the link aggregation group.
Run the display lacp statistics eth-trunk [ trunk-id [ interface interface-type interfacenumber ] ] command to display the statistics of sent and received LACP packets.
----End

This section provides several configuration examples of link aggregation in manual load
balancing mode and in static LACP mode.
2.6.1 Example for Configuring Link Aggregation in Manual Load

Balancing Mode
As shown in Figure 2-4, the Switch is connected to the SwitchA through an Eth-Trunk. The
link between the Switch and SwitchA must ensure high reliability.
Issue 01 (2011-07-15)

32

Figure 2-4 Networking diagram for configuring link aggregation in manual load balancing mode
SwitchA
Eth-Trunk 1
Eth-Trunk
Eth-Trunk 1
GE0/0/3
GE0/0/4
Switch
GE0/0/1
VLAN 100-150
LAN Switch
GE0/0/2
VLAN 151-200
LAN Switch
1.
Create an Eth-Trunk.
2.
Add member interfaces to the Eth-Trunk.
Data Preparation
l
Number of the Eth-Trunk
Types and numbers of the member interfaces in the Eth-Trunk
Procedure
Step 1 Create an Eth-Trunk.
# Create Eth-Trunk 1.
[Quidway] sysname Switch
[Switch] interface eth-trunk 1
[Switch-Eth-Trunk1] quit
Step 2 Add member interfaces to the Eth-Trunk.

Issue 01 (2011-07-15)

33

# Add Eth 0/0/3 to Eth-Trunk 1.

[Switch] interface ethernet 0/0/3
[Switch-Ethernet0/0/3] eth-trunk 1
[Switch-Ethernet0/0/3] quit
# Add Eth 0/0/4 to Eth-Trunk 1.

[Switch] interface ethernet 0/0/4
[Switch-Ethernet0/0/4] eth-trunk 1
[Switch-Ethernet0/0/4] quit
Step 3 Configure Eth-Trunk 1.

# Configure Eth-Trunk 1 to allow packets of VLANs 100 to 200 to pass through.
[Switch] interface eth-trunk 1
[Switch-Eth-Trunk1] port link-type trunk
[Switch-Eth-Trunk1] port trunk allow-pass vlan 100 to 200
[Switch-Eth-Trunk1] quit

Run the display trunkmembership command in any view to check whether Eth-Trunk 1 is
created and whether member interfaces are added.
[Switch] display trunkmembership eth-trunk 1
Trunk ID: 1
used status: VALID
TYPE: ethernet
Working Mode : Normal
Number Of Ports in Trunk = 2
Number Of UP Ports in Trunk = 2
operate status: up
Interface Ethernet0/0/3, valid, operate up, weight=1,
Interface Ethernet0/0/4, valid, operate up, weight=1,
# Display the configuration of Eth-Trunk 1.

[Switch] display eth-trunk 1
Eth-Trunk1's state information is:
WorkingMode: NORMAL
Hash arithmetic: According to SA-XOR-DA
Least Active-linknumber: 1 Max Bandwidth-affected-linknumber: 8
Operate status: up
Number Of Up Port In Trunk: 2
-------------------------------------------------------------------------------PortName
Status
Weight
Ethernet0/0/3
Up
1
Ethernet0/0/4
Up
1
The preceding information indicates that Eth-Trunk 1 consists of member interfaces Eth 0/0/3
and Eth 0/0/4. The member interfaces are both in Up state.
----End
Configuration Files
#
sysname Switch
#
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 100 to 200
#
eth-trunk 1
Issue 01 (2011-07-15)

34

#
eth-trunk 1
#
return
2.6.2 Example for Configuring Link Aggregation in Static LACP

Mode
To improve the bandwidth and the connection reliability, configure the link aggregation group
on two directly connected Switches, as shown in Figure 2-5. The requirements are as follows:
l
M active links can implement load balancing.
N links between two Switches can carry out redundancy backup. When a fault occurs on
an active link, the backup link replaces the faulty link to keep the reliability of data
transmission.
Figure 2-5 Networking diagram for configuring link aggregation in static LACP mode
Eth-Trunk 1
Eth 0/0/1
Eth 0/0/2
Eth 0/0/3
Eth-Trunk
Eth-Trunk 1
Eth 0/0/1
Eth 0/0/2
Eth 0/0/3
SwitchA
Active link
Backup link
SwitchB
1.
Create an Eth-Trunk on the Switch and configure the Eth-Trunk to work in static LACP
mode.
2.
Add member interfaces to the Eth-Trunk.
3.
Set the system priority and determine the Actor.
4.
Set the upper threshold of the active interfaces.
5.
Set the priority of the interface and determine the active link.
Data Preparation
l
Numbers of the link aggregation groups on the Switches
System priority of SwitchA
Upper threshold of active interfaces
LACP priority of the active interface
Issue 01 (2011-07-15)

35

Procedure
Step 1 Create Eth-Trunk 1 and set the load balancing mode of the Eth-Trunk to static LACP mode.
# Configure SwitchA.
[Quidway] sysname SwitchA
[SwitchA] bpdu enable
[SwitchA] interface eth-trunk 1
[SwitchA-Eth-Trunk1] mode lacp-static
[SwitchA-Eth-Trunk1] quit
# Configure SwitchB.
[Quidway] sysname SwitchB
[SwitchB] bpdu enable
[SwitchB] interface eth-trunk 1
[SwitchB-Eth-Trunk1] mode lacp-static
[SwitchB-Eth-Trunk1] quit
Step 2 Add member interfaces to the Eth-Trunk.

# Configure SwitchA.
[SwitchA] interface ethernet 0/0/1
[SwitchA-Ethernet0/0/1] eth-trunk 1
[SwitchA-Ethernet0/0/1] quit
# Configure SwitchB.
[SwitchB] interface ethernet 0/0/1
[SwitchB-Ethernet0/0/1] eth-trunk 1
[SwitchB-Ethernet0/0/1] quit
Step 3 Set the system priority on SwitchA to 100 so that SwitchA becomes the Actor.
[SwitchA] lacp priority 100
Step 4 Set the upper threshold M of active interfaces on SwitchA to 2.
[SwitchA] interface eth-trunk 1
[SwitchA-Eth-Trunk1] max active-linknumber 2
[SwitchA-Eth-Trunk1] quit
Step 5 Set the priority of the interface and determine active links on SwitchA.
[SwitchA] interface ethernet
[SwitchA-Ethernet0/0/1] lacp
[SwitchA-Ethernet0/0/2] lacp
0/0/1
priority 100
0/0/2
priority 100

Issue 01 (2011-07-15)

36

# Check information about the Eth-Trunk of the Switches and check whether the negotiation is
successful on the link.
[SwitchA] display eth-trunk 1
Local:
LAG ID: 1
WorkingMode: STATIC
Preempt Delay: Disabled
System Priority: 100
System ID: 00e0-fca8-0417
Least Active-linknumber: 1 Max Active-linknumber: 2
Operate status: Up
-----------------------------------------------------------------------------ActorPortName
Status
PortType PortPri
PortNo PortKey
PortState
Weight
Ethernet0/0/1
Selected 100M
100
6145
2865
11111100
1
Ethernet0/0/2
Selected 100M
100
6146
2865
11111100
1
Ethernet0/0/3
Unselect 100M
32768
6147
2865
11100000
1
Partner:
-----------------------------------------------------------------------------PartnerPortName
SysPri
SystemID
PortPri PortNo PortKey
PortState
Ethernet0/0/1
32768 00e0-fca6-7f85 32768
6145
2609
11111100
Ethernet0/0/2
32768 00e0-fca6-7f85 32768
6146
2609
11111100
Ethernet0/0/3
32768 00e0-fca6-7f85 32768
6147
2609
11110000
[SwitchB] display eth-trunk 1
Local:
LAG ID: 1
WorkingMode: STATIC
Preempt Delay: Disabled
System Priority: 32768
System ID: 00e0-fca6-7f85
Least Active-linknumber: 1
Max Active-linknumber: 8
Operate status: Up
-----------------------------------------------------------------------------ActorPortName
Status
PortType PortPri
PortNo PortKey
PortState
Weight
Ethernet0/0/1
Selected 100M
32768
6145
2609
11111100
1
Ethernet0/0/2
Selected 100M
32768
6146
2609
11111100
1
Ethernet0/0/3
Unselect 100M
32768
6147
2609
11100000
1
Partner:
-----------------------------------------------------------------------------PartnerPortName
SysPri
SystemID
PortPri PortNo PortKey
PortState
Ethernet0/0/1
100
00e0-fca8-0417 100
6145
2865
11111100
Ethernet0/0/2
100
00e0-fca8-0417 100
6146
2865
11111100
Ethernet0/0/3
100
00e0-fca8-0417 32768
6147
2865
11110000
The preceding information shows that the system priority of SwitchA is 100 and it is higher than
the system priority of SwitchB. Member interfaces Eth0/0/1 and Eth0/0/2 become the active
interfaces and are in Selected state. Interface Eth0/0/3 is in Unselect state. M active links work
in load balancing mode and N links are the backup links.
----End
Configuration Files
l
Issue 01 (2011-07-15)
Configuration file of SwitchA

37

#
sysname SwitchA
#
lacp priority 100
#
mode lacp-static
max active-linknumber 2
#
eth-trunk 1
lacp priority 100
#
eth-trunk 1
lacp priority 100
#
eth-trunk 1
#
return
Configuration file of SwitchB
#
sysname SwitchB
#
mode lacp-static
#
eth-trunk 1
#
eth-trunk 1
#
eth-trunk 1
#
return
Issue 01 (2011-07-15)

38

3 VLAN Configuration
VLAN Configuration
About This Chapter

Virtual Local Area Networks (VLANs) have advantages of broadcast domain isolation, security
enhancement, flexible networking, and good extensibility.
3.1 Introduction
The VLAN technology is important for forwarding on Layer 2 networks. This section describes
the background, functions, and advantages of the VLAN technology.
3.2 VLAN Features Supported by the S2700
This section describes VLAN features supported by the S2700 to help you understand VLAN
configurations.
3.3 Dividing a LAN into VLANs
A LAN can be divided into several VLANs and users in each VLAN can communicate with
each other. Currently, the S2700 supports several VLAN division modes. You can choose one
of them as required.
3.4 Creating a VLANIF Interface
VLANIF interfaces are Layer 3 logical interfaces. After creating VLANIF interfaces on Layer
2 devices, you can configure Layer 3 features on these interfaces.
3.5 Configuring Inter-VLAN Communication
Configuring inter-VLAN communication allows users in different VLANs to communicate with
each other. Currently, the S2700 supports several inter-VLAN communication schemes. Choose
one of them as required.
3.6 Configuring VLAN Aggregation to Save IP Addresses
VLAN aggregation prevents the waste of IP addresses and implements inter-VLAN
communication.
3.7 Configuring a Voice VLAN to Transmit Voice Data
A voice VLAN is used to transmit voice data.
3.8 Configuring an mVLAN to Implement Integrated Management
Configuring an mVLAN allows users to use the IP address of the VLANIF interface
corresponding to the mVLAN to log in to a management switch to manage devices attached to
the switch.
Issue 01 (2011-07-15)

39

3.9 Maintaining VLAN

A command of clearing statistics helps to locate the faults in a VLAN.
This section provides several examples of VLAN configuration.
Issue 01 (2011-07-15)

40

3.1 Introduction
The VLAN technology is important for forwarding on Layer 2 networks. This section describes
the background, functions, and advantages of the VLAN technology.
Overview of VLAN
The Ethernet technology is for sharing communication mediums and data based on the Carrier
Sense Multiple Access/Collision Detect (CSMA/CD). If there are a large number of PCs on an
Ethernet network, collision becomes a serious problem and can lead to broadcast storms. As a
result, network performance deteriorates. This can even cause the Ethernet network to become
unavailable. Switches can be used to interconnect local area networks (LANs). Switches forward
information received by inbound ports to specified outbound ports, thereby preventing access
collision in a shared medium. If no specified outbound port is found for information received
by an inbound port, the switch will forward the information from all ports except the inbound
port. This forms a broadcast domain.
To prevent broadcast domains from being too broad and causing problems, you can divide a
network into segments. In this manner, a large broadcast domain is divided into multiple small
broadcast domains to confine the possible scope of broadcast packets. Routers can be deployed
at the network layer to separate broadcast domains, but this method has disadvantages, which
include: complex network planning, inflexible networking, and high levels of expenditure. The
Virtual Local Area Network (VLAN) technology can divide a large Layer 2 network into
broadcast domains to prevent broadcast storms and protect network security.
Definition of VLAN
The VLAN technology is used to divide a physical LAN into multiple logical broadcast domains,
each of which is called a VLAN. Each VLAN contains a group of PCs that have the same
requirements. A VLAN has the same attributes as a LAN. PCs of a VLAN can be placed on
different LAN segments. If two PCs are located on one LAN segment but belong to different
VLANs, they do not broadcast packets to each other. With VLAN, the broadcast traffic volume
is reduced; fewer devices are required; network management is simplified; and network security
is improved.
Figure 3-1 shows a typical VLAN application. Three switches are placed in different locations,
for example, different stories of an office building. If each enterprise builds up a LAN, a high
level of expenditure is required. If enterprises in the office building use the existing LAN,
enterprise information security cannot be guaranteed. The VLAN technology allows enterprises
to share LAN facilities and ensures information security for each enterprise network.
Issue 01 (2011-07-15)

41

Figure 3-1 Schematic diagram for a typical VLAN application
Router
Switch1
Switch2
Switch3
VLAN-A
VLAN-B
VLAN-C
This application shows the following VLAN advantages:

l
Broadcast domains are confined. A broadcast domain is confined to a VLAN. This saves
bandwidth and improves network processing capabilities.
Network security is enhanced. Packets from different VLANs are separately transmitted.
PCs in one VLAN cannot directly communicate with PCs in another VLAN.
Network robustness is improved. A fault in a VLAN does not affect PCs in other VLANs.
Virtual groups are set up flexibly. With the VLAN technology, PCs in different
geographical areas can be grouped together. This facilitates network construction and
maintenance.
Basic VLAN Concepts and Principles

l
802.1Q and VLAN frame format

A conventional Ethernet frame is encapsulated with the Length/Type field for an upperlayer protocol following the Destination address and Source address fields, as shown in
Figure 3-2.
Figure 3-2 Conventional Ethernet frame format
6bytes
Destination
address
6bytes
2bytes
46-1500bytes 4bytes
Source
Data
FCS
Length/Type
address
IEEE 802.1Q is an Ethernet networking standard for a specified Ethernet frame format. It
adds a 32-bit field between the Source address and the Length/Type fields of the original
frame, as shown in Figure 3-3.
Issue 01 (2011-07-15)

42

Figure 3-3 802.1Q frame format

6bytes
6bytes
4bytes
Destination Source 802.1Q

address
address
Tag
TPID
2bytes
PRI
2bytes 42-1500bytes 4bytes

Length/
Type
Data
FCS
CFI VID
3bits 1bit 12bits
Tag Protocol Identifier (TPID): a 16-bit field set to a value of 0x8100 in order to identify
the frame as an IEEE 802.1Q-tagged frame. If an 802.1Q-incapable device receives an
802.1Q frame, it will discard the frame.
Priority (PRI): a 3-bit field which indicates the frame priority. The value ranges from 0
to 7. The greater the value, the higher the priority. These values can be used to prioritize
different classes of traffic to ensure that frames with high priorities are transmitted first
when traffic is heavy.
Canonical Format Indicator (CFI): a 1-bit field. If the value of this field is 1, the MAC
address is in the non-canonical format. If the value is 0, the MAC address is in the
canonical format. CFI is used to ensure compatibility between Ethernet networks and
Token Ring networks. It is always set to zero for Ethernet switches.
VLAN Identifier (VID): a 12-bit field specifying the VLAN to which the frame belongs.
On the S2700, VLAN IDs range from 0 to 4095. The values 0 and 4095 are reserved,
and therefore VLAN IDs range from 1 to 4094.
Each frame sent by an 802.1Q-capable switch carries a VLAN ID. On a VLAN, Ethernet
frames are classified into the following types:
Tagged frames: frames with 32-bits 802.1Q tags.
Untagged frames: frames without 32-bits 802.1Q tags.
l
VLAN division methods

Table 3-1 shows VLAN division methods.
Table 3-1 VLAN division methods
VLAN
Division
Method
Definition
Port-based
VLAN division
VLANs are configured based on ports on a switch. For example, ports

1 to 4 on a switch are added to VLAN 2; ports 5 to 8 are added to
VLAN 3.
Ports on different Ethernet switches can be added to one VLAN. For
example, ports 1 to 4 on switch A and ports 3 to 6 on switch B can
be added to the same VLAN.
Each switch maintains a VLAN mapping table that records mappings
between local ports and VLANs.
Issue 01 (2011-07-15)

43

VLAN
Division
Method
Definition
MAC addressbased VLAN

division
PCs are added to VLANs based on their MAC addresses.

A switch maintains a VLAN mapping table that records mappings
between MAC addresses and VLANs.
Type of VLAN links

Figure 3-4 Schematic diagram for VLAN links
VLAN3
PC3
VLAN3
PC4
Access link
3
3
2
Trunk link
CE1
3
2
Trunk link
PE
2
Access link
PC1
VLAN2
CE2
PC2
VLAN2
As shown in Figure 3-4, there are the following types of VLAN links:
Access link: connects a PC to a switch. Generally, a PC does not know which VLAN
it belongs to, and PC hardware cannot distinguish frames with VLAN tags. Therefore,
PCs send and receive only untagged frames.
Trunk link: connects a switch to another switch or to a router. Data of different VLANs
are transmitted along a trunk link. The two ends of a trunk link must be able to distinguish
frames with VLAN tags. Therefore, only tagged frames are transmitted along trunk
links.
l
Port types
Table 3-2 lists VLAN port types.
Issue 01 (2011-07-15)

44

Table 3-2 Port types

Port
Type
Method of
Processing
Received
Untagged Frames
Method of
Processing
Received
Tagged
Frames
Method of
Sending
Frames
Application
Access
port
Accepts an untagged
frame and adds a tag
with the default
VLAN ID to the
frame.
l Accepts a
tagged
frame if the
VLAN ID
carried in
the frame is
the same as
the default
VLAN ID.
Removes the tag

from a frame and
sends the frame.
An access port
connects a
switch to a PC
and can be
added to only
one VLAN.
l Discards a
tagged
frame if the
VLAN ID
carried in
the frame is
different
from the
default
VLAN ID.
Issue 01 (2011-07-15)

45

Port
Type
Method of
Processing
Received
Untagged Frames
Method of
Processing
Received
Tagged
Frames
Method of
Sending
Frames
Application
Trunk
port
l Adds a tag with

the default
VLAN ID to an
untagged frame
and accepts the
frame if the port
permits the
default VLAN
ID.
l Accepts a
tagged
frame if the
port permits
the VLAN
ID carried in
the frame.
l Removes the
tag from a
received
frame and
sends the
frame if the
VLAN ID
carried in the
frame is the
same as the
default
VLAN ID
and
permitted by
the port.
A trunk port
can be added to
multiple
VLANs to send
and receive
frames for these
VLANs. A
trunk port
connects a
switch to
another switch
or to a router.
l Adds a tag with

the default
VLAN ID to an
untagged frame
and discards the
frame if the port
denies the default
VLAN ID.
Hybrid
port
Issue 01 (2011-07-15)
l Discards a
tagged
frame if the
port denies
the VLAN
ID carried in
the frame.
l Directly
sends a
received
frame if the
VLAN ID
carried in the
frame is
different
from the
default
VLAN ID
but permitted
by the port.
Sends a received
frame if the port
permits the
VLAN ID
carried in the
frame. A
specified
command can be
used to
determine
whether a hybrid
port sends
frames with or
without tags.

A hybrid port
can be added to
multiple
VLANs to send
and receive
frames for these
VLANs. A
hybrid port can
connect a
switch to a PC
or connect a
network device
to another
network
device.
46

Port
Type
Method of
Processing
Received
Untagged Frames
Method of
Processing
Received
Tagged
Frames
Method of
Sending
Frames
Application
QinQ
port
QinQ ports are enabled with the IEEE 802.1QinQ protocol. A QinQ port adds
a tag to a single-tagged frame, and thus supports a maximum of 4094 x 4094
VLAN tags, which meets the requirement of a Networkfor the number of
VLANs.
NOTE
The S2700SI does not support QinQ port.
Each access, trunk, hybrid, or QinQ port can be configured with a default VLAN, namely,
the port default VLAN ID (PVID) to specify the VLAN to which the port belongs.
The PVID of an access port indicates the VLAN to which the port belongs.
As a trunk or hybrid port can be added to multiple VLANs, the port must be configured
with PVIDs.
By default, a port is added to VLAN 1.
l
Principle for data switching in a VLAN

Use the network shown in Figure 3-4 as an example. If PC 1 in VLAN 2 intends to send
data to PC 2, the data is forwarded as follows:
1.
An access port on CE 1 receives an untagged frame from PC 1 and adds a PVID

(VLAN 2) to the frame. CE 1 searches the MAC address table for an outbound port.
NOTE
Assume that VLANs are configured based on MAC addresses. After an access port on CE 1
receives an untagged frame from PC 1, the port checks the VLAN mapping table for a VLAN
ID corresponding to the source MAC address, and adds a tag with the obtained VLAN ID to
the frame.
2.
After the trunk port on CE 1 and PE receives the frame, the port checks whether the
VLAN ID carried in the frame is the same as that configured on the port. If the VLAN
ID has been configured on the port, the port transparently transmits the frame to CE
2. If the VLAN ID is not configured on the port, the port discards the frame.
3.
After a trunk port on CE 2 receives the frame, the system searches the MAC address
table for an outbound port.
4.
After the frame is sent to the access port connecting CE 2 to PC 2, the port checks that
the VLAN ID carried in the frame is the same as that configured on the port. The port
then removes the tag from the frame and sends the untagged frame to PC 2.
VLANIF interface
A VLANIF interface is a Layer 3 logical interface, which can be configured on either a
Layer 3 switch or a router.
Layer 3 switching combines routing and switching techniques to implement routing on a
switch, thus improving the overall network performance. After sending the first data flow,
a Layer 3 switch generates mappings between MAC addresses and IP addresses. To send
the same data flow, the switch directly sends the data flow at Layer 2 but not Layer 3 based
on this mapping table. In this manner, delays on the network caused by route selection are
eliminated, thus improving data forwarding efficiency. Layer 3 switches have both
switching and routing functions.
Issue 01 (2011-07-15)

47

To allow that new data flows are correctly forwarded based on the routing table, be sure
that the routing table's routing entries are correct. Therefore, VLANIF interfaces and
routing protocols must be configured on Layer 3 switches for reachable Layer 3 routes.
NOTE
Key points are summarized as follows:

l
A PC does not need to know the VLAN to which it belongs. It sends only untagged frames.
After receiving an untagged frame from a PC, a switching device determines the VLAN to which
the frame belongs. The determination is based on the configured VLAN division method such as port
information, and then the switching device processes the frame accordingly.
If the frame needs to be forwarded to another switching device, the frame must be transparently
transmitted along a trunk link. Frames transmitted along trunk links must carry VLAN tags to allow
other switching devices to properly forward the frame based on the VLAN information.
Before sending the frame to the destination PC, the switching device connected to the destination PC
removes the VLAN tag from the frame to ensure that the PC receives an untagged frame.
Generally, only tagged frames are transmitted on trunk links; only untagged frames are transmitted on
access links. In this manner, switching devices on the network can properly process VLAN information
and PCs are not concerned about VLAN information.
3.2 VLAN Features Supported by the S2700

This section describes VLAN features supported by the S2700 to help you understand VLAN
configurations.
The VLAN technology helps set up virtual groups to separate broadcast domains and implements
both intra-VLAN and inter-VLAN communication.
1.
After VLANs are configured, users in a VLAN can communicate with each other.
2.
In addition to intra-VLAN communication, users in different VLANs need to communicate

with each other sometimes.
NOTE
Intra-VLAN communication and inter-VLAN communication are basic VLAN functions.
3.
The following VLAN features are also supported to meet requirements of special
applications and extended functions:
l VLAN aggregation: prevents the waste of IP addresses and implements inter-VLAN
communication.
l Voice VLAN: select voice data packets from various packets and changes the priority
of voice data packets to improve the voice data transmission quality.
l Management VLAN (mVLAN): helps implement integrated management by using a
remote device. A user can use the IP address of the VLANIF interface corresponding
to the mVLAN to telnet to a management switch.
NOTE
l The S2700SI does not support voice VLAN.

l The S2700SI does not support VLAN aggregation.
VLAN Assignment
VLAN assignment is a basic VLAN configuration. After VLANs are configured, users in a
VLAN can communicate with each other. VLANs are configured in different manners, as shown
in Table 3-3.
Issue 01 (2011-07-15)

48

Table 3-3 VLAN assignment in different usage scenarios

VLAN
Assignment
Method
Advantage
Disadvantage
Usage Scenario
Port-based
VLAN
assignment
The configuration is
simple. It is the most
common VLAN
assignment method.
not flexible. If a port
needs to transmit
frames of another
VLAN, the port must
be deleted from the
original VLAN and
added to the new
VLAN. For a network
having a large number
of traveling users, the
network administrator
needs to spend more
time on maintenance.
Port-based VLAN
assignment is applicable
to large-scale networks
that do not have high
security requirements.

assignment
If a user travels from

one place to another,
the user does not need
to be added to a new
VLAN. This improves
security and flexibility
for terminal users.
A network
administrator needs to
configure a switch
with a MAC address
associated with a
specific VLAN. For a
network with a large
number of terminals,
configuration will take
the network
administrator a lot of
work before VLANbased communication
can be enabled.
MAC address-based
VLAN assignment is
applicable to networks
that have high security
requirements and many
traveling users.
NOTE
The S2700SI does not support MAC address-based VLAN assignment.
Inter-VLAN Communication
After VLANs are configured, users in a VLAN can communicate with each other. Users in
different VLANs cannot directly communicate with each other. Table 3-4 lists schemes for interVLAN communication.
Issue 01 (2011-07-15)

49

Table 3-4 Schemes for inter-VLAN communication

Inter-VLAN
Communica
tion Scheme
Advantage
Disadvantage
Usage Scenario
VLANIF
interface
After VLANIF
interfaces are
configured, users in
different VLANs and
network segments can
communicate with
each other as long as
routes are reachable.
If multiple users on a
network belong to
different VLANs, each
VLAN requires a
VLANIF interface.
Each VLANIF interface
needs to be assigned an
IP address. This
increases configuration
workload and uses a lot
of IP addresses.
This scheme is
applicable to smallscale networks on
which users belong to
different network
segments and IP
addresses of these
users are seldom
changed.
Inter-VLAN
communication can
also be implemented by
Layer 3 switches if
This scheme boasts of
low operating costs.
VLAN Aggregation
To implement inter-VLAN communication on switches, configure IP addresses for the VLANIF
interfaces. When many VLANs are deployed, a great number of IP addresses are occupied.
VLAN aggregation can solve the problem of occupation of excessive IP addresses.
VLAN aggregation means that multiple VLANs are aggregated into a super-VLAN. The VLANs
that form the super-VLAN is called sub-VLANs.
You can create a VLANIF interface for a super-VLAN. Then, you can configure an IP address
only for this interface rather than for each sub-VLAN. All sub-VLANs share the same IP network
segment, which optimizes the use of IP addresses.
3.3 Dividing a LAN into VLANs

A LAN can be divided into several VLANs and users in each VLAN can communicate with
each other. Currently, the S2700 supports several VLAN division modes. You can choose one
of them as required.

Before dividing a LAN into VLANs, familiarize yourself with the applicable environment,
complete the pre-configuration tasks, and obtain the data required for the configuration. This
will help you complete the configuration task quickly and accurately.
Currently, the S2700 supports the following VLAN division modes. You can choose one of them
as required. Table 3-5 lists VLAN division modes.
Issue 01 (2011-07-15)

50

Table 3-5 VLAN assignment in different usage scenarios

VLAN
Assignment
Method
Advantage
Disadvantage
Usage Scenario
Port-based
VLAN
assignment
simple. It is the most
common VLAN
assignment method.
not flexible. If a port
needs to transmit
frames of another
VLAN, the port must
be deleted from the
original VLAN and
added to the new
VLAN. For a network
having a large number
of traveling users, the
network administrator
needs to spend more
time on maintenance.
Port-based VLAN
assignment is applicable
to large-scale networks
that do not have high
security requirements.

assignment
If a user travels from

one place to another,
the user does not need
to be added to a new
VLAN. This improves
security and flexibility
for terminal users.
A network
administrator needs to
configure a switch
with a MAC address
associated with a
specific VLAN. For a
network with a large
number of terminals,
configuration will take
the network
administrator a lot of
work before VLANbased communication
can be enabled.
MAC address-based
VLAN assignment is
applicable to networks
that have high security
requirements and many
traveling users.
NOTE
The S2700SI does not support MAC address-based VLAN assignment.

NOTE
In the case that the S2700 supports multiple VLAN division modes, the priorities of these VLAN division
modes are in descending order:
1. MAC address-based VLAN division
2. Port-based VLAN division
Port-based VLAN division has the lowest priority, but is most commonly used.
Before dividing a LAN into VLANs, complete the following task:
l
Issue 01 (2011-07-15)
Connecting ports and configuring physical parameters of the ports, ensuring that the ports
are physically Up
51

Data Preparation
To dividing a LAN into VLANs, you need the following data.
No.
Data
VLAN ID, number of each Ethernet port to be added to the VLAN, and (optional)
attributes of Ethernet ports
(Optional) Priority of each Ethernet port
MAC address mapped to the VLAN
3.3.2 Dividing a LAN into VLANs Based on Ports

Dividing a LAN into VLANs based on ports is the most simple and effective VLAN division
mode.
Context
After VLANs are configured based on ports, the VLANs can process tagged and untagged frames
in the following manners:
l
After receiving an untagged frame, a port adds the PVID to the frame, searches the MAC
address table for an outbound port, and sends the tagged frame from the outbound port.
After a port receives a tagged frame, it checks the VLAN ID carried in the frame:
If the port allows frames with the specified VLAN ID to pass through, it forwards the
frame.
If the port does not allow frames with the specified VLAN ID to pass through, it discards
the frame.

1.
Create VLANs.
2.
Configure the port type and features.

(1) Configure the port type (access, trunk, hybrid, or QinQ).
3.
Add ports to VLANs.
Procedure
Step 1 Run:
system-view

Step 2 Run:
vlan vlan-id
A VLAN is created, and the VLAN view is displayed. If the specified VLAN has been created,
the VLAN view is directly displayed.
Issue 01 (2011-07-15)

52

The VLAN ID ranges from 1 to 4094. If VLANs need to be created in batches, run the vlan
batch { vlan-id1 [ to vlan-id2 ] } &<1-10> command to create VLANs in batches, and then run
the vlan vlan-id command to enter the view of a specified VLAN.
Step 3 Run:
quit

Step 4 Configure the port type and features.
1.
Run the interface interface-type interface-number command to enter the view of an

Ethernet port to be added to the VLAN.
2.
Run the port link-type { access | hybrid | trunk | dot1q-tunnel } command to configure
the port type.
By default, the port type is hybrid.
l If a Layer 2 Ethernet port is directly connected to a terminal, set the port type to access
or hybrid. Setting the port type to access is recommended.
l If a Layer 2 Ethernet port is connected to another switch, the port type can be set to
access, trunk, hybrid, or QinQ. Setting the port type to trunk is recommended.
Step 5 Add ports to the VLAN.

Run either of the following commands as needed:
l For access or QinQ ports:
Run the port default vlan vlan-id command to add a port to a specified VLAN.
To add ports to a VLAN in batches, run the port interface-type { interface-number1 [ to
interface-number2 ] } &<1-10> command in the VLAN view.
l For trunk ports:
Run the port trunk allow-pass vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
command to add the port to specified VLANs.
(Optional) Run the port trunk pvid vlan vlan-id command to specify the default VLAN
for a trunk interface.
l For hybrid ports:
Run either of the following commands to add a port to VLANs in untagged or tagged
mode:
Run the port hybrid untagged vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
command to add a port to VLANs in untagged mode.
In untagged mode, a port removes tags from frames and then forwards the frames.
This is applicable to scenarios in which Layer 2 Ethernet ports are connected to
terminals.
Run the port hybrid tagged vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
command to add a port to VLANs in tagged mode.
In tagged mode, a port forwards frames without removing their tags. This is applicable
to scenarios in which Layer 2 Ethernet ports are connected to switches.
(Optional) Run the port hybrid pvid vlan vlan-id command to specify the default VLAN
of a hybrid interface.
By default, all ports are added to VLAN 1.
----End
Issue 01 (2011-07-15)

53

3.3.3 Dividing a LAN into VLANs Based on MAC Addresses

MAC address-based VLAN division is used if user locations do not need to be concerned. This
improves security and flexibility for terminal users.
Context
VLANs configured based on MAC addresses process only untagged frames, and treat tagged
frames in the same manner as VLANs configured based on ports.
After receiving an untagged frame, a port searches for a MAC-VLAN mapping based on the
source MAC address in the frame.
l
If a mapping is found, the port forwards the frame based on the VLAN ID and priority
value in the mapping.
If no matching mapping is found, the port matches the frame with other matching rules.

1.
Create VLANs.
2.
Map MAC addresses to VLAN IDs.
3.
Configure the port type and features.

(1) Set the port type to hybrid.
(2) Configure a port to allow frames with specified VLAN IDs to pass through.
4.
Enable MAC address-based VLAN division.
Procedure
Step 1 Run:
system-view

Step 2 Run:
vlan vlan-id
A VLAN is created, and the VLAN view is displayed. If the specified VLAN has been created,
the VLAN view is directly displayed.
The VLAN ID ranges from 1 to 4094. If VLANs need to be created in batches, run the vlan
batch { vlan-id1 [ to vlan-id2 ] } &<1-10> command to create VLANs in batches, and then run
the vlan vlan-id command to enter the view of a specified VLAN.
Step 3 Run:
mac-vlan mac-address mac-address [ mac-address-mask | mac-address-mask-length ]
Map a MAC address to the VLAN.

l The mac-address value is in the H-H-H format. H is a hexadecimal number that contains one
to four digits, such as 00e0 and fc01. If an H contains less than four digits, 0s are padded
ahead. For example, if you specify an H as e0, it is displayed as 00e0. A MAC address cannot
be set to all 0s or all Fs.
Step 4 Run:
quit
Issue 01 (2011-07-15)

54


Step 5 Configure the port type and features.
1.
Run the interface interface-type interface-number command to enter the view of the port
to be configured to allow frames with a specified VLAN ID to pass through.
2.
Run the port link-type hybrid command to set the port type to hybrid.
By default, the port type is hybrid.
3.
Run the port hybrid untagged vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all } command
to configure the hybrid port to allow frames with a specified VLAN ID to pass through.
NOTE
If an interface is added to a MAC address-based VLAN with a mask specified, add this interface to
its default VLAN.
Step 6 Run:
mac-vlan enable
MAC address-based VLAN division is enabled.

By default, MAC address-based VLAN division is disabled.
----End

After dividing a LAN into VLANs, you can view information about VLANs configured in
different modes. For example, which VLANs are classified based on ports or MAC addresses.
Prerequisite
The configurations of VLAN division are complete.
Procedure
l
Run the display vlan [ vlan-id [ verbose ] ] command to check information about all
VLANs or a specified VLAN.
Run the display mac-vlan { mac-address { all | mac-address [ mac-address-mask | macaddress-mask-length ] } | vlan vlan-id } command to check information about VLANs
configured based on MAC addresses.
----End
3.4 Creating a VLANIF Interface

VLANIF interfaces are Layer 3 logical interfaces. After creating VLANIF interfaces on Layer
2 devices, you can configure Layer 3 features on these interfaces.

Before creating a VLANIF interface, familiarize yourself with the applicable environment,
Issue 01 (2011-07-15)

55

Layer 3 switching combines routing and switching techniques to implement routing on a switch,
thus improving the overall network performance. After sending the first data flow, a Layer 3
switch generates mappings between MAC addresses and IP addresses. To send the same data
flow, the switch directly sends the data flow at Layer 2 but not Layer 3 based on this mapping
table. In this manner, delays on the network caused by route selection are eliminated, thus
improving data forwarding efficiency. Layer 3 switches have both switching and routing
functions.
To allow that new data flows are correctly forwarded based on the routing table, be sure that the
routing table's routing entries are correct. Therefore, VLANIF interfaces and routing protocols
must be configured on Layer 3 switches for reachable Layer 3 routes.
Before creating a VLANIF interface, complete the following task:
l
Creating a VLAN
Data Preparation
To create a VLANIF interface, you need to the following data.
No.
Data
VLAN ID
IP address to be assigned to the VLANIF interface
(Optional) Delay after which the VLANIF interface goes Down
(Optional) MTU of the VLANIF interface
3.4.2 Creating a VLANIF Interface

Before configure Layer 3 features on a Layer 2 device, you must create a VLANIF interface on
the device.
Procedure
Step 1 Run:
system-view

Step 2 Run:
interface vlanif vlan-id
A VLANIF interface is created and the VLAIF interface view is displayed.

The VLAN ID specified in this command must be the ID of an existing VLAN.
Issue 01 (2011-07-15)

56

NOTE
A VLANIF interface is Up only when at least one physical port added to the corresponding VLAN is Up.
----End
3.4.3 Assigning an IP Address to a VLANIF Interface

As a VLANIF interface is a Layer 3 logical interface, it can communicate with other interfaces
at the network layer only after being assigned an IP address.
Procedure
Step 1 Run:
system-view

Step 2 Run:
The VLANIF interface view is displayed.

Step 3 Run:
ip address ip-address { mask | mask-length } [ sub ]
An IP address is assigned to the VLANIF interface for communication at the network layer.
----End
3.4.4 (Optional) Setting a Delay After Which a VLANIF Interface

Goes Down
Setting a delay after which a VLANIF interface goes Down prevents network flapping caused
by changes of VLANIF interface status. This function is also called VLAN damping.
Context
If a VLAN goes Down because all ports in the VLAN go Down, the system immediately reports
the VLAN Down event to the corresponding VLANIF interface, instructing the VLANIF
interface to go Down.
To prevent network flapping caused by changes of VLANIF interface status, enable VLAN
damping on the VLANIF interface. After the last Up port in a VLAN goes Down, the system
starts a delay timer and informs the corresponding VLANIF interface of the VLAN Down event
after the timer expires. If a port in the VLAN goes Up during the delay period, the VLANIF
interface remains Up.
Procedure
Step 1 Run:
system-view

Issue 01 (2011-07-15)

57

Step 2 Run:

Step 3 Run:
damping time delay-time
The delay for VLAN damping is set.

The delay-time value ranges from 0 to 20, in seconds. By default, the value is 0 seconds,
indicating that VLAN damping is disabled.
----End
3.4.5 (Optional) Setting the MTU of a VLANIF Interface

Context
NOTE
l After changing the maximum transmission unit (MTU) by using the mtu command on a specified
interface, you need to restart the interface to make the new MTU take effect. To restart the interface,
run the shutdown command and then the undo shutdown command, or run the restart command in
the interface view.
l If you change the MTU of an interface, you need to change the MTU of the peer interface to the same
value by using the mtu command; otherwise, services may be interrupted.
l To ensure availability of Layer 3 functions, set the MTU value of the VLANIF interface to be smaller
than the maximum length of frames on the physical interface in the corresponding VLAN.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
mtu mtu
The MTU of the VLANIF interface is set.

The MTU of a VLANIF interface ranges from 128 to 9216, in bytes. The default value is 1500.
NOTE
If the MTU is too small whereas the packet size is large, the packet is probably split into many fragments.
Therefore, the packet may be discarded due to the insufficient QoS queue length. To avoid this situation,
lengthen the QoS queue accordingly.
----End
Issue 01 (2011-07-15)

58


After a VLANIF interface is configured for communication at the network layer, you can check
the IP address and status of a specified VLANIF interface.
Prerequisite
The configurations of a VLANIF interface are complete.
Procedure
l
Run the display interface vlanif [ vlan-id ] command to check the physical status, link
protocol status, description, and IP address of the VLANIF interface.
----End
3.5 Configuring Inter-VLAN Communication

Configuring inter-VLAN communication allows users in different VLANs to communicate with
each other. Currently, the S2700 supports several inter-VLAN communication schemes. Choose
one of them as required.

Before configuring inter-VLAN communication, familiarize yourself with the applicable
environment, complete the pre-configuration tasks, and obtain the data required for the
configuration. This will help you complete the configuration task quickly and accurately.
Currently, schemes listed in Table 3-6 are provided for inter-VLAN communication. You can
choose one of them based on the real world situation.
Issue 01 (2011-07-15)

59

Table 3-6 Schemes for inter-VLAN communication

Inter-VLAN
Communica
tion Scheme
Advantage
Disadvantage
Usage Scenario
VLANIF
interface
After VLANIF
interfaces are
configured, users in
different VLANs and
network segments can
communicate with
each other as long as
If multiple users on a
network belong to
different VLANs, each
VLAN requires a
VLANIF interface.
Each VLANIF interface
needs to be assigned an
IP address. This
increases configuration
workload and uses a lot
of IP addresses.
This scheme is
applicable to smallscale networks on
which users belong to
different network
segments and IP
addresses of these
users are seldom
changed.
Inter-VLAN
communication can
also be implemented by
Layer 3 switches if
This scheme boasts of
low operating costs.
Before configuring inter-VLAN communication, complete the following task:
l
Creating VLANs
Data Preparation
To configure inter-VLAN communication, you need the following data.
No.
Data
VLAN ID, VLANIF interface number, IP address and mask of the VLANIF
interface
3.5.2 Configuring VLANIF Interfaces for Inter-VLAN

Communication
Configuring VLANIF interfaces for inter-VLAN communication saves expenditure and helps
implement fast forwarding.
Context
VLAIF interfaces are Layer 3 logical interfaces. After being assigned IP addresses, VLANIF
interfaces are able to communicate at the network layer.
By using VLANIF interfaces to implement inter-VLAN communication, you need to configure
a VLANIF interface for each VLAN and assign an IP address to each VLANIF interface.
Issue 01 (2011-07-15)

60

Figure 3-5 Networking diagram for configuring VLANIF interfaces for inter-VLAN
communication
Switch
VLANIF2
VLAN2
VLANIF3
VLAN3
NOTE
The default gateway address of each PC in a VLAN must be the IP address of the corresponding VLANIF
interface. Otherwise, inter-VLAN communication will fail.
Procedure
Step 1 Run:
system-view

Step 2 Run:

NOTE
A VLANIF interface is Up only when at least one physical port added to the corresponding VLAN is Up.
Step 3 Run:
An IP address is assigned to the VLANIF interface.

VLANIF interfaces must belong to different network segments.
----End
Issue 01 (2011-07-15)

61


After inter-VLAN communication is configured, you can check whether users in different
VLANs can communicate with each other and check information about VLANs to which users
belong.
Prerequisite
The configurations of inter-VLAN communication are complete.
Procedure
l
Run the ping [ ip ] [ -a source-ip-address | -c count | -d | -f | -h ttl-value | -i interfacetype interface-number | -m time | -n | -p pattern | -q | -r | -s packetsize | -system-time | -t
timeout | -tos tos-value | -v | -vpn-instance vpn-instance-name ] * host command to check
whether users in different VLANs can communicate with each other.
If the ping fails, you can run the following commands to locate the fault:
Run the display vlan [ vlan-id [ verbose ] ] command to check information about all
VLANs or a specified VLAN.
Run the display interface vlanif [ vlan-id ] command to check information about
VLANIF interfaces.
Before running this command, ensure that VLANIF interfaces have been configured.
----End
3.6 Configuring VLAN Aggregation to Save IP Addresses

VLAN aggregation prevents the waste of IP addresses and implements inter-VLAN
communication.

Before configuring VLAN aggregation, familiarize yourself with the applicable environment,
As networks expand, address resources become insufficient. VLAN aggregation is developed
to save IP addresses.
In VLAN aggregation, one super-VLAN is associated with multiple sub-VLANs. Physical ports
cannot join a super-VLAN but a VLANIF interface can be created for the super-VLAN and an
IP address can be assigned to the VLANIF interface. Physical ports can join a sub-VLAN but
no VLANIF interface can be created for the sub-VLAN. All the ports in the sub-VLAN use the
same IP address with the VLANIF interface of the super-VLAN. This saves subnet IDs, default
gateway addresses of the subnets, and directed broadcast addresses of the subnets. In addition,
different broadcast domains can use the addresses in the same subnet segment. As a result, subnet
differences are eliminated, addressing becomes flexible, and the number of idle addresses is
reduced. VLAN aggregation allows each sub-VLAN to function as a broadcast domain and
reduces the waste of IP addresses to be assigned to ordinary VLANs.
Issue 01 (2011-07-15)

62

Figure 3-6 shows the typical VLAN aggregation networking.

Figure 3-6 Typical networking diagram for VLAN aggregation
PE
Super
VLAN4
CE1
CE2
Sub-VLAN 2
Sub-VLAN 3
NOTE
S2700SI does not support VLAN aggregation.
Before configuring VLAN aggregation, complete the following task:
l
Connecting ports and configuring physical parameters of the ports, ensuring that the ports
are physically Up
Data Preparation
To configure VLAN aggregation, you need the following data.
No.
Data
ID of each sub-VLAN and number of each port belonging to the sub-VLAN
ID of a super-VLAN
IP address and mask of a VLANIF interface
3.6.2 Creating a Sub-VLAN

Each sub-VLAN functions as a broadcast domain.
Issue 01 (2011-07-15)

63

Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
port link-type access
The link type of the interface is set to access.

Step 4 Run:
quit
Return to the system view.

Step 5 Run:
vlan vlan-id
A sub-VLAN is created and the sub-VLAN view is displayed.

Step 6 Run:
port interface-type { interface-number1 [ to interface-number2 ] } &<1-10>
A port is added to the sub-VLAN.

----End
3.6.3 Creating a Super-VLAN

A super-VLAN consists of several sub-VLANs. No physical port can be added to a super-VLAN,
but a VLANIF interface can be configured for the super-VLAN and an IP address can be assigned
to the VLANIF interface.
Context
NOTE
Before configuring a super-VLAN, ensure that sub-VLANs have been configured.
Procedure
Step 1 Run:
system-view

Step 2 Run:
vlan vlan-id
A VLAN is created, and the VLAN view is displayed.

The VLAN ID of a super-VLAN must be different from every sub-VLAN ID.
Issue 01 (2011-07-15)

64

Step 3 Run:
aggregate-vlan
A super-VLAN is created.
A super-VLAN cannot contain any physical interfaces.
VLAN 1 cannot be configured as a super-VLAN.
Step 4 Run:
access-vlan { vlan-id1 [ to vlan-id2 ] } &<1-10>
A sub-VLAN is added to a super-VLAN.

Before adding sub-VLANs to a super-VLAN in batches, ensure that these sub-VLANs are not
configured with VLANIF interfaces.
----End
3.6.4 Assigning an IP Address to the VLANIF Interface of a SuperVLAN

The IP address of the VLANIF interface of a super-VLAN must contain the subnet segments
where users in sub-VLANs reside. All the sub-VLANs use the IP address of the VLANIF
interface of the super-VLAN, thus saving IP addresses.
Procedure
Step 1 Run:
system-view

Step 2 Run:
A VLANIF interface is created for a super-VLAN, and the view of the VLANIF interface is
displayed.
Step 3 Run:
An IP address is assigned to the VLANIF interface.

----End
3.6.5 (Optional) Enabling Proxy ARP on the VLANIF Interface of a

Super-VLAN
PCs in different sub-VLANs cannot directly communicate with each other. To allow these PCs
to communicate with each other at Layer 3, enable proxy ARP on the VLANIF interface of the
super-VLAN.
Context
VLAN aggregation allows sub-VLANs to use the same subnet address, but prevents PCs in
different sub-VLANs from communicating with each other at the network layer.
Issue 01 (2011-07-15)

65

PCs in ordinary VLANs can communicate with each other at the network layer by using different
gateway addresses. In VLAN aggregation, PCs in a super-VLAN use the same subnet address
and gateway address. As PCs in different sub-VLANs belong to one subnet, they communicate
with each other only at Layer 2, not Layer 3. These PCs are isolated from each other at Layer
2. Consequently, PCs in different sub-VLANs cannot communicate with each other.
Proxy ARP is required to enable PCs in a sub-VLAN to communicate with PCs in another subVLAN or PCs on other networks. After a super-VLAN and its VLANIF interface are created,
proxy ARP must be enabled to allow the super-VLAN to forward or process ARP request and
reply packets. Proxy ARP helps PCs in sub-VLANs communicate with each other at the network
layer.
NOTE
An IP address must have been assigned to the VLANIF interface corresponding to the super-VLAN.
Otherwise, proxy ARP cannot take effect.
VLAN aggregation simplifies configurations for the network where many VLANs are
configured and PCs in different VLANs need to communicate with each other.
Procedure
Step 1 Run:
system-view

Step 2 Run:
The view of the VLANIF interface of the super-VLAN is displayed.

Step 3 Run:
arp-proxy inter-sub-vlan-proxy enable
Inter-sub-VLAN proxy ARP is enabled.

----End

After VLAN aggregation is configured, you can view VLAN types and information about
VLANIF interfaces, such as the physical status, link protocol status, IP address, and mask.
Prerequisite
The VLAN aggregation configurations are complete.
Procedure
l
Run the display vlan [ vlan-id [ verbose ] ] command to check VLAN information.
Run the display interface vlanif [ vlan-id ] command to check information about a specific
VLANIF interface.
----End
Issue 01 (2011-07-15)

66

3.7 Configuring a Voice VLAN to Transmit Voice Data

A voice VLAN is used to transmit voice data.

Before configuring a voice VLAN, familiarize yourself with the applicable environment,
Voice and non-voice data are transmitted on networks. Voice data is configured with a higher
priority than non-voice data to reduce the probability of the transmission delay and packet loss.
In most cases, an Access Control List (ACL) is configured to distinguish voice data from nonvoice data, and the Quality of Service (QoS) is used to ensure the transmission quality of voice
data.
Voice over IP (VoIP) phones are commonly used. If an ACL is configured to distinguish voice
data from non-voice data, and QoS is used to ensure the transmission quality of voice data, each
terminal needs to be configured with an ACL rule. This increases the network administrator's
workload and burdens maintenance.
The voice VLAN technique is introduced to solve the preceding problem.
After being enabled with the voice VLAN function, a device determines voice data based on
source MAC addresses of received frames, adds ports that receive voice data to a voice VLAN,
and automatically applies priority rules to ensure high priorities and good qualities of voice data.
This simplifies user configuration and facilitates management on voice data.
On the network shown in Figure 3-7, a user's High Speed Internet (HSI), VoIP, and Internet
Protocol Television (IPTV) services are connected to a switch. A voice VLAN can be configured
on the switch to implement QoS for voice data, prioritize voice data, and ensure the
communication quality.
Issue 01 (2011-07-15)

67

Figure 3-7 Networking diagram for configuring a voice VLAN
Server
Network
Voice VLAN
VLAN 10
Switch
LAN Switch2
LAN Switch1
HSI
VoIP
IPTV
HSI
VoIP
IPTV
Voice flow
Before configuring a voice VLAN, complete the following task:
l
Creating VLANs
Data Preparation
To configure a voice VLAN, you need the following data.
Issue 01 (2011-07-15)
No.
Data
The Organizationally Unique Identifier (OUI) address and mask of the voice VLAN
(Optional) Aging timer value of the voice VLAN
(Optional) 802.1p priority and DSCP value for the voice VLAN
Type and number of the port enabled with the voice VLAN function
Mode in which the port is added to the voice VLAN
(Optional) Security mode of the voice VLAN

68

3.7.2 Enabling the Voice VLAN Function

After being enabled with the voice VLAN function, a device is able to identify voice data based
on source MAC addresses of received frames.
Procedure
Step 1 Run:
system-view

Step 2 Run:
The view of a port connecting the device to users' voice devices is displayed.
Step 3 Run:
voice-vlan vlan-id enable
A voice VLAN is configured and the voice VLAN function is enabled on the port.
By default, the voice VLAN function is disabled on ports.
NOTE
l VLAN 1 cannot be configured as a voice VLAN.

l The voice VLAN and default VLAN on a port must be assigned different VLAN IDs to ensure that
every function works properly.
l Only one VLAN on a port can be configured as a voice VLAN at a time.
l If the voice VLAN configured on an interface works in automatic mode, you need to run the port linktype command to set the interface type to trunk, or hybrid.
l Before deleting a voice VLAN, run the undo voice-vlan enable command to disable the voice VLAN
function.
l The port enabled with the voice VLAN function cannot be configured with VLAN mapping, VLAN
stacking, or traffic policies.
----End
3.7.3 Configuring an OUI for a Voice VLAN

A voice VLAN-enabled port checks source MAC addresses of received frames. If the source
MAC addresses match OUIs, the frames are considered voice data.
Context
An OUI is a globally-unique identifier assigned by the Institute of Electrical and Electronics
Engineers (IEEE) to a specific equipment vendor. An OUI represents the first 24 bits of a binary
MAC address.
An OUI represents a MAC address segment that is obtained by performing the AND operation
between a 48-bit MAC address and a mask. For example, the MAC address is 1-1-1, and the
mask is FFFF-FF00-0000. The AND operation is performed between the MAC address and the
mask to obtain the OUI 0001-0000-0000. If the first 24 bits of the MAC address of a device are
the same as an OUI, a voice VLAN-enabled port considers the device as a voice device and data
from the device as voice data.
Issue 01 (2011-07-15)

69

Procedure
Step 1 Run:
system-view

Step 2 Run:
voice-vlan mac-address
mac-address mask oui-mask [ description text ]
An OUI is configured.
l The mac-address value cannot be all 0s or a multicast or broadcast address.
l A device can be configured with a maximum of 16 OUIs. When the device is configured
with 16 OUIs, subsequent configurations will not take effect.
l When using the undo voice-vlan mac-address command to delete an OUI, specify the macaddress value in this command as the result of the AND operation by using the configured
MAC address and mask.
NOTE
When the source MAC address of a packet matches the OUI, the S2700 changes the priority of the packet
basing on the configuration of 3.7.5 (Optional) Configuring an 802.1p Priority and a DSCP Value for
the Voice VLAN to improve the transmission quality.
----End
3.7.4 (Optional) Setting an Aging Timer for a Voice VLAN

In automatic mode, a voice VLAN-enabled port learns source MAC addresses of frames from
voice devices, adds ports connecting the device to voice devices to a voice VLAN, and uses the
voice VLAN aging timer to control the number of ports in the voice VLAN.
Context
The aging timer of a voice VLAN is effective only when ports are automatically added to the
voice VLAN.
If a voice VLAN-enabled port does not receive voice data from a voice device before the aging
timer expires, the port will be automatically deleted from the voice VLAN. If the port receives
voice data from the voice device again, the port will be automatically added to the voice VLAN.
Procedure
Step 1 Run:
system-view

Step 2 Run:
voice-vlan aging-time minutes
The aging timer is set for a voice VLAN.

The aging timer value ranges from 5 to 43200, in minutes. The default value is 1440 minutes.
----End
Issue 01 (2011-07-15)

70

3.7.5 (Optional) Configuring an 802.1p Priority and a DSCP Value

for the Voice VLAN
Different 802.1p priorities and DiffServ Code Point (DSCP) values can be configured for
different voice VLANs, which makes voice service deployment more flexible.
Context
By default, the 802.1p priority and DSCP value for each voice VLAN are 6 and 46 respectively.
Manual configuration of the 802.1p priority and DSCP value will allow you to plan priorities
for different voice services at will.
NOTE
l The 802.1p priority is indicated by the value in the 3-bit PRI field in each 802.1Q VLAN frame. This
field determines the transmission priority for data packets when a switching device is congested.
l The DSCP value is indicated by the 6 bits in the Type of Service (ToS) field in the IPv4 packet header.
DSCP, as the signaling for DiffServ, is used for QoS guarantee on IP networks. The traffic controller
on the network gateway takes actions merely based on the information carried by the 6 bits.
Procedure
Step 1 Run:
system-view

Step 2 Run:
voice-vlan remark { 8021p 8021p-value | dscp dscp-value }
An 802.1p priority and a DSCP value are configured for a voice VLAN.
By default, the 802.1p priority and DSCP value for a voice VLAN are 6 and 46 respectively.
----End
3.7.6 (Optional) Configuring the Mode in Which Ports Are Added

to a Voice VLAN
On a switching device, only one VLAN on a port can be configured as a voice VLAN. Ports can
be added to the voice VLAN in either automatic or manual mode.
Context
Ports can be added to a voice VLAN in either of the following modes:
l
Automatic mode
A voice VLAN-enabled port learns source MAC addresses of frames from voice devices,
adds ports connecting the device to voice devices to a voice VLAN, and uses the voice
VLAN aging timer to control the number of ports in the voice VLAN. If a voice VLANenabled port does not receive voice data from a voice device before the aging timer expires,
the port will be automatically deleted from the voice VLAN. If the port receives voice data
from the voice device again, the port will be automatically added to the voice VLAN.
l
Issue 01 (2011-07-15)
Manual mode
71

After the voice VLAN function is enabled, ports connected to voice devices must be
manually added to a voice VLAN. Otherwise, the voice VLAN function does not take
effect.
Procedure
Step 1 Run:
system-view

Step 2 Run:
Step 3 Run:
voice-vlan mode { auto | manual }
The mode in which ports are added to a voice VLAN is configured.

By default, ports are automatically added to a voice VLAN.
l If the auto parameter is configured, ports will be automatically added to a voice VLAN.
l If the manual parameter is configured, ports will be manually added to a voice VLAN.
If trunk ports are connected to voice devices, run the port trunk allow-pass vlan
{ { vlan-id1 [ to vlan-id2 ] } &<1-10> | all } command to manually add these ports to a
voice VLAN.
If hybrid ports are connected to voice devices, do as follows as required:
Run the port hybrid untagged vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
command to manually add these ports to a voice VLAN in untagged mode.
Run the port hybrid tagged vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
command to manually add these ports to a voice VLAN in tagged mode.
NOTE
In Access ports cannot be automatically added to a voice VLAN. To add a port of the access type to the
voice VLAN, run the port link-type command to change the port type to trunk or hybrid.
----End
3.7.7 (Optional) Configuring the Working Mode for a Voice VLAN

A voice VLAN works in either security or ordinary mode to transmit merely voice data or both
voice and non-voice data.
Context
Based on the data filtering mechanism, a voice VLAN works in either security or ordinary mode:
l
Security mode
A voice VLAN-enabled inbound port transmits only frames of which the source MAC
addresses match OUIs configured on the device, discards the voice data not belong to the
current voice VLAN and the other data can be forwarded normally.
The security mode prevents a voice VLAN from being attacked by malicious data flows,
but consumes system resources to check frames.
Issue 01 (2011-07-15)

72

Ordinary mode
A voice VLAN-enabled inbound port transmits both voice and non-voice data. The port
does not compare source MAC addresses in received frames with configured OUIs,
exposing a voice VLAN to malicious attacks.
NOTE
Transmitting voice and service data at the same time in a voice VLAN is not recommended. If a voice
VLAN must transmit both voice and service data, ensure that the voice VLAN works in ordinary mode.
Table 3-7 shows how to process frames in different voice VLAN working modes.
Table 3-7 Frame processing in different voice VLAN working modes
Voice VLAN
Working Mode
Frame Processing Mode
Security mode
If the source MAC address of a frame and the OUI do not match,
the priority of the frame is not changed and the frame is prohibited
from forwarding in the voice VLAN.
Ordinary mode
If the source MAC address of a frame and the OUI do not match,
the priority of the frame is not changed and the frame is allowed to
be forwarded in the voice VLAN.
Procedure
l
Security mode
1.
Run the system-view command to enter the system view.
2.
Run the interface interface-type interface-number command to enter the view of a

port connecting the device to users' voice devices.
3.
Run the voice-vlan security enable command to configure the voice VLAN work in
security mode.
By default, a voice VLAN works in security mode.
Ordinary mode
1.
Run the system-view command to enter the system view.
2.
Run the interface interface-type interface-number command to enter the view of a

port connecting the device to users' voice devices.
3.
Run the undo voice-vlan security enable command to configure the voice VLAN
work in ordinary mode.
By default, a voice VLAN works in security mode.
----End
3.7.8 (Optional) Configuring a Port to Communicate with a Voice

Device of Another Vendor
The voice VLAN legacy function can be configured to allow Huawei datacom devices to identify
packets of proprietary protocols of other vendors.
Issue 01 (2011-07-15)

73

Context
After VoIP devices of some vendors are powered on, proprietary protocol packets but not DHCP
packets are sent to apply for IP addresses. To help Huawei datacom devices communicate with
voice devices of other vendors, you can enable the voice VLAN legacy function. This allows
Huawei devices to identify packets of proprietary protocols of other vendors.
Procedure
Step 1 Run:
system-view

Step 2 Run:
Step 3 Run:
voice-vlan legacy enable
The port is configured to communicate with a voice device of another vendor.

By default, ports on Huawei devices cannot communicate with voice devices of other vendors.
----End

After a voice VLAN is configured, you can view information about the voice VLAN, including
the OUI, working mode, security mode or ordinary mode, aging timer value, the 802.1p priority
and DSCP value as well as the configuration of the port enabled with the voice VLAN function.
Prerequisite
The configurations of a voice VLAN are complete.
Procedure
l
Run the display voice-vlan [ vlan-id ] status command to check information about the
voice VLAN, including the working mode, security mode, aging timer value and the 802.1p
priority and DSCP value as well as the configuration of the port enabled with the voice
VLAN function.
Run the display voice-vlan oui command to check information about the OUI of the voice
VLAN, including the mask and description of the OUI.
----End
3.8 Configuring an mVLAN to Implement Integrated

Management
Configuring an mVLAN allows users to use the IP address of the VLANIF interface
corresponding to the mVLAN to log in to a management switch to manage devices attached to
the switch.
Issue 01 (2011-07-15)

74


Before configuring an mVLAN to implement integrated management, familiarize yourself with
the applicable environment, complete the pre-configuration tasks, and obtain the data required
for the configuration. This will help you complete the configuration task quickly and accurately.
An mVLAN can be configured to help a user use an NMS to manage indirectly-connected
devices.
After an mVLAN is configured, a user can use the IP address of the VLANIF interface
corresponding to the mVLAN to telnet to a management switch and manage devices attached
to the switch.
Before configuring an mVLAN, complete the following task:
l
Creating a VLAN
Data Preparation
To configure an mVLAN, you need the following data.
No.
Data
VLAN ID
3.8.2 Configuring an mVLAN

An mVLAN allows a user to use the IP address of the VLANIF interface corresponding to the
mVLAN to telnet to a management switch to manage devices attached to the switch.
Do as follows on the device that requires an mVLAN:
Procedure
Step 1 Run:
system-view

Step 2 Run:
vlan vlan-id
The VLAN view is displayed.

Step 3 Run:
management-vlan
An mVLAN is configured.
Issue 01 (2011-07-15)

75

An mVLAN cannot be configured as a multicast VLAN, control VLAN of RRPP, or control

VLAN of SEP.
Only a trunk or hybrid port can be added to an mVLAN.
After the undo management-vlan command is used for an mVLAN, the mVLAN becomes an
ordinary VLAN, to which access, trunk, or hybrid ports can be added.
----End
3.8.3 Configuring a VLANIF Interface for an mVLAN

You need to use the IP address of the VLANIF interface corresponding to an mVLAN to telnet
to a management switch to manage attached devices.
Do as follows on the device that requires an mVLAN:
Procedure
Step 1 Run:
system-view

Step 2 Run:

The ID of the VLANIF interface must be the ID of a configured mVLAN.
Step 3 Run:
After assigning an IP address to the VLANIF interface, you can run the telnet command to log
in to a management switch to manage attached devices.
----End

After an mVLAN is configured, you can check information about the mVLAN.
Prerequisite
The configurations of an mVLAN are complete.
Procedure
l
Run the display vlan command to check information about the mVLAN. The command
output shows information about the mVLAN in the line started with an asterisk sign (*).
----End
3.9 Maintaining VLAN

A command of clearing statistics helps to locate the faults in a VLAN.
Issue 01 (2011-07-15)

76

3.9.1 Clearing the Statistics of VLAN Packets

Before collecting traffic statistics in a specified time period on an interface, you need to reset
the original statistics on the interface.
Context
CAUTION
Statistics about VLAN packets cannot be restored after you clear it. So, confirm the action before
you use the command.
To clear the Statistics of VLAN Packets, run the following reset command in the user view:
Procedure
l
Run the reset vlan vlan-id statistics command to clear packets of a specified VLAN
statistics.
----End

This section provides several examples of VLAN configuration.
3.10.1 Example for Configuring Interface-based VLANs

It is easy to divide a LAN into VLANs based on ports. After ports are added to different VLANs,
users in the same VLAN can directly communicate with each other, whereas users in different
VLANs cannot directly communicate with each other.
An enterprise has multiple departments. It is required that departments in charge of the same
service can communicate with each other, and departments in charge of different services cannot
It is required that on the network shown in Figure 3-8, the requirements are as follows:
l
Department 1 and Department 2 are isolated from Department 3 and Department 4.
Department 1 and Department 2 can communicate with each other.
Department 3 and Department 4 can communicate with each other.
Issue 01 (2011-07-15)

77

Figure 3-8 Networking diagram for configuring interface-based VLANs
Network
Eth0/0/4
Eth0/0/1
Eth0/0/2
Switch
Eth0/0/3
Group32 Department 4
Department 1 Department 2 Department
VLAN 3
VLAN 2
VLAN 3
1.
Create VLANs and determine mappings between employees and VLANs.
2.
Configure port types to determine the device connected to each port.
3.
Add the ports connected to department 1 and department 2 to VLAN 2 and the ports
connected to department 3 and department 4 to VLAN 3 to prevent employees in department
1 or department 2 from communicating with employees in department 3 or department 4.
Data Preparation
l
Eth 0/0/1 and Eth 0/0/2 belong to VLAN 2.
Procedure
Step 1 Configure the Switch.
# Create VLAN 2.
[Quidway] vlan 2
[Quidway-vlan2] quit
# Set the link type of Eth 0/0/1 to trunk and add Eth 0/0/1 to VLAN 2.
Issue 01 (2011-07-15)

78


[Quidway-Ethernet0/0/1] port link-type trunk
[Quidway-Ethernet0/0/1] port trunk allow-pass vlan 2
[Quidway]interface ethernet 0/0/2
# Create VLAN 3.
[Quidway] vlan 3

Ping any host in VLAN 3 from a host in VLAN 2. The ping operation fails. This indicates that
Department 1 and Department 2 are isolated from Department 3 and Department 4.
Ping any host in Department 2 from a host in Department 1. The ping operation is successful.
This indicates that Department 1 and Department 2 can communicate with each other.
Ping any host in Department 4 from a host in Department 3. The ping operation is successful.
This indicates that Department 3 and Department 4 can communicate with each other.
----End
Configuration Files
The following lists the configuration file of the Switch.
#
sysname Quidway
#
vlan batch 2 to 3
#
port trunk allow-pass vlan 2
#
#
#
Issue 01 (2011-07-15)

79


#
return
3.10.2 Example for Configuring MAC Address-based VLAN

Assignment
MAC address-based VLAN assignment is applicable only to simple networks where network
adapters are not changed frequently.
On an enterprise network, the network administrator adds PCs of employees in a department to
the same VLAN. To improve information security, only employees is this department are
allowed to access the intranet.
As shown in Figure 3-9, only PC1, PC2, and PC3 are allowed to access the intranet through
SwitchA and Switch.
Figure 3-9 Network diagram of MAC address-based VLAN assignment
Network
Eth0/0/2
Switch
Eth0/0/1
Eth0/0/1
SwitchA
MAC:22-22-22 MAC:33-33-33 MAC:44-44-44

PC3
PC2
PC1
VLAN 10
1.
Issue 01 (2011-07-15)
Create VLANs and determine the VLAN that PCs of employees belong to.
80

2.
Add Ethernet interfaces to VLANs.
3.
Associate MAC addresses of PC1, PC2, and PC3 with the specified VLAN so that the
Switch can assign the VLAN to packets according to their source MAC addresses.
Data Preparation
l
The PVID of Eth0/0/1 on the Switch is 100.
Eth0/0/1 of the Switch needs to be added to VLAN 10 in untagged mode.
Eth0/0/2 of the Switch needs to be added to VLAN 10 in tagged mode.
All the interfaces on SwitchA need to be added to VLAN 1 in untagged mode.
MAC addresses of PC1, PC2, and PC3 need to be associated with VLAN 10.
Procedure
# Create VLANs.
[Quidway] vlan batch 10 100
# Set the PVID of interfaces and add interfaces to the VLANs.

[Quidway] interface ethernet
[Quidway-Ethernet0/0/1] port
0/0/1
hybrid pvid vlan 100
hybrid untagged vlan 10
0/0/2
hybrid tagged vlan 10
# Associate MAC addresses of PC1, PC2, and PC3 with VLAN 10.
[Quidway] vlan 10
[Quidway-Vlan10] mac-vlan mac-address 22-22-22
[Quidway-Vlan10] quit
# Enable MAC address-based VLAN assignment on Eth0/0/1.

[Quidway-Ethernet0/0/1] mac-vlan enable

PC1, PC2, and PC3 can access the intranet, whereas PCs of non-employees cannot access the
intranet.
----End
Configuration Files
#
sysname Quidway
#
Issue 01 (2011-07-15)

81

vlan batch 10 100

#
vlan 10
mac-vlan mac-address 0022-0022-0022
#
port hybrid pvid vlan 100
port hybrid untagged vlan 10
mac-vlan enable
#
port hybrid tagged vlan 10
#
return
3.10.3 Example for Implementing Communication Between VLANs

by Using VLANIF Interfaces
A Layer 3 switch can replace a router to implement communications between VLANs by using
VLANIF interfaces.
Departments of an enterprise are located on different network segments and use same services
such as Internet access and VoIP. Departments in different VLANs need to use the same service,
so communication between VLANs must be implemented.
As shown in Figure 3-10, department 1 and department 2 use the same service but belong to
different VLANs and are located on different network segments. Users in department 1 and
department 2 need to communicate with each other.
Figure 3-10 Communication between VLANs using VLANIF interfaces
Switch
Eth0/0/1
SwitchA
Eth0/0/2
VLAN 10
Department1
Eth0/0/1
Eth0/0/3
VLAN 20
Department2
PC1
10.10.10.2/24
PC2
20.20.20.2/24
Issue 01 (2011-07-15)

82

1.
Create VLANs on the switches for different departments.
2.
Add Layer 2 interfaces to the VLANs so that packets of the VLANs can pass through the
Layer 2 interfaces.
3.
On the Layer 3 switch, create VLANIF interfaces corresponding to the VLANs and
configure IP addresses for the VLANIF interfaces to implement Layer 3 communication.
NOTE
To implement communication between VLANs, hosts in each VLAN must use the IP address of the
corresponding VLANIF interface as gateway address.
Data Preparation
l
Eth0/0/1 of the Switch needs to be added to VLAN 10 and VLAN 20.
The IP address of VLANIF10 on the Switch is 10.10.10.1/24.
The IP address of VLANIF20 on the Switch is 20.20.20.1/24.
Eth0/0/1of SwitchA needs to be added to VLAN 10 and VLAN 20.
Eth0/0/2 of SwitchA needs to be added to VLAN 10.
Eth0/0/3 of SwitchA needs to be added to VLAN 20.
Procedure
Step 1 # Configure the Switch.
# Create VLANs.
# Add Eth0/0/1 to VLANs.

[Quidway-Ethernet0/0/1] port trunk allow-pass vlan 10 20
# Assign IP addresses to VLANIF interfaces.

[Quidway] interface vlanif 10
[Quidway-Vlanif10] ip address 10.10.10.1 24
[Quidway-Vlanif10] quit
[Quidway-Vlanif20] ip address 20.20.20.1 24
Step 2 Configure SwitchA.

# Create VLANs.
# Add interfaces to VLANs.

Issue 01 (2011-07-15)
0/0/1
link-type trunk
trunk allow-pass vlan 10 20
0/0/2

83

[Quidway] ethernet 0/0/3
link-type access
default vlan 10
link-type access
default vlan 20

On PC1 in VLAN 10, set the default gateway address to 10.10.10.1/24, which is the IP address
of VLANIF10.
On PC2 in VLAN 20, set the default gateway address to 20.20.20.1/24, which is the IP address
of VLANIF20.
After the preceding configurations are complete, PC1 in VLAN 10 and PC2 in VLAN 20 can
communicate.
----End
Configuration Files
#
sysname Quidway
#
vlan batch 10 20
#
interface Vlanif10
ip address 10.10.10.1 255.255.255.0
#
interface Vlanif20
ip address 20.20.20.1 255.255.255.0
#
port trunk allow-pass vlan 10 20
#
return

#
sysname Quidway
#
vlan batch 10 20
#
port trunk allow-pass vlan 10 20
#
port default vlan 10
#
#
return
3.10.4 Example for Configuring VLAN Aggregation

This part describes how to configure communication between VLANs with less IP addresses.
Issue 01 (2011-07-15)

84

Assume that an enterprise has many departments and IP addresses of these departments are on
the same network segment, to improve the service security, IP address of employee users in
different departments are added to different VLANs. Employee users in different departments
need to communicate with each other.
As shown in Figure 3-11, IP addresses of the R&D department and test department belong to
different VLANs. It is required that employee users in different VLANs communicate with each
other.
Figure 3-11 Typical networking of VLAN configuration
Switch
Eth0/0/1
Eth0/0/3
Eth0/0/2
Eth0/0/4
VLAN2
VLAN3
VLAN4
VLANIF4:100.1.1.12/24
VLAN 2
VLAN 3
Development
Department
Test
Department
1.
Add interfaces of the Switch to sub-VLANs.
2.
Add the sub-VLANs to a super-VLAN.
3.
Configure the IP address for the super-VLAN.
4.
Configure proxy ARP for the super-VLAN.
Data Preparation
l
The VLAN ID of the super-VLAN is 4.
Issue 01 (2011-07-15)

85

The IP address of the super-VLAN is 100.1.1.12.
Procedure
Step 1 Set the interface type.
# Configure Eth 0/0/1 as an access interface.
[Quidway-Ethernet0/0/1] port link-type access



Step 2 Configure VLAN 2.

# Create VLAN 2.
[Quidway] vlan 2
# Add Eth 0/0/1 and Eth 0/0/2 to VLAN 2.

[Quidway-vlan2] port ethernet 0/0/1 0/0/2

# Create VLAN 3.
[Quidway] vlan 3
# Add Eth 0/0/3 and Eth 0/0/4 to VLAN 3.

[Quidway-vlan3] port ethernet 0/0/3 0/0/4

# Configure the super-VLAN.
[Quidway] vlan 4
[Quidway-vlan4] aggregate-vlan
[Quidway-vlan4] access-vlan 2 to 3
# Configure the VLANIF interface.

Issue 01 (2011-07-15)

86


[Quidway-Vlanif4] ip address 100.1.1.12 255.255.255.0
Step 5 Configure the personal computers.

Configure the IP address for each personal computer and make them reside in the same network
segment with VLAN 4.
After the preceding configuration, the personal computers and the Switch can ping each other,
but the computers in VLAN 2 and the computers in VLAN 3 cannot ping each other.
Step 6 Configure proxy ARP.
[Quidway-Vlanif4] arp-proxy inter-sub-vlan-proxy enable

After the preceding configuration, the computers in VLAN 2 and the computers in VLAN 3 can
ping each other.
----End
Configuration Files
#
sysname Quidway
#
vlan batch 2 to 4
#
vlan 4
aggregate-vlan
access-vlan 2 to 3
#
interface Vlanif4
ip address 100.1.1.12 255.255.255.0
arp-proxy inter-sub-vlan-proxy enable
#
port default vlan 2
#
port default vlan 2
#
port default vlan 3
#
port default vlan 3
#
return
3.10.5 Example for Configuring a Voice VLAN in Auto Mode

In this example, voice traffic is transmitted by using a specific VLAN, namely, voice VLAN.
During a certain period, if a voice device becomes faulty or exits from the network, the interface
connected to the voice device will exit from the voice VLAN.
Issue 01 (2011-07-15)

87

Data flows of the HSI, VoIP, and IPTV services are transmitted on a network. Users require
high quality of VoIP services; therefore, voice data flows must be transmitted with a high priority
to ensure the call quality.
As shown in Figure 3-12, after a voice VLAN is configured on the Switch, the Switch checks
whether a data flow received by Ethernet0/0/1 is a voice data flow based on the source MAC
address of the flow. If the data flow is a voice data flow, the Switch changes the priority of the
flow and transmits it in the voice VLAN. If not, the Switch transmits the flow in a common
VLAN without changing the priority of the flow. Ethernet0/0/1 needs to be automatically added
to or deleted from the voice VLAN.
Figure 3-12 Networking diagram of a voice VLAN in auto mode
DHCP Server
Internet
Switch
Eth0/0/1
LAN Switch
HSI
VoIP
IPTV
1.
Create VLANs.
2.
Configure the link type and default VLAN of the interface.
3.
Enable the voice VLAN on the interface.
4.
Set the mode of adding the interface to the voice VLAN to auto.
5.
Set the OUI of the voice VLAN.
6.
Set the aging time of the voice VLAN.
7.
Set the working mode of the voice VLAN.
Issue 01 (2011-07-15)

88

Data Preparation
l
Voice VLAN and VLAN through which the IP phone applies for an IP address: VLAN 2
and VLAN 6
OUI and mask: 0011-2200-0000 and ffff-ff00-0000
Aging time of the voice VLAN: 100 minutes
The default VLAN of Ethernet0/0/1: VLAN 6
Procedure
Step 1 Create VLANs and configure the interface on the Switch.
# Create VLAN 2 and VLAN 6.
# Configure the link type and default VLAN of the interface.

[Quidway-Ethernet0/0/1] port hybrid pvid vlan 6
[Quidway-Ethernet0/0/1] port hybrid untagged vlan 6
Step 2 Configure the voice VLAN on the Switch.

# Configure the voice VLAN on the interface.
[Quidway-Ethernet0/0/1] voice-vlan 2 enable
# Set the mode of adding the interface to the voice VLAN to auto.
[Quidway-Ethernet0/0/1] voice-vlan mode auto
# Set the OUI of the voice VLAN.

[Quidway] voice-vlan mac-address 0011-2200-0000 mask ffff-ff00-0000
# Set the aging time of the voice VLAN.

[Quidway] voice-vlan aging-time 100
# Set the working mode of the voice VLAN.

[Quidway-Ethernet0/0/1] voice-vlan security enable

Run the display voice-vlan oui command to check whether the OUI of the voice VLAN is
correct.
<Quidway> display voice-vlan oui
--------------------------------------------------OuiAddress
Mask
Description
--------------------------------------------------0011-2200-0000
ffff-ff00-0000
Run the display voice-vlan 2 status command to check whether the mode of adding the interface
to the voice VLAN, working mode, and aging time of the voice VLAN are correct.
<Quidway> display voice-vlan 2 status
Voice VLAN Configurations:
Issue 01 (2011-07-15)

89

--------------------------------------------------Voice VLAN ID
: 2
Voice VLAN status
: Enable
Voice VLAN aging time
: 100 (minutes)
Voice VLAN 8021p remark : 6
Voice VLAN dscp remark
: 46
---------------------------------------------------------Port Information:
----------------------------------------------------------Port
Add-Mode Security-Mode Legacy
----------------------------------------------------------Ethernet0/0/1
Auto
Security
Disable
----End
Configuration Files
#
sysname Quidway
#
vlan batch 2 6
#
voice-vlan aging-time 100
#
voice-vlan mac-address 0011-2200-0000 mask ffff-ff00-0000
#
voice-vlan 2 enable
#
return
3.10.6 Example for Configuring a Voice VLAN in Manual Mode

In manual voice VLAN mode, an interface must be added to the voice VLAN manually after
the voice VLAN function is enabled on the interface. The interface connected to a voice device
can forward voice data packets only after the interface is added to the voice VLAN manually.
Data flows of the HSI, VoIP, and IPTV services are transmitted on a network. Users require
high quality of VoIP services; therefore, voice data flows must be transmitted with a high priority
to ensure the call quality.
As shown in Figure 3-13, after a voice VLAN is configured on the Switch, the Switch checks
whether a data flow received by Ethernet0/0/1 is a voice data flow based on the source MAC
address of the data flow. If the data flow is a voice data flow, the Switch changes the priority of
the flow and transmits it in the voice VLAN. If not, the Switch transmits the flow in a common
VLAN without changing the priority of the flow. Ethernet0/0/1 needs to be added to or deleted
from the voice VLAN manually.
Issue 01 (2011-07-15)

90

Figure 3-13 Networking diagram of a voice VLAN in manual mode
DHCP Server
Internet
Switch
Eth0/0/1
LAN Switch
HSI
VoIP
IPTV
1.
Create VLANs.
2.
Configure the link type and default VLAN of the interface.
3.
Enable the voice VLAN on the interface.
4.
Set the mode of adding the interface to the voice VLAN to manual.
5.
Set the OUI of the voice VLAN.
6.
Set the working mode of the voice VLAN.
7.
Add the interface to the voice VLAN.
Data Preparation
l
Voice VLAN and VLAN through which the IP phone applies for an IP address: VLAN 2
and VLAN 6
OUI and mask: 0011-2200-0000 and ffff-ff00-0000
The default VLAN of Ethernet0/0/1: VLAN 6
Procedure
Step 1 Create VLANs and configure the interface on the Switch.
# Create VLAN 2 and VLAN 6.
Issue 01 (2011-07-15)

91

# Configure the link type and default VLAN of the interface.

[Quidway-Ethernet0/0/1] port hybrid pvid vlan 6
[Quidway-Ethernet0/0/1] port hybrid untagged vlan 6
Step 2 Configure the voice VLAN on the Switch.

# Configure the voice VLAN on the interface.
[Quidway-Ethernet0/0/1] voice-vlan 2 enable
# Set the mode of adding the interface to the voice VLAN to manual and add the interface to the
voice VLAN.
[Quidway-Ethernet0/0/1] voice-vlan mode manual
[Quidway-Ethernet0/0/1] port hybrid tagged vlan 2
# Set the OUI of the voice VLAN.

[Quidway] voice-vlan mac-address 0011-2200-0000 mask ffff-ff00-0000
# Set the working mode of the voice VLAN.

[Quidway-Ethernet0/0/1] voice-vlan security enable

Run the display voice-vlan oui command to check whether the OUI of the voice VLAN is
correct.
<Quidway> display voice-vlan oui
--------------------------------------------------OuiAddress
Mask
Description
--------------------------------------------------0011-2200-0000
ffff-ff00-0000
Run the display voice-vlan 2 status command to check whether the mode of adding the interface
to the voice VLAN, working mode, and aging time of the voice VLAN are correct.
<Quidway> display voice-vlan 2 status
Voice VLAN Configurations:
--------------------------------------------------Voice VLAN ID
: 2
Voice VLAN status
: Enable
Voice VLAN aging time
: 1440(minutes)
Voice VLAN 8021p remark : 6
Voice VLAN dscp remark
: 46
---------------------------------------------------------Port Information:
----------------------------------------------------------Port
Add-Mode Security-Mode Legacy
----------------------------------------------------------Ethernet0/0/1
Manual
Security
Disable
----End
Configuration Files
Issue 01 (2011-07-15)

92

#
sysname Quidway
#
vlan batch 2 6
#
voice-vlan mac-address 0011-2200-0000 mask ffff-ff00-0000
#
voice-vlan 2 enable
voice-vlan mode manual
#
return
Issue 01 (2011-07-15)

93

4 VLAN Mapping Configuration
VLAN Mapping Configuration
About This Chapter

This chapter describes the basic knowledge, methods, and examples for configuring VLAN
mapping.
4.1 Introduction to VLAN Mapping
This section describes the concept of VLAN mapping.
4.2 VLAN Mapping Features Supported by the S2700
This section describes VLAN mapping features supported by the S2700.
4.3 Configuring VLAN Mapping of Single VLAN Tag
This section describes how to configure VLAN mapping of single VLAN tag.
4.4 Configuring Global VLAN Mapping
This section describes how to configure global VLAN mapping.
This section provides several examples of VLAN mapping configuration.
Issue 01 (2011-07-15)

94

4.1 Introduction to VLAN Mapping

This section describes the concept of VLAN mapping.
VLAN Mapping is a process of mapping the customer VLAN to the carrier VLAN by replacing
the inner and outer VLAN tags of data frames. In this manner, VLAN aggregation is realized,
and services of customers can be transmitted according to the network planning of the carrier.
4.2 VLAN Mapping Features Supported by the S2700

This section describes VLAN mapping features supported by the S2700.
The S2700 supports the following VLAN mapping features:
l
Single-tag VLAN mapping based on the interface and VLAN
Global VLAN mapping

NOTE
The S2700SI does not support VLAN mapping.

Global VLAN mapping and interface-based VLAN mapping cannot be configured on an S2700
simultaneously.
4.3 Configuring VLAN Mapping of Single VLAN Tag

This section describes how to configure VLAN mapping of single VLAN tag.

When two private networks in different VLANs communicate with each other through a public
network, the user packets may carry the C-VLAN tag when reaching the ISP network. You can
configure VLAN mapping on the edge device of the public network so that the VLANs of private
networks are separated from VLANs of the public network. This saves VLAN resources of the
public network.
Before configuring VLAN mapping, complete the following task:
l
Configuring VLANs
Data Preparation
To configure VLAN mapping, you need the following data.
Issue 01 (2011-07-15)
No.
Data
VLAN ID before VLAN mapping

95

No.
Data
VLAN ID after VLAN mapping
4.3.2 Replacing a Single Tag

Context
Do as follows on the S2700 where you need to configure single-tag VLAN mapping.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
The link type of the interface is set.

By default, the link type of an interface is hybrid.
Step 4 Run:
port trunk allow-pass vlan vlan-id
The interface is added to the VLAN specified by map-vlan.

Step 5 Run:
qinq vlan-translation enable
VLAN translation is enabled on the interface.

Step 6 Run:
port vlan-mapping vlan vlan-id1 [ to vlan-id2 ] map-vlan vlan-id3
Single-tag VLAN mapping is configured on the interface.

NOTE
l VLAN mapping can only be configured on a trunk or hybrid interface, and the interface must be added
to the VLAN specified by map-vlan in tagged mode.
l The interface must be added to original VLANs (VLANs before mapping) in tagged mode.
l A maximum of 16 original VLANs can be specified for VLAN mapping. The original VLAN IDs
cannot be the same as the allowed VLAN IDs modulo 128.
l Limiting MAC address learning on an interface may affect the N:1 VLAN mapping on the interface.
----End
Issue 01 (2011-07-15)

96


Procedure
l
Run the display vlan vlan-id command to check whether the interface is added to the
translated local VLAN.
Run the display current-configuration command to display information about the VLAN
mapping of single VLAN tag on the interface.
Run the preceding command, and you can obtain the following information:
The interface is added to the translated local VLAN.
The information about the VLAN mapping is correct.
----End
4.4 Configuring Global VLAN Mapping

This section describes how to configure global VLAN mapping.

To apply VLAN mapping to multiple interfaces, you can configure global VLAN mapping to
simplify configuration.
NOTE
Global VLAN mapping and interface-based VLAN mapping cannot be configured on an S2700
simultaneously.
Before configuring global VLAN mapping, complete the following tasks:
l
Creating the VLANs involved in VLAN mapping
Adding the related interfaces to the translated VLAN in tagged mode
Data Preparations
To configure global VLAN mapping, you need the following data.
Issue 01 (2011-07-15)
No.
Data
Original VLAN ID
Translated VLAN ID

97

4.4.2 Configuring Global VLAN Mapping

Context
Do as follows as the S2700 where global VLAN mapping needs to be configured.
Procedure
Step 1 Run:
system-view

Step 2 Run:
vlan vlan-id

Step 3 Run:
vlan-mapping map-vlan vlan-id
Global VLAN mapping is configured.

NOTE
To enable global VLAN mapping to take effect on an interface, ensure that:

l The interface is a hybrid or trunk interface.
l The interface has been added to the translated VLAN in tagged mode.
l VLAN translation is enabled on the interface by using the qinq vlan-translation enable command.
NOTE
The S2700SI does not support global VLAN mapping.
----End

Procedure
l
Run the display this command in the VLAN view to check the configuration of global
VLAN mapping.
----End
Example
Run the display this command in the VLAN view.
[Quidway-vlan10] display this
#
vlan 10
vlan-mapping map-vlan 20 remark-8021p 3
#
return
Issue 01 (2011-07-15)

98


This section provides several examples of VLAN mapping configuration.
4.5.1 Example for Configuring Single-Tag VLAN Mapping

As shown in Figure 4-1, users in VLAN 6 need to communicate with users in VLAN 5 through
VLAN 10 on the network.
Figure 4-1 Networking diagram of single-tag VLAN mapping configurations
Network
SwitchC
Eth0/0/1
VLAN10
SwitchD
Eth0/0/1
SwitchA
SwitchB
Eth0/0/1
VLAN6
Eth0/0/2
Eth0/0/3
172.16.0.1/16 172.16.0.2/16 172.16.0.3/16
Eth0/0/1
Eth0/0/2
VLAN5
Eth0/0/3
172.16.0.5/16 172.16.0.6/16 172.16.0.7/16
1.
Create VLANs on SwitchA, SwitchB, SwitchC, and SwitchD.
2.
Add interfaces of SwitchA, SwitchB, SwitchC, and SwitchD to the corresponding VLANs.
3.
Configure single-tag VLAN mapping on Eth 0/0/1 of SwitchA.
4.
Configure single-tag VLAN mapping on Eth 0/0/1 of SwitchB.
Data Preparation
Issue 01 (2011-07-15)

99

VLAN to be created on SwitchA: VLAN 6
VLAN to be created on SwitchB: VLAN 5
VLAN to be created on SwitchC and SwitchD: VLAN 10
Procedure
Step 1 Create VLANs on the Switches.
# Create VLAN 6 on SwitchA.
[SwitchA] vlan 6
# Create VLAN 5 on SwitchB.

[SwitchB] vlan 5
# Create VLAN 10 on SwitchC.

[Quidway] sysname SwitchC
[SwitchC] vlan 10
# Create VLAN 10 on SwitchD.

[Quidway] sysname SwitchD
[SwitchD] vlan 10
Step 2 Add interfaces to VLANs.

# Add Eth 0/0/2 and Eth 0/0/3 of SwitchA to VLAN 6.
[SwitchA-Ethernet0/0/2] port
0/0/2
link-type trunk
trunk allow-pass vlan 6
0/0/3
link-type trunk
# Add Eth 0/0/1 of SwitchA to VLAN 6.

[SwitchA-Ethernet0/0/1] port link-type trunk
[SwitchA-Ethernet0/0/1] port trunk allow-pass vlan 6
# Add Eth 0/0/2 and Eth 0/0/3 of SwitchB to VLAN 5.

[SwitchB] interface ethernet
[SwitchB-Ethernet0/0/2] port
[SwitchB] interface ethernet
0/0/2
link-type trunk
0/0/3
link-type trunk
# Add Eth 0/0/1 of SwitchB to VLAN 5.

[SwitchB-Ethernet0/0/1] port link-type trunk
Issue 01 (2011-07-15)

100

[SwitchB-Ethernet0/0/1] port trunk allow-pass vlan 5

# Add Eth 0/0/1 of SwitchC to VLAN 10.

[SwitchC] interface ethernet 0/0/1
[SwitchC-Ethernet0/0/1] port link-type trunk
[SwitchC-Ethernet0/0/1] port trunk allow-pass vlan 10
[SwitchC-Ethernet0/0/1] quit
# Add Eth 0/0/1 of SwitchD to VLAN 10.

[SwitchD] interface ethernet 0/0/1
[SwitchD-Ethernet0/0/1] port link-type trunk
[SwitchD-Ethernet0/0/1] port trunk allow-pass vlan 10
[SwitchD-Ethernet0/0/1] quit
Step 3 Configure single-tag VLAN mapping on the Switches.

# Configure single-tag VLAN mapping on Eth 0/0/1 of SwitchA.
[SwitchA-Ethernet0/0/1] qinq vlan-translation enable
[SwitchA-Ethernet0/0/1] port vlan-mapping vlan 10 map-vlan 6
# Configure single-tag VLAN mapping on Eth 0/0/1 of SwitchB.

[SwitchB-Ethernet0/0/1] qinq vlan-translation enable
[SwitchB-Ethernet0/0/1] port vlan-mapping vlan 10 map-vlan 5

The hosts in VLAN 6 and the hosts in VLAN 5 can ping each other.
----End
Configuration Files
l
#
sysname SwitchA
#
vlan batch 6
#
port vlan-mapping vlan 10 map-vlan 6
#
#
#
return
#
sysname SwitchB
#
vlan batch 5
#
Issue 01 (2011-07-15)

101


#
#
#
return
Configuration file of SwitchC
#
sysname SwitchC
#
vlan batch 10
#
#
return
Configuration file of SwitchD
#
sysname SwitchD
#
vlan batch 10
#
#
return
4.5.2 Example for Configuring N:1 VLAN Mapping

As shown in Figure 4-2, users in VLAN 100 to VLAN 110 connect to the Internet through the
aggregate switch of the carrier, that is, the Switch.
After user devices are powered on, they send service request packets to the switch of the carrier.
After the user devices pass the authentication, services can be used.
Issue 01 (2011-07-15)

102

Figure 4-2 Networking diagram of N:1 VLAN mapping
Internet
Switch
VLAN100~110
SwitchA
SwitchC
SwitchB
Eth0/0/1
SwitchD
SwitchE
1.
Configure the VLANs before and after mapping.
2.
Add Eth 0/0/1 of the Switch to the VLANs before and after mapping in tagged mode.
3.
Configure VLAN mapping on Eth 0/0/1 of the Switch.
Data preparation
l
VLANs before mapping: VLAN 100 to VLAN 110
VLAN after mapping: VLAN 10
Procedure
# Create VLANs.
[Quidway] vlan batch 10 100 to 110
# Add related Eth 0/0/1 to the VLANs.

Issue 01 (2011-07-15)

103


[Quidway-Ethernet0/0/1] port hybrid tagged vlan 10 100 to 110
# Configure VLAN mapping on Eth 0/0/1.

[Quidway-Ethernet0/0/1] qinq vlan-translation enable
[Quidway-Ethernet0/0/1] port vlan-mapping vlan 100 to 110 map-vlan 10

Users in VLAN 100 to VLAN 110 can connect to the Internet through the Switch.
----End
Configuration Files
l
#
sysname Quidway
#
vlan batch 10 100 to 110
#
port hybrid tagged vlan 10 100 to 110
port vlan-mapping vlan 100 to 110 map-vlan 10
#
return
4.5.3 Example for Configuring Global VLAN Mapping

As shown in Figure 4-3, users in VLAN 10 connect to network through the Switch.
Issue 01 (2011-07-15)

104

Figure 4-3 Networking of global VLAN mapping
Internet
VLAN 20
Switch
Eth0/0/1
VLAN 10
SwitchA
SwitchB
SwitchC
SwitchD
1.
Create the VLANs before and after mapping on the Switch.
2.
Add Eth0/0/1 of the Switch to the translated VLAN in tagged mode.
3.
Enable VLAN translation on Eth0/0/1 of the Switch.
4.
Configure other downlink interfaces of the Switch in the same way.
5.
Configuring global VLAN mapping on the Switch.
Data Preparations
l
VLAN ID before VLAN mapping: VLAN 10
Translated VLAN ID: VLAN 20
Procedure
# Create VLANs.
Issue 01 (2011-07-15)

105

# Add Eth0/0/1 to the VLANs.

[Quidway-Ethernet0/0/1] port hybrid tagged vlan 10 20
# Enable VLAN translation on Eth0/0/1.

[Quidway-Ethernet0/0/1] qinq vlan-translation enable
# Configure global LAN mapping.

[Quidway] vlan 10
[Quidway-vlan10] vlan-mapping map-vlan 20

Users in VLAN 10 can connect to the Internet through the Switch.
----End
Configuration Files
l
#
sysname Quidway
#
vlan batch 10 20
#
port hybrid tagged vlan 10 20
#
vlan-mapping map-vlan 20
#
return
Issue 01 (2011-07-15)

106

5 QinQ Configuration
QinQ Configuration
About This Chapter

This chapter describes the basic knowledge, methods, and examples for configuring QinQ.
5.1 Concept of QinQ
This section describes the concept of QinQ.
5.2 QinQ Features Supported by the S2700
This section describes the QinQ features supported by the S2700.
5.3 Configuring QinQ on an Interface
This section describes how to configure the interface type, the protocol used by the outer VLAN
tag, and the interface-based QinQ.
5.4 Configuring QinQ Stacking on a VLANIF Interface
To log in to a remote device to manage it, configure QinQ stacking on the VLANIF interface
corresponding to the management VLAN on the remote device.
5.5 Setting the Protocol Type in the Outer VLAN Tag
This section describes how to set the protocol type in the outer VLAN tag on an interface.
This section provides several configuration examples of QinQ.
Issue 01 (2011-07-15)

107

5.1 Concept of QinQ

This section describes the concept of QinQ.
The 802.1Q-in-802.1Q (QinQ) protocol is a Layer 2 tunneling protocol based on the IEEE
802.1Q technology. The frame transmitted on the public network has double 802.1Q tags. One
is a public tag and the other is a private tag. It is called the QinQ protocol.
The principle of QinQ is to encapsulate a private VLAN tag in a public VLAN tag; therefore, a
packet traverses the backbone network of the Internet service provider (ISP) carrying double
VLAN tags. By using the QinQ technology, the S2700 provides a simpler Layer 2 VPN tunnel
for users.
5.2 QinQ Features Supported by the S2700

This section describes the QinQ features supported by the S2700.
Protocols Used by Outer VLAN Tags

The protocols applied to outer VLAN tags vary according to the vendors. To interwork with
non-Huawei devices, the S2700 supports the selective setting of the protocols used by the outer
VLAN tags.
NOTE
The S2700SI does not support QinQ.
5.3 Configuring QinQ on an Interface

This section describes how to configure the interface type, the protocol used by the outer VLAN
tag, and the interface-based QinQ.

To separate the private network from the public network and save VLAN resources, you can
configure double 802.1q tags on a QinQ interface provided by the S2700. The inner VLAN tag
of the private network is distributed for the internal network such as the intranet; the outer VLAN
tag of the public network is distributed for the external network such as the ISP's network. In
this way, a maximum of 4094 x 4094 VLAN tags are provided to enable transparent transmission
of the packets from different private network users with the same VLAN ID.
None
Data Preparation
To configure QinQ on the interface, you need the following data.
Issue 01 (2011-07-15)

108

No.
Data
Number of the QinQ interface
(Optional) Protocol used by the outer VLAN tag
Outer VLAN ID
5.3.2 Setting the Link Type of an Interface

Context
Do as follows on the S2700 to be configured with interface QinQ.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
port link-type dot1q-tunnel
The link type of the interface is set to dot1q-tunnel.

By default, the link type of an interface is hybrid.
Dot1q-tunnel interfaces do not support Layer 2 multicast.
----End
5.3.3 Specifying the Outer VLAN ID

Context
Do as follows on the S2700 to be configured with interface QinQ.
Procedure
Step 1 Run:
system-view

Step 2 Run:
vlan vlan-id
Issue 01 (2011-07-15)

109

The VLAN is created.

Step 3 Run:
quit

Step 4 Run:

Step 5 Run:
port default vlan vlan-id
The VLAN ID (default VLAN) of the outer VLAN tag is set.

----End

Procedure
l
Run the display current-configuration interface interface-type interface-number

command to display the QinQ configuration on the interface.
----End
5.4 Configuring QinQ Stacking on a VLANIF Interface


Before configuring QinQ stacking on a VLANIF interface, familiarize yourself with the
applicable environment, complete the pre-configuration tasks, and obtain the data required for
the configuration. This will help you complete the configuration task quickly and accurately.
As shown in Figure 5-1, SwitchA is connected to SwitchB through a third-party network. The
management VLAN on SwitchB is the same as the VLAN for users connected to SwitchA. The
VLAN ID provided by the carrier, however, is different from the management VLAN ID.
Issue 01 (2011-07-15)

110

Figure 5-1 Networking for QinQ stacking on a VLANIF interface
IP
10
20
SwitchB
Internet
SwitchA
IP
Management VLAN 10
Interface VLANIF 10
10
user2
user1
VLAN 10
To log in to SwitchB to manage it from SwitchA, you can configure QinQ stacking on the
VLANIF interface corresponding to the management VLAN on SwitchB.
After QinQ stacking is configured, data frames are processed as follows:
l
Frames sent from SwitchA to SwitchB

The user-side interface of SwitchA, which is configured with QinQ, sends double-tagged
frames to the ISP network. The outer VLAN tag is assigned by the carrier so that the frames
can be transparently transmitted across the ISP network to SwitchB.
When SwitchB receives double-tagged frames, it compares the VLAN tags of the frames
with the VLAN tags configured on the VLANIF interface. If the outer tag of the frames is
the same as the outer tag configured on the VLANIF interface, SwitchB removes the outer
tag and sends the frames to the IP layer for processing.
Frames sent from SwitchB to SwitchA

When the VLANIF interface of SwitchB receives data frames, SwitchB adds a VLAN tag
to the frames according to the QinQ stacking configuration. The new outer VLAN tag is
assigned by the carrier so that the double-tagged data frames can be transparently
transmitted to SwitchA across the ISP network. SwitchA removes the outer VLAN tag of
the frames and forwards the frames to users.
Before configuring QinQ stacking on a VLANIF interface, complete the following tasks:
l
Creating VLANs
Configuring the management VLAN
Data Preparations
To configure QinQ stacking on a VLANIF interface, you need the following data.
Issue 01 (2011-07-15)

111

No.
Data
VLAN IDs
5.4.2 Configuring QinQ Stacking on a VLANIF Interface

Procedure
Step 1 Run:
system-view

Step 2 Run:
The VLANIF interface corresponding to the management VLAN is created.

Before running this command, ensure that the management VLAN exists.
Step 3 Run:
qinq stacking vlan vlan-id
QinQ stacking is configured on the VLANIF interface.

NOTE
l When configuring QinQ stacking on a VLANIF interface, ensure that the VLANIF interface
corresponds to the management VLAN. VLANIF interfaces corresponding to other VLANs do not
support QinQ stacking.
l To change the configured outer VLAN tag, run the undo qinq stacking vlan command to disable QinQ
stacking, and then run the qinq stacking vlan command to configure a new outer VLAN tag.
l The qinq stacking vlan command conflicts with the icmp host-unreachable send command.
Therefore, you must run the undo icmp host-unreachable send command before using the qinq
stacking vlan command.
----End

After QinQ stacking is configured on the VLANIF interface of the remote device, you can log
in to the remote device to manage it from the local device.
Prerequisite
The configurations of QinQ stacking on the VLANIF interface are complete.
Procedure
Step 1 Run the display vlan [ vlan-id [ verbose ] ] command to check whether the management VLAN
is configured correctly.
Issue 01 (2011-07-15)

112

Step 2 Run the display this command in the VLANIF interface view to check whether QinQ stacking
is configured correctly.
----End
5.5 Setting the Protocol Type in the Outer VLAN Tag

This section describes how to set the protocol type in the outer VLAN tag on an interface.

To enable the S2700 to communicate with devices of other vendors, you need to set a protocol
type that can be identified by the peer device in the outer VLAN tag.
The S2700SI does not support protocol type setting in the outer VLAN tag.
None.
Data Preparation
To set the protocol type in the outer VLAN tag, you need the following data.
No.
Data
Interface number
Protocol type in the outer VLAN tag
5.5.2 Configuring the Type of an Interface

Context
Do as follows on the S2700 where you need to set the protocol type in the outer VLAN tag.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Issue 01 (2011-07-15)

113

Step 3 Run:
port link-type { hybrid | trunk | access }
The interface type is configured.

By default, the interface type is hybrid.
----End
5.5.3 Setting the Protocol Type in the Outer VLAN Tag

Context
Do as follows on the S2700 where you need to set the protocol type in the outer VLAN tag.
Procedure
Step 1 Run:
system-view

Step 2 Run:
qinq protocol protocol-id
The protocol type of the outer VLAN tag is set.

The qinq protocol command cannot be used on a QinQ interface.
The qinq protocol command is used to identify incoming frames and add or change TPID for
outgoing frames.
By default, the protocol type in the outer VLAN tag is 0x8100.
NOTE
l To implement the connectivity between the devices of different vendors, the protocol type in the outer
VLAN tag must be identified by the peer device.
l The protocol IDs set by the qinq protocol command cannot be the same as well-known protocol IDs.
Otherwise, the interface cannot distinguish packets of these protocols. For example, protocol-id cannot
be set to 0x0806, which is the ARP protocol ID.
----End

Procedure
Step 1 Run the display current-configuration interface interface-type interface-number command to
display protocol type in the outer VLAN tag set on an interface.
----End
Issue 01 (2011-07-15)

114


This section provides several configuration examples of QinQ.
5.6.1 Example for Configuring QinQ on Interfaces

As shown in Figure 5-2, there are two enterprises on the network, namely, Enterprise 1 and
Enterprise 2. Enterprise 1 has two office locations; Enterprise 2 has three office locations. The
office locations of the two enterprises access SwitchG or SwitchF of the ISP network. The
network of Enterprise 1 is divided into VLAN 1000 to VLAN 1500; the network of Enterprise
2 is divided into VLAN 2000 to VLAN 3000. It is required that employees in the same VLAN
can communicate with each other through the ISP network but the two enterprises are isolated
from each other.
Figure 5-2 Networking diagram for configuring QinQ on interfaces
Enterprise 2
Enterprise 2
SwitchG
Eth0/0/1
Eth0/0/2
Eth0/0/3
Eth0/0/4
SwitchF
Eth0/0/3
Eth0/0/1
VLAN2000
VLAN3000
VLAN2000
VLAN3000
Eth0/0/2
VLAN1000 VLAN1500
Enterprise 1
VLAN2000
VLAN3000
Enterprise 2
VLAN1000
VLAN1500
Enterprise1
Issue 01 (2011-07-15)

115

1.
Create VLAN 10 and VLAN 20 on SwitchF; create VLAN 20 on SwitchG.
2.
Configure Eth 0/0/1, Eth 0/0/2, and Eth 0/0/3 of SwitchF as QinQ interfaces.
3.
Configure Eth 0/0/1 and Eth 0/0/2 of SwitchG as QinQ interfaces.
4.
Add Eth 0/0/4 of SwitchF and Eth 0/0/3 of SwitchG to VLAN 20 in tagged mode.
Data Preparation
l
VLAN 10 assigned to Enterprise 1 on the ISP network
VLAN 20 assigned to Enterprise 2 on the ISP network.
Procedure
Step 1 Create VLANs.
# Create VLAN 10 and VLAN 20 on SwitchF.
[Quidway] sysname SwitchF
[SwitchF] vlan batch 10 20
# Create VLAN 20 on SwitchG.

[Quidway] sysname SwitchG
[SwitchG] vlan 20
Step 2 Configure the interfaces as QinQ interfaces.

# Configure Eth 0/0/1, Eth 0/0/2, and Eth 0/0/3 of SwitchF as QinQ interfaces. Set the VLAN
ID of the outer VLAN tag added by Eth 0/0/1 and Eth 0/0/3/ to VLAN 10; set the VLAN ID of
the outer VLAN tag added by Eth 0/0/2 to VLAN 20.
[SwitchF] interface ethernet
[SwitchF-Ethernet0/0/1] port
[SwitchF-Ethernet0/0/1] quit
0/0/1
link-type dot1q-tunnel
default vlan 10
0/0/2
default vlan 20
0/0/3
default vlan 10
# Set Eth 0/0/1 and Eth 0/0/2 of SwitchG as QinQ interfaces; set the VLAN ID of the outer
VLAN tags added by Eth 0/0/1 and Eth 0/0/2/ to VLAN 20.
[SwitchG] interface ethernet
[SwitchG-Ethernet0/0/1] port
[SwitchG-Ethernet0/0/1] quit
[SwitchG] interface ethernet
0/0/1
default vlan 20
0/0/2
default vlan 20
Step 3 Configure other interfaces.

# Add Eth 0/0/4 of SwitchF to VLAN 20.
Issue 01 (2011-07-15)

116

[SwitchF] interface ethernet 0/0/4

[SwitchF-Ethernet0/0/4] port link-type trunk
[SwitchF-Ethernet0/0/4] port trunk allow-pass vlan 20
# Add Eth 0/0/3 of SwitchG to VLAN 20.

[SwitchG] interface ethernet 0/0/3
[SwitchG-Ethernet0/0/3] port link-type trunk
[SwitchG-Ethernet0/0/3] port trunk allow-pass vlan 20

Ping a remote host on the same VLAN in another office location of Enterprise 1 from a host of
Enterprise 1. If it can ping the remote host, hosts in different locations of Enterprise 1 can
Ping a remote host on the same VLAN in another office location of Enterprise 2 from a host of
Enterprise 2. If it can ping the remote host, hosts in different locations of Enterprise 2 can
Ping a host of Enterprise 2 from a host in any office location of Enterprise 1. If it fails to ping
the host of Enterprise 2, the two enterprises are isolated from each other.
----End
Configuration Files
The following lists the configuration files of the Switch.
l
Configuration file of SwitchF
#
sysname SwitchF
#
vlan batch 10 20
#
#
#
#
#
return
Configuration file of SwitchG
#
sysname SwitchG
#
vlan batch 20
#
#
Issue 01 (2011-07-15)

117


#
#
return
5.6.2 Example for Configuring QinQ Stacking on the VLANIF

Interface
In this networking, the management VLAN is deployed on the remote server and the VLAN ID
of Switch A is the same as the management VLAN ID. The VLAN ID provided by the carrier,
however, is different from the management VLAN ID. To remotely log in to the remote server
for managing VLAN services on Switch A, you can configure VLAN stacking according to this
example.
As shown in Figure 5-3, Switch A is connected to the remote server through the third-party
network. The management VLAN is deployed on the remote server and the VLAN ID that the
downstream user connected to Switch A belongs to is the same as the management VLAN ID.
The VLAN ID provided by the carrier, however, is different from the management VLAN ID.
Figure 5-3 Networking diagram for configuring QinQ stacking on the VLANIF interface
IP
10
E th 0 /0 /2
20
In te rn e t
S e rv e r
E th 0 /0 /2
S w itc h A E th 0 /0 /1
IP
10
E th 0 /0 /2
S w itc h C
E th 0 /0 /1
u s e r1
VLAN 10
To remotely log in to the remote server for managing VLAN services on Switch A, you can
configure QinQ stacking on the VLANIF interface corresponding to the management VLAN on
Switch B.
NOTE
The VLANIF interface where QinQ stacking is configured must correspond to the management VLAN.
This is because other types of VLANs do not support QinQ stacking.
Issue 01 (2011-07-15)

118

1.
Configure QinQ on Switch A.
2.
Do as follows on the remote server:

(1) Create VLAN 10 and configure VLAN 10 as the management VLAN.
(2) Create a VLANIF interface on VLAN 10.
(3) Configure QinQ stacking on the VLANIF interface.
Data Preparation
l
Outer tag that Switch A adds to data frames
Management VLAN ID on the remote server
Procedure
Step 1 Configure Switch C.
# Configure Eth 0/0/1 and Eth 0/0/2 to allow packets from VLAN 10 to pass through.
[SwitchC] vlan batch 10
[SwitchC] interface ethernet
[SwitchC-Ethernet0/0/1] port
0/0/1
0/0/2
Step 2 Configure Switch A.

# Configure QinQ so that the frames sent from Switch A to the remote server carry double tags.
[SwitchA] vlan batch 20
0/0/1
vlan-stacking vlan 10 stack-vlan 20
0/0/2
Step 3 Configure the remote server.

# Configure Eth 0/0/2 to allow frames from VLAN 20 to pass through.
[Quidway] sysname Server
[Server] vlan batch 10 20
[Server] interface ethernet 0/0/2
[Server-Ethernet0/0/2] port hybrid tagged vlan 20
[Server-Ethernet0/0/2] quit
# Configure QinQ stacking.

[Server] vlan 10
[Server-vlan10] management-vlan
[Server-vlan10] quit
[Server] interface vlanif 10
[Server-Vlanif10] undo icmp host-unreachable send
[Server-Vlanif10] qinq stacking vlan 20
Issue 01 (2011-07-15)

119

[Server-Vlanif10] ip address 10.10.10.1 24

[Server-Vlanif10] quit
[Server] interface ethernet 0/0/2
[Server-Ethernet0/0/2] port hybrid tagged vlan 10 20

You can log in to the remote server for managing VLAN services on Switch A.
----End
Configuration Files
l
Configuration file of Switch A

#
sysname SwitchA
#
vlan batch 20
#
interface Ethernet 0/0/1
port vlan-stacking vlan 10 stack-vlan 20
#
#
return
Configuration file of Switch C

#
sysname SwitchC
#
vlan batch 10
#
#
#
return
Configuration file of the remote server

#
sysname Server
#
vlan batch 10 20
#
vlan 10
management-vlan
#
interface Vlanif10
ip address 10.10.10.1 255.255.255.0
undo icmp host-unreachable send
qinq stacking vlan 20
#
#
return
Issue 01 (2011-07-15)

120

6 GVRP Configuration
GVRP Configuration
About This Chapter

This chapter describes basic concepts involved in GVRP, GVRP configuration procedures, and
concludes with a GVRP configuration example.
6.1 GVRP Overview
This section explains the concepts of Generic Attribute Registration Protocol (GARP) and GARP
VLAN Registration Protocol (GVRP), and how they relate to each another.
6.2 GVRP Features Supported by the S2700
This section describes the GVRP features supported by the S2700.
6.3 Configuring GVRP
This section describes how to configure the GVRP function.
6.4 Maintaining GVRP
This section describes how to clear the statistics about GARP.
This section provides configuration examples of GVRP.
Issue 01 (2011-07-15)

121

6.1 GVRP Overview

This section explains the concepts of Generic Attribute Registration Protocol (GARP) and GARP
VLAN Registration Protocol (GVRP), and how they relate to each another.
GVRP
GVRP is an application of GARP that maintains and propagates VLAN registration information
to other devices.
GARP
GARP enables member switches on a LAN to distribute, transmit, and register information such
as VLAN information and multicast addresses with one another.
GARP is not an entity on a device. GARP-compliant entities are called GARP participants.
GVRP is a GARP application. When a GARP application runs on an interface, the interface is
considered a GARP participant.
l
GARP messages and timers

GARP messages
GARP members transmit VLAN registration information by exchanging GARP
messages. The three main GARP messages are Join, Leave, and LeaveAll.
When a GARP participant expects other devices to register its attributes, it sends
Join messages to other devices. When the GARP participant receives a Join message
from another participant or is configured with attributes statically, it also sends Join
messages to other devices for the devices to register the new attributes.
When a GARP participant expects other devices to deregister its attributes, it sends
Leave messages to other devices. When the GARP participant receives a Leave
message from another participant or some of its attributes are deregistered statically,
it also sends Leave messages to other devices.
When a GARP participant is enabled, the LeaveAll timer is started. When the
LeaveAll timer expires, the GARP participant sends LeaveAll messages to request
other GARP participants to deregister all the attributes of the sender. Then other
participants can re-register the attributes.
The Join, Leave, and LeaveAll messages are used to control registration and
deregistration of attributes.
Through GARP messages, all attributes that need to be registered are sent to all the
GARP-enabled devices on the same LAN.
GARP timers
The intervals for sending GARP messages are controlled by GARP timers. GARP
defines four timers to control the intervals for sending GARP messages.
Hold timer: When a GARP participant receives a registration message from another
participant, it does not send the registration message in a Join message to other
participants immediately. Instead, the participant starts the Hold timer. When the
Hold timer expires, the participant packs all the registration messages received
within this period in a Join message and sends the Join message to other participants.
This saves bandwidth on the network.
Issue 01 (2011-07-15)

122

Join timer: To ensure reliable transmission of Join messages, a participant can send
each Join message twice. If the participant does not receive the response after
sending the Join message the first time, it sends the Join message again. The Join
timer specifies the interval between the two Join messages.
Leave timer: When a GARP participant expects other participants to deregister its
attribute, it sends Leave messages to other participants. When another participant
receives the Leave message, it starts the Leave timer. If the participant does not
receive any Join message before the Leave timer expires, it deregisters the attributes
of the Leave message sender.
LeaveAll timer: When a GARP participant is enabled, the LeaveAll timer is started.
When the LeaveAll timer expires, the GARP participant sends LeaveAll messages
to request other GARP participants to re-register all its attributes. Then the LeaveAll
timer restarts.
NOTE
l The GARP timers apply to all GARP participants (such as GVRP) on the same LAN.
l The Hold timer, Join timer, and Leave timer must be set individually on each interface,
whereas the LeaveAll timer is set globally and takes effect on all interfaces of a device.
l Devices on a network may have different settings of the LeaveAll timer. In this case, all the
devices use the smallest LeaveAll timer value on the network. When the LeaveAll timer of
a device expires, the device sends LeaveAll messages to other devices. After other devices
receive the LeaveAll messages, they reset their LeaveAll timers. Therefore, only the
LeavelAll timer with the smallest value takes effect even if devices have different settings
of the LeaveAll timer.
GARP operation process

Through GARP, the configuration information of a GARP member can be propagated on
the entire LAN. A GARP member may be a terminal workstation or a bridge. A GARP
member sends an attribute declaration or an attribute reclaim declaration to request other
GARP members to register or deregister its attributes. The GARP member can also register
or deregister attributes of other members when receiving attribute declarations or attribute
reclaim declarations from other members. When an interface receives an attribute
declaration, it registers the attribute. When the interface receives an attribute reclaim
declaration, the interface deregisters the attribute.
PDUs sent from a GARP participant use a multicast MAC address as the destination MAC
address. When a device receives a packet from a GARP participant, the device identifies
the packet according to the destination MAC address of the packet and sends the packet to
the corresponding GARP participant (such as GVRP).
Format of a GARP packet

Figure 6-1 shows the format of a GARP packet.
Issue 01 (2011-07-15)

123

Figure 6-1 Format of a GARP packet
DA SA length DSAP SSAP Ctrl
PDU
Ethernet Frame
N
Protocol ID Message 1 Message N End Mark

1
2
Attribute Type
GARP PDU structure
Message structure
Attribute List
N
1
Attribute 1
1
Attribute List structure
Attribute N End Mark

3
Attribute Length Attribute Event Attribute Value
Attribute structure
The following table describes the fields in a GARP packet.
Issue 01 (2011-07-15)
Field
Description
Value
Protocol ID
Indicates the protocol ID.
The value is 1.
Message
Indicates the messages in

the packet. A message
consists of the Attribute
Type and Attribute List
fields.
Attribute Type
Indicates the type of an

attribute, which is defined
by the GARP application.
The value is 0x01 for

GVRP, indicating that the
attribute value is a VLAN
ID.
Attribute List
Indicates the attribute list,

which consists of multiple
attributes.
Attribute
Indicates an attribute,
which consists of the
Attribute Length, Attribute
Event, and Attribute Value
fields.
Attribute Length
Indicates the length of an

attribute.
The value ranges from 2 to

255, in bytes.

124

Field
Description
Value
Attribute Event
Indicates the event that an

attribute describes. The
value can be:
l 0: LeaveAll event
l 1: JoinEmpty event
l 2: JoinIn event
l 3: LeaveEmpty event
l 4: LeaveIn event
l 5: Empty event
Attribute Value
Indicates the value of an

attribute.
The value is a VLAN ID for

GVRP. This field is invalid
in a LeaveAll attribute.
End Mark
Indicates the end of a

GARP PDU.
The value is 0x00.
6.2 GVRP Features Supported by the S2700

This section describes the GVRP features supported by the S2700.
GVRP is an application of GARP. Based on the working mechanism of GARP, GVRP maintains
dynamic VLAN registration information in a device and propagates the registration information
to other devices.
After GVRP is enabled on the S2700, the S2700 can receive VLAN registration information
from other devices and dynamically update local VLAN registration information. VLAN
registration information includes which VLAN members are on the VLAN and through which
interfaces their packets can be sent to the S2700. The S2700 can also send the local VLAN
registration information to other devices. By exchanging VLAN registration information, all the
devices on the same LAN have the same VLAN information. The VLAN registration
information transmitted through GVRP contains both static local registration information that
is manually configured and the dynamic registration information from other devices.
A GVRP interface supports three registration modes:
l
Normal: In this mode, the GVRP interface can dynamically register and deregister VLANs,
and transmit dynamic VLAN registration information and static VLAN registration
information.
Fixed: In this mode, the GVRP interface is disabled from dynamically registering and
deregistering VLANs and can transmit only the static registration information. If the
registration mode of a trunk interface is set to fixed, the interface allows only the manually
configured VLANs to pass even if it is configured to allow all the VLANs to pass.
Forbidden: In this mode, the GVRP interface is disabled from dynamically registering and
deregistering VLANs and can transmit only information about VLAN 1. If the registration
mode of a trunk interface is set to forbidden, the interface allows only VLAN 1 to pass even
if it is configured to allow all the VLANs to pass.
Issue 01 (2011-07-15)

125

NOTE
The S2700SI does not support GVRP.

The S2700EI supports a maximum of 256 dynamic VLANs.
The GVRP protocol can run only in the Common and Internal Spanning Tree (CIST) instance. The interface
blocked by MSTP in the CIST instance cannot send or receive GVRP packets.
6.3 Configuring GVRP

This section describes how to configure the GVRP function.

On a complicated Layer 2 network, you can enable interfaces to dynamically join or leave
VLANs by configuring the GVRP function. This simplifies the configuration
Before configuring the GVRP function, complete the following task:
l
Adding the GVRP interfaces to all VLANs
Configuring the interface to send BPDUs to the CPU
Data Preparation
To configure the GVRP function, you need the following data.
No.
Data
(Optional) Registration mode of GVRP interfaces
(Optional) Values of GARP timers
6.3.2 Enabling GVRP

Context
Do as follows on the S2700 to enable GVRP.
Procedure
Step 1 Run:
system-view

Step 2 Run:
Issue 01 (2011-07-15)

126

gvrp
GVRP is enabled globally.

Step 3 Run:

Step 4 Run:
The link type of the interface is set to trunk.

Step 5 Run:
port trunk allow-pass vlan { { vlan-id1 [ to vlan-id2 ] }&<1-10> | all }
The interface is added to the specified VLANs.

Step 6 Run:
gvrp
GVRP is enabled on the interface.

By default, GVRP is disabled globally and on each interface.
NOTE
l Before enabling GVRP on an interface, you must enable GVRP globally.

l Before enabling GVRP on an interface, you must set the link type of the interface to trunk.
----End
6.3.3 (Optional) Setting the Registration Mode of a GVRP Interface

Context
A GVRP interface supports three registration modes:
l
Normal: In this mode, the GVRP interface can dynamically register and deregister VLANs,
and transmit dynamic VLAN registration information and static VLAN registration
information.
Fixed: In this mode, the GVRP interface is disabled from dynamically registering and
deregistering VLANs and can transmit only the static registration information. If the
registration mode of a trunk interface is set to fixed, the interface allows only the manually
configured VLANs to pass even if it is configured to allow all the VLANs to pass.
Forbidden: In this mode, the GVRP interface is disabled from dynamically registering and
deregistering VLANs and can transmit only information about VLAN 1. If the registration
mode of a trunk interface is set to forbidden, the interface allows only VLAN 1 even if it
is configured to allow all the VLANs.
Do as follows on the S2700 to set the registration mode of interfaces.
Procedure
Step 1 Run:
system-view
Issue 01 (2011-07-15)

127


Step 2 Run:

Step 3 Run:
gvrp registration { fixed | forbidden | normal }
The registration mode of the interface is set.

By default, the registration type of a GVRP interface is normal.
NOTE
Before setting the registration mode of an interface, you need to enable GVRP on the interface.
----End
6.3.4 (Optional) Setting the GARP Timers

Context
When a GARP participant is enabled, the LeaveAll timer is started. When the LeaveAll timer
expires, the GARP participant sends LeaveAll messages to request other GARP participants to
re-register all its attributes. Then the LeaveAll timer restarts.
Devices on a network may have different settings of the LeaveAll timer. In this case, all the
devices use the smallest LeaveAll timer value on the network. When the LeaveAll timer of a
device expires, the device sends LeaveAll messages to other devices. After other devices receive
the LeaveAll messages, they reset their LeaveAll timers. Therefore, only the LeavelAll timer
with the smallest value takes effect even if devices have different settings of the LeaveAll timer.
When using the garp timer command to set the GARP timers, pay attention to the following
points:
l
The undo garp timer command restores the default values of the GARP timers. If the
default value of a timer is out of the valid range, the undo garp timer command does not
take effect.
The value range of each timer changes with the values of the other timers. If a value you
set for a timer is not in the allowed range, you can change the value of the timer that
determines the value range of this timer.
To restore the default values of all the GARP timers, restore the Hold timer to the default
value, and then restore the Join timer, Leave timer, and LeaveAll timer to the default values
in sequence.
NOTE
In actual application, it is recommended that you use the following values of the GVRP timers:
l
GARP Hold timer: 100 centiseconds (1 second)
GARP Join timer: 600 centiseconds (6 seconds)
GARP Leave timer: 3000 centiseconds (30 seconds)
GARP LeaveAll timer: 12000 centiseconds (2 minutes)
When the number of dynamic VLANs increases, lengths of the GARP timers need to be increased.
Issue 01 (2011-07-15)

128

Procedure
Step 1 Run:
system-view

Step 2 Run:
garp timer leaveall timer-value
The value of the LeaveAll timer is set.

The default value of the LeaveAll timer is 1000 centiseconds (10 seconds).
Step 3 Run:

Step 4 Run:
garp timer { hold | join | leave } timer-value
The value of the Hold timer, Join timer, or Leave timer is set.
By default, the value of the Hold timer is 10 centiseconds, the value of the Join timer is 20
centiseconds, and the value of the Leave timer is 60 centiseconds.
----End

Procedure
l
Run the display gvrp status command to view the status of global GVRP is enabled.
Run the display gvrp statistics [ interface { interface-type interface-number [ to interfacetype interface-number ] }&<1-10> ] command to view the statistics about GVRP on an
interface.
Run the display garp timer [ interface { interface-type interface-number [ to interfacetype interface-number ] }&<1-10> ] command to view the values of GARP timers.
----End
6.4 Maintaining GVRP

This section describes how to clear the statistics about GARP.
6.4.1 Clearing GARP Statistics
Issue 01 (2011-07-15)

129

Context
CAUTION
GARP statistics cannot be restored after being cleared. Therefore, use this command with
caution.
Procedure
Step 1 Run the reset garp statistics [ interface { interface-type interface-number [ to interface-type
interface-number ] }&<1-10> ] command in the user view to clear statistics about GARP on the
specified interfaces.
----End

This section provides configuration examples of GVRP.
6.5.1 Example for Configuring GVRP

As shown in Figure 6-2, a branch of company A communicates with the headquarters through
Switch A and Switch B. To simplify the configuration, you need to enable GVRP on all switches
of company A and set the registration mode to normal on interfaces of these switches.
Company B communicates with company A through Switch B and Switch C. To configure
switches of company B to transmit packets of only VLANs of company B, you need to enable
GVRP on all switches of company B and set the registration mode to fixed on the interfaces
connected to switches of company A.
Figure 6-2 Networking for configuring GVRP
SwitchB
Eth0/0/1
SwitchA
Eth0/0/2
Eth0/0/1 SwitchC
Eth0/0/1
Company A
Eth0/0/2
Eth0/0/2
Branch of
company A
Issue 01 (2011-07-15)
Company A
Company A

Company B
130

1.
Enable GVRP globally.
2.
Set the link type of interfaces to trunk.
3.
Enable GVRP on interfaces.
4.
Set the registration mode of interfaces.
Data Preparation
l
VLANs allowed by interfaces of Switch A, Switch B, and Switch C: all VLANs
Registration mode of interfaces of Switch A and Switch B: normal
Registration modes of Eth 0/0/1 and Eth 0/0/2 of Switch C: fixed and normal respectively
VLANS of company B on Switch C: VLAN 101 to VLAN 200
Procedure
Step 1 Configure Switch A.
# Enable GVRP globally.
<Quidway>
[Quidway]
[SwitchA]
[SwitchA]
system-view
sysname SwitchA
gvrp
bpdu enable
# Set the link type of Eth 0/0/1 and Eth 0/0/2 to trunk and configure the interfaces to allow all
VLANs.
0/0/1
link-type trunk
trunk allow-pass vlan all
0/0/2
link-type trunk
# Enable GVRP on the interfaces and set the registration modes of the interfaces.
[SwitchA-Ethernet0/0/1] gvrp
0/0/1
registration normal
0/0/2
registration normal
The configuration of Switch B is similar to the configuration of Switch A, and is not mentioned
here.
Step 2 Configure Switch C.
# Create VLAN 101 to VLAN 200.
Issue 01 (2011-07-15)

131

[SwitchC] vlan batch 101 to 200
# Enable GVRP globally.

[SwitchC] gvrp
[SwitchC] bpdu enable
# Set the link type of Eth 0/0/1 and Eth 0/0/2 to trunk and configure the interfaces to allow all
VLANs.
0/0/1
link-type trunk
0/0/2
link-type trunk
# Enable GVRP on the interfaces and set the registration modes of the interfaces.
[SwitchC-Ethernet0/0/1] gvrp
0/0/1
registration fixed
0/0/2
registration normal

After the configuration is complete, the branch of company A can communicate with the
headquarters, and users of company A in VLAN 101 to VLAN 200 can communicate with users
in company B.
Run the display gvrp status command on Switch A to check whether GVRP is enabled globally.
The following information is displayed:
<SwitchA> display gvrp status
GVRP is enabled
Run the display gvrp statistics command on Switch A to view statistics about GVRP on GVRP
interfaces, including the GVRP state of each interface, number of GVRP registration failures,
source MAC address of the last GVRP PDU, and registration type of each interface.
<SwitchA> display gvrp statistics
GVRP statistics on port Ethernet0/0/1
GVRP status
: Enabled
GVRP registrations failed
: 0
GVRP last PDU origin
: 0000-0000-0000
GVRP registration type
: Normal
Verify the configurations of Switch B and Switch C in the same way.

----End
Configuration Files
l
Configuration file of Switch A
#
sysname SwitchA
#
gvrp
Issue 01 (2011-07-15)

132

#
gvrp
#
gvrp
#
return
Configuration file of Switch B
#
sysname SwitchB
#
gvrp
#
gvrp
#
gvrp
#
return
Configuration file of Switch C
#
sysname SwitchC
#
vlan batch 101 to 200
#
gvrp
#
gvrp
gvrp registration fixed
#
gvrp
#
return
Issue 01 (2011-07-15)

133

7 MAC Address Table Configuration
MAC Address Table Configuration
About This Chapter

This chapter provides the basics for MAC address table configuration, configuration procedure,
and configuration examples.
7.1 MAC Address Table Overview
This section describes the definition of the MAC address table, how MAC address entries are
generated, and how packets are forwarded based on the MAC address table.
7.2 MAC Address Features Supported by the S2700
This section describes the MAC address features supported by the S2700 and provides usage
scenarios of the features to help you complete configuration tasks quickly and accurately.
7.3 Configuring a Static MAC Address Entry
A static MAC address entry specifies an outbound interface for packets destined for a specified
MAC address. Static MAC address entries protect the S2700 from MAC address attacks.
7.4 Configuring a Blackhole MAC Address Entry
You can configure a blackhole MAC address entry so that the S2700 can discard packets with
the specified source or destination MAC address.
7.5 Setting the Aging Time of Dynamic MAC Address Entries
Dynamic MAC address entries are created by the S2700 and can be aged out. Setting a proper
aging time prevents sharp increase of MAC address entries.
7.6 Disabling MAC Address Learning
If a fixed device is connected to an interface, you can disable MAC address learning on the
interface. This prevents other devices from accessing the interface and improves device security.
7.7 Limiting the Number of Learned MAC Addresses
This section describes how to limit the number of MAC addresses learned on an interface.
7.8 Configuring Port Security
The port security function prevents devices with untrusted MAC addresses from accessing an
interface. This function is applicable to the networks that require high access security.
7.9 Configuring the S2700 to Discard Packets with an All-0 MAC Address
You can configure the S2700 to discard packets with an all-0 source or destination MAC address.
Issue 01 (2011-07-15)

134


This section provides several examples for the configuration of the MAC address table.
Issue 01 (2011-07-15)

135

7.1 MAC Address Table Overview

This section describes the definition of the MAC address table, how MAC address entries are
generated, and how packets are forwarded based on the MAC address table.
Definition
A MAC address table is maintained on theS2700. The MAC address table stores the MAC
addresses of other devices learned by the S2700, the VLAN IDs, and the outbound interfaces
that are used to send data. Before forwarding a data packet, the S2700 searches the MAC address
table based on the destination MAC address and the VLAN ID of the packet to find the outbound
interface quickly. This reduces the number of broadcast packets.
Creation of MAC Address Entries

MAC address entries can be created dynamically or manually.
l
Automatic creation: MAC address entries are learned by the system automatically. The
MAC address table needs to be updated constantly because the network topology always
changes. The automatically created MAC address entries are not always valid. Each entry
has an aging time. If an entry is not updated within the aging time, it is deleted. If the entry
is updated before its aging time expires, the aging timer is reset.
Manual creation: Automatically created MAC address entries cannot distinguish packets
of authorized users from attack packets. If a hacker sets the source MAC address of attack
packets to the MAC address of an authorized user and connects to another interface of the
S2700, the S2700 learns an incorrect MAC address entry. The packets that should be
forwarded to the authorized user are forwarded to the hacker. To improve interface security,
you can manually create MAC address entries to bind MAC addresses of authorized users
to specified interfaces. This prevents hackers from intercepting data of authorized users.
Manually created MAC address entries take precedence over automatically created MAC
address entries.
Classification of MAC Address Entries

MAC address entries are classified into the following types:
l
Dynamic MAC address entries that are learned by an interface after MAC address learning
is enabled.
Static MAC address entries that are configured manually. Static MAC address entries take
precedence over dynamic MAC address entries.
Blackhole MAC address entries that are the manually configured and used to discard data
frames with the specified source or destination MAC addresses. Blackhole MAC address
entries take precedence over dynamic MAC address entries.
Packet Forwarding Based on the MAC Address Table

The S2700 forwards packets based on the MAC address table in either of the following modes:
l
Issue 01 (2011-07-15)
Unicast mode: If the destination MAC address of a packet can be found in the MAC address
table, the S2700 forwards the packet through the outbound interface specified in the
matching entry.
136

Broadcast mode: If a packet is a broadcast or multicast packet or its destination MAC

address cannot be found in the MAC address table, the S2700 broadcasts the packet to all
the interfaces except the inbound interface of the packet.
7.2 MAC Address Features Supported by the S2700

This section describes the MAC address features supported by the S2700 and provides usage
scenarios of the features to help you complete configuration tasks quickly and accurately.
You can configure the following MAC address features to improve device security and control
the number of entries in the MAC address table:
l
Create static MAC address entries for MAC addresses of fixed upstream devices or trusted
user devices to improve communication security.
Configure blackhole MAC address entries to protect the S2700 from attacks.
Set a proper aging time for dynamic MAC addresses to prevent sharp increase of dynamic
MAC address entries.
You can use the following methods to improve security or meet special requirements:
l
Disable MAC address learning. This method can be used on a network where the topology
seldom changes or forwarding paths are specified in static MAC address entries. This
method prevents users with unknown MAC addresses from accessing the network, protects
the network from MAC address attacks, and improves network security.
Limit the number of MAC addresses that can be learned. This method can be used on an
insecure network to prevent untrusted users from connecting to the network.
Enable port security. If a network requires high security, port security can be configured
on the interfaces connected to trusted devices. The port security function prevents devices
with untrusted MAC addresses from accessing these interfaces and improves device
security.
Discard packets with an all-0 MAC address. A faulty device may send packets with an all-0
source or destination MAC address to the S2700. You can configure the S2700 to discard
such packets and send a trap to the network management system (NMS). You can locate
the faulty device according to the trap message.
NOTE
On the S2700SI, MAC address learning cannot be disabled.

The S2700SI does not support port security.
The S2700SI cannot discard invalid packets with an all-0 source or destination MAC address.
Disabling MAC Address Learning

When an S2700 enabled with MAC address learning receives an Ethernet frame, it records the
source MAC address and inbound interface of the Ethernet frame in a MAC address entry. When
receiving other Ethernet frames destined for this MAC address, the S2700 forwards the frames
through the corresponding outbound interface according to the MAC address entry. The MAC
address learning function reduces broadcast packets on a network.
After MAC address learning is disabled on an interface, the S2700 does not learn source MAC
addresses of packets received by the interface.
Issue 01 (2011-07-15)

137

Limiting the Number of Learned MAC Addresses

The S2700 can limit the number of MAC addresses learned on an interface. When the number
of learned MAC address entries reaches the limit, the S2700 stops learning MAC addresses.
When the S2700 receives packets with unknown source MAC addresses, it generates an alarm
to alert you if it is configured to do so. This method controls the number of access users flexibly
and protects user devices and the network from MAC address attacks.
Port Security
The port security function changes MAC addresses learned by an interface to secure dynamic
MAC addresses or sticky MAC addresses. It prevents devices with untrusted MAC addresses
from accessing an interface and improves device security.
Differences between secure dynamic MAC addresses and sticky MAC addresses are:
l
Secure dynamic MAC addresses are learned after port security is enabled and will not be
aged out by default. You can set the aging time of secure dynamic MAC addresses so that
they can be aged out. Secure dynamic MAC addresses will be lost after the device restarts
and the device needs to learn the MAC addresses again.
Sticky MAC addresses are learned after the sticky MAC function is enabled. Sticky MAC
addresses will not be aged out and will exist after the S2700 restarts.
7.3 Configuring a Static MAC Address Entry

A static MAC address entry specifies an outbound interface for packets destined for a specified
MAC address. Static MAC address entries protect the S2700 from MAC address attacks.
You can configure a static MAC address entry if an interface is connected to an upstream device
or a server, as shown in Figure 7-1. Attackers may set the source MAC address of packets to
the server MAC address and send the packets to the Switch to intercept data of the server. To
protect the server and ensure communication between users and the server, you can configure a
static MAC address entry in which the destination MAC address is the server MAC address and
the outbound interface is the interface connected to the server.
Issue 01 (2011-07-15)

138

Figure 7-1 Networking diagram of static MAC address entry configurations
Network
Server
Switch
VLAN2
LSW
VLAN4
PC1
PC2
None.
Data Preparation
To configure a static MAC address entry, you need the following data.
No.
Data
Destination MAC address, destination outbound interface number and ID of the

VLAN which the outbound interface belongs to
Procedure
Step 1 Run:
system-view

Step 2 Run:
mac-address static mac-address interface-type interface-number vlan vlan-id1
A static MAC address entry is configured.

NOTE
Static MAC address entries take precedence over dynamic MAC address entries.
----End
Issue 01 (2011-07-15)

139

Checking the Configuration

Run the display mac-address static [ vlan vlan-id | interface-type interface-number ] *
[ verbose ] command to view static MAC address entries.
7.4 Configuring a Blackhole MAC Address Entry

You can configure a blackhole MAC address entry so that the S2700 can discard packets with
the specified source or destination MAC address.
To protect user devices or network devices from MAC address attacks, you can configure
untrusted MAC addresses as blackhole MAC addresses. Packets with source or destination MAC
addresses matching the blackhole MAC address entries are discarded.
None.
Data Preparation
To configure a blackhole MAC address entry, you need the following data.
No.
Data
Destination or source MAC address and ID of VLAN to which the outbound interface
belongs to
Procedure
Step 1 Run:
system-view

Step 2 Run:
mac-address blackhole mac-address [ vlan vlan-id ]
A blackhole MAC address entry is configured.

----End

Run the display mac-address blackhole [ vlan vlan-id ] [ verbose ] command to view blackhole
MAC address entries.
Issue 01 (2011-07-15)

140

7.5 Setting the Aging Time of Dynamic MAC Address

Entries
Dynamic MAC address entries are created by the S2700 and can be aged out. Setting a proper
aging time prevents sharp increase of MAC address entries.
Dynamical MAC address entries are learned by the S2700 from source MAC addresses of
received packets. The system starts an aging timer for dynamic MAC address entry. If a dynamic
MAC address entry is not updated within a certain period (twice the aging time), this entry is
deleted. If the entry is updated within this period, the aging timer of this entry is reset. A shorter
aging time enables the S2700 to respond to network topology changes more quickly.
The network topology changes frequently, and the S2700 will learn many MAC addresses. After
the aging time of dynamic MAC address entries is set, the S2700 can delete unneeded MAC
address entries to prevent sharp increase of MAC address entries.
None.
Data Preparation
To set the aging time of dynamic MAC address entries, you need the following data.
No.
Data
Aging time
Procedure
Step 1 Run:
system-view

Step 2 Run:
mac-address aging-time aging-time
The aging time of dynamic MAC address entries is set.

By default, the aging time of dynamic MAC address entries is 300 seconds.
----End

l
Issue 01 (2011-07-15)
Run the display mac-address aging-time command to check whether the aging time of
dynamic MAC address entries is set properly.
141

7.6 Disabling MAC Address Learning

If a fixed device is connected to an interface, you can disable MAC address learning on the
interface. This prevents other devices from accessing the interface and improves device security.

Before disabling MAC address learning, familiarize yourself with the applicable environment,
As shown in Figure 7-2, an interface of the Switch is connected to a server. To protect the server,
configure the server MAC address as a static MAC address, disable MAC address learning on
the interface, and configure the interface to discard the packets with unknown MAC addresses.
The configuration prevents other servers or terminals from accessing the interface and improves
network stability and security.
Figure 7-2 Disabling MAC address learning
Server
mac-address
learning disable
Switch
NOTE
On the S2700SI, MAC address learning cannot be disabled.
None.
Data Preparation
To disable MAC address learning, you need the following data.
Issue 01 (2011-07-15)

142

No.
Data
Interface type and number
VLAN ID
7.6.2 Disabling MAC Address Learning on an Interface

Disabling MAC address learning on an interface can improve security of the device connected
to the interface.
Context
When an S2700 enabled with MAC address learning receives an Ethernet frame, it records the
source MAC address and inbound interface of the Ethernet frame in a MAC address entry. When
receiving other Ethernet frames destined for this MAC address, the S2700 forwards the frames
through the corresponding outbound interface according to the MAC address entry. The MAC
address learning function reduces broadcast packets on a network. After MAC address learning
is disabled on an interface, the S2700 does not learn source MAC addresses of packets received
by the interface.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
mac-address learning disable [ action { discard | forward } ]
MAC address learning is disabled on the interface.

By default, MAC address learning is enabled on an interface.
You can configure an action for the S2700 to perform when a packet with an unknown MAC
address is received on the interface. By default, the S2700 forwards such packets based on the
MAC address table. When the action is set to discard, the S2700 searches for the source MAC
address of the packet in the MAC address table. If the source MAC address is found in the MAC
address table, the S2700 forwards the packet according to the MAC address entry. If the source
MAC address is not found, the S2700 discards the packet.
NOTE
If you set the action to forward when disabling MAC address learning, untrusted terminals can still access
the network. This action only controls the number of learned MAC address entries.
----End
Issue 01 (2011-07-15)

143

7.6.3 Disabling MAC Address Learning in a VLAN

Disabling MAC address learning in a VLAN can protect users in this VLAN from MAC address
attacks.
Context
After MAC address learning is disabled in a VLAN, the S2700 checks source MAC addresses
of packets received by interfaces in the VLAN. If the source MAC address of a packet is in the
MAC address table, the S2700 forwards the packet; otherwise, the S2700 broadcasts the packet.
Procedure
Step 1 Run:
system-view

Step 2 Run:
vlan vlan-id

Step 3 Run:
mac-address learning disable
MAC address learning is disabled in the VLAN.

By default, MAC address learning is enabled in a VLAN.
----End

After disabling MAC address learning on an interface or in a VLAN, use the following
commands to verify the configuration.
Procedure
l

command to view the current configuration of an interface.
Run the display vlan command to check the VLAN configuration.
----End
7.7 Limiting the Number of Learned MAC Addresses

This section describes how to limit the number of MAC addresses learned on an interface.

Before limiting the number of learned MAC addresses, familiarize yourself with the applicable
environment, complete the pre-configuration tasks, and obtain the data required for the
configuration. This will help you complete the configuration task quickly and accurately.
Issue 01 (2011-07-15)

144

As shown in Figure 7-3, an insecure residential network or enterprise often receives packets
with bogus MAC addresses. The capacity of a MAC address table is limited; therefore, if hackers
forge a large number of packets with different source MAC addresses and send the packets to
the Switch, the MAC address table of the Switch becomes full quickly. When the MAC address
table is full, the Switch cannot learn source MAC addresses of valid packets. A limit can be set
for the number of learned MAC addresses. When the number of learned MAC addresses reaches
the limit, the Switch stops learning MAC addresses. When the Switch receives packets with
unknown source MAC addresses, it can be configured to generate an alarm. This protects the
network from MAC address attacks.
Figure 7-3 Limiting the number of MAC addresses on an insecure network
Internet
Switch
VLAN2
MAC- Limit
VLAN2
LSW1
LSW2
VLAN2
Before limiting the number of learned MAC addresses, complete the following task:
l
Deleting the existing MAC address entries from the interface where you want to limit the
number of learned MAC addresses
Data Preparation
To limit the number of learned MAC addresses, you need the following data.
Issue 01 (2011-07-15)
No.
Data
Maximum number of MAC addresses that can be learned on an interface

145

7.7.2 Limiting the Number of MAC Addresses Learned on an

Interface
A limit can be set for the number of MAC addresses learned on an interface to control the number
of access users on the interface. When the number of learned MAC addresses on the interface
reaches the limit, the S2700 stops learning MAC addresses on this interface. When the interface
receives packets with unknown source MAC addresses, it can be configured to generate an alarm.
This protects the network from MAC address attacks.
Context
The MAC address limiting rule applies to all MAC addresses, including trusted MAC addresses.
If a user from an enterprise or a family uses bogus MAC addresses to attack the network, users
in the enterprise or family are not allowed to access the network, but other users on the network
are not affected.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
mac-limit maximum max-num
The maximum number of MAC addresses learned on the interface is set.

By default, the number of MAC addresses learned on an interface is not limited.
Step 4 Run:
mac-limit alarm { disable | enable }
The S2700 is configured to (or not to) send a trap to the NMS when the number of learned MAC
addresses reaches the limit.
By default, the S2700 sends a trap to the NMS when the number of learned MAC addresses
reaches the limit.
----End

After completing the configuration of MAC address limiting, use the following command to
verify the configuration.
Procedure
Step 1 Run the display mac-limit [ interface-type interface-number | vlan vlan-id ] command to view
the MAC address limiting rule.
----End
Issue 01 (2011-07-15)

146

7.8 Configuring Port Security

The port security function prevents devices with untrusted MAC addresses from accessing an
interface. This function is applicable to the networks that require high access security.

The port security function changes MAC addresses learned by an interface to secure dynamic
MAC addresses or sticky MAC addresses. It prevents devices with untrusted MAC addresses
from accessing an interface and improves device security.
If a network requires high access security, you can configure port security on specified interfaces.
MAC addresses learned by these interfaces change to secure dynamic MAC addresses or sticky
MAC addresses. When the number of learned MAC addresses reaches the limit, the interface
does not learn new MAC addresses and allows only the devices with the learned MAC addresses
to communicate with the S2700. This prevents devices with untrusted MAC addresses from
accessing these interfaces, improving security of the S2700 and the network.
NOTE
The S2700SI does not support port security.
Before configuring port security on an interface, complete the following tasks:
l
Disabling MAC address limiting on the interface
Disabling MAC address authentication on the interface
Disabling 802.1x authentication on the interface
Disabling MAC address security for DHCP snooping on the interface
Data Preparation
To configure port security on an interface, you need the following data.
Issue 01 (2011-07-15)
No.
Data
Secure dynamic MAC: interface type and number, limit on the number of learned
MAC addresses, action to perform when the limit is exceeded, and aging time of
secure dynamic MAC addresses
Sticky MAC: interface type and number, limit on the number of learned MAC
addresses, and action to perform when the limit is exceeded

147

7.8.2 Configuring the Secure Dynamic MAC Function on an

Interface
After port security is enabled on an interface, MAC addresses learned by the interface change
to secure dynamic MAC addresses. When the number of secure dynamic MAC addresses reaches
the limit, the interface does not learn new MAC addresses and allows only the devices with the
learned MAC addresses to communicate with the S2700. You can configure a protection action
for the S2700 to perform when it receives a packet with a new source MAC address.
Context
By default, secure dynamic MAC addresses will not be aged out. You can set the aging time of
secure dynamic MAC addresses so that they can be aged out. Secure dynamic MAC addresses
will be lost after the device restarts and the device needs to learn the MAC addresses again.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
port-security enable
Port security is enabled.

By default, port security is disabled on an interface.
NOTE
You can set the limit on the number of secure dynamic MAC addresses, aging time of secure dynamic
MAC addresses, and protection action only when port security is enabled.

port-security max-mac-num max-number
The limit on the number of secure dynamic MAC addresses is set.

By default, the limit on the number of secure dynamic MAC addresses is 1.
port-security protect-action { protect | restrict | shutdown }
The protection action is configured.

The default action is restrict.
l protect: discards packets with new source MAC addresses when the number of learned MAC
l restrict: discards packets with new source MAC addresses and sends a trap message when
the number of learned MAC addresses exceeds the limit.
Issue 01 (2011-07-15)

148

l shutdown: shuts down the interface when the number of learned MAC addresses exceeds
the limit.
port-security aging-time time [ type { absolute | inactivity } ]
The aging time of secure dynamic MAC addresses is set.

By default, secure dynamic MAC addresses will not be aged out.
----End
7.8.3 Configuring the Sticky MAC Function on an Interface

After the sticky MAC function is enabled on an interface, MAC addresses learned by the
interface change to sticky MAC addresses. When the number of sticky MAC addresses reaches
the limit, the interface does not learn new MAC addresses and allows only the devices with the
learned MAC addresses to communicate with the S2700. You can configure a protection action
for the S2700 to perform when it receives a packet with a new source MAC address.
Context
The sticky MAC function changes MAC addresses learned by an interface to sticky MAC
addresses. Sticky MAC addresses will not be aged out and will exist after the S2700 restarts.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
Port security is enabled.

By default, port security is disabled on an interface.
Step 4 Run:
port-security mac-address sticky
The sticky MAC function is enabled on the interface.

By default, the sticky MAC function is disabled on an interface.
port-security max-mac-num max-number
The limit on the number of sticky MAC addresses is set.

By default, the limit on the number of sticky MAC addresses is 1.
Issue 01 (2011-07-15)

149

port-security protect-action { protect | restrict | shutdown }
The protection action is configured.

The default action is restrict.
l protect: discards packets with new source MAC addresses when the number of learned MAC
l restrict: discards packets with new source MAC addresses and sends a trap message when
the number of learned MAC addresses exceeds the limit.
l shutdown: shuts down the interface when the number of learned MAC addresses exceeds
the limit.
port-security mac-address sticky mac-address vlan vlan-id
A sticky MAC address entry is configured.

----End

After completing the configuration of port security, you can verify the configuration and view
secure dynamic MAC address entries or sticky MAC address entries.
Procedure
l

command to view the current configuration of an interface.
Run the display mac-address sticky [ vlan vlan-id | interface-type interface-number ] *

[ verbose ] command to view sticky MAC address entries.
Run the display mac-address security [ vlan vlan-id | interface-type interface-number ]

[ verbose ] command to view secure dynamic MAC address entries.
----End
7.9 Configuring the S2700 to Discard Packets with an All-0

MAC Address
You can configure the S2700 to discard packets with an all-0 source or destination MAC address.
A faulty network device may send packets with an all-0 source or destination MAC address to
the S2700. You can configure the S2700 to discard such packets and send a trap to the network
management system (NMS). You can locate the faulty device according to the trap message.
NOTE
The S2700SI cannot discard invalid packets with an all-0 source or destination MAC address.
l
Issue 01 (2011-07-15)
Powering on the S2700 and ensuring that it functions properly

150

Data Preparation
None.
Procedure
Step 1 Run:
system-view

Step 2 Run:
drop illegal-mac enable
The S2700 is configured to discard packets with an all-0 MAC address.

By default, the S2700 does not discard packets with an all-0 MAC address.
drop illegal-mac alarm
The S2700 is configured to send a trap to the NMS when receiving packets with an all-0 MAC
address.
By default, the S2700 does not send a trap to the NMS when receiving packets with an all-0
MAC address.
NOTE
The S2700 sends only one trap after receiving packets with an all-0 MAC address. To enable the S2700 to
send a trap again, run the drop illegal-mac alarm command.
----End

Run the display current-configuration command to check whether the S2700 is configured to
discard the packets with an all-0 MAC address.

This section provides several examples for the configuration of the MAC address table.
7.10.1 Example for Configuring the MAC Address Table

As shown in Figure 7-4, the MAC address of the user host PC1 is 0002-0002-0002 and the MAC
address of the user host PC2 is 0003-0003-0003. PC1 and PC2 are connected to the Switch
through the LSW. The LSW is connected to Eth 0/0/1 of the Switch. Interface Eth 0/0/1 belongs
to VLAN 2. The MAC address of the server is 0004-0004-0004. The server is connected to Eth
0/0/2 of the Switch. Interface Eth 0/0/2 belongs to VLAN 2.
l
Issue 01 (2011-07-15)
To prevent hackers from attacking the network with MAC addresses, you need to add a
static entry to the MAC table of the Switch for each user host. When sending packets
151

through Eth 0/0/1, the Switch changes the VLAN ID to VLAN 4 to which the LSW belongs.
In addition, you need to set the aging time of the dynamic entries in the MAC address table
to 500 seconds.
l
To prevent hackers from forging the MAC address of the server and stealing user
information, you can configure the packet forwarding based on static MAC address entries
on the Switch.
Figure 7-4 Networking diagram of MAC address table configurations

S e rve r
N e tw o rk
S w itch
M A C a d d re ss: 4 -4 -4
E th 0 /0 /2
VLAN2
E th 0 /0 /1
LSW
PC1
VLAN4
PC2
M A C a d d re ss: 2 -2 -2
M A C a d d re ss: 3 -3 -3
1.
Create a VLAN and add interfaces to the VLAN.
2.
Add static MAC address entries.
3.
Set the aging time of dynamic MAC address entries.
Data Preparation
l
MAC address of PC1: 0002-0002-0002
MAC address of PC2: 0003-0003-0003
MAC address of the server: 0004-0004-0004
VLAN to which the Switch belongs: VLAN 2
Interface connecting the Switch to the LSW: Eth 0/0/1
Interface connecting the Switch to the server: Eth 0/0/2
VLAN ID required to be changed to when the Switch sends packets through the outgoing
interface: VLAN 4
Aging time of dynamic entries in the MAC address table of the Switch: 500 seconds
Issue 01 (2011-07-15)

152

Procedure
Step 1 Add static MAC address entries.
# Create VLAN 2; add Eth 0/0/1 0/0/2 to VLAN 2; configure VLAN mapping on Eth 0/0/1.
[Quidway] vlan 2
0/0/1
hybrid pvid vlan 2
vlan-mapping vlan 4 map-vlan 2
0/0/2
hybrid pvid vlan 2
# Configure static MAC address entries.

[Quidway] mac-address static 2-2-2 ethernet 0/0/1 vlan 2
Step 2 Set the aging time of dynamic MAC address entries.

[Quidway] mac-address aging-time 500

# Run the display mac-address command in any view. You can check whether the static MAC
address entries are successfully added.
[Quidway] display mac-address static vlan 2
------------------------------------------------------------------------------MAC Address
VLAN/VSI
Learned-From
Type
------------------------------------------------------------------------------0002-0002-0002
2/Eth0/0/1
static
0003-0003-0003
2/Eth0/0/1
static
0004-0004-0004
2/Eth0/0/2
static
------------------------------------------------------------------------------Total items displayed = 3
# Run the display mac-address aging-time command in any view. You can check whether the
aging time of dynamic entries is set successfully.
[Quidway] display mac-address aging-time
Aging time: 500 seconds
----End
Configuration Files
The following lists the configuration file of the Switch.
#
sysname Quidway
#
vlan batch 2
#
mac-address aging-time 500
#
Issue 01 (2011-07-15)

153

#
#
mac-address static 0002-0002-0002 Ethernet0/0/1 vlan 2
#
return
7.10.2 Example for Configuring Interface Security

As shown in Figure 7-5, a company wants to prevent the computers of non-employees from
accessing the intranet of the company to protect information security. To achieve this goal, the
company needs to enable the sticky MAC function on the interface connected to computers of
employees and set the maximum number of MAC addresses learned by the interface to be the
same as the number of trusted computers.
Figure 7-5 Networking diagram of interface security configuration
Internet
Switch
Eth0/0/1
VLAN 10
SwitchA
PC1
PC2
PC3
1.
Create a VLAN and set the link type of the interface to trunk.
2.
Enable the interface security function.
3.
Enable the sticky MAC function on the interface.
4.
Configure the security protection action on the interface.
Issue 01 (2011-07-15)

154

5.
Set the maximum number of MAC addresses that can be learned by the interface.
Data Preparation
l
VLAN allowed by the interface
Type and number of the interface connected to computers of employees
Security protection action
Maximum number of MAC addresses learned by the interface
Procedure
Step 1 Create a VLAN and set the link type of the interface to trunk.
[Quidway] vlan 10
Step 2 Configure the interface security function.

# Enable the interface security function.
[Quidway-Ethernet0/0/1] port-security enable
Enable the sticky MAC function.

[Quidway-Ethernet0/0/1] port-security mac-address sticky
# Configure the security protection action.

[Quidway-Ethernet0/0/1] port-security protect-action protect
# Set the maximum number of MAC addresses that can be learned by the interface.
[Quidway-Ethernet0/0/1] port-security max-mac-num 4
To enable the interface security function on other interfaces, repeat the preceding steps.
If PC1 is replaced by another PC, this PC cannot access the intranet of the company.
----End
Configuration Files
#
sysname Quidway
#
vlan batch 10
#
port-security protect-action protect
port-security mac-address sticky
Issue 01 (2011-07-15)

155

port-security max-mac-num 4
#
return
Issue 01 (2011-07-15)

156

8 STP/RSTP Configuration
STP/RSTP Configuration
About This Chapter

The Spanning Tree Protocol (STP) trims a ring network into a loop-free tree network. It prevents
replication and circular propagation of packets, provides multiple redundant paths for Virtual
LAN (VLAN) data traffic, and enables load balancing. The Rapid Spanning Tree Protocol
(RSTP) develops rapid convergence and introduces the edge port and its protection function
based on STP.
8.1 STP/RSTP Overview
STP is a management protocol on the data link layer. It is used to block redundant links on the
Layer 2 network and trim a network into a loop-free tree. RSTP is a refinement of STP and
introduces rapid convergence of the network topology.
8.2 Configuring Basic STP/RSTP Functions
STP/RSTP is used to block redundant links on the Layer 2 network and trim a network into a
loop-free tree topology.
8.3 Configuring STP/RSTP Parameters on an Interface
A feedback mechanism is provided to confirm topology convergence. Thus, rapid convergence
is implemented for RSTP.
8.4 Configuring RSTP Protection Functions
RSTP protection functions are as follows, and you can configure one or more functions as
required.
8.5 Configuring STP/RSTP Interoperability Between Huawei Devices and Non-Huawei Devices
To supports STP/RSTP interoperability between Huawei devices and non-Huawei devices,
proper parameters are required on Huawei devices running STP/RSTP to ensure nonstop
communication.
8.6 Maintaining STP/RSTP
STP/RSTP maintenance includes resetting STP/RSTP statistics.
This section shows typical usage scenarios of STP/RSTP by describing networking
requirements, configuration roadmap, and data preparation, and provides related configuration
files.
Issue 01 (2011-07-15)

157

8.1 STP/RSTP Overview

STP is a management protocol on the data link layer. It is used to block redundant links on the
Layer 2 network and trim a network into a loop-free tree. RSTP is a refinement of STP and
introduces rapid convergence of the network topology.
8.1.1 STP/RSTP Overview

Introduction
On a complex network, loops are inevitable. With the requirement for network redundancy
backup, network designers tend to deploy multiple physical links between two devices, one of
which is the master and the others are the backup. Loops are likely or bound to occur in such a
situation.
Loops will cause broadcast storms, thereby exhausting network resources and paralyzing the
network. Loops also cause flapping of MAC address tables and thus damages MAC address
entries.
The devices running STP discover loops on the network by exchanging information with each
other and trim the ring topology into a loop-free tree topology by blocking a certain interface.
In this manner, replication and circular propagation of packets are prevented on the network. In
addition, it is prevented that the processing performance of devices is degraded when
continuously processing repeated packets.
STP, however, converges the network topology slowly. In 2001, the IEEE published document
802.1w to introduce an evolution of the Spanning Tree Protocol: Rapid Spanning Tree Protocol
(RSTP). RSTP is developed based on STP but outperforms STP.
Concepts
l
Root bridge
A tree topology must have a root. Therefore, the root bridge is introduced by STP/RSTP.
There is only one root bridge on the entire STP/RSTP-capable network. The root bridge is
the logical center but is unnecessarily the physical center of the entire network. The root
bridge may be served by another switching device along with the network topology change.
ID
There are Bridge IDs (BIDs) and port IDs (PIDs).
BID
IEEE 802.1D defines that a BID is composed of a 2-bit bridge priority and a bridge
MAC address. That is, BID (8 bits) = Bridge priority (2 bits) + Bridge MAC address (6
bits).
On the STP-capable network, the device with the smallest BID is selected as the root
bridge. The bridge priority that is allowed to be configured on a Huawei device ranges
from 0 to 61440. By default, the bridge priority is 32768.
PID
Issue 01 (2011-07-15)

158

A 16-bit PID is composed of a 4-bit port priority and a 12-bit port number.
The PID is used when the designated port needs to be selected. That is, when the root
path costs and the sender BIDs of two ports are the same, the port with a smaller PID
is selected as the designated port. As shown in Figure 8-1, the root path costs and sender
BIDs of port A and port B on S2 are the same. Port A has a smaller PID, and is thus
selected as the designated port on the local segment. The port priority that can be
configured on a Huawei device ranges from 0 to 240, with the step 16. That is, the port
priority can be 0, 16, or 32. By default, the port priority is 128.
l
Path cost
A path cost is port-specific, which is used by STP/RSTP as a reference to select a link.
STP/RSTP calculates the path cost to select the robust link and blocks redundant links to
trim the network into a loop-free tree topology.
On an STP/RSTP-capable network, the accumulative cost of the path from a certain port
to the root bridge is the sum of the costs of the segment paths into which the path is separated
by the ports on the transit bridges.
Port roles
STP-capable port
Root port
The root port is the port that is nearest to the root bridge. The root port is determined
based on the path cost. Among all the ports where STP is enabled on the network
bridge, the port with the smallest root path cost is the root port. There is only one
root port on an STP-capable device, but there is no root port on the root bridge.
Designated Port
The designated port on a switching device forwards bridge protocol data units
(BPDUs) to the downstream switching device. All ports on the root bridge are
designated ports. A designated port is selected on each network segment. The device
where the designated port resides is called the designated bridge on the network
segment.
RSTP-capable port
Compared with STP, RSTP has two additional types of ports, namely, the alternate port
and backup port. More port roles are defined to simplify the knowledge and deployment
of STP.
Issue 01 (2011-07-15)

159

Figure 8-1 Diagram of port roles

S1
Root bridge
S2
S3
S1
Root bridge
S2
A
B
b
S3
Root port
Designated port
Alternate port
Backup port
As shown in Figure 8-1, RSTP defines four port roles: root port, designated port,
alternate port, and backup port.
The functions of the root port and designated port are the same as those defined in STP.
The description of the alternate port and backup port is as follows:
From the perspective of configuration BPDU transmission:
The alternate port is blocked after learning the configuration BPDUs sent by
other bridges.
The backup port is blocked after learning the configuration BPDUs sent by itself.
From the perspective of user traffic:
The alternate port backs up the root port and provides an alternate path from the
designated bridge to the root bridge.
The backup port backs up the designated port and provides an alternate path from
the root node to the leaf node.
After all ports are assigned roles, topology convergence is completed.
Issue 01 (2011-07-15)

160

Port status
STP port state
Table 8-1 shows the port status of an STP-capable port.
Table 8-1 STP port state
Port state
Purpose
Description
Forwardin
g
The port in the Forwarding state

forwards not only user traffic but also
BPDUs.
Only the root port and

designated port can enter the
Forwarding state.
Learning
When a port is in the Learning state, a

device creates a MAC address table
based on the received user traffic but
does not forward user traffic.
This is a transition state,

which is designed to prevent
temporary loops.
Listening
When a port is in the Listening state, the

root bridge, root port, and designated
port are to be selected.
This is a transition state.
Blocking
The port in the Blocking state receives

and forwards only BPDUs but does not
forward user traffic.
This is the final state of a

blocked port.
Disabled
The port in the Disabled state forwards

neither BPDUs nor user traffic.
The port is Down.
RSTP port state

Table 8-2 shows the port status of an RSTP-capable port.
Table 8-2 RSTP port state
Port state
Description
Forwarding
A port in the Forwarding state can send and receive BPDUs as

well as forward user traffic.
Learning
This is a transition state. A port in the Learning state learns

MAC addresses from user traffic to construct a MAC address
table.
In the Learning state, the port can send and receive BPDUs, but
cannot forward user traffic.
Discarding
Issue 01 (2011-07-15)
A port in the Discarding state can only receive BPDUs.

161

CAUTION
A Huawei datacom device is in MSTP mode by default. After a device experiences the
transition from the MSTP mode to the STP mode, an STP-capable port supports the same
port states as those supported by an MSTP-capable port, including the Forwarding,
Learning, and Discarding states. For details, see Table 8-2.
l
Three timers
Hello Timer
Sets the interval at which BPDUs are sent.
Forward Delay Timer
Sets the time spent in the Listening and Learning states.
Max Age
Sets the maximum lifetime of a BPDU on the network. When the Max Age time expires,
the connection to the root bridge fails.
Comparison between STP, RSTP, and MSTP

Table 8-3 shows the comparison between STP, RSTP, and MSTP.
Table 8-3 Comparison between STP, RSTP, and MSTP
Spanning
Tree
Protocol
Characteristics
Applicable
Environment
Precautions
STP
A loop-free tree is
generated. Thus, broadcast
storms are prevented and
redundancy is
implemented.
Irrespective of different
users or services, all
VLANs share one
spanning tree.
NOTE
RSTP
l A loop-free tree is
generated. Thus,
broadcast storms are
prevented and
redundancy is
implemented.
l A feedback mechanism
is provided to confirm
topology convergence.
Thus, rapid
convergence is
implemented.
Issue 01 (2011-07-15)

l If the current
switching device
supports STP and
RSTP, RSTP is
recommended.
l If the current
switching device
supports STP or
RSTP, and MSTP,
MSTP is
recommended. See
MSTP
Configuration.
162

Spanning
Tree
Protocol
Characteristics
Applicable
Environment
MSTP
l In an MSTP region, a
loop-free tree is
generated. Thus,
prevented and
redundancy is
implemented.
User or service-specific
load balancing is
required. Traffic for
different VLANs is
forwarded through
different spanning
trees, which are
independent of each
other.
l A feedback mechanism
is provided to confirm
Thus, rapid
convergence is
implemented.
Precautions
l MSTP implements
load balancing among
VLANs. Traffic in
different VLANs is
transmitted along
different paths.
8.1.2 STP/RSTP Features Supported by the S2700

Before configuring STP/RSTP, familiarize yourself with the concepts of basic STP/RSTP
functions, topology convergence, STP/RSTP protection, and STP/RSTP interoperability
between Huawei devices and non-Huawei devices. This will help you complete the configuration
task quickly and accurately.
loop-free tree topology. The basic configuration roadmap of STP/RSTP is as follows:
1.
Select a switching device (functioning as a root bridge) from switching devices for each
spanning tree. You can configure the priorities of the switching devices to preferentially
select a root bridge.
2.
In each spanning tree, calculate the shortest paths from the other switching devices to the
root bridge, and select a root port for each non-root switching device. You can configure
the cost of the path from a switching device to the root bridge to preferentially select a root
port.
3.
In each spanning tree, select a designated port for each connection according to the bridge
ID, the cost of path and port IDs. If the devices have the same bridge ID and the cost of
path, You can configure the port priorities to preferentially select a designated port.
STP/RSTP also supports the following features to meet requirements of special applications and
extended functions:
l
A feedback mechanism is provided to confirm topology convergence. Thus, rapid

convergence is implemented.
RSTP provides the following protection functions, as listed in Table 8-4.
Issue 01 (2011-07-15)

163

Supports STP/RSTP interoperability between Huawei devices and non-Huawei devices.

Proper parameters are required on Huawei devices running STP/RSTP to ensure nonstop
communication.
Table 8-4 RSTP Protection Function
Issue 01 (2011-07-15)
Protection
Function
Scenario
Configuration Impact
BPDU
protection
An edge port changes to be

a non-edge port after
receiving a BPDU, which
triggers spanning tree
recalculation. If an attacker
keeps sending bogus
BPDUs to a switching
device, network flapping
occurs.
After BPDU protection is enabled on the

switching device, the switching device
shuts down the edge port if the edge port
receives an RST BPDU, and notifies the
NMS of the shutdown event. The attributes
of the edge port are not changed.
TC
protection
Generally, after receiving

TC BPDUs (packets for
advertising network
topology changes), a
switching device needs to
delete MAC entries and
ARP entries. Frequent
deletion operations will
exhaust CPU resources.
TC protection is used to suppress TCBPDUs. The number of times that TCBPDUs are processed by a switching
device within a given time period is
configurable. If the number of TC-BPDUs
that the switching device receives within a
given time exceeds the specified threshold,
the switching device handles TC-BPDUs
only for the specified number of times.
Excess TC-BPDUs are processed by the
switching device as a whole for once after
the timer (that is, the specified time period)
expires. This protects the switching device
from frequently deleting MAC entries and
ARP entries, thus avoiding over-burdened.
Root
protection
Due to incorrect
configurations or
malicious attacks on the
network, a root bridge may
receive BPDUs with a
higher priority.
Consequently, the
legitimate root bridge is no
longer able to serve as the
root bridge, and the
network topology is
illegitimately changed,
triggering spanning tree
recalculation. This may
transfer traffic from highspeed links to low-speed
links, causing traffic
congestion.
If a designated port is enabled with the root

protection function, the role of the port
cannot be changed. Once a designated port
that is enabled with root protection
receives RST BPDUs with a higher
priority, the port enters the Discarding state
and does not forward packets. If the port
does not receive any RST BPDUs with a
higher priority before a period (generally
two Forward Delay periods) expires, the
port automatically enters the Forwarding
state.

164

Protection
Function
Scenario
Loop
protection
A root port or an alternate

port will age if link
congestion or a one-way
link failure occurs. After
the root port ages, a
switching device may reselect a root port
incorrectly and after the
alternate port ages, the port
enters the Forwarding
state. Loops may occur in
such a situation.
After loop protection is configured, if the

root port or alternate port does not receive
RST BPDUs from the upstream switching
device for a long time, the switching device
notifies the NMS that the port enters the
Discarding state. The blocked port remains
in the Blocked state and no longer forwards
packets. This prevents loops on the
network. The root port restores the
Forwarding state after receiving new
BPDUs.
8.2 Configuring Basic STP/RSTP Functions

STP/RSTP is commonly configured on a switching device to trim a ring network to a loop-free
network. STP/RSTP configurations on the switching device involve STP/RSTP working mode
configuration. If you need to interfere in the spanning tree calculation, the following methods
are available:
l
Setting a priority for a switching device: The lower the numerical value, the higher the
priority of the switching device and the more likely the switching device becomes a root
bridge; the higher the numerical value, the lower the priority of the switching device and
the less likely that the switching device becomes a root bridge.
Setting a path cost for a port: With the same calculation method, the lower the numerical
value, the smaller the cost of the path from the port to the root bridge and the more likely
the port becomes a root port; the higher the numerical value, the larger the cost of the path
from the port to the root bridge and the less likely that the port becomes a root port.
Setting a priority for a port: The lower the numerical value, the more likely the port becomes
a designated port; the higher the numerical value, the less likely that the port becomes a
designated port.

Before configuring basic STP/RSTP functions, familiarize yourself with the applicable
environment, complete the pre-configuration tasks, and obtain the required data. This will help
you complete the configuration task quickly and accurately.
situation.
Issue 01 (2011-07-15)

165

entries.
STP/RSTP can be deployed on a network to eliminate loops. If a loop is detected, STP/RSTP
blocks one port to eliminate the loop.
As shown in Figure 8-2, Switch A, Switch B, Switch C, and Switch D form a ring network, and
STP/RSTP is enabled on the ring network to eliminate loops.
Figure 8-2 Diagram of a ring network
Network
Root
Bridge
SwitchA
SwitchB
SwitchC
SwitchD
PC1
PC2
Blocked port
NOTE
If the current switching device supports STP and RSTP, RSTP is recommended.
Before configuring basic STP/RSTP functions, complete the following task:
l
Connecting interfaces and setting physical parameters for the interfaces to ensure that the
physical status of the interfaces is Up
Data Preparation
To configure basic STP/RSTP functions, you need the following data.
Issue 01 (2011-07-15)

166

No.
Data
(Optional) Priority of a switching device
(Optional) Priority of a port
(Optional) Path cost of a port
8.2.2 Configuring the STP/RSTP Mode

Before configuring basic STP/RSTP functions, you need to configure the working mode of a
switching device to STP/RSTP. RSTP is compatible with STP.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp mode { stp | rstp }
The working mode of the switching device is configured as STP/RSTP.

By default, the S2700SI works in the STP mode, the S2700EI works in the MSTP mode.
----End
8.2.3 (Optional) Configuring Switching Device Priorities

The lower the numerical value is, the higher priority a switching device has and the more likely
the switching device will be selected as a root bridge.
Context
On an STP/RSTP-capable network, there is only one root bridge and it is the logic center of the
entire spanning tree. In root bridge selection, the switching device with high performance and
network hierarchy is generally selected as a root bridge; however, the priority of such a device
may be not that high. Thus setting a high priority for the switching device is necessary so that
the device can function as a root bridge.
Other devices with low performance and network hierarchy are not fit to be a root bridge.
Therefore, set low priorities for these devices.
CAUTION
If an S2700 is configured as the root switch or secondary root switch, the priority of the
S2700 cannot be set. If you want to set the priority of the S2700, you must disable the root switch
or secondary root switch.
Issue 01 (2011-07-15)

167

Procedure
Step 1 Run:
system-view

Step 2 Run:
stp priority
priority
The priority of a switching device is configured.

The default priority value of a switching device is 32768.
NOTE
l To configure a switching device as a primary root bridge, you can run the stp root primary command
directly. The priority value of this switching device is 0.
l To configure a switching device as a secondary root bridge, run the stp root secondary command. The
priority value of this switching device is 4096.
A switching device cannot act as a primary root bridge and a secondary root bridge at the same time.
----End
8.2.4 (Optional) Setting the Path Cost for a Port

The STP/RSTP path cost determines root port selection. The port from which to the root port
costs the least is selected as the root port.
Context
A path cost is port-specific, which is used by STP/RSTP as a reference to select a link.
The range of the path cost value is determined by the calculation method. After the calculation
method is determined, you are recommended to set a relatively small path cost value for the port
at a high link rate.
Use the Huawei proprietory calculation method as an example. Different link rates correspond
to default path cost values of ports. For details, see Table 8-5.
Table 8-5 Mappings between link rates and path cost values
Issue 01 (2011-07-15)
Link Rate
Recommended
value
Recommended
Value Range
Value Range
10 Mbit/s
2000
200-20000
1-200000
100 Mbit/s
200
20-2000
1-200000
1 Gbit/s
20
2-200
1-200000
10 Gbit/s
2-20
1-200000
Over 10 Gbit/s
1-2
1-200000

168

On a network where loops occur, you are recommended to set a relatively large path cost for the
port at a low link rate. STP/RSTP puts the port with the large path cost in the Blocking state and
blocks the link where this port resides.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp pathcost-standard { dot1d-1998 | dot1t | legacy }
A path cost calculation method is configured.

By default, the IEEE 802.1t standard method is used to calculate the default path cost.
All switching devices on a network must use the same calculation method for path costs.
Step 3 Run:

Step 4 Run:
stp cost cost
A path cost is set for the port.

l When the Huawei proprietory calculation method is used, cost ranges from 1 to 200000.
l When the IEEE 802.1d standard method is used, cost ranges from 1 to 65535.
l When the IEEE 802.1t standard method is used, cost ranges from 1 to 200000000.
----End
8.2.5 (Optional) Configuring Port Priorities

The lower the numerical value, the more likely the port on a switching device becomes a
designated port; the higher the numerical value, the more likely the port is to be blocked.
Context
Whether a port on a switching device will be selected as a designated port is determined by its
priority. For details, see 8.1.1 STP/RSTP Overview.
If you expect to block a port on a switching device to eliminate loops, set the port priority value
to be larger than the default value when the devices have the same bridge ID and the cost of
path. This port will be blocked in designated port selection.
Procedure
Step 1 Run:
system-view

Issue 01 (2011-07-15)

169

Step 2 Run:

Step 3 Run:
stp port priority priority
The port priority is configured.

The default priority value of a port on a switching device is 128.
----End
8.2.6 Enabling STP/RSTP

After STP/RSTP is enabled, spanning trees are calculated.
Context
After STP/RSTP is enabled on a ring network, STP/RSTP immediately calculates spanning trees
on the network. Configurations on the switching device, such as the switching device priority
and port priority, will affect spanning tree calculation. Any change of the configurations may
cause network flapping. Therefore, to ensure rapid and stable spanning tree calculation, perform
basic configurations on the switching device and its ports and enable STP/RSTP.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp enable
STP/RSTP is enabled on the switching device.

By default, the STP/RSTP function is enabled on a S2700.
----End

After basic STP/RSTP functions are configured, you can view the information such as the port
role and port status to check whether the spanning tree calculation is correctly performed.
Prerequisite
All configurations of basic STP/RSTP functions are complete.
Procedure
l
Run the display stp [ interface interface-typeinterface-number ] [ brief ] command to view

spanning-tree status and statistics.
----End
Issue 01 (2011-07-15)

170

8.3 Configuring STP/RSTP Parameters on an Interface

A feedback mechanism is provided to confirm topology convergence. Thus, rapid convergence
is implemented for RSTP.
STP does not implement rapid convergence; however, STP parameters, such as the network
diameter, hello time, Max Age time, and Forward Delay time, may affect network convergence.
RSTP is a refinement of STP and implements rapid convergence. In addition to the preceding
parameters, such parameters as the type of the link where the port resides, rapid transition
mechanism, and maximum number of sent BPDUs port parameters also affect STP/RSTP
For the parameters of devices running STP/RSTP, see Table 8-6.
Table 8-6 Parameters affecting the STP/RSTP topology convergence
Issue 01 (2011-07-15)
Paramete
r
Parameter
Description
Commands
Description
System
parameter
network
diameter, timer
value (Hello
Time, Forward
Delay period,
Max Age time),
and timeout
period for
waiting for
BPDUs from
the upstream (3
x hello time x
time factor)
l stp bridge-diameter
diameter
It is recommended that you

set the network diameter to
determine the timer value.
The switching device
automatically calculates
the Forward Delay period,
Hello time, and Max Age
time based on the network
diameter. Then, you can
run the stp timer-factor
factor command to set the
timeout period for waiting
for BPDUs from the
upstream (3 x hello time x
time factor).
l stp timer hello hello-time

l stp timer forward-delay
forward-delay
l stp timer max-age max-age
l stp timer-factor factor

171

Paramete
r
Parameter
Description
Commands
Description
Port
parameter
Link type of a
port
l stp point-to-point { auto |

force-false | force-true }
A P2P link helps

implement the rapid
convergence.
l If the port works in fullduplex mode, the link
where the port resides is
a P2P link.
l If the port works in
half-duplex mode, you
can forcibly switch the
link where the port
resides to a P2P link.
l In other cases, you can
enable the port to
automatically
determine whether to
connect to the P2P link.
Port transition
to the RSTP
mode
l stp mcheck
On a switching device
running RSTP, if an
interface is connected to a
device running STP, the
interface automatically
transitions to the STP
mode.
Enabling MCheck on the
interface is required When
the interface fail to
automatically transition to
the RSTP mode.
Maximum
number of
BPDUs sent by
the interface
within each
Hello time
Issue 01 (2011-07-15)
l stp transmit-limit packetnumber

If the maximum number of

BPDUs sent by the
interface within each Hello
time is set properly, the rate
at which BPDUs are sent
can be restricted, which
prevents RSTP from
consuming too many
bandwidths when network
flapping occurs.
172

Paramete
r
Parameter
Description
Commands
Description
Edge ports
l stp edged-port enable
The ports connecting to

terminals do not participate
in STP/RSTP calculation.
If a port is configured as an
edge port, the port does not
participate in STP/RSTP
calculation.
l error-down auto-recovery
cause cause-item interval
interval-value
After BPDU protection is

configured on a switching
device, an edge port is shut
down when receiving
BPDUs. The port can be
configured to
automatically go Up after a
specific delay.

Before configuring parameters affecting STP/RSTP rapid convergence, familiarize yourself
with the applicable environment, complete the pre-configuration tasks, and obtain the required
data. This will help you complete the configuration task quickly and accurately.
On some specific networks, RSTP parameters will affect the speed of network convergence.
Configuring proper RSTP parameters is required.
NOTE
The default configurations of the parameters described in this section help implement RSTP rapid
convergence. Therefore, the configuration process and all involved procedures described in this section
are optional. You can perform some of the configurations as required.
Before configuring STP/RSTP parameters, complete the following task:
l
Configuring basic STP/RSTP functions
Data Preparation
To configure STP/RSTP parameters, you need the following data.
Issue 01 (2011-07-15)
No.
Data
Network diameter
Hello time, forwarding delay time, maximum aging time, and timeout period for
waiting for BPDUs from the upstream (3 x hello time x time factor)
Link type of a port

173

No.
Data
Whether a port is enabled with rapid transition mechanism
Whether a port needs to transition to the RSTP mode
Maximum number of sent BPDUs
Whether a port needs to be configured as an edge port
Whether auto recovery needs to be configured for an edge port being shut down
Whether a port needs to clear statistics of the spanning tree
10
Whether an edge port needs to be configured as a BPDU filter
8.3.2 Setting System Parameters

STP/RSTP parameters that may affect network convergence include the network diameter, hello
time, and timeout period for waiting for BPDUs from the upstream (3 x hello time x time factor).
Therefore, STP/RSTP parameters need to be set properly to help implement rapid network
convergence.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp bridge-diameter diameter
The network diameter is configured.

By default, the network diameter is 7.
l RSTP uses a single spanning tree instance on the entire network, which cannot prevent the
performance from deteriorating when the network scale grows. Therefore, the network
diameter cannot be larger than 7.
l It is recommended that you run the stp bridge-diameter diameter command to set the
network diameter. Then, the switching device calculates the optimal Forward Delay period,
Hello time, and Max Age period based on the set network diameter.
Step 3 Run:
stp timer-factor factor
The timeout period for waiting for BPDUs from the upstream of a switching device is set.
By default, the timeout period of a switching device is 9 times as long as the Hello time.
Step 4 (Optional) To set the Forward Delay period, Hello time, and Max Age period, perform the
following operations:
l Run the stp timer forward-delay forward-delay command to set the Forward Delay period
for a switching device.
Issue 01 (2011-07-15)

174

The default Forward Delay period of a switching device is 1500, in centiseconds.

l Run the stp timer hello hello-time command to set the Hello time for a switching device.
The default Hello time of a switching device is 200, in centiseconds.
l Run the stp timer max-age max-age command to set the Max Age period for a switching
device.
The default Max Age period of a switching device is 2000, in centiseconds.
NOTE
The values of the Hello time, Forward Delay period, and Max Age period must comply with the following
formulas. Otherwise, networking flapping occurs.
l 2 (Forward Delay - 1.0 second) >= Max Age
l Max Age >= 2 (Hello Time + 1.0 second)
----End
8.3.3 Setting Port Parameters

Port parameters that may affect RSTP topology convergence include the link type and maximum
number of sent BPDUs. Proper port parameters help RSTP to implement rapid topology
convergence.
Procedure
Step 1 Run:
system-view

Step 2 Run:

stp point-to-point { auto | force-false | force-true }
The link type is configured for a port.

By default, a port automatically determines whether to connect to a P2P link. The P2P link
supports rapid network convergence.
l If the Ethernet port works in full-duplex mode, the port is connected to a P2P link. In this
case, force-true can be configured to implement rapid network convergence.
l If the Ethernet port works in half-duplex mode, you can configure stp point-to-point forcetrue to forcibly set the link type to P2P to implement rapid network convergence.
Step 4 Run:
stp mcheck
MCheck is enabled.
On a switching device running RSTP, if a port is connected to a device running STP, the port
automatically transitions to the STP interoperable mode.
Enabling MCheck on the port is required because the port may fail to automatically transition
to the RSTP mode in the following situations:
Issue 01 (2011-07-15)

175

l The switching device running STP is shut down or moved.

l The switching device running STP transitions to the RSTP mode.
NOTE
If you run the stp mcheck command in the system view, the MCheck operation is performed on all the
interfaces.
Step 5 Run:
stp transmit-limit packet-number
The maximum number of BPDUs sent by a port within each Hello time is set.
By default, the maximum number of BPDUs that a port sends within each Hello time is 51.
stp edged-port enable
The port is configured as an edge port.

If a device port is connected to a terminal, you can run this command to configure the port as
an edge port.
By default, the port is a non-edge port.
Step 7 Run:
quit

error-down auto-recovery cause cause-item interval interval-value
The auto recovery function on an edge port is configured. That is, enable the port in the errordown state to automatically go Up, and set the delay for the transition from Down to Up.
There is no default value for the recovery time. Therefore, you must specify a delay when
configuring this command.
----End
Follow-up Procedure
When the topology of a spanning tree changes, the forwarding paths to associated VLANs are
changed. Then, ARP entries corresponding to those VLANs on the switching device need to be
updated. STP/RSTP processes ARP entries in either fast or normal mode.
l
In fast mode, ARP entries to be updated are directly deleted.
In normal mode, ARP entries to be updated are rapidly aged.

The remaining lifetime of ARP entries to be updated is set to 0. The switching device rapidly
processes these aged entries. If the number of ARP aging probe attempts is not set to 0,
ARP implements aging probe for these ARP entries.
In either fast or normal mode, MAC entries are directly deleted.
You can run the stp converge { fast | normal } command in the system view to configure the
STP/RSTP convergence mode.
By default, the STP/RSTP convergence is configured as normal.
Issue 01 (2011-07-15)

176

NOTE
The normal mode is recommended. If the fast mode is adopted, ARP entries will be frequently deleted,
causing the CPU usage on the MPU or LPU to reach 100%. As a result, network flapping frequently occurs.

You can verify that the configurations take effect after configuring STP/RSTP parameters that
affect the topology convergence.
Prerequisite
The parameters that affect the topology convergence have been configured.
Procedure
l
Run the display stp [ interface interface-type interface-number ] [ brief ] command to

view spanning-tree status and statistics.
----End
8.4 Configuring RSTP Protection Functions

RSTP protection functions are as follows, and you can configure one or more functions as
required.

Before configuring RSTP protection functions, familiarize yourself with the applicable
RSTP provides the following protection functions, as listed in Table 8-7.
Table 8-7 RSTP Protection Function
Issue 01 (2011-07-15)
Protection
Function
Scenario
BPDU
protection
An edge port changes to be a

non-edge port after
keeps sending bogus BPDUs
to a switching device,
network flapping occurs.

switching device, the switching device shuts
down the edge port if the edge port receives
an RST BPDU, and notifies the NMS of the
shutdown event. The attributes of the edge
port are not changed.

177

Protection
Function
Scenario
TC protection

advertising network
delete MAC entries and ARP
entries. Frequent deletion
operations will exhaust CPU
resources.
TC protection is used to suppress TC-BPDUs.

The number of times that TC-BPDUs are
processed by a switching device within a
given time period is configurable. If the
number of TC-BPDUs that the switching
device receives within a given time exceeds
the specified threshold, the switching device
handles TC-BPDUs only for the specified
number of times. Excess TC-BPDUs are
processed by the switching device as a whole
for once after the timer (that is, the specified
time period) expires. This protects the
switching device from frequently deleting
MAC entries and ARP entries, thus avoiding
over-burdened.
Root
protection
Due to incorrect
configurations or malicious
attacks on the network, a
root bridge may receive
BPDUs with a higher
priority. Consequently, the
root bridge, and the network
topology is illegitimately
changed, triggering
spanning tree recalculation.
This may transfer traffic
from high-speed links to
low-speed links, causing
traffic congestion.
If a designated port is enabled with the root

protection function, the role of the port cannot
be changed. Once a designated port that is
enabled with root protection receives RST
BPDUs with a higher priority, the port enters
the Discarding state and does not forward
packets. If the port does not receive any RST
BPDUs with a higher priority before a period
(generally two Forward Delay periods)
expires, the port automatically enters the
Forwarding state.
Loop
protection

congestion or a one-way link
failure occurs. After the root
port ages, a switching device
may re-select a root port
enters the Forwarding state.
Loops may occur in such a
situation.
After loop protection is configured, if the root

port or alternate port does not receive RST
BPDUs from the upstream switching device
for a long time, the switching device notifies
the NMS that the port enters the Discarding
state. The blocked port remains in the
Blocked state and no longer forwards packets.
This prevents loops on the network. The root
port restores the Forwarding state after
receiving new BPDUs.
Before configuring basic RSTP functions, complete the following task:
Issue 01 (2011-07-15)

178

Configuring basic RSTP functions

NOTE
Configuring an edge port on the switching device before configuring BPDU protection.
Data Preparation
To configure basic RSTP functions, you need the following data.
No.
Data
Number of the port on which root protection is to be enabled
Number of the port on which loop protection is to be enabled
8.4.2 Configuring BPDU Protection on a Switching Device

After BPDU protection is enabled on a switching device, the switching device shuts down an
edge port if the edge port receives a BPDU, and notifies the NMS of the shutdown event.
Context
Edge ports are directly connected to user terminals and normally, the edge ports will not receive
BPDUs. Some attackers may send pseudo BPDUs to attach the switching device. If the edge
ports receive the BPDUs, the switching device automatically configures the edge ports as nonedge ports and triggers new spanning tree calculation. Network flapping then occurs. BPDU
protection can be used to protect switching devices against malicious attacks.
NOTE
Do as follows on a switching device having an edge port:
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp bpdu-protection
BPDU protection is enabled on the switching device.

By default, BPDU protection is not enabled on the switching device.
----End
Follow-up Procedure
To allow an edge port to automatically start after being shut down, you can run the error-down
auto-recovery cause cause-item interval interval-value command to configure the auto
recovery function and set the delay on the port. After the delay expires, the port automatically
goes Up. interval interval-value ranges from 30 to 86400, in seconds. Note the following when
setting this parameter:
Issue 01 (2011-07-15)

179

The smaller the interval-value is set, the sooner the edge port becomes Up, and the more
frequently the edge port alternates between Up and Down.
The larger the interval-value is set, the later the edge port becomes Up, and the longer the
service interruption lasts.
8.4.3 Configuring TC Protection on a Switching Device

After TC protection is enabled, you can set the number of times for a switching device to process
TC BPDUs within a given time. TC protection avoids frequent deletion of MAC address entries
and ARP entries, thereby protecting switching devices.
Context
An attacker may send pseudo TC BPDUs to attack switching devices. Switching devices receive
a large number of TC BPDUs in a short time and delete entries frequently, which burdens system
processing and degrades network stability.
TC protection is used to suppress TC BPDUs. The number of times that TC BPDUs are processed
by a switching device within a given time period is configurable. If the number of TC BPDUs
that the switching device receives within a given time exceeds the specified threshold, the
switching device handles TC BPDUs only for the specified number of times. Excess TC-BPDUs
are processed by the switching device as a whole for once after the specified time period expires.
This protects the switching device from frequently deleting MAC entries and ARP entries, thus
avoiding overburden.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp tc-protection
TC protection is enabled for a switching device.

By default, TC protection is enabled on the switching device.
Step 3 Run:
stp tc-protection threshold threshold
The threshold of the number of times the switching device handles the received TC BPDUs and
updates forwarding entries within a given time is set.
NOTE
The value of the given time is consistent with the RSTP Hello time set by using the stp timer hello hellotime command.
----End
8.4.4 Configuring Root Protection on a Port

The root protection function on a switching device protects a root bridge by preserving the role
of a designated port.
Issue 01 (2011-07-15)

180

Context
Due to incorrect configurations or malicious attacks on the network, a root bridge may receive
BPDUs with a higher priority. Consequently, the legitimate root bridge is no longer able to serve
as the root bridge, and the network topology is incorrectly changed, triggering spanning tree
recalculation. This also may cause the traffic that should be transmitted over high-speed links
to be transmitted over low-speed links, leading to network congestion. The root protection
function on a switching device is used to protect the root bridge by preserving the role of the
designated port.
NOTE
Root protection is configured on a designated port. Root protection takes effect only on a designated port.
Do as follows on the root bridge.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
stp root-protection
Root protection is configured on the switching device.

By default, root protection is disabled.
----End
8.4.5 Configuring Loop Protection on a Port

The loop protection function suppresses the loops caused by link congestion.
Context
On a network running RSTP, a switching device maintains the root port status and status of
blocked ports by receiving BPDUs from an upstream switching device. If the switching device
cannot receive BPDUs from the upstream because of link congestion or unidirectional-link
failure, the switching device re-selects a root port. The original root port becomes a designated
port and the original blocked ports change to the Forwarding state. This may cause network
loops. To address such a problem, configure loop protection.
After loop protection is configured, if the root port or alternate port does not receive BPDUs
from the upstream switching device, the root port is blocked and the switching device notifies
the NMS that the port enters the Discarding state. The blocked port remains in the Blocked state
and no longer forwards packets. This prevents loops on the network. The root port restores the
Forwarding state after receiving new BPDUs.
Issue 01 (2011-07-15)

181

NOTE
An alternate port is a backup port of a root port. If a switching device has an alternate port, you need to
configure loop protection on both the root port and the alternate port.
Do as follows on a root port and an alternate port on a switching device.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
stp loop-protection
Loop protection for the root port or the alternate port is configured on the switching device.
By default, loop protection is disabled.
----End

After RSTP protection functions are configured, you can verify that the configurations take
effect.
Prerequisite
All configurations of RSTP protection functions are complete.
Procedure
l

view the status of a spanning tree, including the status of protection functions on a switching
device
----End
8.5 Configuring STP/RSTP Interoperability Between

Huawei Devices and Non-Huawei Devices
To supports STP/RSTP interoperability between Huawei devices and non-Huawei devices,
proper parameters are required on Huawei devices running STP/RSTP to ensure nonstop
communication.

Before configuring STP/RSTP interoperability between Huawei devices and non-Huawei
devices, familiarize yourself with the applicable environment, complete the pre-configuration
Issue 01 (2011-07-15)

182

tasks, and obtain the required data. This will help you complete the configuration task quickly
and accurately.
On a network running STP/RSTP, inconsistent protocol packet formats and BPDU keys may
lead to a communication failure. Configuring proper STP/RSTP parameters on Huawei devices
ensures interoperability between Huawei devices and non-Huawei devices.
Before configuring STP/RSTP interoperability between Huawei devices and non-Huawei
devices, complete the following task:
l
Configuring basic STP/RSTP functions
Data Preparation
To configure STP/RSTP interoperability between Huawei devices and non-Huawei devices, you
need the following data.
No.
Data
BPDU format
8.5.2 Configuring the Proposal/Agreement Mechanism

To enable Huawei Datacom devices to communicate with non-Huawei devices, a proper rapid
transition mechanism needs to be configured on Huawei devices based on the Proposal/
Agreement mechanism on non-Huawei devices.
Context
The rapid transition mechanism is also called the Proposal/Agreement mechanism. Switching
devices currently support the following modes:
l
Enhanced mode: The current interface counts a root port when it counts the synchronization
flag bit.
An upstream device sends a Proposal message to a downstream device, requesting rapid
status transition. After receiving the message, the downstream device sets the port
connected to the upstream device to a root port and blocks all non-edge ports.
The upstream device then sends an Agreement message to the downstream device. After
the downstream device receives the message, the root port transitions to the Forwarding
state.
The downstream device responds the Proposal message with an Agreement message.
After receiving the message, the upstream device sets the port connected to the
downstream device as a designated port. The designated port then transitions to the
Forwarding state.
Issue 01 (2011-07-15)
Common mode: The current interface ignores the root port when it counts the
synchronization flag bit.
183


connected to the upstream device to a root port and blocks all non-edge ports. The root
port then transitions to the Forwarding state.
The downstream device responds the Proposal message with an Agreement message.
Forwarding state.
When Huawei datacom devices are interworking with non-Huawei devices, select either mode
depending on the Proposal/Agreement mechanisms on non-Huawei devices.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
stp no-agreement-check
The common rapid transition mechanism is configured.

By default, the interface uses the enhanced rapid transition mechanism.
----End

After MSTP parameters are configured for the interoperability between Huawei devices and
non-Huawei devices, you can verify that the configurations take effect.
Prerequisite
Parameters have been configured to ensure MSTP interoperability between Huawei devices and
non-Huawei devices.
Procedure
l

view spanning-tree status.
----End
8.6 Maintaining STP/RSTP

STP/RSTP maintenance includes resetting STP/RSTP statistics.
Issue 01 (2011-07-15)

184

8.6.1 Clearing STP/RSTP Statistics

You can run the reset commands to reset STP/RSTP statistics to 0.
Context
CAUTION
STP/RSTP statistics cannot be restored after you clear them. Therefore, exercise caution when
using the reset commands.
After you confirm that STP/RSTP statistics need to be cleared, run the following command in
the user view.
Procedure
Step 1 Run the reset stp [ interface interface-type interface-number ] statistics command to clear
spanning-tree statistics.
----End

This section shows typical usage scenarios of STP/RSTP by describing networking
requirements, configuration roadmap, and data preparation, and provides related configuration
files.
8.7.1 Example for Configuring Basic STP Functions

This example shows how to configure basic STP functions.
situation.
network. Loops also cause flapping of MAC address tables and damages MAC address entries.
STP can be deployed on a network to eliminate loops by blocking some ports. On the network
shown in Figure 8-3, after SwitchA, SwitchB, SwitchC, and SwitchD running STP discover
loops on the network by exchanging information with each other, they trim the ring topology
into a loop-free tree topology by blocking a certain port. In this manner, replication and circular
propagation of packets are prevented on the network and the switching devices are released from
processing duplicated packets, thereby improving their processing performance.
Issue 01 (2011-07-15)

185

Figure 8-3 Networking diagram of configuring basic STP functions
Network
Eth0/0/3
SwitchD
Eth0/0/3
Root
Eth0/0/1 Eth0/0/1
Bridge
Eth0/0/2 SwitchA
Eth0/0/2
STP
Eth0/0/3
Eth0/0/3
SwitchC
Eth0/0/1
SwitchB
Eth0/0/1
Eth0/0/2
Eth0/0/2
PC1
PC2
Blocked port
1.
Configure basic STP functions, including:

(1) Configure the STP mode for the ring network.
(2) Configure primary and secondary root bridges.
(3) Set path costs for ports to block certain ports.
(4) Enable STP to eliminate loops.
NOTE
STP is not required on the interfaces connected to terminals because these interfaces do not
need to participate in STP calculation.
Data Preparation
l
EthInterface number, as shown in Figure 8-3
Primary root bridge SwitchA and secondary root bridge SwitchD
Path cost of a port to be blocked (20000 is used in this example)
Issue 01 (2011-07-15)

186

Procedure
Step 1 Configure basic STP functions.
1.
Configure the STP mode for the devices on the ring network.
# Configure the STP mode on SwitchA.
[SwitchA] stp mode stp
# Configure the STP mode on SwitchB.

[SwitchB] stp mode stp
# Configure the STP mode on SwitchC.

[SwitchC] stp mode stp
# Configure the STP mode on SwitchD.

[SwitchD] stp mode stp
2.
Configure primary and secondary root bridges.

# Configure SwitchA as a primary root bridge.
[SwitchA] stp root primary
# Configure SwitchD as a secondary root bridge.

[SwitchD] stp root secondary
3.
Set path costs for ports in each spanning tree to block certain ports.
NOTE
l The values of path costs depend on path cost calculation methods. Use the Huawei proprietary
calculation method as an example to set the path costs of the ports to be blocked to 20000.
l All switching devices on a network must use the same path cost calculation method.
# Set the path cost of Eth0/0/1 on SwitchC to 20000.

[SwitchC-Ethernet0/0/1] stp cost 20000
4.
Enable STP to eliminate loops.

l Disable STP on interfaces connected to PCs.
# Disable STP on Eth 0/0/2 on SwitchB.
[SwitchB-Ethernet0/0/2] stp disable
# Disable STP on Eth 0/0/2 on SwitchC.

[SwitchC-Ethernet0/0/2] stp disable
l Enable STP globally.

# Enable STP globally on SwitchA.
[SwitchA] stp enable
# Enable STP globally on SwitchB.

[SwitchB] stp enable
Issue 01 (2011-07-15)

187

# Enable STP globally on SwitchC.

[SwitchC] stp enable
# Enable STP globally on SwitchD.

[SwitchD] stp enable
[SwitchD] bpdu enable

After the previous configurations, run the following commands to verify the configuration when
the network is stable:
# Run the display stp brief command on SwitchA to view the interface status and protection
type. The displayed information is as follows:
[SwitchA] display stp brief
MSTID Port
0
Ethernet0/0/1
0
Ethernet0/0/2
Role STP State

DESI FORWARDING
DESI FORWARDING
Protection
NONE
NONE
After SwitchA is configured as a root bridge, Eth 0/0/2 and Eth 0/0/1 connected to SwitchB and
SwitchD respectively are elected as designated ports in spanning tree calculation.
# Run the display stp interface ethernet 0/0/1 brief command on SwitchB to view status of
Eth 0/0/1. The displayed information is as follows:
[SwitchB] display stp interface ethernet 0/0/1 brief
MSTID Port
Role STP State
0
Ethernet0/0/1
DESI FORWARDING
Protection
NONE
Eth 0/0/1 is elected as a designated port in spanning tree calculation and is in the Forwarding
state.
# Run the display stp brief command on SwitchC to view the interface status and protection
[SwitchC] display stp brief
MSTID Port
0
Ethernet0/0/1
0
Ethernet0/0/3
Role STP State

ALTE DISCARDING
ROOT FORWARDING
Protection
NONE
NONE
Eth 0/0/1 is elected as an alternate port in spanning tree calculation and is in the Discarding state.
Eth 0/0/3 is elected as a root port in spanning tree calculation and is in the Forwarding state.
----End
Configuration Files
l

#
sysname
SwitchA
#
stp mode
stp
stp instance 0 root
primary
#
return
l
Issue 01 (2011-07-15)

188

#
sysname
SwitchB
#
stp mode
stp
#
stp disable
#
return

#
sysname
SwitchC
#
stp mode
stp
#
stp instance 0 cost
20000
#
stp disable
#
return

#
sysname
SwitchD
#
stp mode
stp
stp instance 0 root
secondary
#
return
8.7.2 Example for Configuring Basic RSTP Functions

This example describes how to configure basic RSTP functions.
On a complex network, loops often occur. To implement network redundancy backup, network
designers tend to deploy multiple physical links between two devices, one of which is the master
device and the others are backup devices. Loops are likely or bound to occur in such a situation.
Loops will cause broadcast storms, exhausting network resources and making the network break
down. Loops also cause flapping of MAC address tables and damage MAC address entries.
RSTP can be deployed on a network to eliminate loops by blocking some ports. On the network
shown in Figure 8-4, after SwitchA, SwitchB, SwitchC, and SwitchD running RSTP detect
loops on the network by exchanging information with each other, they trim the ring topology
into a loop-free tree topology by blocking a certain port. In this manner, packets are not replicated
and looped on the network and switching devices do not need to process duplicate packets,
improving their processing performance.
Issue 01 (2011-07-15)

189

Figure 8-4 Networking diagram of basic RSTP functions
Network
Eth0/0/3
SwitchD
Eth0/0/3
Root
Eth0/0/1 Eth0/0/1
Bridge
Eth0/0/2 SwitchA
Eth0/0/2
RSTP
Eth0/0/3
Eth0/0/3
SwitchC
Eth0/0/1
SwitchB
Eth0/0/1
Eth0/0/2
Eth0/0/2
PC1
PC2
Blocked port
1.
Configure basic RSTP functions, including:

(1) Configure the RSTP mode for the ring network.
(2) Configure primary and secondary root bridges.
(3) Set path costs for ports in each MSTI to block certain ports.
(4) Enable RSTP to eliminate loops.
NOTE
RSTP is not required on the interfaces connected to terminals because these interfaces do not
need to participate in RSTP calculation.
2.
Configure RSTP protection functions, for example, root protection on a designated port of
a root bridge in each MSTI.
Data Preparation
l
Eth interface number, as shown in Figure 8-4
Primary root bridge SwitchA and secondary root bridge SwitchD
Issue 01 (2011-07-15)

190

Path cost of a port to be blocked (20000 is used in this example)
Procedure
Step 1 Configure basic RSTP functions.
1.
Configure the RSTP mode for the devices on the ring network.
# Configure the RSTP mode on SwitchA.
[SwitchA] stp mode rstp
# Configure the RSTP mode on SwitchB.

[SwitchB] stp mode rstp
# Configure the RSTP mode on SwitchC.

[SwitchC] stp mode rstp
# Configure the RSTP mode on SwitchD.

[SwitchD] stp mode rstp
2.
Configure primary and secondary root bridges.

# Configure SwitchA as a primary root bridge.
[SwitchA] stp root primary
# Configure SwitchD as a secondary root bridge.

[SwitchD] stp root secondary
3.
Set path costs for ports to block certain ports.

NOTE
l The values of path costs depend on path cost calculation methods. Use the Huawei proprietary
calculation method as an example to set the path costs of the ports to be blocked to 20000.
l All switching devices on a network must use the same path cost calculation method.
# Set the path cost of Eth0/0/1 on SwitchC to 20000.

[SwitchC-Ethernet0/0/1] stp cost 20000
4.
Enable RSTP to eliminate loops.

l Disable RSTP on interfaces connected to PCs.
# Disable RSTP on Eth 0/0/2 on SwitchB.
[SwitchB-Ethernet0/0/2] stp disable
# Disable RSTP on Eth 0/0/2 on SwitchC.

[SwitchC-Ethernet0/0/2] stp disable
l Enable RSTP globally.

# Enable RSTP globally on SwitchA.
Issue 01 (2011-07-15)

191

# Enable RSTP globally on SwitchB.

# Enable RSTP globally on SwitchC.

# Enable RSTP globally on SwitchD.

Step 2 Configure RSTP protection functions.

# Enable root protection on Eth 0/0/1 on SwitchA.
[SwitchA-Ethernet0/0/1] stp root-protection
# Enable root protection on Eth 0/0/2 on SwitchA.


After the previous configurations, run the following commands to verify the configuration when
the network is stable:
# Run the display stp brief command on SwitchA to view the interface status and protection
[SwitchA] display stp brief
MSTID Port
0
Ethernet0/0/1
0
Ethernet0/0/2
Role STP State

DESI FORWARDING
DESI FORWARDING
Protection
ROOT
ROOT
After SwitchA is configured as a root bridge, Eth 0/0/2 and Eth 0/0/1 connected to SwitchB and
SwitchD respectively are elected as designated ports in spanning tree calculation. The root
protection function is enabled on the designated ports.
# Run the display stp interface ethernet 0/0/1 brief command on SwitchB to view status of
Eth 0/0/1. The displayed information is as follows:
[SwitchB] display stp interface ethernet 0/0/1 brief
MSTID Port
Role STP State
0
Ethernet0/0/1
DESI FORWARDING
Protection
NONE
Eth 0/0/1 is elected as a designated port in spanning tree calculation and is in the Forwarding
state.
# Run the display stp brief command on SwitchC to view the interface status and protection
[SwitchC] display stp brief
MSTID Port
0
Ethernet0/0/1
0
Ethernet0/0/3
Role STP State

ALTE DISCARDING
ROOT FORWARDING
Protection
NONE
NONE
Eth 0/0/1 is elected as an alternate port in spanning tree calculation and is in the Discarding state.
Eth 0/0/3 is elected as a root port in spanning tree calculation and is in the Forwarding state.
----End
Issue 01 (2011-07-15)

192

Configuration Files
l

#
sysname SwitchA
#
stp mode
rstp
stp instance 0 root
primary
#
stp rootprotection
#
stp rootprotection
#
return

#
sysname SwitchB
#
stp mode
rstp
#
stp disable
#
return

#
sysname SwitchC
#
stp mode
rstp
#
stp instance 0 cost
20000
#
stp disable
#
return

#
sysname SwitchD
#
stp mode
rstp
stp instance 0 root
secondary
#
return
Issue 01 (2011-07-15)

193

9 MSTP Configuration
MSTP Configuration
About This Chapter

The Multiple Spanning Tree Protocol (MSTP) trims a ring network into a loop-free tree network.
It prevents replication and circular propagation of packets, provides multiple redundant paths
for Virtual LAN (VLAN) data traffic, and enables load balancing.
9.1 MSTP Overview
MSTP enables multiple VLANs to be grouped into a spanning-tree instance, forming a VLAN
mapping table. Each instance has a spanning-tree topology independent of other spanning-tree
instances. This architecture provides multiple forwarding paths for data traffic and enables load
balancing.
9.2 Configuring Basic MSTP Functions
MSTP based on the basic STP/RSTP function divides a switching network into multiple regions,
each of which has multiple spanning trees that are independent of each other. MSTP isolates
user traffic and service traffic, and load-balances VLAN traffic.
9.3 Configuring MSTP Parameters on an Interface
MSTP implements RSTP rapid convergence. To achieve rapid convergence, you need to
configure proper MSTP parameters.
9.4 Configuring MSTP Protection Functions
MSTP protection functions are as follows, and you can configure one or more functions as
required.
9.5 Configuring MSTP Interoperability Between Huawei Devices and Non-Huawei Devices
To enable Huawei devices to interwork with non-Huawei devices, configure proper parameters
and functions, including the BPDU format, MSTP protocol packet format, and digest snooping
function, on the Huawei devices running MSTP.
9.6 Maintaining MSTP
MSTP maintenance includes resetting MSTP statistics.
This section provides a configuration example of MSTP.
Issue 01 (2011-07-15)

194

9.1 MSTP Overview

MSTP enables multiple VLANs to be grouped into a spanning-tree instance, forming a VLAN
mapping table. Each instance has a spanning-tree topology independent of other spanning-tree
instances. This architecture provides multiple forwarding paths for data traffic and enables load
balancing.
9.1.1 MSTP Introduction

The Multiple Spanning Tree Protocol (MSTP) incorporates the functions of the Spanning Tree
Protocol (STP) and Rapid Spanning Tree Protocol (RSTP), and outperforms them. It enables
rapid convergence and provides load balancing across redundant paths.
Background
STP and RSTP are used in a LAN to prevent loops. The devices running STP/RSTP discover
loops on the network by exchanging information with each other and trim the ring topology into
a loop-free tree topology by blocking a certain interface. Replication and circular propagation
of packets are thus prevented on the network and the processing performance of devices is
improved by avoiding repeated packets on the network.
STP and RSTP both have a defect: All VLANs on a LAN use one spanning tree, and thus interVLAN load balancing cannot be performed. Once a link is blocked, the link will no longer
transmit traffic, wasting bandwidth and causing a failure in forwarding certain VLAN packets.
To fix the defect of STP and RSTP, the IEEE released the 802.1s standard in 2002, defining
MSTP. MSTP compatible with STP and RSTP implements rapid convergence and provides
multiple paths to load balance VLAN traffic.
Table 9-1 shows the comparison between STP, RSTP, and MSTP.
Issue 01 (2011-07-15)

195

Table 9-1 Comparison between STP, RSTP, and MSTP

Spanning Tree
Protocols
Characteristics
Application
Scenarios
Precautions
STP
A loop-free tree is generated.

Thus, broadcast storms are
prevented and redundancy is
implemented.
Irrespective of
different users or
services, all
VLANs share one
spanning tree.
NOTE
RSTP
l A loop-free tree is
generated. Thus,
prevented and redundancy
is implemented.
l A feedback mechanism is
provided to confirm
Thus, rapid convergence
is implemented.
MSTP
l A loop-free tree or some

loop-free trees are
generated. Thus,
prevented and redundancy
is implemented.
l A feedback mechanism is
provided to confirm
Thus, rapid convergence
is implemented.
l MSTP implements load
balancing among VLANs.
Traffic in different
VLANs is transmitted
along different paths.
User or servicespecific load

balancing is
required. Traffic
for different
VLANs is
forwarded
through different
spanning trees,
which are
independent of
each other.
l If the current
switching
device
supports
only STP,
STP is
recommende
d. For
details, see
STP/RSTP
Configurati
on.
l If the current
switching
device
supports
both STP
and RSTP,
RSTP is
recommende
d. For
details, see
STP/RSTP
Configurati
on.
l If the current
switching
device
supports
STP or
RSTP, and
MSTP,
MSTP is
recommende
d.
Introduction
situation.
entries.
MSTP, compatible with STP and RSTP, isolates service traffic and user traffic by using multiple
instances and provides multiple paths to load balance VLAN traffic.
Issue 01 (2011-07-15)

196

If MSTP is deployed in the LAN shown in Figure 9-1, MSTIs are generated, as shown in Figure
9-1.
Figure 9-1 Multiple spanning trees in an MST region
SwitchD
SwitchA
VLAN3
VLAN2
VLAN2
VLAN2
VLAN3
VLAN3
Host C
(VLAN3)
Host A
(VLAN2)
SwitchB
SwitchE
VLAN2
Host B
(VLAN2)
VLAN2
VLAN2
VLAN3
VLAN2
VLAN3
Host D
(VLAN3)
VLAN3
SwitchC
VLAN3
SwitchF
MSTI1 (root switch: SwitchD)

MSTI2 (root switch: SwitchF)
VLAN2 --> MSTI1

VLAN3 --> MSTI2
MSTI 1 uses Switch D as the root switching device to forward packets of VLAN 2.
MSTI 2 uses Switch F as the root switching device to forward packets of VLAN 3.
Devices within the same VLAN can communicate with each other and packets of different
VLANs are load-balanced along different paths.
Basic MSTP Concepts

l
MST region
An MST region contains multiple switching devices and network segments between them.
The switching devices have the following characteristics:
MSTP-enabled
Same region name
Same VLAN-to-instance mapping
Same MSTP revision number
A LAN can comprise several MST regions that are directly or indirectly connected.
Multiple switching devices can be grouped into an MST region by using MSTP
configuration commands.
As shown in Figure 9-2, the MST region D0 contains the switching devices S1, S2, S3,
and S4, and has three MSTIs.
Issue 01 (2011-07-15)

197

Figure 9-2 MST region

AP1
D0
Master Bridge
MSTI1
root switch:S3
S1
MSTI2
root switch:S2
S2
S3
S4
MSTI0 (IST)
root switch:S1
VLAN1
MSTI1
VLAN2,VLAN3 MSTI2
other VLANs MSTI0
VLAN mapping table

The VLAN mapping table is an attribute of the MST region. It describes mappings between
VLANs and MSTIs.
Figure 9-2 shows the mappings in the VLAN mapping table of the MST region D0:
VLAN 1 is mapped to MSTI 1.
VLAN 2 and VLAN 3 are mapped to MSTI 2.
Other VLANs are mapped to MSTI 0.
Regional root
Regional roots are classified into Internal Spanning Tree (IST) and MSTI regional roots.
In the region B0, C0, and D0 on the network shown in Figure 9-4, the switching devices
closest to the Common and Internal Spanning Tree (CIST) root are IST regional roots.
An MST region can contain multiple spanning trees, each called an MSTI. An MSTI
regional root is the root of the MSTI. On the network shown in Figure 9-3, each MSTI has
its own regional root.
Issue 01 (2011-07-15)

198

Figure 9-3 MSTI
MST Region
VLA
N
VLAN
10&20&30
10&
20
VLAN 20&30
VLAN
10&30
VLAN
30
VLAN
20
VLAN
10&30
VLAN 10
Root
Root
MSTI
corresponding to
VLAN 10
MSTI
corresponding to
VLAN 20
MSTI Root
corresponding to
VLAN 30
MSTI links
MSTI links blocked by the protocol
MSTIs are independent of each other. An MSTI can correspond to one or more VLANs,
but a VLAN can be mapped to only one MSTI.
l
Issue 01 (2011-07-15)
CIST root

199

Figure 9-4 MSTP network
A0
CIST Root
D0
Region Root
B0
Region Root
C0
Region Root
IST
CST
On the network shown in Figure 9-4, the CIST root is the root bridge of a CIST. The CIST
root is a device in A0.
l
CST
A Common Spanning Tree (CST) connects all the MST regions on a switching network.
Each MST region can be considered a node. A CST is calculated by using STP or RSTP
based on all the nodes.
As shown in Figure 9-4, the MST regions are connected to form a CST.
IST
An IST resides within an MST region.
An IST is a special MSTI with the MSTI ID of 0, called MSTI 0.
An IST is a segment of the CIST in an MST region.
As shown in Figure 9-4, the switching devices in an MST region are connected to form an
IST.
CIST
A CIST, calculated by using STP or RSTP, connects all the switching devices on a switching
network.
As shown in Figure 9-4, the ISTs and the CST form a complete spanning tree, that is, CIST.
SST
A Single Spanning Tree (SST) is formed in either of the following situations:
Issue 01 (2011-07-15)

200

A switching device running STP or RSTP belongs to only one spanning tree.
An MST region has only one switching device.
As shown in Figure 9-4, the switching device in B0 is an SST.
l
Port roles
Compared with RSTP, MSTP has two additional port types. MSTP ports can be root ports,
designated ports, alternate ports, backup ports, edge ports, master ports, and regional edge
ports.
The functions of root ports, designated ports, alternate ports, backup ports, and edge ports
have been defined in RSTP. Table 9-2 lists all port roles in MSTP.
NOTE
Except edge ports, all ports participate in MSTP calculation.

A port can play different roles in different MSTIs.
Table 9-2 Port roles

Port
Roles
Description
Root port
A root port is the non-root bridge port closest to the root bridge. Root bridges
do not have root ports.
Root ports are responsible for sending data to root bridges.
As shown in Figure 9-5, S1 is the root; CP1 is the root port on S3; BP1 is
the root port on S2; DP1 is the root port on S4.
Designat
ed port
The designated port on a switching device forwards bridge protocol data

units (BPDUs) to the downstream switching device.
As shown in Figure 9-5, AP2 and AP3 are designated ports on S1; BP2 is
a designated port on S2; CP2 is a designated port on S3.
Alternate
port
l From the perspective of sending BPDUs, an alternate port is blocked after

a BPDU sent by another switching devices is received.
l From the perspective of user traffic, an alternate port provides an
alternate path to the root bridge. This path is different than using the root
port.
As shown in Figure 9-5, BP2 and AP4 are alternate ports.
Backup
port
l From the perspective of sending BPDUs, a backup port is blocked after

a BPDU sent by itself is received.
l From the perspective of user traffic, a backup port provides a backup/
redundant path to a segment where a designated port already connects.
As shown in Figure 9-5, CP3 is a backup port.
Issue 01 (2011-07-15)

201

Port
Roles
Description
Master
port
A master port is on the shortest path connecting MST regions to the CIST
root.
BPDUs of an MST region are sent to the CIST root through the master port.
Master ports are special regional edge ports, functioning as root ports on
ISTs or CISTs and master ports in instances.
As shown in Figure 9-5, S1, S2, S3, and S4 form an MST region. AP1 on
S1, being the nearest port in the region to the CIST root, is the master port.
Regional
edge port
A regional edge port is located at the edge of an MST region and connects
to another MST region or an SST.
During MSTP calculation, the roles of a regional edge port in the MSTI and
the CIST instance are the same. If the regional edge port is the master port
in the CIST instance, it is the master port in all the MSTIs in the region.
As shown in Figure 9-5, AP1, DP2, and DP3 in an MST region are directly
connected to other regions, and therefore they are all regional edge ports of
the MST region.
As shown in Figure 9-5, AP1 is a regional edge port and also a master port
in the CIST. Therefore, AP1 is the master port in every MSTI in the MST
region.
Edge
port
An edge port is located at the edge of an MST region and does not connect
to any switching device.
Generally, edge ports are directly connected to terminals.
As shown in Figure 9-5, BP3 is an edge port.
Figure 9-5 Port roles
S1
AP2
CP1
S3
CP2
CP3
Root bridge
AP3
BP1
S2
BP2
Root port
Designated port
Alternate port
Backup port
Issue 01 (2011-07-15)

202

Port status
Table 9-3 lists the MSTP port status, which is the same as the RSTP port status.
Table 9-3 Port status
Port
Status
Description
Forwardi
ng
A port in the Forwarding state can send and receive BPDUs as well as
Learning
This is a transition state. A port in the Learning state learns MAC addresses
from user traffic to construct a MAC address table.
In the Learning state, the port can send and receive BPDUs, but cannot
Discardi
ng
A port in the Discarding state can only receive BPDUs.
There is no necessary link between the port status and the port role. Table 9-4 lists the
relationships between port roles and port status.
Table 9-4 Relationships between port roles and port status
Port
Status
Root Port/
Master
Port
Designate
d Port
Regional
Edge Port
Alternate
Port
Backup
Port
Forwardi
ng
Yes
Yes
Yes
No
No
Learning
Yes
Yes
Yes
No
No
Discardi
ng
Yes
Yes
Yes
Yes
Yes
Yes: The port supports this status.

No: The port does not support this status.
NOTE
The S2700SI does not support MSTP.
9.1.2 MSTP Features Supported by the S2700

Before configuring MSTP, familiarize yourself with the concepts of basic MSTP functions,
topology convergence, MSTP protection, and MSTP interoperability between Huawei devices
and non-Huawei devices. This will help you complete the configuration task quickly and
accurately.
Issue 01 (2011-07-15)

203

MSTP is used to block redundant links on the Layer 2 network and trim a network into a loopfree tree. In MSTP, multiple MSTIs can be created and VLANs are mapped into different
instances to load-balance VLAN traffic. The basic configuration roadmap of MSTP is as follows:
1.
In a ring network, divide regions and create different instances for regions.
2.
Select a switching device functioning as a root bridge from switching devices for each
instance.
3.
In each instance, calculate the shortest paths from the other switching devices to the root
bridge, and select a root port for each non-root switching device.
4.
In each instance, select a designated port for each connection according to port IDs.
According to current networking, master ports and backup ports may be involved. For details,
see 9.1.1 MSTP Introduction.
MSTP also supports the following features to meet requirements of special applications and
extended functions:
l
Supports the Proposal/Agreement mechanism to implement rapid convergence.
Supports protection functions as listed in Table 9-5.
Supports MSTP interoperability between Huawei devices and non-Huawei devices. Proper
parameters are required on Huawei devices running MSTP to ensure nonstop
communication.
NOTE
The S2700SI does not support MSTP.
Table 9-5 MSTP protection
Issue 01 (2011-07-15)
MSTP
Protection
Scenario
BPDU
protection

non-edge port after

TC protection

advertising network
resources.

device receives within the given time exceeds
number of times. Excessive TC-BPDUs are
for once after the timeout period expires. This
protects the switching device from frequently
deleting MAC entries and ARP entries, thus
avoiding over-burden.

204

MSTP
Protection
Scenario
Root
protection
Due to incorrect
BPDUs with a higher
changed, triggering
traffic congestion.
To address this issue, the root protection

function can be configured to protect the root
bridge by preserving the role of the
designated port. With this function, when the
designated port receives RST BPDUs with a
higher priority, the port enters the Discarding
state and does not forward the BPDUs. If the
port does not receive any RST BPDUs with a
higher priority for a certain period (double the
Forward Delay), the port transitions to the
Forwarding state.
Loop
protection

situation.
The loop protection function can be used to

prevent such network loops. If the root port
or alternate port cannot receive RST BPDUs
from the upstream switching device, the root
port is blocked and the switching device
Discarding state. The blocked port remains in
the Blocked state and no longer forwards
packets. This prevents loops on the network.
The root port restores the Forwarding state
after new RST BPDUs are received.
NOTE
The S2700 does not support the Per-VLAN Spanning Tree (PVST) protocol and cannot process PVST
packets. You can configure the S2700 to transparently transmit PVST packets. For details, see 10 Layer
2 Protocol Transparent Transmission Configuration.
9.2 Configuring Basic MSTP Functions

MSTP based on the basic STP/RSTP function divides a switching network into multiple regions,
each of which has multiple spanning trees that are independent of each other. MSTP isolates
user traffic and service traffic, and load-balances VLAN traffic.
MSTP is commonly configured on a switching device to trim a ring network to a loop-free
network. MSTP configurations on the switching device involve MSTP working mode
configuration and MST region configuration and activation. If you need to interfere in the
spanning tree calculation, the following methods are available:
l
Issue 01 (2011-07-15)
Setting a priority for a switching device in an MSTI: The lower the numerical value, the
higher the priority of the switching device and the more likely the switching device becomes
205

a root bridge; the higher the numerical value, the lower the priority of the switching device
and the less likely that the switching device becomes a root bridge.
l
Setting a path cost for a port in an MSTI: With the same calculation method, the lower the
numerical value, the smaller the cost of the path from the port to the root bridge and the
more likely the port becomes a root port; the higher the numerical value, the larger the cost
of the path from the port to the root bridge and the less likely that the port becomes a root
port.
Setting a priority for a port in an MSTI: The lower the numerical value, the more likely the
port becomes a designated port; the higher the numerical value, the less likely that the port
becomes a designated port.

Before configuring basic MSTP functions, familiarize yourself with the applicable environment,
complete the pre-configuration tasks, and obtain the required data. This will help you complete
the configuration task quickly and accurately.
situation.
entries.
MSTP can be deployed on a network to eliminate loops. If a loop is detected, MSTP blocks one
or more ports to eliminate the loop. In addition, MSTIs can be configured to load-balance VLAN
traffic.
As shown in Figure 9-6, Switches A, B, C, and D all support MSTP. It is required to create
MSTI 1 and MSTI 2, configure a root bridge for each MSTI, and set the ports to be blocked to
load-balance traffic of VLANs 1 to 10 and VLANs 11 to 20 among different paths.
Issue 01 (2011-07-15)

206

Figure 9-6 Networking diagram of configuring basic MSTP functions
Network
MST Region
SwitchA
SwitchB
SwitchC
SwitchD
PC1
PC2
VLAN1~10
VLAN11~20
MSTI1
MSTI2
MSTI1:
Root Switch:SwitchA
Blocked port
MSTI2:
Root Switch:SwitchB
Blocked port
NOTE
If the current device supports MSTP, configuring MSTP is recommended.
Before configuring basic MSTP functions, complete the following task:
Issue 01 (2011-07-15)

207

physical status of the interfaces is Up
Configuring VLAN features of the ports
Data Preparation
To configure basic MSTP functions, you need the following data.
No.
Data
MSTP working mode
MST region name, VLAN-to-instance mapping, and MSTP revision number
(Optional) ID of an MSTI
(Optional) Priority of a switching device in an MSTI
(Optional) Priority of a port in an MSTI
(Optional) Path cost of a port in an MSTI
9.2.2 Configuring the MSTP Mode

Before configuring basic MSTP functions, you need to configure the working mode of a
switching device to MSTP. MSTP is compatible with STP and RSTP.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp mode mstp
The working mode of the switching device is configured as MSTP. By default, the working
mode is MSTP.
STP and MSTP cannot recognize packets of each other but MSTP and RSTP can. If a switching
device is configured to work in MSTP mode and is connected to some switching devices running
STP, the switching device automatically transits the working mode of the interfaces connected
to the switching devices running STP to STP and other interfaces still run MSTP. This enables
devices running different spanning tree protocols to interwork with each other.
----End
9.2.3 Configuring and Activating an MST Region

MSTP divides a switching network into multiple MST regions. After an MST region name,
VLAN-to-instance mappings, and an MSTP revision number are configured, activating the MST
region is necessary. After this step is done, MST region configuration is complete.
Issue 01 (2011-07-15)

208

Context
An MST region contains multiple switching devices and network segments between them. These
switching devices are directly connected and have the same region name, same VLAN-toinstance mapping, same configuration revision number after MSTP is enabled. One switching
network can have multiple MST regions and multiple switching devices can be grouped into
one MST region by using MSTP configuration commands.
CAUTION
Two switching devices belong to the same MST region when they have the same:
l
Name of the MST region
Mapping between VLANs and MSTIs
Revision level of the MST region
Do as follows on a switching device that needs to join an MST region:
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp region-configuration
The MST region view is displayed.

Step 3 Run:
region-name name
The name of an MST region is configured.

By default, the MST region name is the MAC address of the management network interface on
the MPU of the switching device.
Step 4 Perform either of the following steps to configure VLAN-to-instance mappings.
l Run the instance instance-id vlan { vlan-id [ to vlan-id ] }&<1-10> command to configure
VLAN-to-instance mappings.
l Run the vlan-mapping modulo modulo command to enable VLAN-to-instance mapping
assignment based on a default algorithm.
By default, all VLANs in an MST region are mapped to MSTI 0.
NOTE
l The instance instance-id vlan { vlan-id [ to vlan-id ] }&<1-10> command is recommended because
VLAN-to-instance mapping assignments cannot meet actual mapping requirements.
l In the command, vlan-mapping modulo indicates that the formula (VLAN ID-1)%modulo+1 is used.
In the formula, (VLAN ID-1)%modulo means the remainder of (VLAN ID-1) divided by the value of
modulo. This formula is used to map a VLAN to the corresponding MSTI. The calculation result of
the formula is ID of the mapping MSTI.
Issue 01 (2011-07-15)

209


revision-level level
The MSTP revision number is set.

By default, the MSTP revision number is 0.
If the revision number of the MST region is not 0, this step is necessary.
NOTE
The change of related MST region configurations (especially change of the VLAN mapping table) causes
the recalculation of spanning trees and the route flapping in a network. Therefore, after an MST region
name, VLAN-to-instance mappings, and an MSTP revision number is configured, activating the MST
region is necessary. You can run the check region-configuration command in the MST region view to check
whether region configurations are correct. After confirming that region configurations are correct, run the
active region-configuration command to activate MST region configurations.
Step 6 Run:
active region-configuration
MST region configurations are activated so that the configured region name, VLAN-to-instance
mappings, and revision number can take effect.
If this step is not done, the preceding configurations cannot take effect.
If you have changed MST region configurations on the switching device after MSTP starts, run
the active region-configuration command to activate the MST region so that the changed
configurations can take effect.
----End
9.2.4 (Optional) Setting a Priority for a Switching Device in an MSTI

The lower the numerical value is, the higher priority a switching device has and the more likely
the switching device will be selected as a root bridge.
Context
In an MSTI, there is only one root bridge and it is the logic center of the MSTI. In root bridge
selection, the switching device with high performance and network hierarchy is generally
selected as a root bridge; however, the priority of such a device may be not that high. Thus setting
a high priority for the switching device is necessary so that the device can function as a root
bridge.
Other devices with low performance and network hierarchy are not fit to be a root bridge.
Therefore, set low priorities for these devices.
CAUTION
If an S2700 is configured as the root switch or secondary root switch, the priority of the
S2700 cannot be set. If you want to set the priority of the S2700, you must disable the root switch
or secondary root switch.
Issue 01 (2011-07-15)

210

Procedure
Step 1 Run:
system-view

Step 2 Run:
stp [ instance instance-id ] priority priority
A priority is set for the switching device in an MSTI.

The default priority value of the switching device is 32768.
If the instance is not designated, a priority is set for the switching device in MSTI0.
NOTE
l To configure a switching device as a primary root bridge, you can run the stp [ instance instance-id ]
root primary command directly. The priority value of this switching device is 0.
l To configure a switching device as a secondary root bridge, run the stp [ instance instance-id ] root
secondary command. The priority value of this switching device is 4096.
In an MSTI, a switching device cannot act as a primary root bridge and a secondary root bridge at the
same time.
----End
9.2.5 (Optional) Setting a Path Cost of a Port in an MSTI

The MSTP path cost determines root port selection in an MSTI. The port with the lowest path
cost to the root bridge is selected as a root port.
Context
A path cost is port-specific, which is used by MSTP as a reference to select a link.
Path costs of a port are an important basis for calculating spanning trees. If you set different path
costs for a port in different MSTIs, you can make VLAN traffic be transmitted along different
physical links and thus carry out VLAN load balancing.
On a network where loops occur, you are recommended to set a relatively large path cost for the
port at a low link rate. MSTP puts the port with the large path cost in the Blocking state and
blocks the link where this port resides.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp pathcost-standard { dot1d-1998 | dot1t | legacy }
A path cost calculation method is configured.

By default, the IEEE 802.1t standard method is used to calculate the default path cost.
Issue 01 (2011-07-15)

211

All switching devices on a network must use the same path cost calculation method.
Step 3 Run:

Step 4 Run:
stp instance instance-id cost cost
A path cost is set for the port in the current MSTI.

l When the Huawei proprietory calculation method is used, cost ranges from 1 to 200000.
l When the IEEE 802.1d standard method is used, cost ranges from 1 to 65535.
l When the IEEE 802.1t standard method is used, cost ranges from 1 to 200000000.
----End
9.2.6 (Optional) Setting a Port Priority in an MSTI

The lower the numerical value, the more likely the port on a switching device becomes a
designated port; the higher the numerical value, the more likely the port is to be blocked.
Context
In spanning tree calculation, priorities of ports on switching devices in MSTIs determine
designated port selection.
If you expect to block a port on a switching device in an MSTI to eliminate loops, set the port
priority value to be larger than the default value. This port will be blocked in designated port
selection.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
stp
instance instance-id port priority priority
A port priority is set in an MSTI.

By default, the port priority is 128.
The value range of the priority is from 0 to 240, with the step 16. That is, the port priority can
be 0, 16, or 32.
----End
Issue 01 (2011-07-15)

212

9.2.7 Enabling MSTP

After basic MSTP functions are configured on a switching device, enabling the MSTP function
is required so that MSTP can work properly.
Context
After MSTP is enabled on a ring network, MSTP immediately calculates spanning trees on the
network. Configurations on the switching device, such as, the switching device priority and port
priority, will affect spanning tree calculation. Any change of the configurations may cause
network flapping. Therefore, to ensure rapid and stable spanning tree calculation, perform basic
configurations on the switching device and its ports and enable MSTP.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp enable
MSTP is enabled on the switching device.

By default, the MSTP function is enabled on a S2700.
----End

After basic MSTP functions are configured, verify that the configurations take effect.
Prerequisite
All configurations of basic MSTP functions are complete.
Procedure
l
Run the display stp [ instance instance-id ][ interface { interface-type interfacenumber } ] [ brief ] command to view spanning-tree status and statistics.
Run the display stp region-configuration command to view configurations of activated

MST regions.
Run the display stp region-configuration [ digest ] command to view the digest
configurations of activated MST regions.
----End
9.3 Configuring MSTP Parameters on an Interface

MSTP implements RSTP rapid convergence. To achieve rapid convergence, you need to
configure proper MSTP parameters.
Issue 01 (2011-07-15)

213


Before configuring basic MSTP parameters, familiarize yourself with the applicable
In some specific networks, MSTP parameters will affect the speed of network convergence.
Configuring proper MSTP parameters is required.
NOTE
The default parameters also can be used to complete MSTP rapid convergence. Therefore, the configuration
procedures and steps in this command task are all optional.
Before configuring MSTP parameters, complete the following task:
l
Configuring basic MSTP functions
Data Preparation
To configure MSTP parameters, you need the following data.
No.
Data
Network diameter
Hello time, forwarding delay time, maximum aging time, and timeout period for
waiting for BPDUs from the upstream (3 x hello time x time factor)
Maximum hop count in an MST region
Link type of a port
Whether to Rapid transition mechanism
Whether to transition to the RSTP mode
Maximum number of sent BPDUs
Whether a port needs to be configured as an edge port
Whether auto recovery needs to be configured for an edge port being shut down
10
Whether a port needs to clear statistics of the spanning tree
11
Whether an edge port needs to be configured as a BPDU filter
9.3.2 Configuring System Parameters

MSTP parameters that may affect network convergence include the network diameter, hello
time, and timeout period for waiting for BPDUs from the upstream (3 x hello time x time factor).
Configure proper MSTP parameters to implement rapid network convergence.
Issue 01 (2011-07-15)

214

Procedure
Step 1 Run:
system-view

Step 2 Run:
stp bridge-diameter diameter
The network diameter is configured.

By default, the network diameter is 7.
l RSTP uses a single spanning tree instance on the entire network, which cannot prevent the
performance from deteriorating when the network scale grows. Therefore, the network
diameter cannot be larger than 7.
l It is recommended that you run the stp bridge-diameter diameter command to set the
network diameter. Then, the switching device calculates the optimal Forward Delay period,
Hello time, and Max Age period based on the set network diameter.
Step 3 Run:
stp timer-factor factor
The timeout period for waiting for BPDUs from the upstream of a switching device is set.
By default, the timeout period of a switching device is 9 times as long as the Hello time.
Step 4 (Optional) To set the Forward Delay period, Hello time, and Max Age period, perform the
following operations:
l Run the stp timer forward-delay forward-delay command to set the Forward Delay period
for a switching device.
The default Forward Delay period of a switching device is 1500, in centiseconds.
l Run the stp timer hello hello-time command to set the Hello time for a switching device.
The default Hello time of a switching device is 200, in centiseconds.
l Run the stp timer max-age max-age command to set the Max Age period for a switching
device.
The default Max Age period of a switching device is 2000, in centiseconds.
NOTE
The values of the Hello time, Forward Delay period, and Max Age period must comply with the following
formulas. Otherwise, networking flapping occurs.
l 2 (Forward Delay - 1.0 second) >= Max Age
l Max Age >= 2 (Hello Time + 1.0 second)
Step 5 Run:
stp max-hops hop
The maximum hop count is set for the MST region.

By default, the maximum hop count of the MST region is 20.
Step 6 Run:
stp mcheck
MCheck is enabled.
Issue 01 (2011-07-15)

215

On a switching device running MSTP, if an interface is connected to a device running STP, the
interface automatically transitions to the STP mode.
Enabling MCheck on the interface is required because the interface may fail to automatically
transition to the MSTP mode in the following situations:
l The switching device running STP transitions to the MSTP mode.
NOTE
If you run the stp mcheck command in the system view, the MCheck operation is performed on all the
interfaces.
----End
9.3.3 Configuring Port Parameters

Port parameters that may affect MSTP topology convergence include the link type and maximum
number of sent BPDUs. Configure proper port parameters to implement rapid topology
convergence.
Procedure
Step 1 Run:
system-view

Step 2 Run:

stp point-to-point { auto | force-false | force-true }
The link type is configured for a port.

By default, a port automatically determines whether to connect to a P2P link. The P2P link
supports rapid network convergence.
l If the Ethernet port works in full-duplex mode, the port is connected to a P2P link. In this
case, force-true can be configured to implement rapid network convergence.
l If the Ethernet port works in half-duplex mode, you can configure stp point-to-point forcetrue to forcibly set the link type to P2P to implement rapid network convergence.
Step 4 Run:
stp mcheck
MCheck is enabled.
On a switching device running MSTP, if an interface is connected to a device running STP, the
interface automatically transitions to the STP mode.
Enabling MCheck on the interface is required because the interface may fail to automatically
transition to the MSTP mode in the following situations:
Issue 01 (2011-07-15)

216

l The switching device running STP transitions to the MSTP mode.

Step 5 Run:
stp transmit-limit packet-number
The maximum number of BPDUs sent by a port within each Hello time is set.
By default, the maximum number of BPDUs that a port sends within each Hello time is 51.
The port is configured as an edge port.

If a device port is connected to a terminal, you can run this command to configure the port as
an edge port.
By default, the port is a non-edge port.
Step 7 Run:
quit

error-down auto-recovery cause cause-item interval interval-value
The auto recovery function on an edge port is configured. That is, enable the port in the errordown state to automatically go Up, and set the delay for the transition from Down to Up.
There is no default value for the recovery time. Therefore, you must specify a delay when
configuring this command.
----End
Follow-up Procedure
When the topology of a spanning tree changes, the forwarding paths to associated VLANs are
changed. Then, ARP entries corresponding to those VLANs on the switching device need to be
updated. MSTP processes ARP entries in either fast or normal mode.
l
In fast mode, ARP entries to be updated are directly deleted.
In normal mode, ARP entries to be updated are rapidly aged.

The remaining lifetime of ARP entries to be updated is set to 0. The switching device rapidly
processes these aged entries. If the number of ARP aging probe attempts is not set to 0,
ARP implements aging probe for these ARP entries.
In either fast or normal mode, MAC entries are directly deleted.
You can run the stp converge { fast | normal } command in the system view to configure the
MSTP convergence mode.
By default, the MSTP convergence is configured as normal.
NOTE
The normal mode is recommended. If the fast mode is adopted, ARP entries will be frequently deleted,
causing the CPU usage on the MPU or LPU to reach 100%. As a result, network flapping frequently occurs.
Issue 01 (2011-07-15)

217


After MSTP parameters are configured, check whether the configurations take effect.
Prerequisite
The configurations of MSTP parameters are complete.
Procedure
l
Run the display stp [ instance instance-id ] [ interface { interface-type interfacenumber } ] [ brief ] command to view spanning-tree status and statistics.
----End
9.4 Configuring MSTP Protection Functions

MSTP protection functions are as follows, and you can configure one or more functions as
required.

Before configuring MSTP protection functions, familiarize yourself with the applicable
MSTP provides the following protection functions, as listed in Table 9-6.
Table 9-6 MSTP protection
Issue 01 (2011-07-15)
MSTP
Protection
Scenario
BPDU
protection

non-edge port after


218

MSTP
Protection
Scenario
TC protection

advertising network
resources.

device receives within the given time exceeds
number of times. Excessive TC-BPDUs are
for once after the timeout period expires. This
protects the switching device from frequently
deleting MAC entries and ARP entries, thus
avoiding over-burden.
Root
protection
Due to incorrect
BPDUs with a higher
changed, triggering
traffic congestion.
To address this issue, the root protection

function can be configured to protect the root
bridge by preserving the role of the
designated port. With this function, when the
designated port receives RST BPDUs with a
higher priority, the port enters the Discarding
state and does not forward the BPDUs. If the
port does not receive any RST BPDUs with a
higher priority for a certain period (double the
Forward Delay), the port transitions to the
Forwarding state.
Loop
protection

situation.
The loop protection function can be used to

prevent such network loops. If the root port
or alternate port cannot receive RST BPDUs
from the upstream switching device, the root
port is blocked and the switching device
Discarding state. The blocked port remains in
the Blocked state and no longer forwards
packets. This prevents loops on the network.
The root port restores the Forwarding state
after new RST BPDUs are received.
Before configuring MSTP protection functions on a switching device, complete the following
task:
Issue 01 (2011-07-15)

219


NOTE
Configuring an edge port on the switching device before configuring BPDU protection.
Data Preparation
To configure MSTP protection functions on a switching device, you need the following data.
No.
Data
Number of the port on which root protection is to be enabled
Number of the port on which loop protection is to be enabled
9.4.2 Configuring BPDU Protection on a Switching Device

After BPDU protection is enabled on a switching device, the switching device shuts down an
edge port if the edge port receives a BPDU, and notifies the NMS of the shutdown event.
Context
Edge ports are directly connected to user terminals and normally, the edge ports will not receive
BPDUs. Some attackers may send pseudo BPDUs to attach the switching device. If the edge
ports receive the BPDUs, the switching device automatically sets the edge ports as non-edge
ports and triggers new spanning tree calculation. Network flapping then occurs. BPDU
protection can be used to protect switching devices against network attacks.
NOTE
Do as follows on a switching device having an edge port:
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp bpdu-protection
BPDU protection is enabled on the switching device.

By default, BPDU protection is not enabled on the switching device.
----End
9.4.3 Configuring TC Protection on a Switching Device

After TC protection is enabled, you can set the number of times for an MSTP process to process
TC-BPDUs within a given time. TC protection avoids frequent deletion of MAC address entries
and ARP entries, thereby protecting switching devices.
Issue 01 (2011-07-15)

220

Context
An attacker may send pseudo TC-BPDUs to attack switching devices. Switching devices receive
a large number of TC BPDUs in a short time and delete entries frequently, which burdens system
processing and degrades network stability.
TC protection is used to suppress TC-BPDUs. The number of times that TC-BPDUs are
processed by a switching device within a given time period is configurable. If the number of
TC-BPDUs that the switching device receives within a given time exceeds the specified
threshold, the switching device handles TC-BPDUs only for the specified number of times.
Excessive TC-BPDUs are processed by the switching device as a whole for once after the timer
(that is, the specified time period) expires. This protects the switching device from frequently
deleting MAC entries and ARP entries, thus avoiding over-burdened.
Procedure
Step 1 Run:
system-view

Step 2 Run:
stp tc-protection
TC protection is enabled for the MSTP process.

By default, TC protection is enabled on the switching device.
Step 3 Run:
stp tc-protection threshold threshold
The threshold of the number of times the MSTP process handles the received TC-BPDUs and
updates forwarding entries within a given time is set.
NOTE
The value of the given time is consistent with the MSTP Hello time set by using the stp timer hello hellotime command.
----End
9.4.4 Configuring Root Protection on an Interface

The root protection function on a switching device protects a root bridge by preserving the role
of a designated port.
Context
Due to incorrect configurations or malicious attacks on the network, a root bridge may receive
BPDUs with a higher priority. Consequently, the legitimate root bridge is no longer able to serve
as the root bridge, and the network topology is illegitimately changed, triggering spanning tree
recalculation. This also may cause the traffic that should be transmitted over high-speed links
to be transmitted over low-speed links, leading to network congestion. The root protection
function on a switching device is used to protect the root bridge by preserving the role of the
designated port.
Issue 01 (2011-07-15)

221

NOTE
Root protection is configured on a designated port. It takes effect only when being configured on the port
that functions as a designated port on all MSTIs. If root protection is configured on other types of ports, it
does not take effect.
Do as follows on a root bridge in an MST region:
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
stp root-protection
Root protection is configured on the switching device.

By default, root protection is disabled.
----End
9.4.5 Configuring Loop Protection on an Interface

The loop protection function suppresses the loops caused by link congestion.
Context
On a network running MSTP, a switching device maintains the root port status and status of
blocked ports by receiving BPDUs from an upstream switching device. If the switching device
cannot receive BPDUs from the upstream because of link congestion or unidirectional-link
failure, the switching device re-selects a root port. The original root port becomes a designated
port and the original blocked ports change to the Forwarding state. This may cause network
loops. To address such a problem, configure loop protection.
After loop protection is configured, if the root port or alternate port does not receive BPDUs
from the upstream switching device, the root port is blocked and the switching device notifies
the NMS that the port enters the Discarding state. The blocked port remains in the Blocked state
and no longer forwards packets. This prevents loops on the network. The root port restores the
Forwarding state after receiving new BPDUs.
NOTE
An alternate port is a backup port of a root port. If a switching device has an alternate port, you need to
configure loop protection on both the root port and the alternate port.
Do as follows on a root port and an alternate port on a switching device in an MST region:
Procedure
Step 1 Run:
system-view
Issue 01 (2011-07-15)

222


Step 2 Run:

Step 3 Run:
stp loop-protection
Loop protection for the root port is configured on the switching device.
By default, loop protection is disabled.
----End

After MSTP protection functions are configured, check whether the configurations take effect.
Prerequisite
All configurations of MSTP protection functions are complete.
Procedure
l
----End
9.5 Configuring MSTP Interoperability Between Huawei

Devices and Non-Huawei Devices
To enable Huawei devices to interwork with non-Huawei devices, configure proper parameters
and functions, including the BPDU format, MSTP protocol packet format, and digest snooping
function, on the Huawei devices running MSTP.

Before configuring MSTP interoperability between Huawei devices and non-Huawei devices,
familiarize yourself with the applicable environment, complete the pre-configuration tasks, and
obtain the data required for the configuration. This will help you complete the configuration task
quickly and accurately.
On an MSTP network, inconsistent protocol packet formats and BPDU keys may lead to a
communication failure. Configuring proper MSTP parameters on Huawei devices ensures
interoperability between Huawei devices and non-Huawei devices.
Issue 01 (2011-07-15)

223

Before configuring MSTP interoperability between Huawei devices and non-Huawei devices,
complete the following task:
l
Data Preparation
To configure MSTP interoperability between Huawei devices and non-Huawei devices, you
need the following data.
No.
Data
BPDU format
MSTP protocol packet format
9.5.2 Configuring a Proposal/Agreement Mechanism

To enable Huawei Datacom devices to communicate with non-Huawei devices, configure a
proper rapid transition mechanism on Huawei devices according to the Proposal/Agreement
mechanism on non-Huawei devices.
Context
The rapid transition mechanism is also called the Proposal/Agreement mechanism. Switching
devices currently support the following modes:
l
Enhanced mode: The current interface counts a root port when it computes the
connected to the upstream device as a root port and blocks all non-edge ports.
The upstream device then sends an Agreement message to the downstream device. After
the downstream device receives the message, the root port transitions to the Forwarding
state.
The downstream device then responds to the Proposal message with an Agreement
message. After receiving the message, the upstream device sets the port connected to
the downstream device as a designated port, and the designated port transitions to the
Forwarding state.
Common mode: The current interface ignores the root port when it computes the
connected to the upstream device as a root port and blocks all non-edge ports. The root
port then transitions to the Forwarding state.
The downstream device responds to the Proposal message with an Agreement message.
Issue 01 (2011-07-15)

224

Forwarding state.
When Huawei Datacom devices are interworking with non-Huawei devices, select either mode
depending on the Proposal/Agreement mechanism on non-Huawei devices.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
stp no-agreement-check
The common rapid transition mechanism is configured.

By default, the interface uses the enhanced rapid transition mechanism.
----End
9.5.3 Configuring the MSTP Protocol Packet Format on an Interface

MSTP protocol packets can be transmitted in auto, dot1s, or legacy mode. The default mode is
auto.
Context
MSTP protocol packets have two formats: dot1s (IEEE 802.1s standard packets) and legacy
(proprietary protocol packets). The auto mode is introduced to allow an interface to automatically
use the format of MSTP protocol packets sent from the remote interface. In this manner, the two
interfaces use the same MSTP protocol packet format.
Do as follows on a switching device in an MST region:
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
stp compliance { auto | dot1s | legacy }
The MSTP protocol packet format is configured on the interface.

The auto mode is used by default.
Issue 01 (2011-07-15)

225

NOTE
If the format of MSTP packets is set to dot1s on one end and legacy on the other end, the negotiation fails.
----End
9.5.4 Enabling the Digest Snooping Function

When a Huawei device is connected to a non-Huawei device, if the region names, revision
numbers, and VLAN-to-instance mappings configured on the two devices are consistent but the
BPDU keys are different, the two devices cannot communicate. To address this problem, enable
the digest snooping function on the Huawei device.
Context
Do as follows on a switching device in an MST region:
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
stp config-digest-snoop
The digest snooping function is enabled.

----End

After MSTP parameters are configured for the interoperability between Huawei devices and
non-Huawei devices, check whether the configurations take effect.
Prerequisite
All the configurations for the interoperability between Huawei devices and non-Huawei devices
are complete.
Procedure
l
----End
9.6 Maintaining MSTP

MSTP maintenance includes resetting MSTP statistics.
Issue 01 (2011-07-15)

226

9.6.1 Clearing MSTP Statistics

You can run the reset commands to reset MSTP statistics to 0.
Context
CAUTION
MSTP statistics cannot be restored after you clear them. Therefore, exercise caution when using
the reset commands.
After you confirm that MSTP statistics need to be cleared, run the following command in the
user view.
Procedure
Step 1 Run the reset stp [ interface interface-type interface-number ] statistics command to clear
spanning-tree statistics.
----End

This section provides a configuration example of MSTP.
9.7.1 Example for Configuring Basic MSTP Functions

SwitchA, SwitchB, SwitchC, and SwitchD run MSTP. In this example, MSTP runs on Layer 2
interfaces of the Switches.
Figure 9-7 Networking diagram of basic MSTP configurations
SwitchA
Eth0/0/2
Eth0/0/2
Eth0/0/1
Eth0/0/1
Eth0/0/3
Eth0/0/3
SwitchC
Eth0/0/1
Issue 01 (2011-07-15)
SwitchB
SwitchD
Eth0/0/2
Eth0/0/2
Eth0/0/1

227

1.
Add SwitchA and SwitchC to MST region RG1, and create MSTI1.
2.
Add SwitchB and SwitchD to MST region RG2, and create MSTI1.
3.
Configure SwitchA as the CIST root.
4.
In RG1, configure SwitchA as the CIST regional root and regional root of MSTI1.
Configure the root protection function on Eth 0/0/2 and the Eth 0/0/1 on SwitchA.
5.
In RG2, configure SwitchB as the CIST regional root and SwitchD as the regional root of
MSTI1.
6.
On SwitchC and SwitchD, connect Eth 0/0/1 to a PC and configure Eth 0/0/1 as an edge
port. Enable BPDU protection on SwitchC and SwitchD.
7.
Configure the Switches to calculate the path cost by using the algorithm of Huawei.
Data Preparation
l
Region that SwitchA and SwitchC belong to: RG1
Region that SwitchB and SwitchD belong to: RG2
Numbers of the Eth interfaces, as shown in Figure 9-7
VLAN IDs: 1-20
Procedure
Step 1 Configure SwitchA.
# Configure the MST region on SwitchA.
<SwitchA> system-view
[SwitchA] stp region-configuration
[SwitchA-mst-region] region-name RG1
[SwitchA-mst-region] instance 1 vlan 1 to 10
# Activate the configuration of the MST region.

[SwitchA-mst-region] active region-configuration
[SwitchA-mst-region] quit
# Set the priority of SwitchA in MSTI0 to 0 to ensure that SwitchA functions as the CIST root.
[SwitchA] stp instance 0 priority 0
# Set the priority of SwitchA in MSTI1 to 1 to ensure that SwitchA functions as the regional
root of MSTI1.
[SwitchA] stp instance 1 priority 0
# Configure SwitchA to use Huawei private algorithm to calculate the path cost.
[SwitchA] stp pathcost-standard legacy
# Create VLANs 2 to 20.

[SwitchA] vlan batch 2 to 20
Issue 01 (2011-07-15)

228

# Add Eth 0/0/2 to the VLANs.

[SwitchA] interface Ethernet 0/0/2
[SwitchA-Ethernet0/0/2] port trunk allow-pass vlan 1 to 20

[SwitchA-Ethernet0/0/1] port trunk allow-pass vlan 1 to 20
# Enable root protection on the Eth 0/0/1.

# Enable root protection on the Eth 0/0/2.

# Enable MSTP.
Step 2 Configure SwitchB.

# Configure the MST region on SwitchB.
[SwitchB] stp region-configuration
[SwitchB-mst-region] region-name RG2
[SwitchB-mst-region] instance 1 vlan 1 to 10

[SwitchB-mst-region] active region-configuration
[SwitchB-mst-region] quit
# Set the priority of SwitchB in MSTI0 to 4096 to ensure that SwitchB functions as the CIST
root.
[SwitchB] stp instance 0 priority 4096
# Configure SwitchB to use Huawei private algorithm to calculate the path cost.
[SwitchB] stp pathcost-standard legacy

[SwitchB] vlan batch 2 to 20

[SwitchB] interface Ethernet 0/0/1
[SwitchB-Ethernet0/0/1] port trunk allow-pass vlan 1 to 20

[SwitchB] interface Ethernet 0/0/2
[SwitchB-Ethernet0/0/2] port trunk allow-pass vlan 1 to 20
Issue 01 (2011-07-15)

229

# Enable MSTP.
Step 3 Configure SwitchC.

# Configure the MST region on SwitchC.
[SwitchC] stp region-configuration
[SwitchC-mst-region] region-name RG1
[SwitchC-mst-region] instance 1 vlan 1 to 10

[SwitchC-mst-region] active region-configuration
[SwitchC-mst-region] quit
# Configure SwitchC to use Huawei private algorithm to calculate the path cost.
[SwitchC] stp pathcost-standard legacy
# Enable BPDU protection.

[SwitchC] stp bpdu-protection

[SwitchC] vlan batch 2 to 20

[SwitchC] interface Ethernet 0/0/2
[SwitchC-Ethernet0/0/2] port trunk allow-pass vlan 1 to 20

[SwitchC-Ethernet0/0/3] port trunk allow-pass vlan 1 to 20
# Configure Eth 0/0/1 as an edge port.

[SwitchC-Ethernet0/0/1] stp edged-port enable
[SwitchC-Ethernet0/0/1] port hybrid pvid vlan 20
[SwitchC-Ethernet0/0/1] port hybrid untagged vlan 20
# Enable MSTP.
Step 4 Configure SwitchD.

# Configure the MST region on SwitchD.
[SwitchD] stp region-configuration
[SwitchD-mst-region] region-name RG2
[SwitchD-mst-region] instance 1 vlan 1 to 10

[SwitchD-mst-region] active region-configuration
[SwitchD-mst-region] quit
Issue 01 (2011-07-15)

230

# Set the priority of SwitchD in MSTI1 to 0 to ensure that SwitchD functions as the regional
root of MSTI1.
[SwitchD] stp instance 1 priority 0
# Configure SwitchD to use Huawei private algorithm to calculate the path cost.
[SwitchD] stp pathcost-standard legacy
# Enable BPDU protection.

[SwitchD] stp bpdu-protection

[SwitchD] vlan batch 2 to 20

[SwitchD] interface Ethernet 0/0/2
[SwitchD-Ethernet0/0/2] port trunk allow-pass vlan 1 to 20

[SwitchD-Ethernet0/0/3] port trunk allow-pass vlan 1 to 20
# Configure Eth 0/0/1 as an edge port.

[SwitchD-Ethernet0/0/1] stp edged-port enable
[SwitchD-Ethernet0/0/1] port hybrid pvid vlan 10
[SwitchD-Ethernet0/0/1] port hybrid untagged vlan 10
# Enable MSTP.

After the preceding configurations are complete and the network topology becomes stable,
perform the following operations to verify the configuration.
# Run the display stp brief command on SwitchA to view the status and protection type on the
interfaces. The displayed information is as follows:
<SwitchA> display stp brief
MSTID
Port
0
Ethernet0/0/1
0
Ethernet0/0/2
1
Ethernet0/0/1
1
Ethernet0/0/2
Role
DESI
DESI
DESI
DESI
STP State
FORWARDING
FORWARDING
FORWARDING
FORWARDING
Protection
ROOT
ROOT
ROOT
ROOT
The priority of SwitchA is the highest in the CIST; therefore, SwitchA is elected as the CIST
root and regional root of RG1. Eth 0/0/2 and Eth 0/0/1 of SwitchA are designated ports in the
CIST.
The priority of SwitchA in MSTI1 is the highest in RG1; therefore, SwitchA is elected as the
regional root of SwitchA. Eth 0/0/2 and Eth 0/0/1 of SwitchA are designated ports in MSTI1.
# Run the display stp interface brief commands on SwitchC. The displayed information is as
follows:
Issue 01 (2011-07-15)

231

<SwitchC> display stp interface Ethernet 0/0/3 brief

MSTID
Port
Role STP State
0
Ethernet0/0/3
ROOT FORWARDING
1
Ethernet0/0/3
ROOT FORWARDING
<SwitchC> display stp interface Ethernet 0/0/2 brief
MSTID
Port
Role STP State
0
Ethernet0/0/2
DESI FORWARDING
1
Ethernet0/0/2
DESI FORWARDING
Protection
NONE
NONE
Protection
NONE
NONE
Eth 0/0/3 of SwitchC is the root port in the CIST and MSTI1. Eth 0/0/2 of SwitchC is a designated
port in the CIST and MSTI1.
# Run the display stp brief command on SwitchB. The displayed information is as follows:
<SwitchB> display stp brief
MSTID
Port
0
Ethernet0/0/1
0
Ethernet0/0/2
1
Ethernet0/0/1
1
Ethernet0/0/2
Role
DESI
ROOT
ROOT
MAST
STP State
FORWARDING
FORWARDING
FORWARDING
FORWARDING
Protection
NONE
NONE
NONE
NONE
The priority of SwitchB in the CIST is lower than that of SwitchA; therefore, Eth 0/0/2 of
SwitchB functions as the root port in the CIST. SwitchA and SwitchB belong to different regions;
therefore, Eth 0/0/2 of SwitchB functions as the master port in MSTI1. In MSTI1, the priority
of SwitchB is lower than that of SwitchD; therefore, Eth 0/0/1 of SwitchB functions as the root
port. The priority of SwitchB in the CIST is higher than that of SwitchB; therefore, Eth 0/0/1 of
SwitchB functions as the designated port in the CIST.
# Run the display stp interface brief commands on SwitchD. The displayed information is as
follows:
<SwitchD> display stp interface Ethernet 0/0/3 brief
MSTID
Port
Role STP State
0
Ethernet0/0/3
ROOT FORWARDING
1
Ethernet0/0/3
DESI FORWARDING
<SwitchD> display stp interface Ethernet 0/0/2 brief
MSTID
Port
Role STP State
0
Ethernet0/0/2
ALTE DISCARDING
1
Ethernet0/0/2
ALTE DISCARDING
Protection
NONE
NONE
Protection
NONE
NONE
On SwitchD, Eth 0/0/2 functions as the alternate port in the CIST. SwitchD and SwitchC are in
different regions; therefore, Eth 0/0/2 of SwitchD also functions as the alternate port in MSTI1.
Eth 0/0/3 of SwitchD is the root port in the CIST. The priority of SwitchD is higher than that of
SwitchB in MSTI1; therefore, Eth 0/0/3 also functions as the designated port in MSTI1.
----End
Configuration Files
l
#
sysname SwitchA
#
vlan batch 2 to 20
#
stp instance 0 priority 0
stp pathcost-standard legacy
region-name RG1
instance 1 vlan 1 to 10
#
Issue 01 (2011-07-15)

232


stp root-protection
#
stp root-protection
#
return
#
sysname SwitchB
#
vlan batch 2 to 20
#
region-name RG2
#
#
#
return
#
sysname SwitchC
#
vlan batch 2 to 20
#
stp bpdu-protection
region-name RG1
#
#
#
#
return
#
sysname SwitchD
#
vlan batch 2 to 20
#
stp bpdu-protection
Issue 01 (2011-07-15)

233


region-name RG2
#
#
#
#
return
Issue 01 (2011-07-15)

234

10
10 Layer 2 Protocol Transparent Transmission Configuration
Layer 2 Protocol Transparent

Transmission Configuration
About This Chapter

This chapter describes the concept, configuration procedure, and configuration examples of
Layer 2 protocol transparent transmission.
10.1 Overview of Layer 2 Protocol Transparent Transmission
This section describes the concept of Layer 2 protocol transparent transmission.
10.2 Layer 2 Protocol Transparent Transmission Features Supported by the S2700
This section describes the Layer 2 protocol transparent transmission features supported by the
S2700.
10.3 Configuring Interface-based Layer 2 Protocol Transparent Transmission
When each interface of a device on the backbone network is connected to only one user network
and Layer 2 protocol packets sent from the user network do not need VLAN tags, you can
configure interface-based Layer 2 protocol transparent transmission so that Layer 2 protocol
packets can be transparently transmitted on the backbone network.
10.4 Configuring VLAN-based Layer 2 Protocol Transparent Transmission
When each interface of devices on the backbone network is connected to multiple user networks
and Layer 2 protocol packets sent from user network contain VLAN tags, you can configure
VLAN-based Layer 2 protocol transparent transmission so that Layer 2 protocol packets are
transparently transmitted on the backbone network.
10.5 Maintaining Layer 2 Protocol Transparent Transmission
This section describes how to debug Layer 2 protocol transparent transmission.
This section provides examples for configuring interface, VLAN based Layer 2 protocol
transparent transmission.
Issue 01 (2011-07-15)

235

10.1 Overview of Layer 2 Protocol Transparent

Transmission
This section describes the concept of Layer 2 protocol transparent transmission.
Background
In certain network environments, packets of Layer 2 protocols such as MSTP, HGMP, and LACP
need to be transmitted between user networks across the backbone network to complete
calculation of the protocols.
As shown in Figure 10-1, user network 1 and user network 2 run Layer 2 protocols, for example,
MSTP. Layer 2 protocol packets of user network 1 must traverse the backbone network to reach
user network 2 so that the spanning tree can be calculated. Packets of a Layer 2 protocol usually
use the same destination MAC address. For example, MSTP packets are BPDUs that use 0180C200-0000 as the destination MAC address. Therefore, when the BPDUs reach a PE on the
backbone network, the PE cannot identify whether the BPDUs are sent from a user network or
the backbone network. As a result, the PE sends the BPDUs to the CPU for spanning tree
calculation.
In this case, the spanning tree is calculated between the devices of user network 1 and PE1, and
the devices of user network 2 are not involved in the calculation. Therefore, BPDUs of user
network 1 cannot be sent to user network 2 through the backbone network.
Figure 10-1 Transparent transmission of Layer 2 protocol packets on an ISP network
ISP
network
PE1
PE2
CE1
CE2
User
network1
User
network2
Layer 2 protocol transparent transmission can solve this problem.

To transparently transmit Layer 2 protocol packets on the backbone network, the following
requirements must be met:
Issue 01 (2011-07-15)

236

Each site on a user network can receive Layer 2 protocol packets from other sites.
Layer 2 protocol packets sent from a user network are not processed by CPUs of devices
on the backbone network.
Layer 2 protocol packets of different user networks are separated from each other.
A Layer 2 protocol packet is transparently transmitted as follows:

l
A user-side device on the backbone network replaces the multicast destination MAC
address of Layer 2 protocol packets with a specified multicast MAC address.
Devices on the backbone network determine whether to add an outer VLAN tag to the
packet according to the transparent transmission mode.
The egress device on the backbone network restores the original multicast destination MAC
address of the packet according to the mappings between multicast destination MAC
addresses and Layer 2 protocols. The egress device also determines whether to remove the
outer VLAN tag, and then forwards the packet to the user network.
10.2 Layer 2 Protocol Transparent Transmission Features

Supported by the S2700
This section describes the Layer 2 protocol transparent transmission features supported by the
S2700.
Based on application scenarios, the S2700 supports the following Layer 2 protocol transparent
transmission features:
l
Interface-based Layer 2 protocol transparent transmission
VLAN-based Layer 2 protocol transparent transmission
Currently, the S2700 can transparently transmit packets of the following Layer 2 protocols:
l
Spanning Tree Protocol (STP)
Link Aggregation Control Protocol (LACP)
Ethernet Operation, Administration, and Maintenance 802.3ah (EOAM3ah)
Link Layer Discovery Protocol (LLDP)
Generic VLAN Registration Protocol (GVRP)
Generic Multicast Registration Protocol (GMRP)
HUAWEI Group Management Protocol (HGMP)
VLAN Trunking Protocol (VTP)
Unidirectional Link Detection (UDLD)
Port Aggregation Protocol (PAGP)
Cisco Discovery Protocol (CDP)
Per VLAN Spanning Tree Plus (PVST+)
Shared Spanning Tree Protocol (SSTP)
Dynamic Trunking Protocol (DTP)
User-defined protocols
NOTE
The S2700SI does not support Layer 2 protocol transparent transmission.
Issue 01 (2011-07-15)

237

Interface-based Layer 2 Protocol Transparent Transmission

Figure 10-2 Networking of interface-based Layer 2 protocol transparent transmission
Port based
VLAN 200
Port based
VLAN 200
LAN-B
MSTP
LAN-B
MSTP
ISP Network
PE1
Port based
VLAN 300
LAN-A
MSTP
PE2
BPDU Tunnel 200

BPDU Tunnel 300
Port based
VLAN 300
PE3
LAN-A
MSTP
Port based
VLAN 200
LAN-B
MSTP
As shown in Figure 10-2, each interface of a PE is connected to one user network. The user
networks connected to the same PE belong to different LANs, namely, LAN-A and LAN-B.
BPDUs sent from user networks are not tagged, but the PE needs to identify the LAN that each
BPDU belongs to. BPDUs of a user network on LAN-A must be forwarded to other user networks
on LAN-A, but cannot be forwarded to user networks on LAN-B. In addition, BPDUs cannot
be processed by network devices of the ISP.
The following methods can be used to meet the proceeding requirements:
l
Issue 01 (2011-07-15)
Replace the default multicast MAC address of Layer 2 protocol packets that can be
identified by PEs on the backbone network with another multicast MAC address.
1.
Configure all PEs as providers. Then the multicast destination MAC address of
BPDUs sent from the backbone network is changed from 01-80-C2-00-00-00 to
01-80-C2-00-00-08.
2.
Configure all devices on user networks as customers. Then the multicast destination
MAC address of BPDUs sent from user networks is 01-80-C2-00-00-00.
3.
On PEs, add the interfaces connected to the same user network to the same VLAN.
Then PEs add VLAN tags to received BPDUs according to default VLANs of the
interfaces.
4.
PEs (providers) do not consider these packets as Layer 2 protocol BPDUs and do not
send them to the CPU. Instead, PEs select a Layer 2 tunnel to forward the packets
according to the default VLANs of interfaces.
5.
Internal nodes on the backbone network forward the packets across the backbone
network as common Layer 2 packets.
238

6.
The egress device on the backbone network forwards the packets to user networks
without modifying the packets.
NOTE
l This method is applicable only to STP, RSTP, and MSTP. To configure a device as the provider,
run the bpdu-tunnel stp bridge role provider command.
Replace the original multicast MAC address of Layer 2 protocol packets from user networks
with a specified multicast MAC address.
NOTE
This method is applicable to all Layer 2 protocols.
1.
PEs identify the type (such as STP) of the Layer 2 protocol packets sent from user
networks and tag the packets with corresponding VLAN IDs according to default
VLANs of interfaces.
2.
PEs replace the standard multicast destination MAC address of Layer 2 protocol
packets with a specified multicast MAC address according to the mappings between
multicast destination MAC addresses and Layer 2 protocols.
3.
4.
The egress device of the backbone network restores the original destination MAC
address of the packets according to the mappings between multicast destination MAC
addresses and Layer 2 protocols, and then forwards the packets to user networks.
VLAN-based Layer 2 Protocol Transparent Transmission

Figure 10-3 Networking of VLAN-based Layer 2 protocol transparent transmission
LAN-B
MSTP
LAN-B
MSTP
CE-VLAN 100
CE-VLAN 100
PE 1
ISP Network
PE 2
BPDU Tunnel
CE-VLAN 200
Trunk
100-200
Trunk
100-200
PE 3
CE-VLAN 200
CE-VLAN 100
LAN-A
MSTP
LAN-A
MSTP
LAN-B
MSTP
Issue 01 (2011-07-15)

239

A PE generally functions as an aggregation device. As shown in Figure 10-3, the aggregation

interface on PE1 can receive BPDUs from LAN-A and LAN-B. To differentiate BPDUs from
the two LANs, BPDUs sent from CEs to PEs must have VLAN tags. In Figure 10-3, packets
sent from LAN-A contain VLAN 200 and packets sent from LAN-B contain VLAN 100.
Packets of certain Layer 2 protocols such as STP, RSTP, and MSTP are untagged. When
receiving Layer 2 protocol packets with VLAN tags, PEs consider the packets invalid and discard
them. In this case, you can configure VLAN-based Layer 2 protocol transparent transmission
on PEs so that Layer 2 protocol packets can traverse the backbone network through Layer 2
tunnels.
Similar to interface-based Layer 2 protocol transparent transmission, you can use either of the
following methods to implement VLAN-based Layer 2 protocol transparent transmission:
l
Replace the default multicast MAC address of the Layer 2 protocol that can be identified
by PEs with another multicast MAC address.
1.
Configure all PEs as providers. Then the multicast destination MAC address of
BPDUs sent from the backbone network is changed from 01-80-C2-00-00-00 to
01-80-C2-00-00-08.
2.
Configure all devices on user networks as customers. Then the multicast destination
MAC address of BPDUs sent from user networks is 01-80-C2-00-00-00.
3.
Configure devices on user networks to send Layer 2 protocol packets with the specified
VLAN IDs to the backbone network.
4.
Enable PEs to identify Layer 2 protocol packets with the specified VLAN IDs and
allow these packets to pass.
5.
PEs (providers) do not consider these packets as Layer 2 protocol BPDUs and do not
send them to the CPU. Instead, PEs select a Layer 2 tunnel to forward the packets
according to the default VLANs of interfaces.
6.
7.
The egress device on the backbone network forwards the packets to user networks
without modifying the packets.
NOTE
l This method is applicable only to STP, RSTP, and MSTP. To configure a device as the provider,
run the bpdu-tunnel stp bridge role provider command.
NOTE
Issue 01 (2011-07-15)
1.
Configure devices on user networks to send Layer 2 protocol packets with the specified
VLAN IDs to the backbone network.
2.
Enable PEs to identify Layer 2 protocol packets with the specified VLAN IDs and
allow these packets to pass.
3.
PEs replace the standard multicast destination MAC address of Layer 2 protocol
packets with a specified multicast MAC address according to the mappings between
multicast destination MAC addresses and Layer 2 protocols.
240

4.
5.
The egress device of the backbone network restores the original destination MAC
address of the packets according to the mappings between multicast destination MAC
addresses and Layer 2 protocols, and then forwards the packets to user networks.
10.3 Configuring Interface-based Layer 2 Protocol

Transparent Transmission
configure interface-based Layer 2 protocol transparent transmission so that Layer 2 protocol
packets can be transparently transmitted on the backbone network.

configure interface-based Layer 2 protocol transparent transmission. In this way, Layer 2
protocol packets from user networks are transmitted to destination user networks through
different Layer 2 tunnels on the backbone network to implement calculation of Layer 2 protocols.
Before configuring interface-based Layer 2 protocol transparent transmission, complete the
following tasks:
l
Connecting interfaces correctly
Configuring VLANs on Layer 2 interfaces
Enabling the interfaces to send BPDUs to the CPU by using the bpdu enable command
Data Preparation
To configure interface-based Layer 2 protocol transparent transmission, you need the following
data.
Issue 01 (2011-07-15)
No.
Data
Name of the user-defined protocol
Destination MAC address of Layer 2 protocol packets and multicast MAC address
that replaces the destination MAC address
Names of the user-side interfaces on PEs and their default VLANs

241

10.3.2 (Optional) Defining Characteristic Information About a

Layer 2 Protocol
Context
When non-standard Layer 2 protocol packets with a certain multicast destination address need
to be transparently transmitted on the backbone network, you can define characteristic
information about the Layer 2 protocol.
Do as follows on PEs.
Procedure
Step 1 Run:
system-view

Step 2 Run:
l2protocol-tunnel user-defined-protocol protocol-name protocol-mac protocol-mac
[ encape-type { { ethernetii | snap } protocol-type protocol-type | llc dsap dsapvalue ssap ssap-value } ] group-mac { group-mac | default-group-mac }
The characteristic information about the Layer 2 protocol is defined, including the protocol
name, Ethernet encapsulation format and destination MAC address of Layer 2 protocol packets,
and MAC address that replaces the destination MAC address.
When defining characteristic information about a Layer 2 protocol, do not use the following
multicast MAC addresses to replace the destination MAC address of Layer 2 protocol packets:
l Destination MAC addresses of BPDUs: 0180-C200-0000 to 0180-C200-002F
l Destination MAC address of Smart Link packets: 010F-E200-0004
l Special multicast MAC addresses: 0100-0CCC-CCCC and 0100-0CCC-CCCD
l Common multicast MAC addresses that have been used on the device
----End
10.3.3 Configuring the Transparent Transmission Mode of Layer 2

Protocol Packets
Context
To implement transparent transmission of Layer 2 protocol packets, replace the default multicast
MAC address of the Layer 2 protocol that can be identified by PEs with another multicast MAC
address or replace the original multicast destination MAC address of Layer 2 protocol packets
from user networks with a specified multicast MAC address.
Use either of the following methods on PEs according to the Layer 2 protocol type and the
required transparent transmission mode.
Issue 01 (2011-07-15)

242

Procedure
l
1.
Run:
system-view

2.
Run:
bpdu-tunnel stp bridge role provider
The PE is configured as a provider.

NOTE
l This method is applicable only to STP, RSTP, and MSTP.
1.
Run:
system-view

2.
Run:
l2protocol-tunnel protocol-type group-mac group-mac
The original multicast destination MAC address of Layer 2 protocol packets is

replaced with a specified multicast MAC address.
NOTE

When configuring Layer 2 protocol transparent transmission, do not use the following multicast
MAC addresses to replace the destination MAC address of Layer 2 protocol packets:
----End
10.3.4 Enabling Layer 2 Protocol Transparent Transmission on an

Interface
Context
Do as follows on PEs according to the type of Layer 2 protocol packets to be transparently
transmitted.
Procedure
Step 1 Run:
system-view

Issue 01 (2011-07-15)

243

Step 2 Run:
The user-side interface view is displayed.

Step 3 Run:
port hybrid pvid vlan vlan-id
The default VLAN of the interface is configured.

Step 4 Run:
port hybrid untagged vlan vlan-id
The interface is added to the default VLAN in untagged mode.

Step 5 Run:
port hybrid tagged vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
The interface is added to the specified VLANs in tagged mode.

NOTE
The range of VLAN IDs specified in this step must include VLAN IDs of Layer 2 protocol packets from
user networks.
Step 6 Run:
l2protocol-tunnel { all | protocol-type | user-defined-protocol protocol-name }
enable
Layer 2 protocol transparent transmission is enabled on the interface.

NOTE
l For details on how to add an interface to VLANs, see the VLAN configuration in the S2700
Configuration Guide- Ethernet.
l Before specifying a user-defined protocol in the l2protocol-tunnel command, run the l2protocoltunnel user-defined-protocol command to define characteristic information about the Layer 2
protocol. STP packets have a default MAC address for replacing the original destination MAC address.
For packets of other Layer 2 protocols, you need to configure a global MAC address to replace the
destination MAC address. For details, see l2protocol-tunnel group-mac.
l The l2protocol-tunnel and l2protocol-tunnel vlan commands cannot specify the same protocol type
on the same interface; otherwise, the configurations conflict.
----End
10.3.5 Checking Configuration

Context
Configurations of interface-based Layer 2 protocol transparent transmission are complete.
Procedure
l
Run the display l2protocol-tunnel group-mac { all | protocol-type | user-definedprotocol protocol-name } command to check information about transparent transmission
of specified or all Layer 2 protocol packets.
----End
Issue 01 (2011-07-15)

244

10.4 Configuring VLAN-based Layer 2 Protocol Transparent

Transmission
and Layer 2 protocol packets sent from user network contain VLAN tags, you can configure
VLAN-based Layer 2 protocol transparent transmission so that Layer 2 protocol packets are
transparently transmitted on the backbone network.

and Layer 2 protocol packets sent from user networks contain VLAN tags, you can configure
VLAN-based Layer 2 protocol transparent transmission. In this way, Layer 2 protocol packets
from user networks are transmitted to destination user networks through different Layer 2 tunnels
on the backbone network to implement calculation of Layer 2 protocols.
Before configuring VLAN-based Layer 2 protocol transparent transmission, complete the
following tasks:
l
Connecting interfaces correctly
Enabling the interfaces to send BPDUs to the CPU by using the bpdu enable command
Data Preparation
To configure VLAN-based Layer 2 protocol transparent transmission, you need the following
data.
No.
Data
Name of the user-defined protocol
Destination MAC address of Layer 2 protocol packets and multicast MAC address
that replaces the destination MAC address
Names of user-side interfaces on PEs and VLANs allowed by user-side interfaces
10.4.2 (Optional) Defining Characteristic Information About a

Layer 2 Protocol
Context
When non-standard Layer 2 protocol packets with a certain multicast destination address need
to be transparently transmitted on the backbone network, you can define characteristic
information about the Layer 2 protocol.
Issue 01 (2011-07-15)

245

Do as follows on PEs.
Procedure
Step 1 Run:
system-view

Step 2 Run:
l2protocol-tunnel user-defined-protocol protocol-name protocol-mac protocol-mac
[ encape-type { { ethernetii | snap } protocol-type protocol-type | llc dsap dsapvalue ssap ssap-value } ] group-mac { group-mac | default-group-mac }
The characteristic information about the Layer 2 protocol is defined, including the protocol
name, Ethernet encapsulation format and destination MAC address of Layer 2 protocol packets,
and MAC address that replaces the destination MAC address.
When defining characteristic information about a Layer 2 protocol, do not use the following
multicast MAC addresses to replace the destination MAC address of Layer 2 protocol packets:
----End
10.4.3 Configuring the Transparent Transmission Mode of Layer 2

Protocol Packets
Context
To implement transparent transmission of Layer 2 protocol packets, replace the default multicast
MAC address of the Layer 2 protocol that can be identified by PEs with another multicast MAC
address or replace the original multicast destination MAC address of Layer 2 protocol packets
from user networks with a specified multicast MAC address.
Use either of the following methods on PEs according to the Layer 2 protocol type and the
required transparent transmission mode.
Procedure
l
1.
Run:
system-view

2.
Run:
bpdu-tunnel stp bridge role provider
The PE is configured as a provider.

Issue 01 (2011-07-15)

246

NOTE
l This method is applicable only to STP, RSTP, and MSTP.
1.
Run:
system-view

2.
Run:
l2protocol-tunnel protocol-type group-mac group-mac
The original multicast destination MAC address of Layer 2 protocol packets is

replaced with a specified multicast MAC address.
NOTE

When configuring Layer 2 protocol transparent transmission, do not use the following multicast
MAC addresses to replace the destination MAC address of Layer 2 protocol packets:
----End
10.4.4 Enabling VLAN-based Layer 2 Protocol Transparent

Transmission on an Interface
Context
Do as follows on PEs according to the type of Layer 2 protocol packets to be transparently
transmitted.
Procedure
Step 1 Run:
system-view

Step 2 Run:
The user-side interface view is displayed.

Step 3 Run:
port hybrid tagged vlan { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
The interface is added to the specified VLANs in tagged mode.

Issue 01 (2011-07-15)

247

NOTE
The range of VLAN IDs specified in this step must include VLAN IDs of Layer 2 protocol packets from
user networks.
Step 4 Run:
l2protocol-tunnel { all | protocol-type | user-defined-protocol protocol-name }
{ vlan low-id [ to high-id ] } &<1-10>
VLAN-based Layer 2 protocol transparent transmission is enabled on the interface.

NOTE
l For details on how to add an interface to VLANs in tagged mode, see the VLAN configuration in the
S2700 Configuration Guide- Ethernet.
l Before specifying a user-defined protocol in the l2protocol-tunnel vlan command, run the l2protocoltunnel user-defined-protocol command to define characteristic information about the Layer 2
protocol. STP packets have a default MAC address for replacing the original destination MAC address.
For packets of other Layer 2 protocols, you need to configure a global MAC address to replace the
destination MAC address. For details, see l2protocol-tunnel group-mac.
l The l2protocol-tunnel vlan and l2protocol-tunnel commands cannot specify the same protocol type
on the same interface; otherwise, the configurations conflict.
----End

Context
Configurations of Layer 2 protocol transparent transmission are complete.
Procedure
l
Run the display l2protocol-tunnel group-mac { all | protocol-type | user-definedprotocol protocol-name } command to check information about transparent transmission
of specified or all Layer 2 protocol packets.
----End
10.5 Maintaining Layer 2 Protocol Transparent

Transmission
This section describes how to debug Layer 2 protocol transparent transmission.
10.5.1 Debugging Layer 2 Protocol Transparent Transmission

Context
CAUTION
Issue 01 (2011-07-15)

248

When a fault occurs during Layer 2 protocol transparent transmission, run the following
debugging command in the user view to locate the fault.
Procedure
l
Run the debugging l2protocol-tunnel [ msg | error | event ] command in the user view
to enable Layer 2 protocol transparent transmission.
----End

This section provides examples for configuring interface, VLAN based Layer 2 protocol
transparent transmission.
10.6.1 Example for Configuring Interface-based Layer 2 Protocol

As shown in Figure 10-4, CEs on user networks communicate with each other through PEs and
STP runs on user networks; therefore, STP packets sent from CEs must be transmitted through
the backbone network between PEs. Each PE interface is connected to only one CE and receives
STP packets from the CE. In this scenario, configure interface-based Layer 2 protocol transparent
transmission.
In this example, PEs on the backbone network transparently transmit STP packets sent from CEs
by replacing the original multicast destination MAC address of STP packets with a specified
MAC address. By default, the destination MAC address of STP packets is 0180-C200-0000.
Figure 10-4 Networking of interface-based Layer 2 protocol transparent transmission
VLAN100
CE1
VLAN100
CE2
Eth 0/0/1
PE1
Eth 0/0/1
Eth 0/0/2
PE2
Eth 0/0/3
Eth 0/0/3
Eth 0/0/1
CE3
Eth 0/0/1
Eth 0/0/2
Eth 0/0/1
CE4
VLAN200
Issue 01 (2011-07-15)
Eth 0/0/1

VLAN200
249

1.
Configure STP on CEs.
2.
Add user-side interfaces of PEs to the specified VLANs.
3.
Configure interface-based Layer 2 protocol transparent transmission on PEs.
4.
Configure network-side interfaces of PEs to allow packets of VLAN 100 and VLAN 200
to pass.
Data Preparation
l
IDs of VLANs that user-side interfaces of PEs belong to
IDs of VLANs allowed by network-side interfaces of PEs
Procedure
Step 1 Enable STP on CEs and PEs.
# Configure CE1.
[Quidway] sysname CE1
[CE1] vlan 100
[CE1-vlan100] quit
[CE1] stp enable
[CE1] bpdu enable
[CE1] interface ethernet 0/0/1
[CE1-Ethernet0/0/1] port hybrid pvid vlan 100
[CE1-Ethernet0/0/1] port hybrid untagged vlan 100
# Configure CE2.
[CE2] vlan 100
[CE2-vlan100] quit
[CE2] stp enable
[CE2] bpdu enable
# Configure CE3.
[CE3] vlan 200
[CE3-vlan200] quit
[CE3] stp enable
[CE3] bpdu enable
# Configure CE4.
Issue 01 (2011-07-15)

250


[CE4] vlan 200
[CE4-vlan200] quit
[CE4] stp enable
[CE4] bpdu enable
# Configure PE1.
[Quidway] sysname PE1
[PE1]
# Configure PE2.
[Quidway] sysname PE2
[PE2]
Step 2 On PE1 and PE2, add Eth 0/0/1 to VLAN 100, add Eth 0/0/2 to VLAN 200, and enable Layer
2 protocol transparent transmission.
# Configure PE1.
[PE1] vlan 100
[PE1-vlan100] quit
[PE1] bpdu enable
[PE1] interface Ethernet 0/0/1
[PE1-Ethernet0/0/1] port hybrid pvid vlan 100
[PE1-Ethernet0/0/1] port hybrid untagged vlan 100
[PE1-Ethernet0/0/1] l2protocol-tunnel stp enable
[PE1-Ethernet0/0/1] quit
[PE1] vlan 200
[PE1-vlan200] quit
[PE1] bpdu enable
# Configure PE2.
[PE2] vlan 100
[PE2-vlan100] quit
[PE2] bpdu enable
[PE2] vlan 200
[PE2-vlan200] quit
[PE2] bpdu enable
Step 3 Configure PEs to replace the destination MAC address of STP packets received from CEs.
# Configure PE1.
[PE1] l2protocol-tunnel stp group-mac 0100-5e00-0011
# Configure PE2.
Issue 01 (2011-07-15)

251

Step 4 On PE1 and PE2, configure network-side interface Eth 0/0/3 to allow packets of VLAN 100 and
VLAN 200 to pass.
# Configure PE1.
[PE1-Ethernet0/0/3] port hybrid tagged vlan 100 200
# Configure PE2.

After the configuration, run the display l2protocol-tunnel group-mac command, and you can
view the protocol type or name, original destination MAC address, new destination MAC
address, and priority of Layer 2 protocol packets to be transparently transmitted.
Take the display on PE1 as an example.
<PE1> display l2protocol-tunnel group-mac stp
Protocol
EncapeType ProtocolType Protocol-MAC
Group-MAC
Pri
----------------------------------------------------------------------------stp
llc
dsap 0x42
0180-c200-0000 0100-5e00-0011 0
ssap 0x42
Run the display stp command on CE1 and CE2 to view the root in the MST region. You can
find that a spanning tree is calculated between CE1 and CE2. Eth 0/0/1 of CE1 is a root port,
and CE 0/0/1 of CE2 is a designated port.
<CE1> display stp
-------[CIST Global Info] [Mode MSTP] ------CIST Bridge
:32768.00e0-fc9f-3257
Bridge Times
:Hello 2s MaxAge 20s FwDly 15s MaxHop 20
CIST Root/ERPC
:32768.00e0-fc9a-4315 / 199999
CIST RegRoot/IRPC
:32768.00e0-fc9f-3257 / 0
CIST RootPortId
:128.82
BPDU-Protection
:disabled
TC or TCN received :6
TC count per hello :6
STP Converge Mode
:Normal
Share region-configuration :enabled
Time since last TC received :0 days 2h:24m:36s
----[Port1(Ethernet0/0/1)] [FORWARDING] ---Port Protocol
:enabled
Port Role
:Root Port
Port Priority
:128
Port Cost(Dot1T )
:Config=auto / Active=200000000
Desg. Bridge/Port
:32768.00e0-fc9a-4315 / 128.82
Port Edged
:Config=disabled / Active=disabled
Point-to-point
:Config=auto / Active=true
Transit Limit
:51 packets/hello-time
Protection Type
:None
Port Stp Mode
:MSTP
Port Protocol Type :Config=auto / Active= dot1s
BPDU Encapsulation :Config=stp / Active=stp
PortTimes
:Hello 2s MaxAge 20s FwDly 15s RemHop 20
TC or TCN send
:0
BPDU Sent
:6
TCN: 0, Config: 0, RST: 0, MST: 6
BPDU Received
:4351
Issue 01 (2011-07-15)

252

<CE2> display stp

-------[CIST Global Info] [Mode MSTP] ------CIST Bridge
:32768.00e0-fc9a-4315
Bridge Times
CIST Root/ERPC
:32768.00e0-fc9a-4315 / 0
CIST RegRoot/IRPC
:32768.00e0-fc9a-4315 / 0
CIST RootPortId
:0.0
BPDU-Protection
:disabled
STP Converge Mode
:Normal
----[Port1(Ethernet0/0/1)] [FORWARDING] ---Port Protocol
:enabled
Port Role
:Designated Port
Port Priority
:128
Port Cost(Dot1T )
Desg. Bridge/Port
:32768.00e0-fc9a-4315 / 128.82
Port Edged
Point-to-point
Transit Limit
Protection Type
:None
Port Stp Mode
:MSTP
PortTimes
TC or TCN send
:0
BPDU Sent
:4534
BPDU Received
:6
<CE3> display stp
-------[CIST Global Info][Mode MSTP]------CIST Bridge
:32768.000b-0967-58a0
Bridge Times
CIST Root/ERPC
:32768.000b-0952-f13e / 199999
CIST RegRoot/IRPC
:32768.000b-0967-58a0 / 0
CIST RootPortId
:128.82
BPDU-Protection
:disabled
STP Converge Mode
:Normal
----[Port1(Ethernet0/0/1)][FORWARDING]---Port Protocol
:enabled
Port Role
:Root Port
Port Priority
:128
Port Cost(Dot1T )
Desg. Bridge/Port
:32768.000b-0952-f13e / 128.82
Port Edged
Point-to-point
Transit Limit
Protection Type
:None
Port Stp Mode
:MSTP
PortTimes
TC or TCN send
:0
BPDU Sent
:114
Issue 01 (2011-07-15)

253

BPDU Received
:885
<CE4> display stp
:32768.000b-0952-f13e
Bridge Times
CIST Root/ERPC
:32768.000b-0952-f13e / 0
CIST RegRoot/IRPC
:32768.000b-0952-f13e / 0
CIST RootPortId
:0.0
BPDU-Protection
:disabled
STP Converge Mode
:Normal
:enabled
Port Role
:Designated Port
Port Priority
:128
Port Cost(Dot1T )
Desg. Bridge/Port
:32768.000b-0952-f13e / 128.82
Port Edged
Point-to-point
Transit Limit
Protection Type
:None
Port Stp Mode
:MSTP
PortTimes
TC or TCN send
:0
BPDU Sent
:1834
BPDU Received
:1
----End
Configuration Files
l
Configuration file of CE1

#
sysname CE1
#
vlan batch 100
#
#
return

#
sysname CE2
#
vlan batch 100
#
#
return

#
sysname CE3
#
Issue 01 (2011-07-15)

254

vlan batch 200

#
#
return

#
sysname CE4
#
vlan batch 200
#
#
return
Configuration file of PE1

#
sysname PE1
#
vlan batch 100 200
#
l2protocol-tunnel stp group-mac 0100-5e00-0011
#
l2protocol-tunnel stp enable
#
#
#
return

#
sysname PE2
#
vlan batch 100 200
#
#
#
#
#
return
Issue 01 (2011-07-15)

255

10.6.2 Example for Configuring VLAN-based Layer 2 Protocol

As shown in Figure 10-5, CEs on user networks communicate with each other through PEs and
STP runs on user networks; therefore, STP packets sent from CEs must be transmitted through
the backbone network between PEs. Each PE interface is an aggregation interface. PEs identify
STP packets from different user networks according to VLAN tags of STP packets. In this
scenario, configure VLAN-based Layer 2 protocol transparent transmission to ensure that:
l
All the devices in VLAN 100 participate in calculation of a spanning tree.
All the devices in VLAN 200 participate in calculation of a spanning tree.
In this example, PEs transparently transmit STP packets sent from user networks by replacing
the original multicast destination MAC address of STP packets with a specified multicast MAC
address. By default, the destination MAC address of STP packets is 0180-C200-0000.
Figure 10-5 Networking of VLAN-based Layer 2 protocol transparent transmission
PE1
Eth0/0/1
Eth0/0/1
Eth0/0/2
Eth0/0/3
Eth0/0/1
Eth0/0/1
CE1
CE3
VLAN 100
VLAN 200
PE2
Eth0/0/1
Eth0/0/2
Eth0/0/2
Eth0/0/3
Eth0/0/1
Eth0/0/1
CE2
VLAN 100
CE4
VLAN 200
1.
Enable STP on the CEs.
2.
Configure CEs to send STP packets with specified VLAN tags to PEs.
3.
Configure VLAN-based Layer 2 protocol transparent transmission on PEs.
4.
Configure network-side interfaces of PEs to allow packets of VLAN 100 and VLAN 200
to pass.
5.
Configure the Layer 2 forwarding function on the P device so that packets sent from PEs
can be transmitted on the backbone network.
Data Preparation
Issue 01 (2011-07-15)

256

VLAN tags in STP packets sent from CEs to PEs
IDs of the VLANs that interfaces of PEs and CEs belong to
Procedure
Step 1 Enable STP on CEs and PEs.
# Configure CE1.
[CE1] stp enable
# Configure CE2.
[CE2] stp enable
# Configure CE3.
[CE3] stp enable
# Configure CE4.
[CE4] stp enable
Step 2 Configure CE1 and CE2 to send STP packets with VLAN tag 100 to PEs and configure CE3
and CE4 to send STP packets with VLAN tag 200 to PEs.
# Configure CE1.
[CE1] vlan 100
[CE1-vlan100] quit
[CE1] bpdu enable
[CE1-Ethernet0/0/1] port hybrid tagged vlan 100
[CE1-Ethernet0/0/1] stp bpdu vlan 100
# Configure CE2.
[CE2] vlan 100
[CE2-vlan100] quit
[CE2] bpdu enable
# Configure CE3.
[CE3] vlan 200
[CE3-vlan200] quit
[CE3] bpdu enable
# Configure CE4.
[CE4] vlan 200
[CE4-vlan200] quit
[CE4] bpdu enable
Step 3 Configure PE interfaces to transparently transmit STP packets of CEs to the P device.
# Configure PE1.
[PE1] vlan 100
Issue 01 (2011-07-15)

257

[PE1-vlan100] quit
[PE1] vlan 200
[PE1-vlan200] quit
[PE1] bpdu enable
[PE1] interface ethernet 0/0/1
[PE1-Ethernet0/0/2] port hybrid tagged vlan 100
[PE1-Ethernet0/0/2] l2protocol-tunnel stp vlan 100
# Configure PE2.
[PE2] vlan 100
[PE2-vlan100] quit
[PE2] vlan 200
[PE2-vlan200] quit
[PE2] bpdu enable
Step 4 Configure PEs to replace the destination MAC address of STP packets received from CEs.
# Configure PE1.
# Configure PE2.
Step 5 Configure the Layer 2 forwarding function on the P device and configure it to allow packets of
VLAN 100 and VLAN 200 to pass.
[P] vlan 100
[P-vlan100] quit
[P] vlan 200
[P-vlan200] quit
[P] interface ethernet
[P-Ethernet0/0/1] port
[P-Ethernet0/0/1] quit
[P] interface ethernet
[P-Ethernet0/0/2] port
[P-Ethernet0/0/2] quit
0/0/1
hybrid tagged vlan 100 200
0/0/2
hybrid tagged vlan 100 200

After the configuration, run the display l2protocol-tunnel group-mac command. You can view
the protocol type or name, original destination MAC address, new destination MAC address,
and priority of Layer 2 protocol packets to be transparently transmitted.
Take the ouput on PE1 as an example.
<PE1> display l2protocol-tunnel group-mac stp
Protocol
EncapeType ProtocolType Protocol-MAC
Issue 01 (2011-07-15)

Group-MAC
Pri
258

----------------------------------------------------------------------------stp
llc
dsap 0x42
0180-c200-0000 0100-5e00-0011 0
ssap 0x42
<CE1> display stp
:32768.000b-09f0-1b91
Bridge Times
CIST Root/ERPC
:32768.000b-09d4-b66c / 199999
CIST RegRoot/IRPC
:32768.000b-09f0-1b91 / 0
CIST RootPortId
:128.82
BPDU-Protection
:disabled
STP Converge Mode
:Normal
:enabled
Port Role
:Root Port
Port Priority
:128
Port Cost(Dot1T )
Desg. Bridge/Port
:32768.000b-09d4-b66c / 128.82
Port Edged
Point-to-point
Transit Limit
Protection Type
:None
Port Stp Mode
:MSTP
PortTimes
TC or TCN send
:0
BPDU Sent
:237
BPDU Received
:9607
<CE2> display stp
:32768.000b-09d4-b66c
Bridge Times
CIST Root/ERPC
:32768.000b-09d4-b66c / 0
CIST RegRoot/IRPC
:32768.000b-09d4-b66c / 0
CIST RootPortId
:0.0
BPDU-Protection
:disabled
STP Converge Mode
:Normal
:enabled
Port Role
:Designated Port
Port Priority
:128
Port Cost(Dot1T )
Desg. Bridge/Port
:32768.000b-09d4-b66c / 128.82
Port Edged
Point-to-point
Transit Limit
Protection Type
:None
Port Stp Mode
:MSTP
PortTimes
TC or TCN send
:0
BPDU Sent
:7095
Issue 01 (2011-07-15)

259


BPDU Received
:2
<CE3> display stp
:32768.00e0-fc9f-3257
Bridge Times
CIST Root/ERPC
:32768.00e0-fc9a-4315 / 199999
CIST RegRoot/IRPC
:32768.00e0-fc9f-3257 / 0
CIST RootPortId
:128.82
BPDU-Protection
:disabled
STP Converge Mode
:Normal
:enabled
Port Role
:Root Port
Port Priority
:128
Port Cost(Dot1T )
Desg. Bridge/Port
:32768.00e0-fc9a-4315 / 128.82
Port Edged
Point-to-point
Transit Limit
Protection Type
:None
Port Stp Mode
:MSTP
PortTimes
TC or TCN send
:0
BPDU Sent
:238
BPDU Received
:9745
<CE4> display stp
:32768.00e0-fc9a-4315
Bridge Times
CIST Root/ERPC
:32768.00e0-fc9a-4315 / 0
CIST RegRoot/IRPC
:32768.00e0-fc9a-4315 / 0
CIST RootPortId
:0.0
BPDU-Protection
:disabled
STP Converge Mode
:Normal
:enabled
Port Role
:Designated Port
Port Priority
:128
Port Cost(Dot1T )
Desg. Bridge/Port
:32768.00e0-fc9a-4315 / 128.82
Port Edged
Point-to-point
Transit Limit
Protection Type
:None
Port Stp Mode
:MSTP
PortTimes
TC or TCN send
:0
BPDU Sent
:7171
Issue 01 (2011-07-15)

260


BPDU Received
:2
----End
Configuration Files
l

#
sysname CE1
#
vlan batch 100
#
stp bpdu vlan 100
#
return

#
sysname CE2
#
vlan batch 100
#
stp bpdu vlan 100
#
return

#
sysname CE3
#
vlan batch 200
#
stp bpdu vlan 200
#
return

#
sysname CE4
#
vlan batch 200
#
stp bpdu vlan 200
#
Return

#
sysname PE1
#
vlan batch 100 200
#
#
#
Issue 01 (2011-07-15)

261


l2protocol-tunnel stp vlan 100
#
#
return
Configuration file of P
#
sysname P
#
vlan batch 100 200
#
#
#
return

#
sysname PE2
#
vlan batch 100 200
#
#
#
#
#
return
Issue 01 (2011-07-15)

262

11
11 Loopback Detection Configuration
Loopback Detection Configuration
About This Chapter

This chapter describes the concept and configuration of loopback detection and provides
configuration examples.
11.1 Loopback Detection Overview
This section describes the concept of loopback detection.
11.2 Configuring Loopback Detection
This section describes how to configure the loopback detection function.
This section provides a loopback detection configuration example.
Issue 01 (2011-07-15)

263

11.1 Loopback Detection Overview

This section describes the concept of loopback detection.
When a loop occurs on a network, broadcast, multicast, and unknown unicast packets are
repeatedly transmitted on the network. This wastes network resources or even causes service
interruption on the entire network. To protect the network, certain actions should be taken on
the interface where the loop occurs, and the administrator need to check the network connection
and configuration to solve the problem soon. Therefore, a mechanism is required on a Layer 2
network to detect loops and notify the administrator.
Loopback detection is such a mechanism. It sends detection packets from an interface at intervals
and checks whether the packets are sent back to the interface. When this occurs, there is a
loopback on the interface. When detecting a loopback, the system sends a trap to the network
management system to notify the administrator. The system also blocks the interface, disables
MAC address learning on the interface, or shuts down the interface to minimize the impact on
the network.
11.2 Configuring Loopback Detection

This section describes how to configure the loopback detection function.

Before configuring loopback detection, familiarize yourself with the applicable environment,
Figure 11-1 and Figure 11-2 show the application of loopback detection.
A loopback occurs on an interface usually because optical fibers are connected incorrectly, the
optical modem fails, or the interface is damaged by high voltage. As shown in Figure 11-1, a
cable is incorrectly connected on the device connected to the Switch. As a result, packets sent
from an interface of the Switch are sent back to the interface. This may cause traffic forwarding
errors or MAC address flapping on the same interface.
Figure 11-1 Loopback detection application 1
Switch
TX
Issue 01 (2011-07-15)
RX

264

As shown in Figure 11-2, loops may occur on the network connected to an Switch interface.
When a loop occurs, packets sent from the interface are sent back to this interface.
Figure 11-2 Loopback detection application 2
Switch
You can configure loopback detection on the interface in the preceding scenarios. When a
loopback is detected on the interface, the Switch performs certain actions, for example, blocks
the interface. Only users connected to this interface are affected, and other users can still
communicate. When the Switch detects that the loopback has been removed, it recovers
communication on the interface.
NOTE
l Loopback detection cannot prevent loops on the entire network. It only detects loops on a single node.
l A large number of packets are sent during loopback detection, occupying CPU resources; therefore,
disable loopback detection if it is not required.
Before configuring loopback detection, complete the following task:
l
physical layer status of the interfaces is Up
Data Preparation
To configure loopback detection, you need the following data.
Issue 01 (2011-07-15)
No.
Data
Interface number
VLAN IDs in detection packets
(Optional) Action performed when a loopback is detected
(Optional) Interface recovery time after a loop is detected

265

No.
Data
(Optional) Loopback detection interval for sending detection packets
11.2.2 Enabling Loopback Detection

An interface sends detection packets to detect loopbacks only after loopback detection is enabled
on the interface.
Context
You can enable loopback detection on all interfaces at one time in the system view or enable it
on a single interface in the interface view.
Procedure
l
Enabling loopback detection on all interfaces

1.
Run:
system-view

2.
Run:
loopback-detect enable
Loopback detection is enabled on all interfaces.

By default, loopback detection is disabled on an interface.
TIP
You can use this method to simplify configuration when most interfaces need to perform
loopback detection.
Enabling loopback detection on a single interface

1.
Run:
system-view

2.
Run:

3.
Run:
Loopback detection is enabled on the interface.

NOTE
Loopback detection cannot be configured on an Eth-Trunk or its member interfaces.
----End
11.2.3 Specifying VLAN IDs of Loopback Detection Packets

You can specify one or more VLAN IDs for loopback detection packets.
Issue 01 (2011-07-15)

266

Context
By default, the system sends untagged detection packets after loopback detection is enabled on
interface. If the interface has been added to a VLAN in tagged mode, the untagged detection
packets are discarded on the link, and the interface cannot receive loopback packets. To solve
the problem, you can configure the VLAN ID for detection packets.
After VLAN IDs are specified, the interface sends an untagged detection packet and multiple
detection packets with the specified VLAN tags. Each interface can send detection packets with
a maximum of eight VLAN IDs.
NOTE
The S2700SI does not support VLAN IDs in loopback detection packets.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
loopback-detect packet vlan vlan-id
A VLAN ID is specified for loopback detection packets.

By default, detection packets do not have a VLAN ID. You can specify a maximum of eight
VLAN IDs for loopback detection packets.
NOTE
Before running the loopback-detect packet vlan vlan-id command, ensure that:
l The specified VLAN exists.
l The interface has been added to the specified VLAN in tagged mode.
----End
11.2.4 (Optional) Configuring an Action to Perform After a

Loopback Is Detected
When a loopback is detected on an interface, the system sets the interface status to loopback and
sends a trap, blocks the interface, disables MAC address learning on the interface, or shuts down
the interface as configured.
Context
After loopback detection is enabled on an interface, the interface periodically sends detection
packets and checks whether loopback packets are received. You can configure the Switch to
take an action to minimize impact on the system and the entire network when a loopback is
detected.
Issue 01 (2011-07-15)

267

Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
loopback-detect action { block | nolearn | shutdown | trap }
The action that will be performed after a loopback is detected on the interface is configured.
The default action is block.
When a loopback is detected on an interface, the system performs any of the following actions:
l block: blocks the interface. After the interface is blocked, it is isolated from other interfaces
and does not forward received data packets to other interfaces.
l nolearn: disables MAC address learning on the interface. When a loopback is detected on
the interface, the interface stops learning MAC addresses.
l shutdown: shuts down the interface.
l trap: only sends a trap.
NOTE
It is recommended that you set the action to shutdown on an S2700SI to prevent high CPU usage caused
by loopback packets.
----End
11.2.5 (Optional) Setting the Interface Recovery Time After a Loop

Is Removed
Context
Perform the following steps on the S2700 that needs to perform loopback detection.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
loopback-detect recovery-time recovery-time
The interface recovery time after a loop is removed is set.

Issue 01 (2011-07-15)

268

The default recovery time is three times the loopback detection interval.
NOTE
l It is recommended that the recovery time be at least three times the interval for sending loopback
detection packets. If the interval for sending loopback detection packets is very short, set the recovery
time to be at least 10 seconds longer than the interval.
l An interface cannot recover automatically after it is shut down. You must manually recover the interface
by using the undo shutdown command.
----End
11.2.6 (Optional) Setting the Interval for Sending Loopback

Detection Packets on an Interface
Context
An interface sends loopback detection packets at intervals to check whether a loopback exists
or whether the existing loopback has been removed.
Procedure
Step 1 Run:
system-view

Step 2 Run:
loopback-detect packet-interval packet-interval-time
The interval for sending loopback detection packets is set.

By default, the interval for sending loopback detection packets is 5s.
----End

Procedure
l
Run the display loopback-detect command to check the loopback detection configuration
and status of loopback detection enabled interfaces.
----End

This section provides a loopback detection configuration example.
11.3.1 Example for Configuring Loopback Detection

Issue 01 (2011-07-15)

269

As shown in Figure 11-3, if there is a loop on the network connected to Eth 0/0/1, broadcast
storms will occur on the Switch or even the entire network. To detect loops on the network
quickly, you can enable loopback detection on this interface.
Figure 11-3 Loopback detection network diagram
Switch
Eth0/0/1
1.
Enable loopback detection on the interface.
2.
Specify the VLAN ID of loopback detection packets.
3.
Configure loopback detection parameters.
Data Preparation
l
Interface where loopback detection needs to be enabled: Eth 0/0/1
Interval for sending loopback detection packets: 10s
VLAN ID of loopback detection packets: 100
Interface recovery time: 30s
Procedure
Step 1 Enable loopback detection on the interface.
[Quidway-Ethernet0/0/1] loopback-detect enable
Step 2 Specify the VLAN ID of loopback detection packets.

Issue 01 (2011-07-15)

270

[Quidway] vlan 100

[Quidway-Ethernet0/0/1] port hybrid tagged vlan 100
[Quidway-Ethernet0/0/1] loopback-detect packet vlan 100
Step 3 Configure loopback detection parameters.

# Configure the system to block the interface when a loopback is detected.
[Quidway-Ethernet0/0/1] loopback-detect action block
# Set the interface recovery time after a loopback is removed.

[Quidway-Ethernet0/0/1] loopback-detect recovery-time 30
# Set the interval for sending loopback detection packets.

[Quidway] loopback-detect packet-interval 10

When a loop occurs on the network connected to Ethernet 0/0/1, the interface is blocked. The
interface will recover 30s after the loop is removed.
----End
Configuration Files
#
sysname Quidway
#
vlan batch 100
#
loopback-detect packet-interval 10
#
loopback-detect recovery-time 30
loopback-detect packet vlan 100
#
return
Issue 01 (2011-07-15)

271

Configuration Guide - Ethernet (V100R006C00 - 01)

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Configuration Guide - Ethernet (V100R006C00 - 01)

Hochgeladen von

Copyright:

Verfügbare Formate

Quidway S2700 Series Ethernet Switches